🔐 Stop silent ID changes

This task addresses a critical security and data integrity concern: handling scenarios where a user's CloudKit ID changes silently when they switch CloudKit accounts on their device and return to the app.

A user's CloudKit ID can change in several situations:

• ●User signs out of iCloud and signs in with a different Apple ID
• ●User changes their primary Apple ID in device settings
• ●User switches between multiple iCloud accounts configured on the device
• ●Family Sharing account transitions
• ●Device restoration or migration scenarios

Phase 1: Understanding Current State

1. ●Analyze how the app currently stores and uses CloudKit user identifiers
2. ●Review the SyncCoordinator and SyncEngine implementations in /Users/pxlshpr/Developer/NutriKit/Packages/App/Sources/App/Supabase/ to understand CloudKit integration points
3. ●Determine if the app currently detects CloudKit account changes at all
4. ●Map out all places in the codebase where CloudKit user identity is assumed to be stable
5. ●Test actual behavior when switching CloudKit accounts mid-session

Data Sync Conflicts:

• ●Local data associated with User A's CloudKit ID attempting to sync when User B is signed in
• ●Orphaned records in CloudKit containers
• ●Cross-contamination of user data between accounts

User Authentication Problems:

• ●Session validity when CloudKit identity no longer matches
• ●Authorization failures for CloudKit operations
• ●Broken relationships between Supabase user records and CloudKit identities

Data Integrity Issues:

• ●Food logs, meals, and health data attributed to wrong user account
• ●Widget data showing information from previous user
• ●Cache invalidation and stale user-specific data
• ●Database records with mismatched CloudKit references

Privacy and Security Concerns:

• ●User A's data being inadvertently synced to User B's CloudKit container
• ●Exposure of sensitive health/nutrition data across accounts

1. CloudKit Account Change Detection

• ●Implement monitoring using CKAccountChangedNotification or equivalent
• ●Store the current CloudKit user record ID and compare on app launch/resume
• ●Add app lifecycle hooks to verify CloudKit identity consistency

2. Graceful Account Transition Handling

• ●Clear local cache and user-specific data when account change detected
• ●Reset sync state and force fresh data pull from new account
• ●Invalidate any CloudKit-dependent authentication tokens

3. User Communication

• ●Present a clear alert/dialog when CloudKit account change is detected
• ●Explain implications: "You've switched iCloud accounts. Your previous data will be cleared and you'll sync with your new account."
• ●Provide option to sign out properly or acknowledge the transition

4. Data Migration/Cleanup Strategy

• ●Define whether any data should be preserved locally vs. completely purged
• ●Implement safe cleanup of CloudKit-tied resources
• ●Ensure no data leakage between accounts
• ●Log account transitions for debugging/audit purposes

5. Prevention Mechanisms

• ●Consider requiring explicit sign-out before allowing account-dependent operations
• ●Implement stronger binding between app session and CloudKit identity
• ●Add validation checks before any sync operations

• ●Review Apple's CloudKit documentation on account change handling best practices
• ●Consider impact on offline-first architecture and pending sync operations
• ●Test extensively with multiple iCloud accounts, sign-out/sign-in flows
• ●Ensure compatibility with existing user data and migration paths
• ●Document the chosen approach in code and user-facing materials

• ● Complete analysis of current CloudKit ID usage throughout codebase
• ● Documented list of all potential failure scenarios
• ● Implemented detection mechanism for CloudKit account changes
• ● User-facing handling flow (alerts, cleanup, re-sync)
• ● Comprehensive test coverage for account switching scenarios
• ● No data leakage between different CloudKit accounts
• ● Graceful degradation if CloudKit becomes unavailable during transition

This app uses CloudKit for data synchronization and has a sophisticated sync system via SyncCoordinator and SyncEngine. The codebase contains 47,000+ lines of Swift with features including meal tracking, Apple Health integration, and widgets. Recent changes removed isTrashed and isArchived fields, suggesting active data model evolution that makes this investigation timely.

Build instruction: Use -destination 'platform=iOS Simulator,name=iPhone 17 Pro' when building this project