From ab559752b8625657d7e16289368810f64e75eb6d Mon Sep 17 00:00:00 2001
From: Kathryn Baldauf <k_baldauf@apple.com>
Date: Mon, 14 Jul 2025 11:40:30 -0700
Subject: [PATCH] Handle keychain query errors in keychain helper lookup (#211)

This allows us to handle errors from lookup with only the keychain
helper error types which simplifies the logic

related https://github.com/apple/container/pull/331

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
---
 .../Client/KeychainHelper.swift               | 29 ++++++++++++-------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/Sources/ContainerizationOCI/Client/KeychainHelper.swift b/Sources/ContainerizationOCI/Client/KeychainHelper.swift
index ab7d845f..e41f2c8c 100644
--- a/Sources/ContainerizationOCI/Client/KeychainHelper.swift
+++ b/Sources/ContainerizationOCI/Client/KeychainHelper.swift
@@ -29,17 +29,25 @@ public struct KeychainHelper: Sendable {
     public func lookup(domain: String) throws -> Authentication {
         let kq = KeychainQuery()
 
-        guard try kq.exists(id: self.id, host: domain) else {
-            throw Self.Error.keyNotFound
+        do {
+            guard try kq.exists(id: self.id, host: domain) else {
+                throw Self.Error.keyNotFound
+            }
+            guard let fetched = try kq.get(id: self.id, host: domain) else {
+                throw Self.Error.keyNotFound
+            }
+            return BasicAuthentication(
+                username: fetched.account,
+                password: fetched.data
+            )
+        } catch let err as KeychainQuery.Error {
+            switch err {
+            case .keyNotPresent(_):
+                throw Self.Error.keyNotFound
+            default:
+                throw Self.Error.queryError("query failure: \(String(describing: err))")
+            }
         }
-        guard let fetched = try kq.get(id: self.id, host: domain) else {
-            throw Self.Error.keyNotFound
-        }
-
-        return BasicAuthentication(
-            username: fetched.account,
-            password: fetched.data
-        )
     }
 
     /// Delete authorization data for a given domain from the keychain.
@@ -93,6 +101,7 @@ extension KeychainHelper {
     public enum Error: Swift.Error {
         case keyNotFound
         case invalidInput
+        case queryError(String)
     }
 }
 #endif