Push subscription expired handling

Account/FxAPushMessageHandler.swift

@@ -56,7 +56,7 @@ extension FxAPushMessageHandler {
 
         guard let string = plaintext else {
             // The app will detect this missing, and re-register. see AppDelegate+PushNotifications.swift.
-            keychain.removeObject(forKey: KeychainKey.apnsToken)
+            keychain.removeObject(forKey: KeychainKey.apnsToken, withAccessibility: .afterFirstUnlock)
             return deferMaybe(PushMessageError.notDecrypted)
         }
 

Client/Application/AppDelegate+PushNotifications.swift

@@ -48,11 +48,21 @@ extension AppDelegate {
             }
         }
 
+        // If we see our local device with a pushEndpointExpired flag, clear the APNS token and re-register.
+        NotificationCenter.default.addObserver(forName: .constellationStateUpdate, object: nil, queue: nil) { notification in
+            if let newState = notification.userInfo?["newState"] as? ConstellationState {
+                if newState.localDevice?.subscriptionExpired ?? false {
+                    KeychainWrapper.sharedAppContainerKeychain.removeObject(forKey: KeychainKey.apnsToken, withAccessibility: .afterFirstUnlock)
+                    NotificationCenter.default.post(name: .RegisterForPushNotifications, object: nil)
+                }
+            }
+        }
+
         // Use sync event as a periodic check for the apnsToken.
         // The notification service extension can clear this token if there is an error, and the main app can detect this and re-register.
         NotificationCenter.default.addObserver(forName: .ProfileDidStartSyncing, object: nil, queue: .main) { _ in
             let kc = KeychainWrapper.sharedAppContainerKeychain
-            if kc.object(forKey: KeychainKey.apnsToken) == nil {
+            if kc.object(forKey: KeychainKey.apnsToken, withAccessibility: .afterFirstUnlock) == nil {
                 NotificationCenter.default.post(name: .RegisterForPushNotifications, object: nil)
             }
         }

Push/PushClient.swift

@@ -128,7 +128,7 @@ public extension PushClient {
         mutableURLRequest.httpBody = JSON(parameters).stringify()?.utf8EncodedData
 
         return send(request: mutableURLRequest) >>== { json in
-            KeychainStore.shared.setString(apnsToken, forKey: KeychainKey.apnsToken)
+            KeychainStore.shared.setString(apnsToken, forKey: KeychainKey.apnsToken, withAccessibility: .afterFirstUnlock)
             return deferMaybe(creds)
         }
     }

RustFxA/PushNotificationSetup.swift

@@ -14,7 +14,7 @@ open class PushNotificationSetup {
         // If we've already registered this push subscription, we don't need to do it again.
         let apnsToken = deviceToken.hexEncodedString
         let keychain = KeychainWrapper.sharedAppContainerKeychain
-        guard keychain.string(forKey: KeychainKey.apnsToken) != apnsToken else {
+        guard keychain.string(forKey: KeychainKey.apnsToken, withAccessibility: .afterFirstUnlock) != apnsToken else {
             return
         }