Suggest a password from a 3rd party password managers automatically

Problem: When Proton Pass is enabled and iCloud Keychain is disabled in OS X under Password Options, both will appear as options within Orion upon clicking the key icon in the login field.

MVP: Clicking the key icon only shows enabled providers (in this case Proton Pass).

User Value Add: If only one provider is enabled, open the enabled provider with a single click instead of 2 clicks (i.e. right now you have to click the key icon, then select the provider [in this case Proton]).

Further User Value Add: If only 1 provider is enabled, autofill the correct password with 0 clicks and maybe even login automatically.

Following the tenant of: "User Input is an error", minimize the number of inputs required to login securely. By enabling a single provider, the user has alraedy made a choice to use only the enabled provider. Don't make the user choose said provider again every time they login to a website. This generates unnecessary toil and adds up to a lot of wasted seconds over time.

I wanted to chime in on this with some information that may be helpful. I was implementing a custom autofill credential provider to wrap Pass (basically just PGP encrypted files where the first line contains the password and the following lines are key-value pairs).

I began by examining the documentation on Authentication Services->AutoFill credentials.

It's fairly straightforward, and all you have to do is override a couple of methods for ASCredentialProviderViewController. The function that is of interest with respect to this thread is:

func prepareCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier])

When a user initiates the flow for selecting a credential from an auto-fill credential provider this is supposed to contain the set of service identifiers that allow you to identify the service the user is signing in to. For example, you can use this information to preemptively add a filter to the set of credentials the user might be shown. You can also use this to register the service identifier and the identifiers for the password to the ASCredentialIdentityStore.

The code for doing that may look something like this:

let credentialIdentity = ASPasswordCredentialIdentity(serviceIdentifier: identifier, user: secret.user, recordIdentifier: secret.uniqueId)
let store = ASCredentialIdentityStore.shared
if await store.state().isEnabled {
    try await store.saveCredentialIdentities([credentialIdentity])
}

Once, you've done that the credential will start showing up in the pop-up as described in the image from OP here:

When I was testing my credential provider on both Safari and Orion I noticed that prepareCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier]) may contain something like this when the provider is run from the pop-up on Safari:

<ASCredentialServiceIdentifier: 0x146607b60; type=url; identifier=https://orionfeedback.org/>

However, for Orion the serviceIdentifiers list is always empty. Without this information an auto-fill provider cannot associate a credential with a service and hence no pop-up can be displayed. I suspect that if the reason for why no service identifiers are populated is resolved the functionality would just start working.