indeed_ai_job_search/Docs/Phase3/OpenAI_Integration.md

Phase 3 — OpenAI integration

Status: Implemented (local key via gitignored xcconfig)
Date: 2026-10-12

What shipped

• OpenAIClient — async chat completions with JSON Schema response format, 30s timeout
• OpenAISearchInterpreter — NL query → schema-validated SearchCriteria
• SecretsProvider — XOR/base64 de-obfuscation of build-injected key (still extractable from binary)
• FeatureFlags.isAIInterpretationEnabled — disable AI and fall back to mock interpreter
• Sandbox: ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES
• Job listings still come from mock/fixture Indeed sources (Option C vendor pending)

Local setup

1. Copy Config/Secrets.xcconfig.example → Config/Secrets.xcconfig

2. Set OPENAI_API_KEY_OBFUSCATED using:

   SecretsProvider.obfuscateForConfig("sk-...")
   

3. Build & run. App uses AppDependencies.live.

Secrets.xcconfig is gitignored. Never commit plaintext or obfuscated production keys.

Security limits

• Obfuscation is not encryption; a determined attacker can recover the key from the binary.
• Do not log prompts/responses that contain PII in production builds.
• Rotate keys if exposed in chat, screenshots, or commits.

Feature flag

FeatureFlags.isAIInterpretationEnabled = false // mock interpretation only