fastlane 2.240.0 → 2.241.0

data/spaceship/lib/spaceship/connect_api/provisioning/provisioning.rb

@@ -3,6 +3,11 @@ require 'spaceship/connect_api/provisioning/client'
 module Spaceship
   class ConnectAPI
     module Provisioning
+      # Raised when a profile with 'Offline Support' is requested while authenticated
+      # with an App Store Connect API key. Apple only exposes the isOfflineProfile
+      # attribute on the Developer Portal endpoint used by Apple ID (web session) logins.
+      class OfflineProfileNotSupportedError < StandardError; end
+
       module API
         module Version
           V1 = "v1"
@@ -84,6 +89,22 @@ module Spaceship
           provisioning_request_client.post("#{Version::V1}/bundleIdCapabilities", body)
         end
 
+        # Modify a Capability Configuration — patches the bundleIdCapability resource
+        # directly (attributes at the top level), not the bundleId it belongs to.
+        def patch_bundle_id_capability_configuration(bundle_id_capability_id:, enabled: false, settings: [])
+          body = {
+            data: {
+              type: "bundleIdCapabilities",
+              id: bundle_id_capability_id,
+              attributes: {
+                enabled: enabled,
+                settings: settings
+              }
+            }
+          }
+          provisioning_request_client.patch("#{Version::V1}/bundleIdCapabilities/#{bundle_id_capability_id}", body)
+        end
+
         def patch_bundle_id_capability(bundle_id_id:, seed_id:, enabled: false, capability_type:, settings: [])
           body = {
             data: {
@@ -222,6 +243,10 @@ module Spaceship
         end
 
         def post_profiles(bundle_id_id: nil, certificates: nil, devices: nil, attributes: {})
+          if attributes[:isOfflineProfile] && !provisioning_request_client.web_session?
+            raise OfflineProfileNotSupportedError, "Profiles with 'Offline Support' (isOfflineProfile) can only be created when logged in with an Apple ID; the App Store Connect API does not support this attribute"
+          end
+
           body = {
             data: {
               attributes: attributes,

data/spaceship/lib/spaceship/du/upload_file.rb

@@ -34,7 +34,7 @@ module Spaceship
       # This will copy the image into the temporary directory to remove the
       # alpha channel there. That's done to not edit the original image.
       def remove_alpha_channel(original)
-        path = File.join(Dir.tmpdir, "#{Digest::MD5.hexdigest(original)}.png")
+        path = File.join(Dir.mktmpdir("spaceship-upload-"), File.basename(original))
         FileUtils.copy(original, path)
         if mac? # sips is only available on macOS
           `sips -s format bmp '#{path}' &> /dev/null` # &> /dev/null since there is warning because of the extension

data/spaceship/lib/spaceship/errors.rb

@@ -86,7 +86,13 @@ module Spaceship
     end
 
     def preferred_error_info
-      return nil unless @error_info.kind_of?(Hash) && @error_info['resultString']
+      return nil unless @error_info.kind_of?(Hash)
+
+      # What Apple's authentication service answers, e.g. on a locked Apple ID
+      service_errors = Array(@error_info['serviceErrors'])
+      return ["Apple provided the following error info:"] + service_errors.map { |error| [error['message'], "(#{error['code']})"].compact.join(" ") } unless service_errors.empty?
+
+      return nil unless @error_info['resultString']
 
       [
         "Apple provided the following error info:",

data/spaceship/lib/spaceship/globals.rb

@@ -7,8 +7,8 @@ module Spaceship
     # if spaceship is run with a FastlaneCore available respect the global state there
     # otherwise fallback to $verbose
     def self.verbose?
-      if Object.const_defined?("FastlaneCore")
-        return FastlaneCore::Globals.verbose? # rubocop:disable Require/MissingRequireStatement
+      if Object.const_defined?("FastlaneCore") && FastlaneCore.const_defined?("Globals")
+        return FastlaneCore::Globals.verbose?
       end
       return $verbose
     end

data/spaceship/lib/spaceship/portal/merchant.rb

@@ -46,7 +46,7 @@ module Spaceship
         # @param mac [Bool] Fetches Mac merchant if true
         # @return (Array) Returns all merchants available for this account
         def all(mac: false)
-          client.merchants(mac: mac).map { |merchant| new(merchant) }
+          client.merchants(mac: mac).map { |merchant| new_with_platform(merchant, mac) }
         end
 
         # Creates a new Merchant on the Apple Dev Portal
@@ -57,7 +57,7 @@ module Spaceship
         # @return (Merchant) The Merchant you just created
         def create!(bundle_id: nil, name: nil, mac: false)
           new_merchant = client.create_merchant!(name, bundle_id, mac: mac)
-          new(new_merchant)
+          new_with_platform(new_merchant, mac)
         end
 
         # Find a specific Merchant ID based on the bundle_id
@@ -68,6 +68,131 @@ module Spaceship
             merchant.bundle_id == bundle_id
           end
         end
+
+        # Apple does not return the platform, so we record the one that was asked for.
+        def new_with_platform(attrs, mac)
+          new(attrs).tap { |merchant| merchant.platform = mac ? 'mac' : 'ios' }
+        end
+        private :new_with_platform
+      end
+
+      # Represents a domain registered to an Apple Pay Merchant ID
+      class Domain < PortalBase
+        # @return (String) The identifier of this domain, provided by the Dev Portal
+        # @example
+        #   "UFVN6788YA"
+        attr_accessor :domain_id
+
+        # @return (String) The domain name you registered
+        # @example
+        #   "krausefx.com"
+        attr_accessor :name
+
+        # @return (String) Status of the domain verification
+        # @example
+        #   "verified"
+        attr_accessor :status
+
+        # @return (String) The URL Apple expects to serve the domain association file
+        # @example
+        #   "https://krausefx.com/.well-known/apple-developer-merchantid-domain-association.txt"
+        attr_accessor :path
+
+        # @return (Bool) Can this domain be verified by the current team?
+        attr_accessor :can_verify
+
+        # @return (String) The date this domain's verification expires
+        # @example
+        #   "2026-10-11"
+        attr_accessor :expiration_date
+
+        # @return (String) A human readable version of the expiration date
+        # @example
+        #   "Oct 11, 2026"
+        attr_accessor :expiration_date_string
+
+        # @return (Spaceship::Portal::Merchant) The merchant this domain is registered to
+        #   This is not part of Apple's response, it gets passed in by whoever fetched the domain
+        attr_accessor :merchant
+
+        attr_mapping(
+          'displayId' => :domain_id,
+          'name' => :name,
+          'status' => :status,
+          'path' => :path,
+          'canVerify' => :can_verify,
+          'expirationDate' => :expiration_date,
+          'expirationDateString' => :expiration_date_string
+        )
+
+        # @param attrs [Hash] The domain attributes as returned by the Dev Portal
+        # @param existing_client [Spaceship::Client] The client to use for requests
+        # @param merchant [Merchant] The merchant this domain is registered to
+        def initialize(attrs = {}, existing_client = nil, merchant: nil)
+          super(attrs, existing_client)
+          @merchant = merchant
+        end
+
+        class << self
+          # @param merchant [Merchant] The merchant to fetch the domains of
+          # @return (Array) Returns all domains registered to the given merchant
+          def all(merchant)
+            client.merchant_domains(merchant.merchant_id, mac: merchant.mac?).map do |domain|
+              new(domain, client, merchant: merchant)
+            end
+          end
+
+          # Registers a new domain for a Merchant ID on the Apple Dev Portal
+          #
+          # @param merchant [Merchant] the merchant to register the domain for
+          # @param domain_name [String] the domain name to register
+          # @return (Domain) The Domain you just registered
+          def create!(merchant: nil, domain_name: nil)
+            new_domain = client.create_merchant_domain!(merchant.merchant_id, domain_name, mac: merchant.mac?)
+            new(new_domain, client, merchant: merchant)
+          end
+
+          # Find a specific domain of a merchant based on the domain name
+          #
+          # @param merchant [Merchant] The merchant to search the domains of
+          # @param name [String] the domain name to look for
+          # @return (Domain) The Domain you're looking for. This is nil if the domain can't be found.
+          def find(merchant, name)
+            all(merchant).find do |domain|
+              domain.name == name
+            end
+          end
+        end
+
+        # Downloads the domain association file for this domain. It has to be
+        # served at `path` before Apple is able to verify the domain
+        #
+        # @return (String) The url-safe base64 encoded contents of the file
+        def verification_file
+          client.merchant_domain_get_verification_file(domain_id, mac: merchant.mac?)
+        end
+
+        # Asks Apple to verify this domain. The `verification_file` has to be
+        # served at `path` before calling this
+        #
+        # @return (Hash) The response of the Dev Portal
+        def verify
+          client.merchant_domain_verify(domain_id, mac: merchant.mac?)
+        end
+
+        # Delete this Domain
+        # @return (Domain) The domain you just deleted
+        def delete!
+          client.delete_merchant_domain!(domain_id, merchant.merchant_id, mac: merchant.mac?)
+          self
+        end
+      end
+
+      # @return (Array of Spaceship::Portal::Merchant::Domain) The domains registered to this merchant
+      def domains
+        @domains ||= client.merchant_domains(merchant_id, mac: mac?).map do |domain|
+          Domain.new(domain, client, merchant: self)
+        end
       end
 
       # Delete this Merchant

data/spaceship/lib/spaceship/portal/portal_client.rb

@@ -1,3 +1,5 @@
+require 'base64'
+
 require_relative '../client'
 
 require_relative 'app'
@@ -344,6 +346,62 @@ module Spaceship
       end
     end
 
+    def merchant_domains(merchant_id, mac: false)
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/listDomainsForMerchant", {
+        merchantId: merchant_id,
+        teamId: team_id
+      })
+      parse_response(r, 'domainList')
+    end
+
+    def merchant_domain_get_verification_file(domain_id, mac: false)
+      r = request(:get, "account/#{platform_slug(mac)}/identifiers/downloadDomainVerificationFile", {
+        teamId: team_id,
+        domainId: domain_id
+      })
+      a = parse_response(r)
+      if r.success? && a.kind_of?(String)
+        begin
+          return a if Base64.urlsafe_decode64(a.delete("\r\n")).include?("Apple Inc.")
+        # if not valid pkcs#7 just fall through
+        rescue ArgumentError
+        end
+      end
+      raise UnexpectedResponse.new, "Couldn't download verification file, got this instead: #{a}"
+    end
+
+    def merchant_domain_verify(domain_id, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/verifyDomain", {
+        domainId: domain_id,
+        teamId: team_id
+      })
+      parse_response(r)
+    end
+
+    def create_merchant_domain!(merchant_id, domain_name, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/registerDomain", {
+        domainName: domain_name,
+        merchantId: merchant_id,
+        teamId: team_id
+      })
+      parse_response(r, 'domainList').first
+    end
+
+    def delete_merchant_domain!(domain_id, merchant_id, mac: false)
+      ensure_csrf(Spaceship::Portal::Merchant)
+
+      r = request(:post, "account/#{platform_slug(mac)}/identifiers/removeDomain", {
+        merchantId: merchant_id,
+        domainId: domain_id,
+        teamId: team_id
+      })
+      parse_response(r)
+    end
+
     def create_merchant!(name, bundle_id, mac: false)
       ensure_csrf(Spaceship::Portal::Merchant)
 

data/spaceship/lib/spaceship/portal/ui/select_team.rb

@@ -31,7 +31,6 @@ module Spaceship
       #     {...}
       #   ]
 
-      # rubocop:disable Require/MissingRequireStatement
       def self.ci?
         if Object.const_defined?("FastlaneCore") && FastlaneCore.const_defined?("Helper")
           return FastlaneCore::Helper.ci?
@@ -45,7 +44,6 @@ module Spaceship
         end
         return true
       end
-      # rubocop:enable Require/MissingRequireStatement
 
       def select_team(team_id: nil, team_name: nil)
         teams = client.teams

data/spaceship/lib/spaceship/portal/website_push.rb

@@ -48,7 +48,7 @@ module Spaceship
         # @param mac [Bool] Fetches Mac website push if true
         # @return (Array) Returns all website push available for this account
         def all(mac: false)
-          client.website_push(mac: mac).map { |website_push| self.new(website_push) }
+          client.website_push(mac: mac).map { |website_push| new_with_platform(website_push, mac) }
         end
 
         # Creates a new Website Push ID on the Apple Dev Portal
@@ -59,7 +59,7 @@ module Spaceship
         # @return (Website Push) The Website Push you just created
         def create!(bundle_id: nil, name: nil, mac: false)
           new_website_push = client.create_website_push!(name, bundle_id, mac: mac)
-          self.new(new_website_push)
+          new_with_platform(new_website_push, mac)
         end
 
         # Find a specific Website Push ID based on the bundle_id
@@ -70,6 +70,12 @@ module Spaceship
             website_push.bundle_id == bundle_id
           end
         end
+
+        # Apple does not return the platform, so we record the one that was asked for.
+        def new_with_platform(attrs, mac)
+          new(attrs).tap { |website_push| website_push.platform = mac ? 'mac' : 'ios' }
+        end
+        private :new_with_platform
       end
 
       # Delete this Website Push ID.

data/spaceship/lib/spaceship/test_flight/client.rb

@@ -286,28 +286,6 @@ module Spaceship
         handle_response(response)
       end
 
-      ##
-      # @!group AppTestInfo
-      ##
-
-      def get_app_test_info(app_id: nil)
-        assert_required_params(__method__, binding)
-
-        response = request(:get, "providers/#{team_id}/apps/#{app_id}/testInfo")
-        handle_response(response)
-      end
-
-      def put_app_test_info(app_id: nil, app_test_info: nil)
-        assert_required_params(__method__, binding)
-
-        response = request(:put) do |req|
-          req.url("providers/#{team_id}/apps/#{app_id}/testInfo")
-          req.body = app_test_info.to_json
-          req.headers['Content-Type'] = 'application/json'
-        end
-        handle_response(response)
-      end
-
       protected
 
       def handle_response(response)

data/spaceship/lib/spaceship/test_flight.rb

@@ -1,6 +1,5 @@
 require 'spaceship/test_flight/client'
 require 'spaceship/test_flight/base'
-require 'spaceship/test_flight/app_test_info'
 require 'spaceship/test_flight/build'
 require 'spaceship/test_flight/build_trains'
 require 'spaceship/test_flight/beta_review_info'

data/spaceship/lib/spaceship/two_step_or_factor_client.rb

@@ -20,10 +20,21 @@ module Spaceship
       elsif r.body.kind_of?(Hash) && r.body["trustedPhoneNumbers"].kind_of?(Array) && r.body["trustedPhoneNumbers"].first.kind_of?(Hash)
         handle_two_factor(r)
       else
+        raise_two_factor_service_errors!(r.body)
         raise "Although response from Apple indicated activated Two-step Verification or Two-factor Authentication, spaceship didn't know how to handle this response: #{r.body}"
       end
     end
 
+    # Apple answers without any way to verify, e.g. when it cannot send the SMS code (-28248). See fastlane#29443.
+    def raise_two_factor_service_errors!(body)
+      errors = body.kind_of?(Hash) ? Array(body["serviceErrors"]) : []
+      return if errors.empty?
+
+      message = errors.map { |error| "#{error['message']} (#{error['code']})" }.join(" ")
+      message += " This Apple ID has no trusted devices: signing in to it on an Apple device adds one." if body["noTrustedDevices"]
+      raise Tunes::Error.new, "Apple could not start two-factor authentication: #{message}"
+    end
+
     def handle_two_step(response)
       if response.body.fetch("securityCode", {})["tooManyCodesLock"].to_s.length > 0
         raise Tunes::Error.new, "Too many verification codes have been sent. Enter the last code you received, use one of your devices, or try again later."

data/supply/lib/supply/options.rb

@@ -108,6 +108,7 @@ module Supply
                                      conflicting_options: [:issuer, :key, :json_key],
                                      optional: true,
                                      description: "The raw content of a Google credentials JSON file (Application Default, Workload Identity, or Service Account), used to authenticate with Google",
+                                     sensitive: true,
                                      code_gen_sensitive: true,
                                      default_value: CredentialsManager::AppfileConfig.try_fetch_value(:json_key_data_raw),
                                      default_value_dynamic: true,

data/supply/lib/supply.rb

@@ -2,7 +2,6 @@ require 'json'
 require 'supply/options'
 require 'supply/client'
 require 'supply/listing'
-require 'supply/apk_listing'
 require 'supply/image_listing'
 require 'supply/generated_universal_apk'
 require 'supply/release_listing'