RubyGems - panda-core - Versions diffs - 1.1.1 → 1.2.0 - Mend

panda-core 1.1.1 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (27) hide show

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37a6c53ce5d4b5656603f5bec9ef7de364b6e94452eb4f635d96811bfdcfd3cd
-  data.tar.gz: 5641f056c4876c0fb00cc1bab8063ccfbeb84bc94835d4df06da6a99ba4d0ef8
+  metadata.gz: d3e74c09fd81106220b436b5fd9f2290fd3c33c4b648d011a9ee637f7da06af1
+  data.tar.gz: 4979e5db64c94a2a48256561fb4dacf8d8970c3621aae32f00fe47d6734b9aea
 SHA512:
-  metadata.gz: 80cb0f2e79923c41c05a67bf3f7a62b37ae6bf5a6dc74d4ed938e58530358f71c0bb1b542a00da04db30f34116e3b557de61a7840dd765c205e832d4a5bfc8d9
-  data.tar.gz: efc50d077137b2e6ef993318ba548fc3dc957560800a291697407f74903443d44491992ba08cc1068a2295cd4027a6cb2974d93d023ad6e08ca4f1430ac20e91
+  metadata.gz: 0da5c19054a4279007f0e82cb77834fec89a42d6f7ec52aa5175991f85008a4e75568e5366c05fa4b6d6de3f44918c53ad1f87b39fa0f742dd431c001de27a85
+  data.tar.gz: bd7540345f539cdfb5e32b2e38f8416bc0a84d6c1d9475f055cc73a5c8b185c2450dda6060a8058643b39b5a66420ea7f1787a832a3152925dbdaf682c0d177d

data/app/components/panda/core/shared/header_component.html.erb CHANGED Viewed

@@ -1,10 +1,20 @@
 <!DOCTYPE html>
-<html data-theme="<%= Panda::Core::Current&.user&.current_theme || Panda::Core.config.default_theme %>" class="<%= @html_class %>">
+<html lang="<%= html_lang %>" data-theme="<%= Panda::Core::Current&.user&.current_theme || Panda::Core.config.default_theme %>" class="<%= @html_class %>">
   <head>
+    <%# Must stay inside the first 1024 bytes of the document: the HTML spec %>
+    <%# ignores a charset declaration that lands any later, and only the %>
+    <%# component can guarantee that (additional_head_content is thousands of %>
+    <%# bytes in). Without it the encoding rests on the Content-Type header %>
+    <%# alone, which a saved copy or a stripping proxy does not carry. %>
+    <meta charset="utf-8">
     <title><%= helpers.content_for?(:title) ? helpers.content_for(:title) : (Panda::Core.config.admin_title || "Panda Admin") %></title>
     <%= helpers.csrf_meta_tags %>
     <%= helpers.csp_meta_tag %>
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@7.1.0/css/all.min.css">
+    <%# Font Awesome is vendored rather than loaded from a CDN: a strict %>
+    <%# style-src 'self' refuses the stylesheet and font-src 'self' refuses the %>
+    <%# webfonts behind it. The upstream CSS is unmodified — its ../webfonts/ %>
+    <%# URLs resolve against the css/ directory it is served from. %>
+    <link rel="stylesheet" href="/panda-core-assets/fontawesome/css/all.min.css">
     <%= helpers.panda_core_stylesheet %>
     <link rel="stylesheet" href="/panda-core-assets/vanilla-calendar.css">
@@ -13,8 +23,11 @@
       <script src="/panda-core-assets/chartkick/chartkick.js"></script>
     <% end %>
-    <!-- ES Module Shims polyfill - must load BEFORE importmap -->
-    <script async src="https://ga.jspm.io/npm:es-module-shims@2.6.2/dist/es-module-shims.js"></script>
+    <%# ES Module Shims polyfill - must load BEFORE the importmap, and must not %>
+    <%# be async: the shim has to merge importmaps before any module script %>
+    <%# evaluates, which async does not guarantee. Vendored so script-src 'self' %>
+    <%# does not refuse it. %>
+    <script src="/panda-core-assets/es-module-shims.js"></script>
     <!-- Panda JavaScript (Core + all registered modules via ModuleRegistry) -->
     <%= helpers.panda_core_javascript %>
@@ -23,9 +36,7 @@
       <%= render "panda/cms/shared/favicons" %>
     <% end %>
-    <% if Panda::Core.config.additional_head_content.respond_to?(:call) %>
-      <%= Panda::Core.config.additional_head_content.call.html_safe %>
-    <% end %>
+    <%= additional_head_content %>
     <%= helpers.content_for :head %>
   </head>

data/app/components/panda/core/shared/header_component.rb CHANGED Viewed

@@ -13,6 +13,43 @@ module Panda
         end
         attr_reader :html_class, :body_class
+        # Language for the <html lang> attribute.
+        #
+        # Screen readers use it to pick a pronunciation, so a page without one is
+        # read in whatever the reader's default happens to be.
+        def html_lang
+          I18n.locale.to_s.presence || "en"
+        end
+        # Render Panda::Core.config.additional_head_content with a view context.
+        #
+        # Called with no receiver and no arguments, a host app's lambda has no
+        # view and no request, so content_security_policy_nonce is nil inside it
+        # and anything it injects (javascript_importmap_tags included) comes out
+        # un-nonced and is dropped by a strict script-src.
+        #
+        # Two shapes are supported, so existing configuration keeps working:
+        #
+        #   # Arity 0 - evaluated against the view context, so view helpers and
+        #   # content_security_policy_nonce resolve directly.
+        #   config.additional_head_content = -> { javascript_importmap_tags(nonce: content_security_policy_nonce) }
+        #
+        #   # Arity 1 - the view context is yielded as an argument.
+        #   config.additional_head_content = ->(view) { view.javascript_importmap_tags(nonce: view.content_security_policy_nonce) }
+        def additional_head_content
+          content = Panda::Core.config.additional_head_content
+          return nil unless content.respond_to?(:call)
+          result =
+            if content.arity == 0
+              helpers.instance_exec(&content)
+            else
+              content.call(helpers)
+            end
+          result&.to_s&.html_safe
+        end
       end
     end
   end

data/app/controllers/panda/core/admin/sessions_controller.rb CHANGED Viewed

@@ -16,7 +16,8 @@ module Panda
             if key.to_sym == :developer
               Rails.env.development?
             else
-              config[:client_id].present? && config[:client_secret].present?
+              symbol = Engine::OmniauthConfig::PROVIDER_REGISTRY[key.to_s] || key.to_sym
+              Engine::OmniauthConfig.credentials_configured?(symbol, config)
             end
           end.keys
         end

data/app/helpers/panda/core/asset_helper.rb CHANGED Viewed

@@ -15,16 +15,38 @@ module Panda
       # via ModuleRegistry.
       #
       # Note: Always uses importmap (Rails 8 approach), regardless of asset source
+      #
+      # The tags are built by hand rather than through +javascript_importmap_tags+
+      # because the importmap is assembled from ModuleRegistry rather than from a
+      # Rails importmap. That means the nonce has to be applied by hand too: under
+      # a Content Security Policy of +script-src 'self'+ an un-nonced inline
+      # <script> is dropped silently, which takes Turbo and every Stimulus
+      # controller with it and looks like nothing at all.
       def panda_core_javascript
-        # Use ModuleRegistry to combine all Panda module importmaps
-        imports = Panda::Core::ModuleRegistry.combined_importmap
+        panda_core_importmap_tag + panda_core_script_tags
+      end
+      # The <script type="importmap"> tag on its own.
+      #
+      # Split out from the entry points because a host app that emits its own
+      # importmap needs exactly one: browsers with native import-map support
+      # honour only the first one in the document and ignore the rest. Such an
+      # app should merge Panda's pins (Panda::Core::ModuleRegistry.combined_importmap)
+      # into its own importmap and call panda_core_script_tags instead of
+      # panda_core_javascript.
+      def panda_core_importmap_tag
+        imports = Panda::Core::ModuleRegistry.combined_importmap
         importmap_json = JSON.generate({"imports" => imports})
-        # Generate entry point script tags for all registered modules (including Core)
+        %(<script type="importmap"#{panda_core_nonce_attribute}>#{importmap_json}</script>).html_safe
+      end
+      # The module entry-point <script> tags for Core and every registered module,
+      # without an importmap. Safe to call alongside a host app's own importmap.
+      def panda_core_script_tags
+        nonce_attr = panda_core_nonce_attribute
         entry_points = []
-        # Add entry points for each registered module
         Panda::Core::ModuleRegistry.modules.each do |gem_name, info|
           # Extract module namespace from gem name (e.g., "panda-cms" -> "cms")
           module_slug = gem_name.sub(/^panda-/, "")
@@ -33,14 +55,11 @@ module Panda
           module_name = info[:engine].sub(/::Engine$/, "")
           next unless Object.const_defined?(module_name)
-          entry_points << %(<script type="module">import "panda/#{module_slug}/application"</script>)
-          entry_points << %(<script type="module">import "panda/#{module_slug}/controllers/index"</script>)
+          entry_points << %(<script type="module"#{nonce_attr}>import "panda/#{module_slug}/application"</script>)
+          entry_points << %(<script type="module"#{nonce_attr}>import "panda/#{module_slug}/controllers/index"</script>)
         end
-        <<~HTML.html_safe
-          <script type="importmap">#{importmap_json}</script>
-          #{entry_points.join("\n")}
-        HTML
+        entry_points.join("\n").html_safe
       end
       # Include only Core CSS
@@ -50,6 +69,32 @@ module Panda
         stylesheet_link_tag(css_url)
       end
+      private
+      # A ready-to-interpolate ` nonce="..."` attribute, or "" when there is no
+      # nonce to emit.
+      #
+      # Guarded on presence because an app with no CSP configured gets nil back,
+      # and emitting nonce="" there is worse than emitting nothing: an empty
+      # nonce never matches a policy, so it would break the very apps that have
+      # no CSP problem to begin with.
+      def panda_core_nonce_attribute
+        nonce = panda_core_csp_nonce
+        return "" if nonce.blank?
+        %( nonce="#{ERB::Util.html_escape(nonce)}")
+      end
+      def panda_core_csp_nonce
+        return nil unless respond_to?(:content_security_policy_nonce)
+        content_security_policy_nonce
+      rescue
+        # No request in scope (e.g. rendering outside a controller), so there is
+        # no per-request nonce to read.
+        nil
+      end
     end
   end
 end

data/app/helpers/panda/core/sessions_helper.rb CHANGED Viewed

@@ -7,7 +7,8 @@ module Panda
       PROVIDER_ICON_MAP = {
         google_oauth2: "google",
         microsoft_graph: "microsoft",
-        github: "github"
+        github: "github",
+        apple: "apple"
       }.freeze
       # Map of providers that don't use fa-brands (use fa-solid instead)
@@ -20,6 +21,7 @@ module Panda
         google_oauth2: "Google",
         microsoft_graph: "Microsoft",
         github: "GitHub",
+        apple: "Apple",
         developer: "Developer"
       }.freeze

data/app/javascript/panda/core/application.js CHANGED Viewed

@@ -1,4 +1,7 @@
 import { Application } from '@hotwired/stimulus'
+// Must precede the Font Awesome import: it disables the SVG watcher, whose
+// un-nonced <style> injection is dropped by a strict style-src. See the module.
+import './fontawesome-config.js'
 import '@fortawesome/fontawesome-free'
 const application = Application.start()

data/app/javascript/panda/core/fontawesome-config.js ADDED Viewed

@@ -0,0 +1,23 @@
+// Font Awesome's JavaScript renders icons by replacing every
+// <i class="fa-solid ..."> with an inline <svg>, and sizes the result with a
+// <style> element it injects through document.head.insertBefore. That style
+// carries no nonce, and Font Awesome 7.2.0 has no nonce option at all — grep the
+// vendored build and there is not one occurrence. Under an enforced
+// style-src 'self' the browser drops it silently and every replaced icon renders
+// at raw viewBox size.
+//
+// Panda serves the Font Awesome webfont CSS (see the <link> in
+// Shared::HeaderComponent), which draws the same fa-solid / fa-brands glyphs
+// from a ::before rule with no JavaScript involved. The SVG watcher is therefore
+// redundant as well as CSP-hostile, so it is switched off here — the icons
+// consumers write keep resolving, through the CSS instead.
+//
+// This lives in its own module rather than at the top of application.js because
+// ES module dependencies are evaluated before the importing module's own body
+// runs: an assignment inside application.js would land *after* Font Awesome had
+// already read its config. A module imported ahead of it does not.
+window.FontAwesomeConfig = {
+  autoReplaceSvg: false,
+  autoAddCss: false,
+  observeMutations: false
+}

data/app/models/panda/core/user.rb CHANGED Viewed

@@ -49,6 +49,20 @@ module Panda
       }
       def self.find_or_create_from_auth_hash(auth_hash)
+        # Email is the cross-provider identity key, so we must only trust it
+        # when the identity provider actually attests the user owns it.
+        # Otherwise a provider that lets a user assert an arbitrary email
+        # (a generic OAuth2/OIDC/SAML strategy, or a misconfigured one) would
+        # allow matching into an existing account — an account-takeover vector.
+        unless email_verified_for_auth?(auth_hash)
+          user = new(
+            email: auth_hash.info.email.to_s.downcase,
+            name: auth_hash.info.name || "Unknown User"
+          )
+          user.errors.add(:base, "Your email address could not be verified with the identity provider. Please contact your administrator.")
+          return user
+        end
         user = find_by(email: auth_hash.info.email.downcase)
         avatar_url = auth_hash.info.image
@@ -102,6 +116,62 @@ module Panda
         user
       end
+      # Whether the provider's asserted email may be trusted as proof of
+      # ownership for this authentication.
+      #
+      # Precedence:
+      #   1. An explicit `email_verified` signal from the provider (checked in
+      #      both `info` and `extra.raw_info`) is authoritative — truthy means
+      #      verified, an explicit false means NOT verified (no fallback).
+      #   2. When the provider returns no such signal, fall back to the
+      #      `trusted_email_providers` allow-list so operators must opt a
+      #      provider in. The dev-only `developer` strategy is trusted only in
+      #      the development environment.
+      def self.email_verified_for_auth?(auth_hash)
+        signal = extract_email_verified_signal(auth_hash)
+        return truthy_verification?(signal) unless signal.nil?
+        provider = indifferent_lookup(auth_hash, :provider).to_s
+        return false if provider.empty?
+        return true if provider == "developer" && Rails.env.development?
+        trusted = Panda::Core.config.trusted_email_providers || []
+        trusted.map(&:to_s).include?(provider)
+      end
+      # Pull an `email_verified` value from the standard OmniAuth locations.
+      # Returns nil when the provider asserts nothing (so the caller can fall
+      # back to the trust policy), and preserves an explicit `false`.
+      def self.extract_email_verified_signal(auth_hash)
+        info = indifferent_lookup(auth_hash, :info)
+        info_signal = indifferent_lookup(info, :email_verified)
+        return info_signal unless info_signal.nil?
+        extra = indifferent_lookup(auth_hash, :extra)
+        raw_info = indifferent_lookup(extra, :raw_info)
+        indifferent_lookup(raw_info, :email_verified)
+      end
+      # OmniAuth strategies variously return booleans or strings ("true").
+      def self.truthy_verification?(value)
+        value == true || value.to_s.strip.casecmp("true").zero?
+      end
+      # Fetch a key from an OmniAuth::AuthHash (Hashie::Mash) or a plain Hash
+      # without losing an explicit `false` value. Returns nil when absent.
+      def self.indifferent_lookup(hash, key)
+        return nil unless hash.respond_to?(:key?)
+        if hash.key?(key.to_s)
+          hash[key.to_s]
+        elsif hash.key?(key.to_sym)
+          hash[key.to_sym]
+        end
+      end
+      private_class_method :email_verified_for_auth?, :extract_email_verified_signal,
+        :truthy_verification?, :indifferent_lookup
       # Admin status check
       def admin?
         ActiveRecord::Type::Boolean.new.cast(admin)

data/db/migrate/20260202171614_create_panda_core_file_categories.rb CHANGED Viewed

@@ -18,7 +18,7 @@ class CreatePandaCoreFileCategories < ActiveRecord::Migration[7.1]
     create_table :panda_core_file_categorizations, id: :uuid do |t|
       t.references :file_category, null: false, type: :uuid,
         foreign_key: {to_table: :panda_core_file_categories}
-      t.bigint :blob_id, null: false
+      t.column :blob_id, active_storage_blob_key_type, null: false
       t.timestamps
     end
@@ -27,4 +27,38 @@ class CreatePandaCoreFileCategories < ActiveRecord::Migration[7.1]
     add_index :panda_core_file_categorizations, :blob_id
     add_foreign_key :panda_core_file_categorizations, :active_storage_blobs, column: :blob_id
   end
+  private
+  # The type of active_storage_blobs.id is decided by the *host application*, not
+  # by this gem: Rails' own CreateActiveStorageTables reads
+  # Rails.configuration.generators[:active_record][:primary_key_type] at migration
+  # time, so an app that sets `primary_key_type: :uuid` gets uuid blob ids while an
+  # app that leaves it alone gets bigint.
+  #
+  # Hardcoding either one makes this migration fail on half of all host apps, and
+  # makes `db:migrate` and `db:schema:load` build structurally different databases
+  # in the same app. Read the type that is actually there instead.
+  def active_storage_blob_key_type
+    unless table_exists?(:active_storage_blobs)
+      raise <<~MESSAGE
+        panda-core's file categorisation tables reference active_storage_blobs, but that
+        table does not exist yet. Install and run Active Storage's migrations first:
+          bin/rails active_storage:install
+          bin/rails db:migrate
+      MESSAGE
+    end
+    column = columns(:active_storage_blobs).find { |c| c.name == "id" }
+    case column.type
+    when :integer
+      # PostgreSQL bigserial reports limit 8; SQLite's INTEGER primary key reports
+      # no limit and is 64-bit. Only a genuinely narrow integer stays :integer.
+      (column.limit && column.limit < 8) ? :integer : :bigint
+    else
+      column.type
+    end
+  end
 end

data/db/migrate/20260213000001_fix_active_storage_attachments_record_id_type.rb CHANGED Viewed

@@ -5,19 +5,25 @@ class FixActiveStorageAttachmentsRecordIdType < ActiveRecord::Migration[8.1]
     return unless table_exists?(:active_storage_attachments)
     column = columns(:active_storage_attachments).find { |c| c.name == "record_id" }
-    return if column.nil? || column.sql_type == "character varying"
+    return if column.nil? || column.type == :string
-    # Remove orphaned attachments where UUID was silently cast to 0
-    execute <<~SQL
-      DELETE FROM active_storage_attachments WHERE record_id = 0
-    SQL
+    # Remove orphaned attachments where a UUID was silently cast to 0. This only
+    # ever happened on an integer column: on a uuid record_id (a host app with
+    # `primary_key_type: :uuid`) the comparison is not even well typed.
+    if column.type == :integer
+      execute <<~SQL
+        DELETE FROM active_storage_attachments WHERE record_id = 0
+      SQL
+    end
     # Drop the unique index before changing the column type
     remove_index :active_storage_attachments,
       name: "index_active_storage_attachments_uniqueness",
       if_exists: true
-    change_column :active_storage_attachments, :record_id, :string, null: false
+    change_column :active_storage_attachments, :record_id, :string,
+      null: false,
+      **cast_to_string_options
     add_index :active_storage_attachments,
       [:record_type, :record_id, :name, :blob_id],
@@ -41,4 +47,19 @@ class FixActiveStorageAttachmentsRecordIdType < ActiveRecord::Migration[8.1]
       unique: true,
       name: "index_active_storage_attachments_uniqueness"
   end
+  private
+  # PostgreSQL has no assignment cast from uuid to text, so ALTER TABLE needs an
+  # explicit USING clause when the host app created record_id as a uuid. Other
+  # adapters (and integer columns) neither need nor accept one.
+  def cast_to_string_options
+    return {} unless adapter_is_postgresql?
+    {using: "record_id::text"}
+  end
+  def adapter_is_postgresql?
+    connection.adapter_name.match?(/postgres/i)
+  end
 end

data/db/migrate/20260825120000_normalise_polymorphic_tenant_id_columns.rb ADDED Viewed

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+# panda_core_tags.tenant_id and panda_core_import_sessions.tenant_id back
+# `belongs_to :tenant, polymorphic: true`. A polymorphic id has to be able to hold
+# whatever primary key the host app's tenant model uses, which for every current
+# panda host is a uuid — so the column has to be a string.
+#
+# #150 established that for panda_core_tags and #151 fixed it by editing the
+# already-released CreatePandaCoreTags migration in place. That fixed what a fresh
+# `db:migrate` builds and nothing else: every database that had already run the
+# migration kept its bigint column, and `db:schema:load` kept building bigint too,
+# because spec/dummy/db/schema.rb was never regenerated. panda_core_import_sessions
+# was never fixed at all.
+#
+# This converts the columns wherever they are still integers, and leaves string and
+# uuid columns (a host app that typed them itself) alone.
+class NormalisePolymorphicTenantIdColumns < ActiveRecord::Migration[8.1]
+  TABLES = %i[panda_core_tags panda_core_import_sessions].freeze
+  def up
+    TABLES.each do |table|
+      next unless integer_tenant_id?(table)
+      change_column table, :tenant_id, :string
+    end
+  end
+  def down
+    raise ActiveRecord::IrreversibleMigration,
+      "tenant_id holds host tenant primary keys, which are not necessarily integers"
+  end
+  private
+  def integer_tenant_id?(table)
+    return false unless table_exists?(table)
+    column = columns(table).find { |c| c.name == "tenant_id" }
+    column&.type == :integer
+  end
+end

data/lib/generators/panda/core/templates/panda.rb CHANGED Viewed

@@ -12,7 +12,22 @@ Panda::Core.configure do |config|
   # Authentication providers
   # Add the corresponding OmniAuth gem for each provider you enable
-  # (e.g. omniauth-google-oauth2, omniauth-github, omniauth-microsoft_graph).
+  # (e.g. omniauth-google-oauth2, omniauth-github, omniauth-microsoft_graph,
+  # omniauth-apple).
+  #
+  # Sign in with Apple uses JWT options instead of a static client_secret:
+  #
+  #   apple: {
+  #     enabled: true,
+  #     name: "Apple",
+  #     client_id: Rails.application.credentials.dig(:apple, :client_id),
+  #     options: {
+  #       scope: "email name",
+  #       team_id: Rails.application.credentials.dig(:apple, :team_id),
+  #       key_id: Rails.application.credentials.dig(:apple, :key_id),
+  #       pem: Rails.application.credentials.dig(:apple, :pem)
+  #     }
+  #   }
   #
   # In development, GitHub OAuth works out of the box with shared dev credentials
   # (restricted to localhost:3000). For production, add your own credentials via

data/lib/panda/core/configuration.rb CHANGED Viewed

@@ -50,7 +50,8 @@ module Panda
         :restrict_user_creation,
         :after_user_invited,
         :invite_form_content,
-        :post_authentication_redirect
+        :post_authentication_redirect,
+        :trusted_email_providers
       def initialize
         @user_class = "Panda::Core::User"
@@ -67,6 +68,19 @@ module Panda
         @authentication_provider_resolver = nil
         @authentication_provider_gate = nil
         @authentication_validator = nil
+        # OAuth providers whose asserted email address may be trusted as proof
+        # of ownership when the provider does NOT return an explicit
+        # `email_verified` signal. Providers that DO return the signal (e.g.
+        # Google/OIDC) are honoured regardless of this list. Operators must
+        # opt a provider in here; anything not listed (and without a verified
+        # signal) is treated as unverified to avoid account-takeover via a
+        # provider that lets users assert arbitrary emails.
+        #
+        # Defaults to the first-party providers this engine ships support for,
+        # all of which verify email ownership (Google also returns an explicit
+        # signal). A generic/self-hosted OAuth2/OIDC/SAML provider an operator
+        # adds is NOT trusted by default and must be listed here explicitly.
+        @trusted_email_providers = %i[google_oauth2 github microsoft_graph apple]
         @admin_path = "/admin"
         @default_theme = "default"

data/lib/panda/core/engine/omniauth_config.rb CHANGED Viewed

@@ -22,10 +22,47 @@ module Panda
           "github" => :github,
           "gh" => :github,
+          # Apple (Sign in with Apple)
+          "apple" => :apple,
           # Developer
           "developer" => :developer
         }.freeze
+        # Whether a provider has enough credentials to register / show on login.
+        # Apple uses a JWT client secret derived from team_id / key_id / pem
+        # (no static client_secret).
+        def self.credentials_configured?(symbol, settings)
+          case symbol.to_sym
+          when :developer
+            true
+          when :apple
+            apple_credentials_configured?(settings)
+          else
+            settings[:client_id].present? && settings[:client_secret].present?
+          end
+        end
+        def self.apple_credentials_configured?(settings)
+          settings[:client_id].present? &&
+            settings.dig(:options, :team_id).present? &&
+            settings.dig(:options, :key_id).present? &&
+            settings.dig(:options, :pem).present?
+        end
+        # Register a provider on an OmniAuth::Builder.
+        # Apple's strategy ignores the static secret and signs a JWT from options.
+        def self.register_provider(builder, symbol, settings, options)
+          case symbol.to_sym
+          when :apple
+            builder.provider :apple, settings[:client_id], "", options
+          when :developer
+            builder.provider :developer, options
+          else
+            builder.provider symbol, settings[:client_id], settings[:client_secret], options
+          end
+        end
         class_methods do
           # Load YAML provider overrides during engine definition (before middleware setup)
           def load_yaml_provider_overrides_early!
@@ -51,8 +88,8 @@ module Panda
               # causes "Forbidden" errors when submitting the admin login form.
               #
               # Disabling OmniAuth's request_validation_phase is safe because:
-              # - Production OAuth providers (Google, GitHub, Microsoft) are
-              #   protected by the OAuth state parameter in the callback phase
+              # - Production OAuth providers (Google, GitHub, Microsoft, Apple)
+              #   are protected by the OAuth state parameter in the callback phase
               # - The developer provider only runs in development/test
               # - The login form still requires POST (allowed_request_methods)
               c.request_validation_phase = nil
@@ -87,21 +124,15 @@ module Panda
           return if symbol == :developer && !Rails.env.development?
-          # Skip providers without credentials (except developer which doesn't need them)
-          has_credentials = settings[:client_id].present? && settings[:client_secret].present?
-          if symbol != :developer && !has_credentials
-            Rails.logger.info("[panda-core] Skipping OmniAuth provider #{name.inspect}: missing client_id or client_secret") if defined?(Rails.logger)
+          unless OmniauthConfig.credentials_configured?(symbol, settings)
+            Rails.logger.info("[panda-core] Skipping OmniAuth provider #{name.inspect}: missing credentials") if defined?(Rails.logger)
             return
           end
           options = (settings[:options] || {}).dup
           options[:name] = settings[:path_name] if settings[:path_name].present?
-          if settings[:client_id] && settings[:client_secret]
-            builder.provider symbol, settings[:client_id], settings[:client_secret], options
-          else
-            builder.provider symbol, options
-          end
+          OmniauthConfig.register_provider(builder, symbol, settings, options)
         end
         included do
@@ -144,10 +175,8 @@ module Panda
               next if symbol == :developer && !Rails.env.development?
-              # Skip providers without credentials (except developer which doesn't need them)
-              has_credentials = settings[:client_id].present? && settings[:client_secret].present?
-              if symbol != :developer && !has_credentials
-                Rails.logger.info("[panda-core] Skipping OmniAuth provider #{name.inspect}: missing client_id or client_secret") if defined?(Rails.logger)
+              unless OmniauthConfig.credentials_configured?(symbol, settings)
+                Rails.logger.info("[panda-core] Skipping OmniAuth provider #{name.inspect}: missing credentials") if defined?(Rails.logger)
                 next
               end
@@ -166,11 +195,7 @@ module Panda
                 }
               end
-              if settings[:client_id] && settings[:client_secret]
-                builder.provider symbol, settings[:client_id], settings[:client_secret], options
-              else
-                builder.provider symbol, options
-              end
+              OmniauthConfig.register_provider(builder, symbol, settings, options)
             end
           end
         end