@capgo/capacitor-social-login 7.9.5 → 7.11.0

package/README.md

@@ -509,7 +509,7 @@ Execute provider-specific calls
 | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`facebook`** | <code>{ appId: string; clientToken?: string; locale?: string; }</code>                                                                                              |
 | **`google`**   | <code>{ iOSClientId?: string; iOSServerClientId?: string; webClientId?: string; mode?: 'online' \| 'offline'; hostedDomain?: string; redirectUrl?: string; }</code> |
-| **`apple`**    | <code>{ clientId?: string; redirectUrl?: string; }</code>                                                                                                           |
+| **`apple`**    | <code>{ clientId?: string; redirectUrl?: string; useProperTokenExchange?: boolean; useBroadcastChannel?: boolean; }</code>                                          |
 
 
 #### FacebookLoginResponse
@@ -556,11 +556,12 @@ Execute provider-specific calls
 
 #### AppleProviderResponse
 
-| Prop              | Type                                                                                                         |
-| ----------------- | ------------------------------------------------------------------------------------------------------------ |
-| **`accessToken`** | <code><a href="#accesstoken">AccessToken</a> \| null</code>                                                  |
-| **`idToken`**     | <code>string \| null</code>                                                                                  |
-| **`profile`**     | <code>{ user: string; email: string \| null; givenName: string \| null; familyName: string \| null; }</code> |
+| Prop                    | Type                                                                                                         | Description                                                                           |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
+| **`accessToken`**       | <code><a href="#accesstoken">AccessToken</a> \| null</code>                                                  | Access token from Apple                                                               |
+| **`idToken`**           | <code>string \| null</code>                                                                                  | Identity token (JWT) from Apple                                                       |
+| **`profile`**           | <code>{ user: string; email: string \| null; givenName: string \| null; familyName: string \| null; }</code> | User profile information                                                              |
+| **`authorizationCode`** | <code>string</code>                                                                                          | Authorization code for proper token exchange (when useProperTokenExchange is enabled) |
 
 
 #### FacebookLoginOptions
@@ -587,11 +588,12 @@ Execute provider-specific calls
 
 #### AppleProviderOptions
 
-| Prop         | Type                  | Description |
-| ------------ | --------------------- | ----------- |
-| **`scopes`** | <code>string[]</code> | Scopes      |
-| **`nonce`**  | <code>string</code>   | Nonce       |
-| **`state`**  | <code>string</code>   | State       |
+| Prop                      | Type                  | Description                                   | Default            |
+| ------------------------- | --------------------- | --------------------------------------------- | ------------------ |
+| **`scopes`**              | <code>string[]</code> | Scopes                                        |                    |
+| **`nonce`**               | <code>string</code>   | Nonce                                         |                    |
+| **`state`**               | <code>string</code>   | State                                         |                    |
+| **`useBroadcastChannel`** | <code>boolean</code>  | Use Broadcast Channel for authentication flow | <code>false</code> |
 
 
 #### isLoggedInOptions

package/android/src/main/java/ee/forgr/capacitor/social/login/AppleProvider.java

@@ -17,7 +17,10 @@ import android.view.View;
 import android.view.ViewGroup;
 import android.view.Window;
 import android.view.WindowManager;
+import android.webkit.ConsoleMessage;
+import android.webkit.WebChromeClient;
 import android.webkit.WebResourceRequest;
+import android.webkit.WebSettings;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
 import android.widget.ImageButton;
@@ -68,6 +71,8 @@ public class AppleProvider implements SocialProvider {
     private final String redirectUrl;
     private final Activity activity;
     private final Context context;
+    private final boolean useProperTokenExchange;
+    private final boolean useBroadcastChannel;
 
     private CustomTabsClient customTabsClient;
     private CustomTabsSession currentSession;
@@ -82,11 +87,20 @@ public class AppleProvider implements SocialProvider {
         public void onServiceDisconnected(ComponentName name) {}
     };
 
-    public AppleProvider(String redirectUrl, String clientId, Activity activity, Context context) {
+    public AppleProvider(
+        String redirectUrl,
+        String clientId,
+        Activity activity,
+        Context context,
+        boolean useProperTokenExchange,
+        boolean useBroadcastChannel
+    ) {
         this.redirectUrl = redirectUrl;
         this.clientId = clientId;
         this.activity = activity;
         this.context = context;
+        this.useProperTokenExchange = useProperTokenExchange;
+        this.useBroadcastChannel = useBroadcastChannel;
     }
 
     public void initialize() {
@@ -136,6 +150,72 @@ public class AppleProvider implements SocialProvider {
             call.reject("Last call is not null");
         }
 
+        // Check if Broadcast Channel is enabled
+        boolean useBroadcastChannel = config.optBoolean("useBroadcastChannel", this.useBroadcastChannel);
+
+        if (useBroadcastChannel) {
+            // Use Broadcast Channel approach - simplified flow
+            loginWithBroadcastChannel(call, config);
+        } else {
+            // Use traditional URL redirect approach
+            loginWithRedirect(call, config);
+        }
+    }
+
+    private void loginWithBroadcastChannel(PluginCall call, JSONObject config) {
+        String state = UUID.randomUUID().toString();
+
+        // Extract scopes from config
+        String scopes = DEFAULT_SCOPE;
+        if (config.has("scopes")) {
+            try {
+                JSONArray scopesArray = config.getJSONArray("scopes");
+                if (scopesArray.length() > 0) {
+                    scopes = String.join("%20", toStringArray(scopesArray));
+                }
+            } catch (JSONException e) {
+                Log.e(SocialLoginPlugin.LOG_TAG, "Error parsing scopes", e);
+            }
+        }
+
+        String nonce = null;
+        if (config.has("nonce")) {
+            try {
+                nonce = config.getString("nonce");
+            } catch (JSONException e) {
+                Log.e(SocialLoginPlugin.LOG_TAG, "Error parsing nonce", e);
+            }
+        }
+
+        // For Broadcast Channel, we use a special redirect URI that handles the channel communication
+        String broadcastRedirectUri = "https://capacitor-social-login.firebaseapp.com/__/auth/handler";
+
+        this.appleAuthURLFull =
+            AUTHURL +
+            "?client_id=" +
+            this.clientId +
+            "&redirect_uri=" +
+            broadcastRedirectUri +
+            "&response_type=code&scope=" +
+            scopes +
+            "&response_mode=form_post&state=" +
+            state;
+
+        if (nonce != null) {
+            this.appleAuthURLFull += "&nonce=" + nonce;
+        }
+
+        if (context == null || activity == null) {
+            call.reject("Context or Activity is null");
+            return;
+        }
+
+        this.lastcall = call;
+        call.setKeepAlive(true);
+        activity.runOnUiThread(() -> setupBroadcastChannelWebview(context, activity, call, appleAuthURLFull));
+    }
+
+    private void loginWithRedirect(PluginCall call, JSONObject config) {
         String state = UUID.randomUUID().toString();
 
         // Extract scopes from config
@@ -235,6 +315,7 @@ public class AppleProvider implements SocialProvider {
         if ("true".equals(success)) {
             String accessToken = uri.getQueryParameter("access_token");
             if (accessToken != null) {
+                // We have proper tokens from the backend
                 String refreshToken = uri.getQueryParameter("refresh_token");
                 String idToken = uri.getQueryParameter("id_token");
                 try {
@@ -244,6 +325,11 @@ public class AppleProvider implements SocialProvider {
                     result.put("profile", createProfileObject(idToken));
                     result.put("idToken", idToken);
 
+                    // For proper token exchange mode, don't include authorization code
+                    if (!useProperTokenExchange) {
+                        result.put("authorizationCode", (String) null);
+                    }
+
                     JSObject response = new JSObject();
                     response.put("provider", "apple");
                     response.put("result", result);
@@ -254,9 +340,18 @@ public class AppleProvider implements SocialProvider {
                     this.lastcall.reject("Cannot persist state", e);
                 }
             } else {
+                // We only have authorization code, need to exchange it
                 String appleAuthCode = uri.getQueryParameter("code");
                 String appleClientSecret = uri.getQueryParameter("client_secret");
-                requestForAccessToken(appleAuthCode, appleClientSecret);
+
+                if (useProperTokenExchange) {
+                    // In proper token exchange mode, we should have received proper tokens
+                    // from the backend. If we only got an auth code, reject the call.
+                    this.lastcall.reject("Expected proper tokens from backend but received authorization code only");
+                } else {
+                    // Legacy mode: exchange the authorization code for tokens
+                    requestForAccessToken(appleAuthCode, appleClientSecret);
+                }
             }
         } else {
             this.lastcall.reject("We couldn't get the Auth Code");
@@ -298,9 +393,21 @@ public class AppleProvider implements SocialProvider {
                             String idToken = jsonObject.getString("id_token");
 
                             persistState(idToken, refreshToken, accessToken);
-                            AppleProvider.this.lastcall.resolve(
-                                    new JSObject().put("provider", "apple").put("result", new JSObject().put("identityToken", idToken))
-                                );
+
+                            // Create proper response with all tokens
+                            JSObject result = new JSObject();
+                            result.put("accessToken", createAccessTokenObject(accessToken));
+                            result.put("profile", createProfileObject(idToken));
+                            result.put("idToken", idToken);
+
+                            // For legacy mode, we don't include authorization code in the response
+                            // since we've already exchanged it for proper tokens
+
+                            JSObject appleResponse = new JSObject();
+                            appleResponse.put("provider", "apple");
+                            appleResponse.put("result", result);
+
+                            AppleProvider.this.lastcall.resolve(appleResponse);
                             AppleProvider.this.lastcall = null;
                         } catch (Exception e) {
                             AppleProvider.this.lastcall.reject("Cannot get access_token", e);
@@ -348,6 +455,220 @@ public class AppleProvider implements SocialProvider {
         builder.build().launchUrl(context, Uri.parse(url));
     }
 
+    @SuppressLint("SetJavaScriptEnabled")
+    private void setupBroadcastChannelWebview(Context context, Activity activity, PluginCall call, String url) {
+        // Create a custom WebView with Broadcast Channel support
+        Dialog dialog = new Dialog(activity);
+        dialog.requestWindowFeature(Window.FEATURE_NO_TITLE);
+        dialog.setCancelable(true);
+        dialog.getWindow().setBackgroundDrawable(new ColorDrawable(Color.TRANSPARENT));
+
+        WebView webView = new WebView(context);
+        webView.setLayoutParams(new ViewGroup.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.MATCH_PARENT));
+
+        // Enable JavaScript
+        WebSettings webSettings = webView.getSettings();
+        webSettings.setJavaScriptEnabled(true);
+        webSettings.setDomStorageEnabled(true);
+        webSettings.setSupportMultipleWindows(false);
+
+        // Set up Broadcast Channel communication
+        webView.addJavascriptInterface(new BroadcastChannelInterface(call), "AndroidBridge");
+
+        // Set up WebViewClient to handle redirects
+        webView.setWebViewClient(
+            new WebViewClient() {
+                @Override
+                public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request) {
+                    String url = request.getUrl().toString();
+
+                    // Check if this is the Broadcast Channel redirect
+                    if (url.contains("capacitor-social-login.firebaseapp.com")) {
+                        // Extract authorization code from URL parameters
+                        Uri uri = Uri.parse(url);
+                        String success = uri.getQueryParameter("success");
+
+                        if ("true".equals(success)) {
+                            String accessToken = uri.getQueryParameter("access_token");
+                            if (accessToken != null) {
+                                // We have proper tokens from the backend
+                                String refreshToken = uri.getQueryParameter("refresh_token");
+                                String idToken = uri.getQueryParameter("id_token");
+                                try {
+                                    persistState(idToken, refreshToken, accessToken);
+                                    JSObject result = new JSObject();
+                                    result.put("accessToken", createAccessTokenObject(accessToken));
+                                    result.put("profile", createProfileObject(idToken));
+                                    result.put("idToken", idToken);
+
+                                    JSObject response = new JSObject();
+                                    response.put("provider", "apple");
+                                    response.put("result", result);
+
+                                    lastcall.resolve(response);
+                                } catch (JSONException e) {
+                                    Log.e(SocialLoginPlugin.LOG_TAG, "Cannot persist state", e);
+                                    lastcall.reject("Cannot persist state", e);
+                                }
+                            } else {
+                                // We only have authorization code, need to handle it
+                                String appleAuthCode = uri.getQueryParameter("code");
+                                String appleClientSecret = uri.getQueryParameter("client_secret");
+
+                                if (useProperTokenExchange) {
+                                    // For Broadcast Channel, we can handle the token exchange directly
+                                    // or pass the authorization code back to the client
+                                    JSObject result = new JSObject();
+                                    result.put("authorizationCode", appleAuthCode);
+                                    result.put("idToken", ""); // Will be filled by client-side token exchange
+
+                                    JSObject response = new JSObject();
+                                    response.put("provider", "apple");
+                                    response.put("result", result);
+
+                                    lastcall.resolve(response);
+                                } else {
+                                    // Legacy mode: use authorization code as access token
+                                    JSObject result = new JSObject();
+                                    result.put("accessToken", createAccessTokenObject(appleAuthCode));
+                                    result.put("profile", createProfileObject(""));
+                                    result.put("idToken", "");
+
+                                    JSObject response = new JSObject();
+                                    response.put("provider", "apple");
+                                    response.put("result", result);
+
+                                    lastcall.resolve(response);
+                                }
+                            }
+                        } else {
+                            lastcall.reject("Authentication failed");
+                        }
+
+                        dialog.dismiss();
+                        lastcall = null;
+                        return true;
+                    }
+
+                    return super.shouldOverrideUrlLoading(view, request);
+                }
+            }
+        );
+
+        // Inject Broadcast Channel polyfill and setup
+        webView.setWebChromeClient(
+            new WebChromeClient() {
+                @Override
+                public boolean onConsoleMessage(ConsoleMessage consoleMessage) {
+                    Log.d("WebView", consoleMessage.message());
+                    return super.onConsoleMessage(consoleMessage);
+                }
+            }
+        );
+
+        dialog.setContentView(webView);
+
+        // Set dialog to fullscreen
+        WindowManager.LayoutParams lp = new WindowManager.LayoutParams();
+        lp.copyFrom(dialog.getWindow().getAttributes());
+        lp.width = WindowManager.LayoutParams.MATCH_PARENT;
+        lp.height = WindowManager.LayoutParams.MATCH_PARENT;
+        dialog.getWindow().setAttributes(lp);
+
+        // Load the Apple authentication URL
+        webView.loadUrl(url);
+
+        // Inject Broadcast Channel setup after page loads
+        webView.setWebViewClient(
+            new WebViewClient() {
+                @Override
+                public void onPageFinished(WebView view, String url) {
+                    super.onPageFinished(view, url);
+
+                    // Inject Broadcast Channel setup
+                    String broadcastChannelScript =
+                        "javascript:" +
+                        "if (!window.BroadcastChannel) {" +
+                        "  window.BroadcastChannel = function(name) {" +
+                        "    this.name = name;" +
+                        "    this.onmessage = null;" +
+                        "    this.postMessage = function(data) {" +
+                        "      if (window.AndroidBridge) {" +
+                        "        window.AndroidBridge.postMessage(JSON.stringify({channel: this.name, data: data}));" +
+                        "      }" +
+                        "    };" +
+                        "    window.addEventListener('message', (event) => {" +
+                        "      if (this.onmessage) {" +
+                        "        this.onmessage({data: event.data});" +
+                        "      }" +
+                        "    });" +
+                        "  };" +
+                        "}" +
+                        "console.log('Broadcast Channel polyfill loaded');";
+
+                    view.evaluateJavascript(broadcastChannelScript, null);
+                }
+            }
+        );
+
+        dialog.show();
+    }
+
+    // JavaScript interface for Broadcast Channel communication
+    private class BroadcastChannelInterface {
+
+        private final PluginCall call;
+
+        BroadcastChannelInterface(PluginCall call) {
+            this.call = call;
+        }
+
+        @android.webkit.JavascriptInterface
+        public void postMessage(String message) {
+            try {
+                JSONObject data = new JSONObject(message);
+                String channel = data.getString("channel");
+                JSONObject messageData = data.getJSONObject("data");
+
+                Log.d("BroadcastChannel", "Received message from channel: " + channel);
+                Log.d("BroadcastChannel", "Message data: " + messageData.toString());
+
+                // Handle authentication messages
+                if ("auth".equals(channel)) {
+                    String type = messageData.getString("type");
+                    if ("success".equals(type)) {
+                        // Handle successful authentication
+                        String idToken = messageData.optString("idToken", "");
+                        String accessToken = messageData.optString("accessToken", "");
+
+                        try {
+                            persistState(idToken, "refresh_token_placeholder", accessToken);
+                            JSObject result = new JSObject();
+                            result.put("accessToken", createAccessTokenObject(accessToken));
+                            result.put("profile", createProfileObject(idToken));
+                            result.put("idToken", idToken);
+
+                            JSObject response = new JSObject();
+                            response.put("provider", "apple");
+                            response.put("result", result);
+
+                            lastcall.resolve(response);
+                        } catch (JSONException e) {
+                            Log.e(SocialLoginPlugin.LOG_TAG, "Cannot create response", e);
+                            lastcall.reject("Cannot create response", e);
+                        }
+                    } else if ("error".equals(type)) {
+                        String error = messageData.optString("error", "Authentication failed");
+                        lastcall.reject(error);
+                    }
+                }
+            } catch (JSONException e) {
+                Log.e("BroadcastChannel", "Error parsing message", e);
+                lastcall.reject("Error parsing authentication message", e);
+            }
+        }
+    }
+
     private JSObject createAccessTokenObject(String accessToken) {
         JSObject tokenObject = new JSObject();
         tokenObject.put("token", accessToken);

package/android/src/main/java/ee/forgr/capacitor/social/login/SocialLoginPlugin.java

@@ -43,11 +43,16 @@ public class SocialLoginPlugin extends Plugin {
                 return;
             }
 
+            boolean useProperTokenExchange = apple.has("useProperTokenExchange") ? apple.getBool("useProperTokenExchange") : false;
+            boolean useBroadcastChannel = apple.has("useBroadcastChannel") ? apple.getBool("useBroadcastChannel") : false;
+
             AppleProvider appleProvider = new AppleProvider(
                 androidAppleRedirect,
                 androidAppleClientId,
                 this.getActivity(),
-                this.getContext()
+                this.getContext(),
+                useProperTokenExchange,
+                useBroadcastChannel
             );
 
             appleProvider.initialize();

package/dist/docs.json

@@ -201,7 +201,7 @@
           "tags": [],
           "docs": "",
           "complexTypes": [],
-          "type": "{ clientId?: string | undefined; redirectUrl?: string | undefined; } | undefined"
+          "type": "{ clientId?: string | undefined; redirectUrl?: string | undefined; useProperTokenExchange?: boolean | undefined; useBroadcastChannel?: boolean | undefined; } | undefined"
         }
       ]
     },
@@ -380,8 +380,13 @@
       "properties": [
         {
           "name": "accessToken",
-          "tags": [],
-          "docs": "",
+          "tags": [
+            {
+              "text": "Content depends on `useProperTokenExchange` setting:\n- When `useProperTokenExchange: true`: Real access token from Apple (~1 hour validity)\n- When `useProperTokenExchange: false`: Contains authorization code as token (legacy mode)\nUse `idToken` for user authentication, `accessToken` for API calls when properly exchanged.",
+              "name": "description"
+            }
+          ],
+          "docs": "Access token from Apple",
           "complexTypes": [
             "AccessToken"
           ],
@@ -389,17 +394,43 @@
         },
         {
           "name": "idToken",
-          "tags": [],
-          "docs": "",
+          "tags": [
+            {
+              "text": "Always contains the JWT with user identity information including:\n- User ID (sub claim)\n- Email (if user granted permission)\n- Name components (if user granted permission)\n- Email verification status\nThis is the primary token for user authentication and should be verified on your backend.",
+              "name": "description"
+            }
+          ],
+          "docs": "Identity token (JWT) from Apple",
           "complexTypes": [],
           "type": "string | null"
         },
         {
           "name": "profile",
-          "tags": [],
-          "docs": "",
+          "tags": [
+            {
+              "text": "Basic user profile data extracted from the identity token and Apple response:\n- `user`: Apple's user identifier (sub claim from idToken)\n- `email`: User's email address (if permission granted)\n- `givenName`: User's first name (if permission granted)\n- `familyName`: User's last name (if permission granted)",
+              "name": "description"
+            }
+          ],
+          "docs": "User profile information",
           "complexTypes": [],
           "type": "{ user: string; email: string | null; givenName: string | null; familyName: string | null; }"
+        },
+        {
+          "name": "authorizationCode",
+          "tags": [
+            {
+              "text": "Only present when `useProperTokenExchange` is `true`. This code should be exchanged\nfor proper access tokens on your backend using Apple's token endpoint. Use this for secure\nserver-side token validation and to obtain refresh tokens.",
+              "name": "description"
+            },
+            {
+              "text": "https ://developer.apple.com/documentation/sign_in_with_apple/tokenresponse",
+              "name": "see"
+            }
+          ],
+          "docs": "Authorization code for proper token exchange (when useProperTokenExchange is enabled)",
+          "complexTypes": [],
+          "type": "string | undefined"
         }
       ]
     },
@@ -615,6 +646,22 @@
           "docs": "State",
           "complexTypes": [],
           "type": "string | undefined"
+        },
+        {
+          "name": "useBroadcastChannel",
+          "tags": [
+            {
+              "text": "When enabled, uses Broadcast Channel API for communication instead of URL redirects.\nOnly applicable on platforms that support Broadcast Channel (Android).",
+              "name": "description"
+            },
+            {
+              "text": "false",
+              "name": "default"
+            }
+          ],
+          "docs": "Use Broadcast Channel for authentication flow",
+          "complexTypes": [],
+          "type": "boolean | undefined"
         }
       ]
     },

package/dist/esm/apple-provider.d.ts

@@ -5,7 +5,8 @@ export declare class AppleSocialLogin extends BaseSocialLogin {
     private redirectUrl;
     private scriptLoaded;
     private scriptUrl;
-    initialize(clientId: string | null, redirectUrl: string | null | undefined): Promise<void>;
+    private useProperTokenExchange;
+    initialize(clientId: string | null, redirectUrl: string | null | undefined, useProperTokenExchange?: boolean): Promise<void>;
     login(options: AppleProviderOptions): Promise<LoginResult>;
     logout(): Promise<void>;
     isLoggedIn(): Promise<{

package/dist/esm/apple-provider.js

@@ -6,10 +6,12 @@ export class AppleSocialLogin extends BaseSocialLogin {
         this.redirectUrl = null;
         this.scriptLoaded = false;
         this.scriptUrl = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js';
+        this.useProperTokenExchange = false;
     }
-    async initialize(clientId, redirectUrl) {
+    async initialize(clientId, redirectUrl, useProperTokenExchange = false) {
         this.clientId = clientId;
         this.redirectUrl = redirectUrl || null;
+        this.useProperTokenExchange = useProperTokenExchange;
         if (clientId) {
             await this.loadAppleScript();
         }
@@ -35,18 +37,25 @@ export class AppleSocialLogin extends BaseSocialLogin {
                 .signIn()
                 .then((res) => {
                 var _a, _b, _c, _d, _e;
-                const result = {
-                    profile: {
+                let accessToken = null;
+                if (this.useProperTokenExchange) {
+                    // When using proper token exchange, the authorization code should be exchanged
+                    // for a proper access token on the backend. For now, we set accessToken to null
+                    // and provide the authorization code in a separate field for backend processing.
+                    accessToken = null;
+                }
+                else {
+                    // Legacy behavior: use authorization code as access token for backward compatibility
+                    accessToken = {
+                        token: res.authorization.code || '',
+                    };
+                }
+                const result = Object.assign({ profile: {
                         user: res.user || '',
                         email: ((_a = res.user) === null || _a === void 0 ? void 0 : _a.email) || null,
                         givenName: ((_c = (_b = res.user) === null || _b === void 0 ? void 0 : _b.name) === null || _c === void 0 ? void 0 : _c.firstName) || null,
                         familyName: ((_e = (_d = res.user) === null || _d === void 0 ? void 0 : _d.name) === null || _e === void 0 ? void 0 : _e.lastName) || null,
-                    },
-                    accessToken: {
-                        token: res.authorization.id_token || '',
-                    },
-                    idToken: res.authorization.code || null,
-                };
+                    }, accessToken: accessToken, idToken: res.authorization.id_token || null }, (this.useProperTokenExchange && { authorizationCode: res.authorization.code }));
                 resolve({ provider: 'apple', result });
             })
                 .catch((error) => {

package/dist/esm/apple-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple-provider.js","sourceRoot":"","sources":["../../src/apple-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKzC,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAArD;;QACU,aAAQ,GAAkB,IAAI,CAAC;QAC/B,gBAAW,GAAkB,IAAI,CAAC;QAClC,iBAAY,GAAG,KAAK,CAAC;QACrB,cAAS,GAAG,sFAAsF,CAAC;IAkF7G,CAAC;IAhFC,KAAK,CAAC,UAAU,CAAC,QAAuB,EAAE,WAAsC;QAC9E,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC;QAEvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;YACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,IAAI,CAAC,QAAS;gBACxB,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,IAAI,CAAC,GAAG,CAAC,KAAI,YAAY;gBAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACrD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI;iBACT,MAAM,EAAE;iBACR,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE;;gBACjB,MAAM,MAAM,GAA0B;oBACpC,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;wBACpB,KAAK,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,KAAK,KAAI,IAAI;wBAC9B,SAAS,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,SAAS,KAAI,IAAI;wBAC5C,UAAU,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,QAAQ,KAAI,IAAI;qBAC7C;oBACD,WAAW,EAAE;wBACX,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ,IAAI,EAAE;qBACxC;oBACD,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,IAAI;iBACxC,CAAC;gBACF,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,iDAAiD;QACjD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type { AppleProviderOptions, AppleProviderResponse, AuthorizationCode, LoginResult } from './definitions';\n\ndeclare const AppleID: any;\n\nexport class AppleSocialLogin extends BaseSocialLogin {\n  private clientId: string | null = null;\n  private redirectUrl: string | null = null;\n  private scriptLoaded = false;\n  private scriptUrl = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js';\n\n  async initialize(clientId: string | null, redirectUrl: string | null | undefined): Promise<void> {\n    this.clientId = clientId;\n    this.redirectUrl = redirectUrl || null;\n\n    if (clientId) {\n      await this.loadAppleScript();\n    }\n  }\n\n  async login(options: AppleProviderOptions): Promise<LoginResult> {\n    if (!this.clientId) {\n      throw new Error('Apple Client ID not set. Call initialize() first.');\n    }\n\n    if (!this.scriptLoaded) {\n      throw new Error('Apple Sign-In script not loaded.');\n    }\n\n    return new Promise((resolve, reject) => {\n      AppleID.auth.init({\n        clientId: this.clientId!,\n        scope: options.scopes?.join(' ') || 'name email',\n        redirectURI: this.redirectUrl || window.location.href,\n        state: options.state,\n        nonce: options.nonce,\n        usePopup: true,\n      });\n\n      AppleID.auth\n        .signIn()\n        .then((res: any) => {\n          const result: AppleProviderResponse = {\n            profile: {\n              user: res.user || '',\n              email: res.user?.email || null,\n              givenName: res.user?.name?.firstName || null,\n              familyName: res.user?.name?.lastName || null,\n            },\n            accessToken: {\n              token: res.authorization.id_token || '',\n            },\n            idToken: res.authorization.code || null,\n          };\n          resolve({ provider: 'apple', result });\n        })\n        .catch((error: any) => {\n          reject(error);\n        });\n    });\n  }\n\n  async logout(): Promise<void> {\n    // Apple doesn't provide a logout method for web\n    console.log('Apple logout: Session should be managed on the client side');\n  }\n\n  async isLoggedIn(): Promise<{ isLoggedIn: boolean }> {\n    // Apple doesn't provide a method to check login status on web\n    console.log('Apple login status should be managed on the client side');\n    return { isLoggedIn: false };\n  }\n\n  async getAuthorizationCode(): Promise<AuthorizationCode> {\n    // Apple authorization code should be obtained during login\n    console.log('Apple authorization code should be stored during login');\n    throw new Error('Apple authorization code not available');\n  }\n\n  async refresh(): Promise<void> {\n    // Apple doesn't provide a refresh method for web\n    console.log('Apple refresh not available on web');\n  }\n\n  private async loadAppleScript(): Promise<void> {\n    if (this.scriptLoaded) return;\n\n    return this.loadScript(this.scriptUrl).then(() => {\n      this.scriptLoaded = true;\n    });\n  }\n}\n"]}
+{"version":3,"file":"apple-provider.js","sourceRoot":"","sources":["../../src/apple-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKzC,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAArD;;QACU,aAAQ,GAAkB,IAAI,CAAC;QAC/B,gBAAW,GAAkB,IAAI,CAAC;QAClC,iBAAY,GAAG,KAAK,CAAC;QACrB,cAAS,GAAG,sFAAsF,CAAC;QACnG,2BAAsB,GAAG,KAAK,CAAC;IAqGzC,CAAC;IAnGC,KAAK,CAAC,UAAU,CACd,QAAuB,EACvB,WAAsC,EACtC,sBAAsB,GAAG,KAAK;QAE9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;YACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,IAAI,CAAC,QAAS;gBACxB,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,IAAI,CAAC,GAAG,CAAC,KAAI,YAAY;gBAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACrD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI;iBACT,MAAM,EAAE;iBACR,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE;;gBACjB,IAAI,WAAW,GAA6B,IAAI,CAAC;gBAEjD,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAChC,+EAA+E;oBAC/E,gFAAgF;oBAChF,iFAAiF;oBACjF,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,qFAAqF;oBACrF,WAAW,GAAG;wBACZ,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE;qBACpC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,mBACV,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;wBACpB,KAAK,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,KAAK,KAAI,IAAI;wBAC9B,SAAS,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,SAAS,KAAI,IAAI;wBAC5C,UAAU,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,QAAQ,KAAI,IAAI;qBAC7C,EACD,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ,IAAI,IAAI,IAExC,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAClF,CAAC;gBACF,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,iDAAiD;QACjD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type { AppleProviderOptions, AppleProviderResponse, AuthorizationCode, LoginResult } from './definitions';\n\ndeclare const AppleID: any;\n\nexport class AppleSocialLogin extends BaseSocialLogin {\n  private clientId: string | null = null;\n  private redirectUrl: string | null = null;\n  private scriptLoaded = false;\n  private scriptUrl = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js';\n  private useProperTokenExchange = false;\n\n  async initialize(\n    clientId: string | null,\n    redirectUrl: string | null | undefined,\n    useProperTokenExchange = false,\n  ): Promise<void> {\n    this.clientId = clientId;\n    this.redirectUrl = redirectUrl || null;\n    this.useProperTokenExchange = useProperTokenExchange;\n\n    if (clientId) {\n      await this.loadAppleScript();\n    }\n  }\n\n  async login(options: AppleProviderOptions): Promise<LoginResult> {\n    if (!this.clientId) {\n      throw new Error('Apple Client ID not set. Call initialize() first.');\n    }\n\n    if (!this.scriptLoaded) {\n      throw new Error('Apple Sign-In script not loaded.');\n    }\n\n    return new Promise((resolve, reject) => {\n      AppleID.auth.init({\n        clientId: this.clientId!,\n        scope: options.scopes?.join(' ') || 'name email',\n        redirectURI: this.redirectUrl || window.location.href,\n        state: options.state,\n        nonce: options.nonce,\n        usePopup: true,\n      });\n\n      AppleID.auth\n        .signIn()\n        .then((res: any) => {\n          let accessToken: { token: string } | null = null;\n\n          if (this.useProperTokenExchange) {\n            // When using proper token exchange, the authorization code should be exchanged\n            // for a proper access token on the backend. For now, we set accessToken to null\n            // and provide the authorization code in a separate field for backend processing.\n            accessToken = null;\n          } else {\n            // Legacy behavior: use authorization code as access token for backward compatibility\n            accessToken = {\n              token: res.authorization.code || '',\n            };\n          }\n\n          const result: AppleProviderResponse = {\n            profile: {\n              user: res.user || '',\n              email: res.user?.email || null,\n              givenName: res.user?.name?.firstName || null,\n              familyName: res.user?.name?.lastName || null,\n            },\n            accessToken: accessToken,\n            idToken: res.authorization.id_token || null,\n            // Add authorization code for proper token exchange when flag is enabled\n            ...(this.useProperTokenExchange && { authorizationCode: res.authorization.code }),\n          };\n          resolve({ provider: 'apple', result });\n        })\n        .catch((error: any) => {\n          reject(error);\n        });\n    });\n  }\n\n  async logout(): Promise<void> {\n    // Apple doesn't provide a logout method for web\n    console.log('Apple logout: Session should be managed on the client side');\n  }\n\n  async isLoggedIn(): Promise<{ isLoggedIn: boolean }> {\n    // Apple doesn't provide a method to check login status on web\n    console.log('Apple login status should be managed on the client side');\n    return { isLoggedIn: false };\n  }\n\n  async getAuthorizationCode(): Promise<AuthorizationCode> {\n    // Apple authorization code should be obtained during login\n    console.log('Apple authorization code should be stored during login');\n    throw new Error('Apple authorization code not available');\n  }\n\n  async refresh(): Promise<void> {\n    // Apple doesn't provide a refresh method for web\n    console.log('Apple refresh not available on web');\n  }\n\n  private async loadAppleScript(): Promise<void> {\n    if (this.scriptLoaded) return;\n\n    return this.loadScript(this.scriptUrl).then(() => {\n      this.scriptLoaded = true;\n    });\n  }\n}\n"]}