@fonderie/auth 7.1.1 → 7.3.0

package/dist/index.d.cts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.cjs';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-6B77MAFn.cjs';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-6B77MAFn.cjs';
+import { I as IAuthConfig } from './session-Dc5-JNoW.cjs';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dc5-JNoW.cjs';
 export { IUserDTO, toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -101,6 +101,10 @@ declare const loginSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
     phone: z.ZodString;
 }, z.core.$strip>]>;
+declare const appleNativeSchema: z.ZodObject<{
+    identityToken: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const refreshSchema: z.ZodObject<{
     refreshToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -157,6 +161,7 @@ type schemas_ChangePasswordInput = ChangePasswordInput;
 type schemas_LoginInput = LoginInput;
 type schemas_RegisterInput = RegisterInput;
 type schemas_ResetPasswordInput = ResetPasswordInput;
+declare const schemas_appleNativeSchema: typeof appleNativeSchema;
 declare const schemas_changePasswordSchema: typeof changePasswordSchema;
 declare const schemas_forgotPasswordSchema: typeof forgotPasswordSchema;
 declare const schemas_loginSchema: typeof loginSchema;
@@ -170,7 +175,7 @@ declare const schemas_updatePreferencesSchema: typeof updatePreferencesSchema;
 declare const schemas_updateProfileSchema: typeof updateProfileSchema;
 declare const schemas_verifySchema: typeof verifySchema;
 declare namespace schemas {
-  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
+  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
 }
 
 declare function normalizeEmail(email: string): string;

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { IMfaChallenge, ISession, IUser } from './types.js';
 import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
-import { I as IAuthConfig } from './session-6B77MAFn.js';
-export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-6B77MAFn.js';
+import { I as IAuthConfig } from './session-Dc5-JNoW.js';
+export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Dc5-JNoW.js';
 export { IUserDTO, toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
@@ -101,6 +101,10 @@ declare const loginSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
     phone: z.ZodString;
 }, z.core.$strip>]>;
+declare const appleNativeSchema: z.ZodObject<{
+    identityToken: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const refreshSchema: z.ZodObject<{
     refreshToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -157,6 +161,7 @@ type schemas_ChangePasswordInput = ChangePasswordInput;
 type schemas_LoginInput = LoginInput;
 type schemas_RegisterInput = RegisterInput;
 type schemas_ResetPasswordInput = ResetPasswordInput;
+declare const schemas_appleNativeSchema: typeof appleNativeSchema;
 declare const schemas_changePasswordSchema: typeof changePasswordSchema;
 declare const schemas_forgotPasswordSchema: typeof forgotPasswordSchema;
 declare const schemas_loginSchema: typeof loginSchema;
@@ -170,7 +175,7 @@ declare const schemas_updatePreferencesSchema: typeof updatePreferencesSchema;
 declare const schemas_updateProfileSchema: typeof updateProfileSchema;
 declare const schemas_verifySchema: typeof verifySchema;
 declare namespace schemas {
-  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
+  export { type schemas_ChangePasswordInput as ChangePasswordInput, type schemas_LoginInput as LoginInput, type schemas_RegisterInput as RegisterInput, type schemas_ResetPasswordInput as ResetPasswordInput, schemas_appleNativeSchema as appleNativeSchema, schemas_changePasswordSchema as changePasswordSchema, schemas_forgotPasswordSchema as forgotPasswordSchema, schemas_loginSchema as loginSchema, schemas_mfaTokenSchema as mfaTokenSchema, schemas_refreshSchema as refreshSchema, schemas_registerSchema as registerSchema, schemas_resetPasswordSchema as resetPasswordSchema, schemas_updateEmailSchema as updateEmailSchema, schemas_updatePhoneSchema as updatePhoneSchema, schemas_updatePreferencesSchema as updatePreferencesSchema, schemas_updateProfileSchema as updateProfileSchema, schemas_verifySchema as verifySchema };
 }
 
 declare function normalizeEmail(email: string): string;

package/dist/index.js

@@ -128,6 +128,7 @@ function buildAuthAccountLimiter(route, store, config) {
 // src/schemas.ts
 var schemas_exports = {};
 __export(schemas_exports, {
+  appleNativeSchema: () => appleNativeSchema,
   changePasswordSchema: () => changePasswordSchema,
   forgotPasswordSchema: () => forgotPasswordSchema,
   loginSchema: () => loginSchema,
@@ -159,6 +160,12 @@ var loginSchema = z.union([
   z.object({ email, password: z.string().min(1).max(128) }),
   z.object({ phone })
 ]);
+var appleNativeSchema = z.object({
+  identityToken: z.string().min(1).max(8192),
+  // Optional nonce the app bound to the native request; when present we check
+  // it against the token's `nonce` claim to defend against replay.
+  nonce: z.string().max(256).optional()
+});
 var refreshSchema = z.object({ refreshToken: z.string().min(1).optional() });
 var forgotPasswordSchema = z.object({ email });
 var resetPasswordSchema = z.union([
@@ -689,7 +696,8 @@ var UserModel = class {
       `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
 			VALUES ($1, now(), $2, $3)
 			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3
+			SET provider = $2, provider_id = $3,
+			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
 			RETURNING id`,
       [email2, provider, providerId]
     );
@@ -2254,12 +2262,170 @@ function userController(store, config, bus) {
 }
 
 // src/controllers/oauth.controller.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes4, createPublicKey, createHash as createHash2 } from "crypto";
+import jwt2 from "jsonwebtoken";
 import { setApiResponse as setApiResponse5, HTTP as HTTP5, constantTimeEqual as constantTimeEqual2 } from "@fonderie/core";
+
+// src/models/consumed-token.model.ts
+var ConsumedTokenModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  // True if the token had not been consumed before (caller may proceed); false
+  // if this is a replay. `expiresAt` is the token's own exp — its TTL here.
+  async consumeOnce(tokenHash, expiresAt) {
+    const rows = await this.store.query(
+      `INSERT INTO fonderie_consumed_tokens (token_hash, expires_at)
+			 VALUES ($1, $2)
+			 ON CONFLICT (token_hash) DO NOTHING
+			 RETURNING token_hash`,
+      [tokenHash, expiresAt]
+    );
+    return rows.length > 0;
+  }
+  // Opportunistic, fire-and-forget cleanup of expired rows (index-backed).
+  // Recording history must never block or fail a login.
+  sweepExpiredSafe() {
+    void this.store.query(`DELETE FROM fonderie_consumed_tokens WHERE expires_at < now()`).catch(() => {
+    });
+  }
+};
+
+// src/controllers/oauth.controller.ts
+var APPLE_AUTH_URL = "https://appleid.apple.com/auth/authorize";
+var APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
+var APPLE_KEYS_URL = "https://appleid.apple.com/auth/keys";
+var APPLE_ISSUER = "https://appleid.apple.com";
+function mintAppleClientSecret(apple) {
+  const now = Math.floor(Date.now() / 1e3);
+  return jwt2.sign(
+    { iss: apple.teamId, iat: now, exp: now + 300, aud: APPLE_ISSUER, sub: apple.clientId },
+    apple.privateKey,
+    { algorithm: "ES256", keyid: apple.keyId }
+  );
+}
+var appleKeyCache = null;
+var appleKeyInflight = null;
+var appleKeyLastAttempt = 0;
+var APPLE_KEYS_TTL_MS = 60 * 60 * 1e3;
+var APPLE_KEYS_MIN_REFETCH_MS = 60 * 1e3;
+var APPLE_KEYS_FETCH_TIMEOUT_MS = 5e3;
+function refreshAppleKeys() {
+  if (appleKeyInflight) return appleKeyInflight;
+  appleKeyLastAttempt = Date.now();
+  appleKeyInflight = (async () => {
+    try {
+      const res = await fetch(APPLE_KEYS_URL, { signal: AbortSignal.timeout(APPLE_KEYS_FETCH_TIMEOUT_MS) });
+      const data = await res.json();
+      if (Array.isArray(data.keys)) appleKeyCache = { keys: data.keys, fetchedAt: Date.now() };
+    } catch {
+    } finally {
+      appleKeyInflight = null;
+    }
+  })();
+  return appleKeyInflight;
+}
+async function getApplePublicKey(kid) {
+  const find = () => appleKeyCache?.keys.find((k) => k.kid === kid) ?? null;
+  const cacheFresh = () => !!appleKeyCache && Date.now() - appleKeyCache.fetchedAt < APPLE_KEYS_TTL_MS;
+  let jwk = find();
+  if ((!jwk || !cacheFresh()) && Date.now() - appleKeyLastAttempt >= APPLE_KEYS_MIN_REFETCH_MS) {
+    await refreshAppleKeys();
+    jwk = find();
+  }
+  if (!jwk) return null;
+  try {
+    return createPublicKey({ key: jwk, format: "jwk" });
+  } catch {
+    return null;
+  }
+}
+async function verifyAppleIdToken(idToken, opts) {
+  if (opts.audiences.length === 0) return null;
+  const decoded = jwt2.decode(idToken, { complete: true });
+  if (!decoded || typeof decoded === "string") return null;
+  const kid = decoded.header.kid;
+  if (!kid) return null;
+  const key = await getApplePublicKey(kid);
+  if (!key) return null;
+  try {
+    const payload = jwt2.verify(idToken, key, {
+      algorithms: ["RS256"],
+      issuer: APPLE_ISSUER,
+      // jsonwebtoken types `audience` as a non-empty tuple; runtime accepts a
+      // list and matches the token's aud against ANY entry (guarded non-empty
+      // above).
+      audience: opts.audiences
+    });
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
 function oauthController(store, config) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
+  const consumedTokens = new ConsumedTokenModel(store);
+  const completeAppleLogin = async (ctx, claims) => {
+    const meta = requestMeta(ctx);
+    if (!claims.email) {
+      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "No email in Apple identity token");
+    }
+    if (!claims.emailVerified) {
+      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Apple account email is not verified");
+    }
+    const normalizedEmail = normalizeEmailSafe(claims.email);
+    if (!normalizedEmail) {
+      return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid email in Apple identity token");
+    }
+    const upserted = await users.upsertByProvider(normalizedEmail, "apple", claims.sub ?? "");
+    if (!upserted) {
+      loginEvents.recordSafe({
+        userId: null,
+        emailAttempted: normalizedEmail,
+        method: "oauth-apple",
+        outcome: "failed",
+        failureReason: "provider_upsert_failed",
+        ...meta
+      });
+      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+    }
+    const fullUser = await users.findById(upserted.id);
+    if (!fullUser) {
+      return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
+    }
+    const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
+    await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
+    loginEvents.recordSafe({
+      userId: upserted.id,
+      emailAttempted: normalizedEmail,
+      method: "oauth-apple",
+      outcome: "success",
+      ...meta
+    });
+    return Response.json(
+      {
+        reason: "APPLE_AUTH_SUCCESS",
+        explanation: "Apple authentication successful.",
+        result: {
+          tokens: { access: accessToken, refresh: refreshToken },
+          user: toUserDTO(fullUser)
+        }
+      },
+      {
+        status: 200,
+        headers: cookieHeaders([
+          ...tokenPairCookies(accessToken, refreshToken, config),
+          // One-time value — clear the (SameSite=None) state cookie.
+          "oauth_state=; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=0"
+        ])
+      }
+    );
+  };
   return {
     googleInit: async (_ctx) => {
       const google = config.google;
@@ -2411,6 +2577,133 @@ function oauthController(store, config) {
           ])
         }
       );
+    },
+    appleInit: async (_ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const state = randomBytes4(16).toString("hex");
+      const params = new URLSearchParams({
+        client_id: apple.clientId,
+        redirect_uri: apple.redirectUri,
+        response_type: "code",
+        // form_post is REQUIRED to receive name/email; Apple then POSTs the
+        // callback cross-site.
+        response_mode: "form_post",
+        scope: "name email",
+        state
+      });
+      const url = `${APPLE_AUTH_URL}?${params}`;
+      return Response.json(
+        {
+          reason: "APPLE_AUTH_URL",
+          explanation: "Redirect the user to the returned URL to begin Apple OAuth.",
+          result: { url }
+        },
+        {
+          status: 200,
+          headers: cookieHeaders([
+            `oauth_state=${state}; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=600`
+          ])
+        }
+      );
+    },
+    appleCallback: async (ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const pre = ctx.meta["body"];
+      const form = pre && typeof pre === "object" ? new URLSearchParams(pre) : new URLSearchParams(await ctx.request.text());
+      const code = form.get("code");
+      if (!code) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing code");
+      }
+      const returnedState = form.get("state") ?? "";
+      const cookieHeader = ctx.request.headers.get("cookie") ?? "";
+      const expectedState = cookieHeader.match(/(?:^|;\s*)oauth_state=([^;]+)/)?.[1] ?? "";
+      if (!returnedState || !expectedState || !constantTimeEqual2(Buffer.from(returnedState), Buffer.from(expectedState))) {
+        return setApiResponse5(
+          HTTP5.BAD_REQUEST,
+          "APPLE_AUTH_FAILED",
+          "OAuth state mismatch \u2014 restart the sign-in flow"
+        );
+      }
+      const tokenRes = await fetch(APPLE_TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: apple.clientId,
+          client_secret: mintAppleClientSecret(apple),
+          redirect_uri: apple.redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+      const tokenData = await tokenRes.json();
+      if (!tokenData.id_token) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "OAuth token exchange failed");
+      }
+      const claims = await verifyAppleIdToken(tokenData.id_token, { audiences: [apple.clientId] });
+      if (!claims) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+      }
+      return completeAppleLogin(ctx, {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: appleEmailVerified(claims)
+      });
+    },
+    appleNative: async (ctx) => {
+      const apple = config.apple;
+      if (!apple) {
+        return setApiResponse5(HTTP5.NOT_IMPLEMENTED, "NOT_CONFIGURED", "Apple OAuth not configured");
+      }
+      const body = ctx.meta["body"];
+      const identityToken = body?.identityToken;
+      if (!identityToken) {
+        return setApiResponse5(HTTP5.BAD_REQUEST, "INVALID_PARAMETER", "Missing identityToken");
+      }
+      const audiences = apple.nativeClientIds && apple.nativeClientIds.length ? apple.nativeClientIds : [apple.clientId];
+      const claims = await verifyAppleIdToken(identityToken, { audiences, nonce: body?.nonce });
+      if (!claims) {
+        const meta = requestMeta(ctx);
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: null,
+          method: "oauth-apple",
+          outcome: "failed",
+          failureReason: "invalid_identity_token",
+          ...meta
+        });
+        return setApiResponse5(HTTP5.UNAUTHORIZED, "APPLE_AUTH_FAILED", "Invalid Apple identity token");
+      }
+      const tokenHash = createHash2("sha256").update(identityToken).digest("hex");
+      const expMs = typeof claims.exp === "number" ? claims.exp * 1e3 : Date.now() + 5 * 60 * 1e3;
+      const firstUse = await consumedTokens.consumeOnce(tokenHash, new Date(expMs));
+      if (!firstUse) {
+        const meta = requestMeta(ctx);
+        loginEvents.recordSafe({
+          userId: null,
+          emailAttempted: claims.email ?? null,
+          method: "oauth-apple",
+          outcome: "failed",
+          failureReason: "token_replayed",
+          ...meta
+        });
+        return setApiResponse5(
+          HTTP5.UNAUTHORIZED,
+          "APPLE_AUTH_FAILED",
+          "This Apple identity token has already been used"
+        );
+      }
+      consumedTokens.sweepExpiredSafe();
+      return completeAppleLogin(ctx, {
+        email: claims.email,
+        sub: claims.sub,
+        emailVerified: appleEmailVerified(claims)
+      });
     }
   };
 }
@@ -2477,7 +2770,21 @@ function buildAuthRoutes(store, config, bus) {
   if (config.providers.includes("google")) {
     routes.push(
       ["GET", "/auth/google", oauth.googleInit],
-      ["GET", "/auth/google/callback", oauth.googleCallback]
+      // ipLimit: an unauthenticated caller can otherwise force one outbound
+      // token-exchange to Google per request (the state check doesn't gate it).
+      ["GET", "/auth/google/callback", ipLimit("login"), oauth.googleCallback]
+    );
+  }
+  if (config.providers.includes("apple")) {
+    routes.push(
+      // Web redirect flow. The callback is a POST (response_mode=form_post);
+      // its urlencoded body is parsed inside the controller. ipLimit for the
+      // same reason as Google's callback (bounds outbound token exchanges).
+      ["GET", "/auth/apple", oauth.appleInit],
+      ["POST", "/auth/apple/callback", ipLimit("login"), oauth.appleCallback],
+      // Native (iOS) flow: the app posts the identityToken from the Apple
+      // sheet. ipLimit guards token brute-forcing; validate bounds the body.
+      ["POST", "/auth/apple/native", ipLimit("login"), validate(appleNativeSchema), oauth.appleNative]
     );
   }
   return routes;
@@ -2526,6 +2833,29 @@ function collectAuthConfigProblems(config) {
       });
     }
   }
+  if (config.apple) {
+    const a = config.apple;
+    if (!a.clientId || !a.teamId || !a.keyId || !a.privateKey || !a.redirectUri) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple OAuth is configured but clientId, teamId, keyId, privateKey, or redirectUri is missing"
+      });
+    } else if (!/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(a.privateKey)) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple.privateKey does not look like a PEM .p8 key (expected `-----BEGIN PRIVATE KEY-----`)"
+      });
+    }
+    if (a.nativeClientIds?.some((id) => !id || id.trim() === "" || id.includes("*"))) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "apple.nativeClientIds must be exact bundle ids \u2014 empty or wildcard entries would accept identity tokens minted for other apps"
+      });
+    }
+  }
   if (config.mfa && !config.mfaSecretKey) {
     problems.push({
       module: MODULE,