@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.4

package/src/apple-credentials/index.ts

@@ -0,0 +1,241 @@
+/**
+ * Headless helpers that turn an authenticated Apple relay session into
+ * signing credentials persisted in a SigningSecretStore. The Apple relay
+ * only proxies: certificate and profile bytes always land in the browser
+ * first, and the browser writes them into the configured store (Limrun's
+ * org secret store by default, or a customer-provided one).
+ */
+import {
+  createAppleCertificate,
+  downloadAppleCertificate,
+  downloadAppleProfile,
+  exportAppleCertificateP12,
+  generateAppleSigningKeyAndCSR,
+  listAppleCertificates,
+  listAppleProfiles,
+} from '../app-store-relay';
+import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
+import {
+  normalizeCertificateSerial,
+  parseProvisioningProfileBase64,
+} from '../core/device-install/storage/browser-storage';
+import {
+  APPLE_CERTIFICATE_SECRET_TYPE,
+  putAppleCertificateSecret,
+  putAppleProvisioningProfileSecret,
+  type AppleCertificateSecretData,
+  type AppleCertificateType,
+  type SigningSecret,
+  type SigningSecretStore,
+} from '../core/device-install/storage/secret-store';
+
+export {
+  APPLE_CERTIFICATE_SECRET_TYPE,
+  APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
+  createBrowserSecretStore,
+  createLimrunSecretStore,
+  putAppleCertificateSecret,
+  putAppleProvisioningProfileSecret,
+  type AppleCertificateSecretData,
+  type AppleCertificateType,
+  type AppleProvisioningProfileSecretData,
+  type LimrunSecretStoreOptions,
+  type SigningSecret,
+  type SigningSecretData,
+  type SigningSecretMetadata,
+  type SigningSecretStore,
+  type SigningSecretType,
+} from '../core/device-install/storage/secret-store';
+export { normalizeCertificateSerial } from '../core/device-install/storage/browser-storage';
+
+/**
+ * Conventional secret name of a team's certificate bundle. One bundle per
+ * team and Apple certificate type; the type is in the name so development
+ * and distribution material never collide.
+ */
+export function appleCertificateSecretName(teamId: string, certificateType: AppleCertificateType) {
+  return `${teamId}/${certificateType}`;
+}
+
+export type EnsureAppleCertificateInput = {
+  relay: AppleRelayWebSocketClient;
+  teamId: string;
+  secretStore: SigningSecretStore;
+  /** Common name used when minting a new certificate. */
+  commonName?: string;
+  log?: (message: string, detail?: string) => void;
+};
+
+export type EnsureAppleCertificateResult = {
+  secret: SigningSecret;
+  certificateId: string;
+  /** True when a new certificate was minted instead of reusing the stored one. */
+  created: boolean;
+};
+
+/**
+ * Returns a usable development certificate secret for the team, reusing the
+ * stored one when its certificate is still on the team and minting a new
+ * one otherwise. Apple caps development certificates at 2 and never returns
+ * private keys, so reuse of the stored p12 is strongly preferred.
+ *
+ * Durability of the stored material is the secret store's concern:
+ * implementors who want retries or fallbacks build them into their
+ * SigningSecretStore.
+ */
+export async function ensureAppleCertificateSecret({
+  relay,
+  teamId,
+  secretStore,
+  commonName,
+  log = () => {},
+}: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult> {
+  // The browser flow mints via the portal's development kind, which is
+  // the DEVELOPMENT certificate type in Apple's App Store Connect enum.
+  const certificateType: AppleCertificateType = 'DEVELOPMENT';
+  const secretName = appleCertificateSecretName(teamId, certificateType);
+  const current = await listAppleCertificates({ relay, teamId, certificateKind: 'development' });
+  const findOnTeam = (certificateId: string | undefined) =>
+    certificateId === undefined ? undefined : (
+      current.find(
+        (item) =>
+          stringField(item, 'certificateId') === certificateId ||
+          stringField(item, 'certRequestId') === certificateId,
+      )
+    );
+
+  const stored = await secretStore.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
+  const storedCertificateId = stringField(stored?.data, 'certificateID');
+  if (stored && storedCertificateId && stored.data.certificateP12Base64) {
+    // The stored value may be a certRequestId; resolve the canonical
+    // certificateId the profile API expects. If the cert is no longer on
+    // the team (revoked), fall through and mint a new one.
+    const matched = findOnTeam(storedCertificateId);
+    if (matched) {
+      const certificateId = stringField(matched, 'certificateId') ?? storedCertificateId;
+      log('Reusing stored Apple certificate', certificateId);
+      return { secret: stored, certificateId, created: false };
+    }
+    log('Stored certificate is no longer on the team', 'Minting a new one.');
+  }
+
+  // The private key is generated and kept in this browser; Apple only ever
+  // sees the CSR. Without this key the downloaded cert cannot sign anything.
+  const key = await generateAppleSigningKeyAndCSR({ commonName: commonName ?? `Limrun ${teamId}` });
+  const certificate = await createAppleCertificate({
+    relay,
+    teamId,
+    certificateKind: 'development',
+    csrPEM: key.csrPEM,
+  });
+  const certificateId =
+    stringField(certificate, 'certificateId') ?? stringField(certificate, 'certRequestId');
+  if (!certificateId) {
+    throw new Error('Apple certificate creation did not return a certificate ID.');
+  }
+  const downloaded = await downloadAppleCertificate({
+    relay,
+    teamId,
+    certificateKind: 'development',
+    certificateId,
+  });
+  if (!downloaded.rawBodyBase64) {
+    throw new Error('Apple certificate download returned no bytes.');
+  }
+  const data: AppleCertificateSecretData = {
+    certificateP12Base64: exportAppleCertificateP12({
+      privateKeyPKCS8Base64: key.privateKeyPKCS8Base64,
+      certificateBase64: downloaded.rawBodyBase64,
+      password: '',
+      friendlyName: `Apple Development ${teamId}`,
+    }),
+    certificateType,
+    teamID: teamId,
+    certificateID: certificateId,
+    // Normalized so it equals the serials profiles reference.
+    serialNumber: normalizeCertificateSerial(stringField(certificate, 'serialNum')),
+    expirationDate: stringField(certificate, 'expirationDateString'),
+  };
+
+  let secret: SigningSecret;
+  try {
+    secret = await putAppleCertificateSecret(secretStore, secretName, data);
+  } catch (error) {
+    // The key existed only in this browser's memory; once this throw
+    // unwinds it is gone, and the portal certificate is unusable.
+    throw new Error(
+      `Certificate ${certificateId} was created on the Apple Developer portal but saving its private ` +
+        `key to the secret store failed: ${errorText(error)}. The key cannot be recovered; revoke ` +
+        `certificate ${certificateId} at developer.apple.com before retrying, or the retry will mint ` +
+        `another certificate against Apple's limit.`,
+    );
+  }
+  log('Apple certificate stored', certificateId);
+  return { secret, certificateId, created: true };
+}
+
+function errorText(error: unknown) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export type SaveAppleProfileInput = {
+  relay: AppleRelayWebSocketClient;
+  teamId: string;
+  profileId: string;
+  secretStore: SigningSecretStore;
+  log?: (message: string, detail?: string) => void;
+};
+
+/**
+ * Downloads the provisioning profile and stores it as an
+ * appleProvisioningProfile secret named `${teamId}/${uuid}`. The UUID is
+ * unique per profile, so a team can hold many profiles for the same
+ * bundle ID and certificate set; the reference fields (certificate
+ * serials, bundle IDs, device IDs parsed out of the profile) are what
+ * consumers filter on.
+ */
+export async function saveAppleProfileSecret({
+  relay,
+  teamId,
+  profileId,
+  secretStore,
+  log = () => {},
+}: SaveAppleProfileInput): Promise<SigningSecret> {
+  const downloaded = await downloadAppleProfile({ relay, teamId, profileId });
+  const profileBase64 = downloaded.rawBodyBase64;
+  if (!profileBase64) {
+    throw new Error('Apple provisioning profile download returned no bytes.');
+  }
+  const info = parseProvisioningProfileBase64(profileBase64);
+  const name = `${teamId}/${info.uuid ?? profileId}`;
+  const secret = await putAppleProvisioningProfileSecret(secretStore, name, {
+    provisioningProfileBase64: profileBase64,
+    certificateSerialNumbers: info.certificateSerialNumbers.join(','),
+    bundleIDs: info.bundleID,
+    deviceIDs: info.provisionedDevices.join(','),
+    teamID: info.teamID ?? teamId,
+    profileName: info.name,
+    uuid: info.uuid,
+    expirationDate: info.expirationDate,
+  });
+  log('Apple provisioning profile stored', name);
+  return secret;
+}
+
+export type ListTeamProfilesInput = {
+  relay: AppleRelayWebSocketClient;
+  teamId: string;
+};
+
+/** Lists the team's development provisioning profiles from the portal. */
+export async function listTeamAppleProfiles({ relay, teamId }: ListTeamProfilesInput) {
+  return listAppleProfiles({ relay, teamId, profileKind: 'development' });
+}
+
+/** Read a string-ish value from a loosely typed portal record. */
+export function stringField(record: Record<string, unknown> | undefined, key: string) {
+  const value = record?.[key];
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+  return undefined;
+}

package/src/components/remote-control.css

@@ -97,3 +97,35 @@
   outline: 2px solid #2563eb;
   outline-offset: 2px;
 }
+
+.rc-terminated {
+  position: absolute;
+  z-index: 50;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
+  max-width: 240px;
+  padding: 12px 18px;
+  border-radius: 16px;
+  text-align: center;
+  font: inherit;
+  background: rgba(255, 255, 255, 0.92);
+  color: #111827;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);
+}
+
+.rc-terminated-title {
+  font: inherit;
+  font-weight: 600;
+}
+
+.rc-terminated-message {
+  font: inherit;
+  font-size: 0.8125rem;
+  line-height: 1.3;
+  color: #6b7280;
+}