@limrun/ui 0.14.0-rc.3 → 0.14.0-rc.5

package/src/app-store-relay/index.ts

@@ -1,17 +1,20 @@
 import {
   createAdHocProfileRequest,
+  createAppStoreProfileRequest,
   createBundleIDRequest,
   createDevelopmentProfileRequest,
   downloadCertificateRequest,
   downloadDistributionCertificateRequest,
   downloadProfileRequest,
   findAdHocProfilesRequest,
+  findAppStoreProfilesRequest,
   findBundleIDRequest,
   findDevelopmentCertificatesRequest,
   findDevelopmentProfilesRequest,
   findDeviceRequest,
   findDistributionCertificatesRequest,
   listTeamsRequest,
+  proxyAppStoreConnectRequest,
   proxyProvisioningRequest,
   registerDeviceRequest,
   submitDevelopmentCSRRequest,
@@ -35,11 +38,13 @@ export type {
   AppleDeveloperPortalTeam,
   AppleProvisioningRequest,
   AppleRelayResponse,
+  AppStoreConnectRequest,
 } from '../core/device-install/apple';
 export {
   AppleRelayWebSocketClient,
   fetchAppleAccountSession,
   openAppleRelayWebSocket,
+  proxyAppStoreConnectRequest,
   proxyPhoneTwoFactorCode,
   proxySrpComplete,
   proxySrpInit,
@@ -58,7 +63,7 @@ export type AppleTeamScopedOptions = AppleRelayClientOptions & {
 
 export type AppleCertificateKind = 'development' | 'distribution';
 
-export type AppleProfileKind = 'development' | 'adhoc';
+export type AppleProfileKind = 'development' | 'adhoc' | 'appstore';
 
 export type RequestAppleProvisioningOptions<T = unknown> = AppleRelayClientOptions & {
   request: AppleProvisioningRequest;
@@ -134,7 +139,9 @@ export type CreateAppleProfileOptions = AppleTeamScopedOptions & {
   bundleId: string;
   appIdId: string;
   certificateIds: string[];
-  deviceIds: string[];
+  /** Devices the profile binds. Ignored for App Store profiles, which bind none. */
+  deviceIds?: string[];
+  /** Profile name. Required for App Store profiles; there is no default. */
   name?: string;
 };
 
@@ -408,8 +415,8 @@ export async function listAppleProfiles({
   return requestAppleProvisioning<Array<Record<string, unknown>>>({
     ...options,
     request:
-      profileKind === 'adhoc' ?
-        findAdHocProfilesRequest({ bundleID: bundleId, teamID: teamId })
+      profileKind === 'adhoc' ? findAdHocProfilesRequest({ bundleID: bundleId, teamID: teamId })
+      : profileKind === 'appstore' ? findAppStoreProfilesRequest({ bundleID: bundleId, teamID: teamId })
       : findDevelopmentProfilesRequest({ bundleID: bundleId, teamID: teamId }),
     label: 'Apple provisioning profile list',
     mapBody: (body) => body?.provisioningProfiles ?? [],
@@ -422,7 +429,7 @@ export async function createAppleProfile({
   bundleId,
   appIdId,
   certificateIds,
-  deviceIds,
+  deviceIds = [],
   name,
   ...options
 }: CreateAppleProfileOptions) {
@@ -430,26 +437,39 @@ export async function createAppleProfile({
   if (!certificateId) {
     throw new Error('At least one certificate ID is required to create an Apple provisioning profile.');
   }
+  let request: AppleProvisioningRequest;
+  if (profileKind === 'appstore') {
+    if (!name) {
+      throw new Error('An explicit name is required to create an App Store provisioning profile.');
+    }
+    request = createAppStoreProfileRequest({
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      name,
+    });
+  } else if (profileKind === 'adhoc') {
+    request = createAdHocProfileRequest({
+      bundleID: bundleId,
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      deviceIDs: deviceIds,
+      name,
+    });
+  } else {
+    request = createDevelopmentProfileRequest({
+      bundleID: bundleId,
+      teamID: teamId,
+      appIDID: appIdId,
+      certificateID: certificateId,
+      deviceIDs: deviceIds,
+      name,
+    });
+  }
   return requestAppleProvisioning<Record<string, unknown> | undefined>({
     ...options,
-    request:
-      profileKind === 'adhoc' ?
-        createAdHocProfileRequest({
-          bundleID: bundleId,
-          teamID: teamId,
-          appIDID: appIdId,
-          certificateID: certificateId,
-          deviceIDs: deviceIds,
-          name,
-        })
-      : createDevelopmentProfileRequest({
-          bundleID: bundleId,
-          teamID: teamId,
-          appIDID: appIdId,
-          certificateID: certificateId,
-          deviceIDs: deviceIds,
-          name,
-        }),
+    request,
     label: 'Apple provisioning profile creation',
     mapBody: (body) => body?.provisioningProfile,
   });
@@ -482,6 +502,321 @@ export async function deleteAppleProfile({ teamId = '', profileId, ...options }:
   });
 }
 
+/**
+ * A JSON:API resource returned by the session-authenticated App Store
+ * Connect API. Kept loose on purpose: the endpoint is not a public contract
+ * and Apple adds attributes freely.
+ */
+export type AppStoreConnectResource = {
+  type?: string;
+  id?: string;
+  attributes?: Record<string, unknown>;
+  relationships?: Record<string, unknown>;
+};
+
+type AppStoreConnectEnvelope = {
+  data?: AppStoreConnectResource | AppStoreConnectResource[];
+  included?: AppStoreConnectResource[];
+  errors?: Array<{ status?: string; code?: string; title?: string; detail?: string }>;
+};
+
+export type SwitchAppStoreConnectProviderOptions = AppleRelayClientOptions & {
+  /** The numeric provider ID of the team, from the team list's providerId. */
+  providerId: string | number;
+};
+
+/**
+ * Points the App Store Connect session at the given team (provider). Must
+ * run before any other App Store Connect call when the account belongs to
+ * multiple teams, because the session carries an active provider.
+ */
+export async function switchAppStoreConnectProvider({
+  relay,
+  providerId,
+}: SwitchAppStoreConnectProviderOptions) {
+  const numericProviderId = Number(providerId);
+  const response = await proxyAppStoreConnectRequest<Record<string, unknown>>(relay, {
+    method: 'POST',
+    path: '/olympus/v1/session',
+    payload: {
+      provider: { providerId: Number.isNaN(numericProviderId) ? providerId : numericProviderId },
+    },
+  });
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(
+      `App Store Connect provider switch failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim(),
+    );
+  }
+  return response;
+}
+
+/**
+ * Roles Apple accepts on App Store Connect API keys. APP_MANAGER is enough
+ * to upload builds and manage TestFlight, which is why it is the default
+ * for keys minted by ensureAppStoreConnectApiKeySecret.
+ */
+export type AppStoreConnectApiKeyRole =
+  | 'ADMIN'
+  | 'APP_MANAGER'
+  | 'CUSTOMER_SUPPORT'
+  | 'DEVELOPER'
+  | 'FINANCE'
+  | 'MARKETING'
+  | 'SALES';
+
+export type ListAppStoreConnectApiKeysOptions = AppleRelayClientOptions;
+
+/** Lists the team's App Store Connect API keys. Requires an Admin session. */
+export async function listAppStoreConnectApiKeys({ relay }: ListAppStoreConnectApiKeysOptions) {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: '/iris/v1/apiKeys',
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key list');
+  return resourceArray(response.body?.data);
+}
+
+export type CreateAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
+  /** Display name of the key. Required; implementors brand keys themselves. */
+  nickname: string;
+  roles?: AppStoreConnectApiKeyRole[];
+  allAppsVisible?: boolean;
+};
+
+/**
+ * Creates a team App Store Connect API key through the logged-in session,
+ * the same way the App Store Connect website does. The session user must
+ * be a team Admin. The private key is NOT part of the response; download
+ * it once with downloadAppStoreConnectApiKeyPrivateKey.
+ */
+export async function createAppStoreConnectApiKey({
+  relay,
+  nickname,
+  roles = ['APP_MANAGER'],
+  allAppsVisible = true,
+}: CreateAppStoreConnectApiKeyOptions) {
+  if (!nickname) {
+    throw new Error('A nickname is required to create an App Store Connect API key.');
+  }
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    method: 'POST',
+    path: '/iris/v1/apiKeys',
+    payload: {
+      data: {
+        type: 'apiKeys',
+        attributes: {
+          nickname,
+          allAppsVisible,
+          keyType: 'PUBLIC_API',
+          roles,
+        },
+      },
+    },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key creation');
+  const key = singleResource(response.body?.data);
+  if (!key?.id) {
+    throw new Error('App Store Connect API key creation did not return a key ID.');
+  }
+  return key;
+}
+
+export type DownloadAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
+  keyId: string;
+};
+
+export type DownloadedAppStoreConnectApiKey = {
+  /** PEM contents of the .p8 private key. */
+  privateKeyPem: string;
+  /** Issuer ID for JWTs signed with this key, when Apple returned it. */
+  issuerId?: string;
+};
+
+/**
+ * Downloads the private half of an App Store Connect API key. Apple serves
+ * it exactly once per key; afterwards the sparse fieldset comes back empty
+ * and the key must be revoked and re-minted.
+ */
+export async function downloadAppStoreConnectApiKeyPrivateKey({
+  relay,
+  keyId,
+}: DownloadAppStoreConnectApiKeyOptions): Promise<DownloadedAppStoreConnectApiKey> {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: `/iris/v1/apiKeys/${encodeURIComponent(keyId)}`,
+    query: { 'fields[apiKeys]': 'privateKey', include: 'provider' },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect API key download');
+  const key = singleResource(response.body?.data);
+  const privateKeyPem = stringField(key?.attributes, 'privateKey');
+  if (!privateKeyPem) {
+    throw new Error(
+      `App Store Connect API key ${keyId} returned no private key. Apple serves it only once; ` +
+        'revoke the key and create a new one.',
+    );
+  }
+  const provider = (response.body?.included ?? []).find((item) => item.type === 'providers');
+  const issuerId =
+    stringField(provider?.attributes, 'publicProviderId') ??
+    stringField(key?.attributes, 'issuerId') ??
+    provider?.id;
+  return { privateKeyPem, issuerId };
+}
+
+export type FindAppStoreConnectAppOptions = AppleRelayClientOptions & {
+  bundleId: string;
+};
+
+/** Looks up the App Store Connect app record for a bundle ID, if any. */
+export async function findAppStoreConnectApp({ relay, bundleId }: FindAppStoreConnectAppOptions) {
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    path: '/iris/v1/apps',
+    query: { 'filter[bundleId]': bundleId },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect app lookup');
+  return resourceArray(response.body?.data).find(
+    (app) => stringField(app.attributes, 'bundleId') === bundleId,
+  );
+}
+
+export type CreateAppStoreConnectAppOptions = AppleRelayClientOptions & {
+  bundleId: string;
+  /** App name shown on the App Store. Required; there is no default. */
+  name: string;
+  /** Unique internal identifier. Defaults to the bundle ID. */
+  sku?: string;
+  /** Primary App Store locale. Defaults to en-US. */
+  primaryLocale?: string;
+  /** Version string of the first App Store version. Defaults to 1.0. */
+  versionString?: string;
+};
+
+/**
+ * Creates the App Store Connect app record for a bundle ID. Only the
+ * session-authenticated API can create app records (the key-authenticated
+ * public API cannot), which is why this goes through the relay. The body
+ * mirrors what the App Store Connect website and fastlane's produce send.
+ */
+export async function createAppStoreConnectApp({
+  relay,
+  bundleId,
+  name,
+  sku,
+  primaryLocale = 'en-US',
+  versionString = '1.0',
+}: CreateAppStoreConnectAppOptions) {
+  if (!name) {
+    throw new Error('An app name is required to create an App Store Connect app record.');
+  }
+  const platform = 'IOS';
+  const response = await proxyAppStoreConnectRequest<AppStoreConnectEnvelope>(relay, {
+    method: 'POST',
+    path: '/iris/v1/apps',
+    payload: {
+      data: {
+        type: 'apps',
+        attributes: {
+          sku: sku || bundleId,
+          primaryLocale,
+          bundleId,
+        },
+        relationships: {
+          appStoreVersions: {
+            data: [{ type: 'appStoreVersions', id: `\${store-version-${platform}}` }],
+          },
+          appInfos: {
+            data: [{ type: 'appInfos', id: '${new-appInfo-id}' }],
+          },
+        },
+      },
+      included: [
+        {
+          type: 'appInfos',
+          id: '${new-appInfo-id}',
+          relationships: {
+            appInfoLocalizations: {
+              data: [{ type: 'appInfoLocalizations', id: '${new-appInfoLocalization-id}' }],
+            },
+          },
+        },
+        {
+          type: 'appInfoLocalizations',
+          id: '${new-appInfoLocalization-id}',
+          attributes: { locale: primaryLocale, name },
+        },
+        {
+          type: 'appStoreVersions',
+          id: `\${store-version-${platform}}`,
+          attributes: { platform, versionString },
+          relationships: {
+            appStoreVersionLocalizations: {
+              data: [
+                { type: 'appStoreVersionLocalizations', id: `\${new-${platform}VersionLocalization-id}` },
+              ],
+            },
+          },
+        },
+        {
+          type: 'appStoreVersionLocalizations',
+          id: `\${new-${platform}VersionLocalization-id}`,
+          attributes: { locale: primaryLocale },
+        },
+      ],
+    },
+  });
+  assertAppStoreConnectResponseOK(response, 'App Store Connect app creation');
+  const app = singleResource(response.body?.data);
+  if (!app?.id) {
+    throw new Error('App Store Connect app creation did not return an app ID.');
+  }
+  return app;
+}
+
+export type EnsureAppStoreConnectAppOptions = CreateAppStoreConnectAppOptions;
+
+/**
+ * Returns the App Store Connect app record for the bundle ID, creating it
+ * when it does not exist yet. A first-time IPA upload fails without an app
+ * record, so run this before the first publish of a new bundle ID.
+ */
+export async function ensureAppStoreConnectApp(options: EnsureAppStoreConnectAppOptions) {
+  const existing = await findAppStoreConnectApp({ relay: options.relay, bundleId: options.bundleId });
+  if (existing) {
+    return { app: existing, created: false };
+  }
+  return { app: await createAppStoreConnectApp(options), created: true };
+}
+
+export function assertAppStoreConnectResponseOK(
+  response: AppleRelayResponse<AppStoreConnectEnvelope>,
+  label: string,
+) {
+  const errors = response.body?.errors;
+  if (errors && errors.length > 0) {
+    const detail = errors
+      .map((error) => error.detail ?? error.title ?? error.code ?? error.status)
+      .filter(Boolean)
+      .join('; ');
+    throw new Error(`${label} failed: ${detail || `HTTP ${response.status}`}`);
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`${label} failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim());
+  }
+}
+
+function resourceArray(data: AppStoreConnectResource | AppStoreConnectResource[] | undefined) {
+  if (!data) return [];
+  return Array.isArray(data) ? data : [data];
+}
+
+function singleResource(data: AppStoreConnectResource | AppStoreConnectResource[] | undefined) {
+  if (!data) return undefined;
+  return Array.isArray(data) ? data[0] : data;
+}
+
+function stringField(record: Record<string, unknown> | undefined, key: string) {
+  const value = record?.[key];
+  return typeof value === 'string' && value !== '' ? value : undefined;
+}
+
 export function assertAppleDeveloperPortalResponseOK(
   response: AppleDeveloperPortalResponse | undefined,
   label: string,

package/src/app-store-relay/react.ts

@@ -5,6 +5,7 @@ import {
   type AppleIDLoginResult,
   type AppleRelayResponse,
 } from './index';
+import { errorMessage } from '../core/errors';
 
 export type UseAppleIDLoginOptions = Pick<AppleIDLoginInput, 'registryApiUrl' | 'token' | 'organizationId'>;
 
@@ -128,7 +129,3 @@ export function useAppleIDLogin({
     close,
   };
 }
-
-function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}

package/src/apple-credentials/index.test.ts

@@ -0,0 +1,180 @@
+// @vitest-environment node
+
+import forge from 'node-forge';
+import { describe, expect, test } from 'vitest';
+import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
+import {
+  APPLE_CERTIFICATE_SECRET_TYPE,
+  appleCertificateSecretName,
+  ensureAppleCertificateSecret,
+  type SigningSecret,
+  type SigningSecretMetadata,
+  type SigningSecretStore,
+  type SigningSecretType,
+} from './index';
+
+/**
+ * A self-signed certificate is enough for exportAppleCertificateP12: the
+ * p12 bundling never verifies that the key matches the certificate.
+ */
+function selfSignedCertificateBase64() {
+  const keys = forge.pki.rsa.generateKeyPair(1024);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = '01';
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
+  const attrs = [{ name: 'commonName', value: 'Apple Development Test' }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.sign(keys.privateKey);
+  return forge.util.encode64(forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes());
+}
+
+function memorySecretStore(options: { failPuts?: () => boolean } = {}) {
+  const entries = new Map<string, SigningSecret>();
+  const store: SigningSecretStore = {
+    async put(type: SigningSecretType, name: string, data: Record<string, string>) {
+      if (options.failPuts?.()) {
+        throw new Error('secret store unavailable');
+      }
+      const secret: SigningSecret = { type, name, data, createdAt: new Date().toISOString() };
+      entries.set(`${type}:${name}`, secret);
+      return secret;
+    },
+    async get(type: SigningSecretType, name: string) {
+      return entries.get(`${type}:${name}`);
+    },
+    async list() {
+      return [...entries.values()].map(({ data: _data, ...metadata }): SigningSecretMetadata => metadata);
+    },
+    async delete(type: SigningSecretType, name: string) {
+      entries.delete(`${type}:${name}`);
+    },
+  };
+  return { store, entries };
+}
+
+type PortalState = { mintedCertificateIds: string[]; certificateBase64: string };
+
+/**
+ * Fakes the relay's provisioning proxy: minting appends to
+ * mintedCertificateIds, listing reflects what has been minted so far.
+ */
+function fakePortalRelay(state: PortalState): AppleRelayWebSocketClient {
+  return {
+    async request(_type: string, payload: unknown) {
+      const request = payload as { path: string };
+      if (request.path.includes('listCertRequests')) {
+        return portalOK({
+          certRequests: state.mintedCertificateIds.map((certificateId) => ({ certificateId })),
+        });
+      }
+      if (request.path.includes('submitCertificateRequest')) {
+        const certificateId = `CERT${state.mintedCertificateIds.length + 1}`;
+        state.mintedCertificateIds.push(certificateId);
+        return portalOK({
+          certRequest: {
+            certificateId,
+            serialNum: '01',
+            expirationDateString: '2027-01-01',
+          },
+        });
+      }
+      if (request.path.includes('downloadCertificateContent')) {
+        return { status: 200, statusText: 'OK', rawBodyBase64: state.certificateBase64 };
+      }
+      throw new Error(`unexpected portal path: ${request.path}`);
+    },
+  } as unknown as AppleRelayWebSocketClient;
+}
+
+function portalOK(body: Record<string, unknown>) {
+  return { status: 200, statusText: 'OK', body: { resultCode: 0, ...body } };
+}
+
+describe('ensureAppleCertificateSecret', () => {
+  const teamId = 'TEAM1';
+  const secretName = appleCertificateSecretName(teamId, 'DEVELOPMENT');
+
+  test('surfaces an actionable error when the store write fails after minting', async () => {
+    const state: PortalState = {
+      mintedCertificateIds: [],
+      certificateBase64: selfSignedCertificateBase64(),
+    };
+    const broken = memorySecretStore({ failPuts: () => true });
+
+    await expect(
+      ensureAppleCertificateSecret({
+        relay: fakePortalRelay(state),
+        teamId,
+        secretStore: broken.store,
+      }),
+    ).rejects.toThrow(/revoke certificate CERT1/);
+    expect(state.mintedCertificateIds).toEqual(['CERT1']);
+  });
+
+  test('mints and stores the certificate with its type in the secret name', async () => {
+    const state: PortalState = {
+      mintedCertificateIds: [],
+      certificateBase64: selfSignedCertificateBase64(),
+    };
+    const org = memorySecretStore();
+
+    const result = await ensureAppleCertificateSecret({
+      relay: fakePortalRelay(state),
+      teamId,
+      secretStore: org.store,
+    });
+    expect(result.created).toBe(true);
+    expect(result.certificateId).toBe('CERT1');
+    const stored = await org.store.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
+    expect(stored?.data.certificateID).toBe('CERT1');
+    expect(stored?.data.certificateType).toBe('DEVELOPMENT');
+    expect(stored?.data.certificateP12Base64).toBeTruthy();
+  });
+
+  test('mints distribution certificates under their own secret name', async () => {
+    const state: PortalState = {
+      mintedCertificateIds: [],
+      certificateBase64: selfSignedCertificateBase64(),
+    };
+    const org = memorySecretStore();
+
+    const result = await ensureAppleCertificateSecret({
+      relay: fakePortalRelay(state),
+      teamId,
+      secretStore: org.store,
+      certificateKind: 'distribution',
+    });
+    expect(result.created).toBe(true);
+    const stored = await org.store.get(
+      APPLE_CERTIFICATE_SECRET_TYPE,
+      appleCertificateSecretName(teamId, 'DISTRIBUTION'),
+    );
+    expect(stored?.data.certificateType).toBe('DISTRIBUTION');
+    expect(stored?.data.certificateP12Base64).toBeTruthy();
+  });
+
+  test('reuses the stored certificate when it is still on the team', async () => {
+    const state: PortalState = {
+      mintedCertificateIds: ['CERT1'],
+      certificateBase64: selfSignedCertificateBase64(),
+    };
+    const org = memorySecretStore();
+    await org.store.put(APPLE_CERTIFICATE_SECRET_TYPE, secretName, {
+      certificateP12Base64: 'cDEy',
+      certificateID: 'CERT1',
+      teamID: teamId,
+    });
+
+    const result = await ensureAppleCertificateSecret({
+      relay: fakePortalRelay(state),
+      teamId,
+      secretStore: org.store,
+    });
+    expect(result.created).toBe(false);
+    expect(result.certificateId).toBe('CERT1');
+    expect(state.mintedCertificateIds).toEqual(['CERT1']);
+  });
+});