@limrun/ui 0.14.0-rc.4 → 0.14.0

package/src/apple-credentials/index.test.ts

@@ -1,158 +0,0 @@
-// @vitest-environment node
-
-import forge from 'node-forge';
-import { describe, expect, test } from 'vitest';
-import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
-import {
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  appleCertificateSecretName,
-  ensureAppleCertificateSecret,
-  type SigningSecret,
-  type SigningSecretMetadata,
-  type SigningSecretStore,
-  type SigningSecretType,
-} from './index';
-
-/**
- * A self-signed certificate is enough for exportAppleCertificateP12: the
- * p12 bundling never verifies that the key matches the certificate.
- */
-function selfSignedCertificateBase64() {
-  const keys = forge.pki.rsa.generateKeyPair(1024);
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = '01';
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date(Date.now() + 24 * 60 * 60 * 1000);
-  const attrs = [{ name: 'commonName', value: 'Apple Development Test' }];
-  cert.setSubject(attrs);
-  cert.setIssuer(attrs);
-  cert.sign(keys.privateKey);
-  return forge.util.encode64(forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes());
-}
-
-function memorySecretStore(options: { failPuts?: () => boolean } = {}) {
-  const entries = new Map<string, SigningSecret>();
-  const store: SigningSecretStore = {
-    async put(type: SigningSecretType, name: string, data: Record<string, string>) {
-      if (options.failPuts?.()) {
-        throw new Error('secret store unavailable');
-      }
-      const secret: SigningSecret = { type, name, data, createdAt: new Date().toISOString() };
-      entries.set(`${type}:${name}`, secret);
-      return secret;
-    },
-    async get(type: SigningSecretType, name: string) {
-      return entries.get(`${type}:${name}`);
-    },
-    async list() {
-      return [...entries.values()].map(({ data: _data, ...metadata }): SigningSecretMetadata => metadata);
-    },
-    async delete(type: SigningSecretType, name: string) {
-      entries.delete(`${type}:${name}`);
-    },
-  };
-  return { store, entries };
-}
-
-type PortalState = { mintedCertificateIds: string[]; certificateBase64: string };
-
-/**
- * Fakes the relay's provisioning proxy: minting appends to
- * mintedCertificateIds, listing reflects what has been minted so far.
- */
-function fakePortalRelay(state: PortalState): AppleRelayWebSocketClient {
-  return {
-    async request(_type: string, payload: unknown) {
-      const request = payload as { path: string };
-      if (request.path.includes('listCertRequests')) {
-        return portalOK({
-          certRequests: state.mintedCertificateIds.map((certificateId) => ({ certificateId })),
-        });
-      }
-      if (request.path.includes('submitCertificateRequest')) {
-        const certificateId = `CERT${state.mintedCertificateIds.length + 1}`;
-        state.mintedCertificateIds.push(certificateId);
-        return portalOK({
-          certRequest: {
-            certificateId,
-            serialNum: '01',
-            expirationDateString: '2027-01-01',
-          },
-        });
-      }
-      if (request.path.includes('downloadCertificateContent')) {
-        return { status: 200, statusText: 'OK', rawBodyBase64: state.certificateBase64 };
-      }
-      throw new Error(`unexpected portal path: ${request.path}`);
-    },
-  } as unknown as AppleRelayWebSocketClient;
-}
-
-function portalOK(body: Record<string, unknown>) {
-  return { status: 200, statusText: 'OK', body: { resultCode: 0, ...body } };
-}
-
-describe('ensureAppleCertificateSecret', () => {
-  const teamId = 'TEAM1';
-  const secretName = appleCertificateSecretName(teamId, 'DEVELOPMENT');
-
-  test('surfaces an actionable error when the store write fails after minting', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: [],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const broken = memorySecretStore({ failPuts: () => true });
-
-    await expect(
-      ensureAppleCertificateSecret({
-        relay: fakePortalRelay(state),
-        teamId,
-        secretStore: broken.store,
-      }),
-    ).rejects.toThrow(/revoke certificate CERT1/);
-    expect(state.mintedCertificateIds).toEqual(['CERT1']);
-  });
-
-  test('mints and stores the certificate with its type in the secret name', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: [],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const org = memorySecretStore();
-
-    const result = await ensureAppleCertificateSecret({
-      relay: fakePortalRelay(state),
-      teamId,
-      secretStore: org.store,
-    });
-    expect(result.created).toBe(true);
-    expect(result.certificateId).toBe('CERT1');
-    const stored = await org.store.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
-    expect(stored?.data.certificateID).toBe('CERT1');
-    expect(stored?.data.certificateType).toBe('DEVELOPMENT');
-    expect(stored?.data.certificateP12Base64).toBeTruthy();
-  });
-
-  test('reuses the stored certificate when it is still on the team', async () => {
-    const state: PortalState = {
-      mintedCertificateIds: ['CERT1'],
-      certificateBase64: selfSignedCertificateBase64(),
-    };
-    const org = memorySecretStore();
-    await org.store.put(APPLE_CERTIFICATE_SECRET_TYPE, secretName, {
-      certificateP12Base64: 'cDEy',
-      certificateID: 'CERT1',
-      teamID: teamId,
-    });
-
-    const result = await ensureAppleCertificateSecret({
-      relay: fakePortalRelay(state),
-      teamId,
-      secretStore: org.store,
-    });
-    expect(result.created).toBe(false);
-    expect(result.certificateId).toBe('CERT1');
-    expect(state.mintedCertificateIds).toEqual(['CERT1']);
-  });
-});

package/src/apple-credentials/index.ts

@@ -1,241 +0,0 @@
-/**
- * Headless helpers that turn an authenticated Apple relay session into
- * signing credentials persisted in a SigningSecretStore. The Apple relay
- * only proxies: certificate and profile bytes always land in the browser
- * first, and the browser writes them into the configured store (Limrun's
- * org secret store by default, or a customer-provided one).
- */
-import {
-  createAppleCertificate,
-  downloadAppleCertificate,
-  downloadAppleProfile,
-  exportAppleCertificateP12,
-  generateAppleSigningKeyAndCSR,
-  listAppleCertificates,
-  listAppleProfiles,
-} from '../app-store-relay';
-import type { AppleRelayWebSocketClient } from '../core/device-install/apple';
-import {
-  normalizeCertificateSerial,
-  parseProvisioningProfileBase64,
-} from '../core/device-install/storage/browser-storage';
-import {
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  putAppleCertificateSecret,
-  putAppleProvisioningProfileSecret,
-  type AppleCertificateSecretData,
-  type AppleCertificateType,
-  type SigningSecret,
-  type SigningSecretStore,
-} from '../core/device-install/storage/secret-store';
-
-export {
-  APPLE_CERTIFICATE_SECRET_TYPE,
-  APPLE_PROVISIONING_PROFILE_SECRET_TYPE,
-  createBrowserSecretStore,
-  createLimrunSecretStore,
-  putAppleCertificateSecret,
-  putAppleProvisioningProfileSecret,
-  type AppleCertificateSecretData,
-  type AppleCertificateType,
-  type AppleProvisioningProfileSecretData,
-  type LimrunSecretStoreOptions,
-  type SigningSecret,
-  type SigningSecretData,
-  type SigningSecretMetadata,
-  type SigningSecretStore,
-  type SigningSecretType,
-} from '../core/device-install/storage/secret-store';
-export { normalizeCertificateSerial } from '../core/device-install/storage/browser-storage';
-
-/**
- * Conventional secret name of a team's certificate bundle. One bundle per
- * team and Apple certificate type; the type is in the name so development
- * and distribution material never collide.
- */
-export function appleCertificateSecretName(teamId: string, certificateType: AppleCertificateType) {
-  return `${teamId}/${certificateType}`;
-}
-
-export type EnsureAppleCertificateInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  secretStore: SigningSecretStore;
-  /** Common name used when minting a new certificate. */
-  commonName?: string;
-  log?: (message: string, detail?: string) => void;
-};
-
-export type EnsureAppleCertificateResult = {
-  secret: SigningSecret;
-  certificateId: string;
-  /** True when a new certificate was minted instead of reusing the stored one. */
-  created: boolean;
-};
-
-/**
- * Returns a usable development certificate secret for the team, reusing the
- * stored one when its certificate is still on the team and minting a new
- * one otherwise. Apple caps development certificates at 2 and never returns
- * private keys, so reuse of the stored p12 is strongly preferred.
- *
- * Durability of the stored material is the secret store's concern:
- * implementors who want retries or fallbacks build them into their
- * SigningSecretStore.
- */
-export async function ensureAppleCertificateSecret({
-  relay,
-  teamId,
-  secretStore,
-  commonName,
-  log = () => {},
-}: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult> {
-  // The browser flow mints via the portal's development kind, which is
-  // the DEVELOPMENT certificate type in Apple's App Store Connect enum.
-  const certificateType: AppleCertificateType = 'DEVELOPMENT';
-  const secretName = appleCertificateSecretName(teamId, certificateType);
-  const current = await listAppleCertificates({ relay, teamId, certificateKind: 'development' });
-  const findOnTeam = (certificateId: string | undefined) =>
-    certificateId === undefined ? undefined : (
-      current.find(
-        (item) =>
-          stringField(item, 'certificateId') === certificateId ||
-          stringField(item, 'certRequestId') === certificateId,
-      )
-    );
-
-  const stored = await secretStore.get(APPLE_CERTIFICATE_SECRET_TYPE, secretName);
-  const storedCertificateId = stringField(stored?.data, 'certificateID');
-  if (stored && storedCertificateId && stored.data.certificateP12Base64) {
-    // The stored value may be a certRequestId; resolve the canonical
-    // certificateId the profile API expects. If the cert is no longer on
-    // the team (revoked), fall through and mint a new one.
-    const matched = findOnTeam(storedCertificateId);
-    if (matched) {
-      const certificateId = stringField(matched, 'certificateId') ?? storedCertificateId;
-      log('Reusing stored Apple certificate', certificateId);
-      return { secret: stored, certificateId, created: false };
-    }
-    log('Stored certificate is no longer on the team', 'Minting a new one.');
-  }
-
-  // The private key is generated and kept in this browser; Apple only ever
-  // sees the CSR. Without this key the downloaded cert cannot sign anything.
-  const key = await generateAppleSigningKeyAndCSR({ commonName: commonName ?? `Limrun ${teamId}` });
-  const certificate = await createAppleCertificate({
-    relay,
-    teamId,
-    certificateKind: 'development',
-    csrPEM: key.csrPEM,
-  });
-  const certificateId =
-    stringField(certificate, 'certificateId') ?? stringField(certificate, 'certRequestId');
-  if (!certificateId) {
-    throw new Error('Apple certificate creation did not return a certificate ID.');
-  }
-  const downloaded = await downloadAppleCertificate({
-    relay,
-    teamId,
-    certificateKind: 'development',
-    certificateId,
-  });
-  if (!downloaded.rawBodyBase64) {
-    throw new Error('Apple certificate download returned no bytes.');
-  }
-  const data: AppleCertificateSecretData = {
-    certificateP12Base64: exportAppleCertificateP12({
-      privateKeyPKCS8Base64: key.privateKeyPKCS8Base64,
-      certificateBase64: downloaded.rawBodyBase64,
-      password: '',
-      friendlyName: `Apple Development ${teamId}`,
-    }),
-    certificateType,
-    teamID: teamId,
-    certificateID: certificateId,
-    // Normalized so it equals the serials profiles reference.
-    serialNumber: normalizeCertificateSerial(stringField(certificate, 'serialNum')),
-    expirationDate: stringField(certificate, 'expirationDateString'),
-  };
-
-  let secret: SigningSecret;
-  try {
-    secret = await putAppleCertificateSecret(secretStore, secretName, data);
-  } catch (error) {
-    // The key existed only in this browser's memory; once this throw
-    // unwinds it is gone, and the portal certificate is unusable.
-    throw new Error(
-      `Certificate ${certificateId} was created on the Apple Developer portal but saving its private ` +
-        `key to the secret store failed: ${errorText(error)}. The key cannot be recovered; revoke ` +
-        `certificate ${certificateId} at developer.apple.com before retrying, or the retry will mint ` +
-        `another certificate against Apple's limit.`,
-    );
-  }
-  log('Apple certificate stored', certificateId);
-  return { secret, certificateId, created: true };
-}
-
-function errorText(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-export type SaveAppleProfileInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-  profileId: string;
-  secretStore: SigningSecretStore;
-  log?: (message: string, detail?: string) => void;
-};
-
-/**
- * Downloads the provisioning profile and stores it as an
- * appleProvisioningProfile secret named `${teamId}/${uuid}`. The UUID is
- * unique per profile, so a team can hold many profiles for the same
- * bundle ID and certificate set; the reference fields (certificate
- * serials, bundle IDs, device IDs parsed out of the profile) are what
- * consumers filter on.
- */
-export async function saveAppleProfileSecret({
-  relay,
-  teamId,
-  profileId,
-  secretStore,
-  log = () => {},
-}: SaveAppleProfileInput): Promise<SigningSecret> {
-  const downloaded = await downloadAppleProfile({ relay, teamId, profileId });
-  const profileBase64 = downloaded.rawBodyBase64;
-  if (!profileBase64) {
-    throw new Error('Apple provisioning profile download returned no bytes.');
-  }
-  const info = parseProvisioningProfileBase64(profileBase64);
-  const name = `${teamId}/${info.uuid ?? profileId}`;
-  const secret = await putAppleProvisioningProfileSecret(secretStore, name, {
-    provisioningProfileBase64: profileBase64,
-    certificateSerialNumbers: info.certificateSerialNumbers.join(','),
-    bundleIDs: info.bundleID,
-    deviceIDs: info.provisionedDevices.join(','),
-    teamID: info.teamID ?? teamId,
-    profileName: info.name,
-    uuid: info.uuid,
-    expirationDate: info.expirationDate,
-  });
-  log('Apple provisioning profile stored', name);
-  return secret;
-}
-
-export type ListTeamProfilesInput = {
-  relay: AppleRelayWebSocketClient;
-  teamId: string;
-};
-
-/** Lists the team's development provisioning profiles from the portal. */
-export async function listTeamAppleProfiles({ relay, teamId }: ListTeamProfilesInput) {
-  return listAppleProfiles({ relay, teamId, profileKind: 'development' });
-}
-
-/** Read a string-ish value from a loosely typed portal record. */
-export function stringField(record: Record<string, unknown> | undefined, key: string) {
-  const value = record?.[key];
-  if (typeof value === 'string') return value;
-  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
-  return undefined;
-}

package/src/core/device-install/apple/client.ts

@@ -1,143 +0,0 @@
-import { AppleGsaSrpClient } from './gsa-srp';
-import {
-  openAppleRelayWebSocket,
-  fetchAppleAccountSession,
-  proxyPhoneTwoFactorCode,
-  proxySrpComplete,
-  proxySrpInit,
-  proxyTwoFactorCode,
-  triggerPhoneTwoFactor,
-  triggerTrustedDeviceTwoFactor,
-  type AppleRelayWebSocketClient,
-  type AppleRelayResponse,
-} from './relay';
-
-export type AppleIDLoginInput = {
-  registryApiUrl: string;
-  accountName: string;
-  password: string;
-  token?: string;
-  organizationId?: string;
-};
-
-export type AppleIDLoginResult = {
-  relay: AppleRelayWebSocketClient;
-  completeResponse: AppleRelayResponse;
-  twoFactorChallengeResponse?: AppleRelayResponse;
-  requiresTwoFactor: boolean;
-  finishTwoFactor: (code: string) => Promise<AppleRelayResponse>;
-  finalize: () => Promise<AppleRelayResponse>;
-  close: () => Promise<void>;
-};
-
-type TwoFactorMethod = { type: 'trustedDevice' } | { type: 'phone'; phoneNumberId: number; mode: string };
-
-export async function startBrowserOwnedAppleIDLogin({
-  registryApiUrl,
-  accountName,
-  password,
-  token,
-  organizationId,
-}: AppleIDLoginInput): Promise<AppleIDLoginResult> {
-  const relay = await openAppleRelayWebSocket(registryApiUrl, token, organizationId);
-  try {
-    const srp = new AppleGsaSrpClient(accountName);
-    const initResponse = await proxySrpInit(relay, await srp.init());
-    if (initResponse.status < 200 || initResponse.status >= 300) {
-      throw new Error(
-        `Apple SRP init failed: HTTP ${initResponse.status} ${initResponse.rawBody ?? ''}`.trim(),
-      );
-    }
-    if (!initResponse.body) {
-      throw new Error('Apple SRP init response did not include a body.');
-    }
-    const proof = await srp.complete(password, initResponse.body);
-    const completeResponse = await proxySrpComplete(relay, {
-      ...proof,
-      rememberMe: false,
-      trustTokens: [],
-    });
-    const requiresTwoFactor = completeResponse.status === 409;
-    let twoFactorChallengeResponse: AppleRelayResponse | undefined;
-    let twoFactorMethod: TwoFactorMethod = { type: 'trustedDevice' };
-    if (requiresTwoFactor) {
-      twoFactorChallengeResponse = await triggerTrustedDeviceTwoFactor(relay);
-      const phone = trustedPhoneNumberFromChallenge(twoFactorChallengeResponse.body);
-      // Only route codes through the phone/SMS endpoint when Apple actually
-      // falls back to phone verification (HTTP 412). The trusted-device
-      // challenge body frequently includes trusted-phone metadata even for a
-      // normal device push; routing those codes to the phone endpoint breaks
-      // trusted-device login.
-      if (twoFactorChallengeResponse.status === 412) {
-        if (!phone) {
-          throw new Error('Apple requested phone verification but did not include a trusted phone number.');
-        }
-        twoFactorMethod = {
-          type: 'phone',
-          phoneNumberId: phone.id,
-          mode: phone.pushMode ?? 'sms',
-        };
-        twoFactorChallengeResponse = await triggerPhoneTwoFactor(relay, phone.id, phone.pushMode ?? 'sms');
-      }
-      if (twoFactorChallengeResponse.status < 200 || twoFactorChallengeResponse.status >= 300) {
-        throw new Error(
-          `Apple two-factor challenge failed: HTTP ${twoFactorChallengeResponse.status} ${
-            twoFactorChallengeResponse.rawBody ?? ''
-          }`.trim(),
-        );
-      }
-    } else if (completeResponse.status < 200 || completeResponse.status >= 300) {
-      throw new Error(
-        `Apple SRP complete failed: HTTP ${completeResponse.status} ${completeResponse.rawBody ?? ''}`.trim(),
-      );
-    }
-    return {
-      relay,
-      completeResponse,
-      twoFactorChallengeResponse,
-      requiresTwoFactor,
-      finishTwoFactor: async (code) => {
-        const response =
-          twoFactorMethod.type === 'phone' ?
-            await proxyPhoneTwoFactorCode(relay, twoFactorMethod.phoneNumberId, code, twoFactorMethod.mode)
-          : await proxyTwoFactorCode(relay, code);
-        if (response.status < 200 || response.status >= 300) {
-          throw new Error(
-            `Apple two-factor code failed: HTTP ${response.status} ${response.rawBody ?? ''}`.trim(),
-          );
-        }
-        return response;
-      },
-      finalize: async () => fetchAppleAccountSession(relay),
-      close: async () => relay.close(),
-    };
-  } catch (error) {
-    relay.close();
-    throw error;
-  }
-}
-
-function trustedPhoneNumberFromChallenge(body: unknown) {
-  if (!isRecord(body)) return undefined;
-  const verification = isRecord(body.phoneNumberVerification) ? body.phoneNumberVerification : undefined;
-  const trustedPhoneNumber =
-    recordValue(verification?.trustedPhoneNumber) ??
-    recordValue(body.trustedPhoneNumber) ??
-    recordValue(body.phoneNumber);
-  if (!trustedPhoneNumber) return undefined;
-  const id = trustedPhoneNumber.id;
-  if (typeof id !== 'number') return undefined;
-  const pushMode =
-    typeof trustedPhoneNumber.pushMode === 'string' ? trustedPhoneNumber.pushMode
-    : typeof body.mode === 'string' ? body.mode
-    : undefined;
-  return { id, pushMode };
-}
-
-function recordValue(value: unknown) {
-  return isRecord(value) ? value : undefined;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}