@marktiderman/genesis-supabase 0.2.0 → 0.3.0

package/functions/genesis-apple-revoke/apple.ts

@@ -0,0 +1,237 @@
+/**
+ * Sign in with Apple's REST API, for the genesis-apple-revoke Edge Function:
+ * the client secret (an ES256 JWT signed with your .p8 key), the
+ * authorization-code exchange (/auth/token) and revocation (/auth/revoke).
+ *
+ * Plain TypeScript over WebCrypto and fetch, with no Deno or Node APIs, so the
+ * same file runs in the Edge Function and in the package's unit tests.
+ * Nothing here logs or returns a token, a key or a client secret.
+ *
+ * Apple's docs: developer.apple.com/documentation/signinwithapplerestapi
+ * (generate-and-validate-tokens, revoke-tokens) and
+ * developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret.
+ */
+
+export const APPLE_ISSUER = "https://appleid.apple.com";
+export const APPLE_TOKEN_URL = "https://appleid.apple.com/auth/token";
+export const APPLE_REVOKE_URL = "https://appleid.apple.com/auth/revoke";
+
+/** Apple caps a client secret's lifetime at 15777000 seconds (six months). Each call signs a fresh one, so five minutes is plenty. */
+export const CLIENT_SECRET_TTL_SECONDS = 300;
+const CLIENT_SECRET_MAX_TTL_SECONDS = 15_777_000;
+const REQUEST_TIMEOUT_MS = 10_000;
+const CLOCK_SKEW_SECONDS = 30;
+
+/** Apple's error codes (ErrorResponse.error). Anything else reads as "unknown". */
+const APPLE_ERRORS = ["invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "invalid_scope"] as const;
+export type AppleErrorCode = (typeof APPLE_ERRORS)[number] | "unknown" | "network" | "bad_response";
+
+export interface AppleConfig {
+  /** APPLE_TEAM_ID: your 10-character Team ID (the secret's `iss`). */
+  teamId: string;
+  /** APPLE_KEY_ID: the 10-character id of your Sign in with Apple key (the secret's `kid`). */
+  keyId: string;
+  /** APPLE_PRIVATE_KEY: the .p8 file's contents (PKCS#8 PEM). Escaped `\n` are accepted. */
+  privateKey: string;
+  /** APPLE_CLIENT_IDS: the bundle ids (App IDs) or Services IDs a code may be exchanged for, comma-separated. The first is the default. */
+  clientIds: string[];
+}
+
+const TEN_CHARS = /^[A-Z0-9]{10}$/;
+const CLIENT_ID = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+
+/**
+ * Reads the Apple settings from the environment. Returns the names that are
+ * missing or malformed (never their values), so the function can fail loud.
+ */
+export function readAppleConfig(env: (name: string) => string | undefined): { config: AppleConfig; problems?: undefined } | { config?: undefined; problems: string[] } {
+  const problems: string[] = [];
+  const teamId = (env("APPLE_TEAM_ID") ?? "").trim();
+  const keyId = (env("APPLE_KEY_ID") ?? "").trim();
+  const privateKey = normalizePem(env("APPLE_PRIVATE_KEY") ?? "");
+  const clientIds = (env("APPLE_CLIENT_IDS") ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (!TEN_CHARS.test(teamId)) problems.push("APPLE_TEAM_ID (10 capital letters or digits)");
+  if (!TEN_CHARS.test(keyId)) problems.push("APPLE_KEY_ID (10 capital letters or digits)");
+  if (!/-----BEGIN PRIVATE KEY-----[\s\S]+-----END PRIVATE KEY-----/.test(privateKey)) problems.push("APPLE_PRIVATE_KEY (the .p8 file's PEM text)");
+  if (clientIds.length === 0 || !clientIds.every((id) => CLIENT_ID.test(id))) problems.push("APPLE_CLIENT_IDS (comma-separated bundle ids or Services IDs)");
+  return problems.length ? { problems } : { config: { teamId, keyId, privateKey, clientIds } };
+}
+
+/** Accepts a PEM pasted with real newlines, escaped `\n`, or surrounding quotes. */
+function normalizePem(raw: string): string {
+  return raw.trim().replace(/^"|"$/g, "").replace(/\\n/g, "\n");
+}
+
+const encoder = new TextEncoder();
+
+export function base64url(bytes: Uint8Array | string): string {
+  const data = typeof bytes === "string" ? encoder.encode(bytes) : bytes;
+  let binary = "";
+  for (const b of data) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function base64urlDecode(text: string): string {
+  const b64 = text.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(b64 + "=".repeat((4 - (b64.length % 4)) % 4));
+  return new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+}
+
+const keyCache = new Map<string, Promise<CryptoKey>>();
+
+function signingKey(pem: string): Promise<CryptoKey> {
+  let key = keyCache.get(pem);
+  if (!key) {
+    const body = pem.replace(/-----(BEGIN|END) PRIVATE KEY-----/g, "").replace(/\s+/g, "");
+    const der = Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
+    key = crypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+    // A bad key must not stay cached as a rejected promise.
+    key.catch(() => keyCache.delete(pem));
+    keyCache.set(pem, key);
+  }
+  return key;
+}
+
+/**
+ * The `client_secret` for one client id: a JWT with header `{ alg: "ES256", kid }`
+ * and claims `{ iss: teamId, iat, exp, aud: "https://appleid.apple.com", sub: clientId }`,
+ * signed with ECDSA P-256 / SHA-256. WebCrypto returns the signature as r‖s
+ * (64 bytes), which is the JWS encoding ES256 needs.
+ */
+export async function appleClientSecret(config: AppleConfig, clientId: string, options: { now?: number; ttlSeconds?: number } = {}): Promise<string> {
+  // Backdated a little, so a clock slightly ahead of Apple's doesn't issue a secret "from the future".
+  const iat = Math.floor((options.now ?? Date.now()) / 1000) - CLOCK_SKEW_SECONDS;
+  const ttl = Math.min(Math.max(1, options.ttlSeconds ?? CLIENT_SECRET_TTL_SECONDS), CLIENT_SECRET_MAX_TTL_SECONDS);
+  const header = base64url(JSON.stringify({ alg: "ES256", kid: config.keyId }));
+  const payload = base64url(JSON.stringify({ iss: config.teamId, iat, exp: iat + ttl, aud: APPLE_ISSUER, sub: clientId }));
+  const input = `${header}.${payload}`;
+  const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, await signingKey(config.privateKey), encoder.encode(input));
+  return `${input}.${base64url(new Uint8Array(signature))}`;
+}
+
+/** The payload of a JWT, unverified, or null if it isn't one. */
+export function decodeJwtPayload(jwt: string): Record<string, unknown> | null {
+  const parts = jwt.split(".");
+  if (parts.length !== 3 || !parts[1]) return null;
+  try {
+    const payload: unknown = JSON.parse(base64urlDecode(parts[1]));
+    return payload && typeof payload === "object" && !Array.isArray(payload) ? (payload as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+async function appleError(res: Response): Promise<AppleErrorCode> {
+  try {
+    const body: unknown = await res.json();
+    const code = body && typeof body === "object" ? (body as { error?: unknown }).error : undefined;
+    return (APPLE_ERRORS as readonly unknown[]).includes(code) ? (code as AppleErrorCode) : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+async function postForm(fetchImpl: typeof fetch, url: string, form: Record<string, string>): Promise<Response | null> {
+  try {
+    return await fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+  } catch {
+    return null;
+  }
+}
+
+export type ExchangeResult =
+  | { ok: true; refreshToken: string; appleUserId: string }
+  /** `mintedRefreshToken`: Apple issued a token the checks then refused; revoke it rather than drop it. */
+  | { ok: false; error: AppleErrorCode; status?: number; mintedRefreshToken?: string };
+
+/**
+ * Exchanges a sign-in's single-use authorization code (valid for five
+ * minutes) for Apple's refresh token: `grant_type=authorization_code` with
+ * `client_id`, `client_secret` and `code`. A native sign-in sends no
+ * `redirect_uri` (Apple wants one only if the authorization request had one).
+ *
+ * Also checks the returned id token names Apple as `iss` and this client as
+ * `aud`, and returns its `sub` (the person's Apple user id) so the caller can
+ * tie the token to the right login. The id token comes straight from Apple
+ * over TLS in this response, so its claims are read without checking its
+ * signature (OpenID Connect Core 3.1.3.7).
+ */
+export async function exchangeAuthorizationCode(config: AppleConfig, clientId: string, code: string, fetchImpl: typeof fetch = fetch): Promise<ExchangeResult> {
+  const res = await postForm(fetchImpl, APPLE_TOKEN_URL, {
+    client_id: clientId,
+    client_secret: await appleClientSecret(config, clientId),
+    code,
+    grant_type: "authorization_code",
+  });
+  if (!res) return { ok: false, error: "network" };
+  if (!res.ok) return { ok: false, error: await appleError(res), status: res.status };
+  let body: { refresh_token?: unknown; id_token?: unknown };
+  try {
+    body = (await res.json()) as typeof body;
+  } catch {
+    return { ok: false, error: "bad_response", status: res.status };
+  }
+  const claims = typeof body.id_token === "string" ? decodeJwtPayload(body.id_token) : null;
+  const aud = claims?.aud;
+  const audOk = aud === clientId || (Array.isArray(aud) && aud.includes(clientId));
+  const minted = typeof body.refresh_token === "string" && body.refresh_token ? body.refresh_token : undefined;
+  if (!minted) return { ok: false, error: "bad_response", status: res.status };
+  if (!claims || claims.iss !== APPLE_ISSUER || !audOk || typeof claims.sub !== "string" || !claims.sub) {
+    return { ok: false, error: "bad_response", status: res.status, mintedRefreshToken: minted };
+  }
+  return { ok: true, refreshToken: minted, appleUserId: claims.sub };
+}
+
+/**
+ * Checks a refresh token is still live with this client's secret:
+ * `grant_type=refresh_token` at /auth/token (Apple returns new access and id
+ * tokens, which are dropped). This is the proof a revocation needs, because
+ * /auth/revoke answers 200 to a token it doesn't know even when the client
+ * secret is garbage: a 200 here means the secret is right and the token is
+ * live; `invalid_grant` means the token is already dead (nothing left to
+ * revoke); `invalid_client` means the secrets are wrong.
+ */
+export async function checkRefreshToken(config: AppleConfig, clientId: string, refreshToken: string, fetchImpl: typeof fetch = fetch): Promise<RevokeResult> {
+  const res = await postForm(fetchImpl, APPLE_TOKEN_URL, {
+    client_id: clientId,
+    client_secret: await appleClientSecret(config, clientId),
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+  });
+  if (!res) return { ok: false, error: "network" };
+  if (res.status === 200) {
+    await res.body?.cancel().catch(() => {});
+    return { ok: true };
+  }
+  return { ok: false, error: await appleError(res), status: res.status };
+}
+
+export type RevokeResult = { ok: true } | { ok: false; error: AppleErrorCode; status?: number };
+
+/**
+ * Revokes a refresh token: `client_id`, `client_secret`, `token` and
+ * `token_type_hint=refresh_token`. Apple answers 200 with no body when it
+ * revoked the token, and also when the token was already invalid. It also
+ * answered 200 to an unknown token with a garbage client secret (seen
+ * 2026-10-24), so a 200 alone proves nothing: check the token with
+ * {@link checkRefreshToken} first.
+ */
+export async function revokeRefreshToken(config: AppleConfig, clientId: string, refreshToken: string, fetchImpl: typeof fetch = fetch): Promise<RevokeResult> {
+  const res = await postForm(fetchImpl, APPLE_REVOKE_URL, {
+    client_id: clientId,
+    client_secret: await appleClientSecret(config, clientId),
+    token: refreshToken,
+    token_type_hint: "refresh_token",
+  });
+  if (!res) return { ok: false, error: "network" };
+  if (res.status === 200) return { ok: true };
+  return { ok: false, error: await appleError(res), status: res.status };
+}

package/functions/genesis-apple-revoke/handler.ts

@@ -0,0 +1,227 @@
+/**
+ * The genesis-apple-revoke Edge Function's request handling, with its
+ * dependencies passed in (index.ts wires the real ones), so it is tested
+ * without Deno, a database or Apple.
+ *
+ *   POST { "action": "store", "code": "<authorizationCode>", "clientId"?: "<bundle id>" }
+ *     Authorization: Bearer <the person's access token>
+ *     Exchanges the code from a Sign in with Apple at /auth/token and keeps
+ *     Apple's refresh token against the caller, server-side only.
+ *
+ *   POST { "action": "revoke" }
+ *     Revokes the tokens of deleted accounts that are due (queued by the
+ *     delete trigger, retried with backoff). It needs no caller: it only
+ *     works through the queue, a bounded batch at a time, and answers
+ *     `{ ok: true }` (202, working in the background, when the runtime can)
+ *     whatever was in it. The app calls it after `delete_my_account`; a
+ *     schedule calls it to retry.
+ *
+ * Responses never carry a token, a secret, or Apple's response body: only an
+ * `error` code.
+ */
+import { checkRefreshToken, exchangeAuthorizationCode, readAppleConfig, revokeRefreshToken, type AppleConfig } from "./apple.ts";
+
+/** The signed-in caller, as the auth server reports it. */
+export interface CallerUser {
+  id: string;
+  /** The `sub` of each Apple identity linked to this login (Apple's user id). */
+  appleUserIds: string[];
+}
+
+export interface DueRevocation {
+  id: number;
+  client_id: string;
+  refresh_token: string;
+  attempts: number;
+}
+
+/** The SQL functions from migration 0003, called with the service role. */
+export interface TokenStore {
+  /** `genesis_apple_token_save`: "stored", or "queued" when the login is already gone. */
+  save(userId: string, clientId: string, refreshToken: string): Promise<"stored" | "queued">;
+  /** `genesis_apple_revocations_claim`: due rows, each leased until its next retry. */
+  claim(limit: number): Promise<DueRevocation[]>;
+  /** `genesis_apple_revocation_done`: forgets a revoked token. */
+  done(id: number): Promise<void>;
+  /** `genesis_apple_revocation_failed`: keeps the row for its next retry ("retry"), or drops its token after the last attempt ("gave_up"). */
+  failed(id: number, error: string): Promise<"retry" | "gave_up">;
+}
+
+export interface HandlerDeps {
+  env: (name: string) => string | undefined;
+  fetch: typeof fetch;
+  /** The user behind an access token (checked with the auth server), or null. */
+  getUser(accessToken: string): Promise<CallerUser | null>;
+  store: TokenStore;
+  log: (message: string) => void;
+  /** Keeps work running after the response (`EdgeRuntime.waitUntil`). Without it, the revoke action answers when the batch is done. */
+  background?: (work: Promise<unknown>) => void;
+}
+
+export const REVOKE_BATCH = 20;
+const MAX_BODY_BYTES = 4096;
+const MAX_REFRESH_TOKEN = 4096;
+const CODE = /^[A-Za-z0-9._-]{1,1024}$/;
+
+const CORS = {
+  "access-control-allow-origin": "*",
+  "access-control-allow-headers": "authorization, x-client-info, apikey, content-type",
+  "access-control-allow-methods": "POST, OPTIONS",
+};
+
+function json(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), { status, headers: { ...CORS, "content-type": "application/json", "cache-control": "no-store" } });
+}
+
+async function readBody(req: Request): Promise<Record<string, unknown> | null> {
+  if (Number(req.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) return null;
+  const text = await req.text().catch(() => null);
+  if (text === null || text.length > MAX_BODY_BYTES) return null;
+  try {
+    const body: unknown = JSON.parse(text);
+    return body && typeof body === "object" && !Array.isArray(body) ? (body as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+function bearer(req: Request): string | null {
+  const match = /^Bearer\s+(\S+)$/i.exec(req.headers.get("authorization") ?? "");
+  return match?.[1] ?? null;
+}
+
+const describe = (error: unknown) => (error instanceof Error ? `${error.name}: ${error.message}` : "unknown error");
+
+export async function handle(req: Request, deps: HandlerDeps): Promise<Response> {
+  try {
+    return await route(req, deps);
+  } catch (error) {
+    // e.g. APPLE_PRIVATE_KEY isn't a P-256 key, or the database is unreachable.
+    deps.log(`genesis-apple-revoke: failed: ${describe(error)}`);
+    return json(500, { error: "internal" });
+  }
+}
+
+async function route(req: Request, deps: HandlerDeps): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS });
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" });
+  const body = await readBody(req);
+  if (!body) return json(400, { error: "bad_request" });
+
+  const apple = readAppleConfig(deps.env);
+  if (!apple.config) {
+    // Loud in the logs, by name only: a missing secret must not pass for a revoked token.
+    deps.log(`genesis-apple-revoke: not configured; set ${apple.problems.join(", ")}`);
+    return json(500, { error: "not_configured" });
+  }
+
+  if (body.action === "store") return store(req, body, apple.config, deps);
+  if (body.action === "revoke") {
+    const work = revokeDue(apple.config, deps);
+    if (deps.background) {
+      // The app waits on this right after deleting the account: answer now, finish the batch after.
+      deps.background(work);
+      return json(202, { ok: true });
+    }
+    await work;
+    return json(200, { ok: true });
+  }
+  return json(400, { error: "bad_request" });
+}
+
+async function store(req: Request, body: Record<string, unknown>, config: AppleConfig, deps: HandlerDeps): Promise<Response> {
+  const token = bearer(req);
+  const user = token ? await deps.getUser(token).catch(() => null) : null;
+  if (!user) return json(401, { error: "not_signed_in" });
+
+  const code = body.code;
+  if (typeof code !== "string" || !CODE.test(code)) return json(400, { error: "bad_request" });
+  const clientId = body.clientId === undefined || body.clientId === null ? config.clientIds[0]! : body.clientId;
+  if (typeof clientId !== "string" || !config.clientIds.includes(clientId)) {
+    deps.log(`genesis-apple-revoke: a store named a client id outside APPLE_CLIENT_IDS; add every bundle id the app signs in with (each build variant too)`);
+    return json(400, { error: "unknown_client" });
+  }
+  if (user.appleUserIds.length === 0) return json(403, { error: "no_apple_identity" });
+
+  const exchanged = await exchangeAuthorizationCode(config, clientId, code, deps.fetch);
+  if (!exchanged.ok) {
+    deps.log(`genesis-apple-revoke: code exchange failed for ${clientId}: ${exchanged.error}${exchanged.status ? ` (HTTP ${exchanged.status})` : ""}`);
+    // Apple minted a token whose id token we refused: revoke it rather than drop it.
+    if (exchanged.mintedRefreshToken) await revokeMinted(config, clientId, exchanged.mintedRefreshToken, deps);
+    return json(502, { error: "exchange_failed", apple: exchanged.error });
+  }
+
+  // The code must belong to this login's Apple identity: otherwise someone
+  // could file another person's token under their own account.
+  if (!user.appleUserIds.includes(exchanged.appleUserId)) {
+    deps.log("genesis-apple-revoke: a code for another Apple account was refused");
+    await revokeMinted(config, clientId, exchanged.refreshToken, deps);
+    return json(403, { error: "apple_identity_mismatch" });
+  }
+  if (exchanged.refreshToken.length > MAX_REFRESH_TOKEN) {
+    // The column would refuse it (and a refused row's text can reach the database's log).
+    deps.log("genesis-apple-revoke: Apple's refresh token is longer than the table allows");
+    await revokeMinted(config, clientId, exchanged.refreshToken, deps);
+    return json(502, { error: "exchange_failed", apple: "bad_response" });
+  }
+
+  const saved = await deps.store.save(user.id, clientId, exchanged.refreshToken);
+  // The login was deleted while this ran: the token went to the queue, so revoke now.
+  if (saved === "queued") await revokeDue(config, deps);
+  return json(200, { ok: true });
+}
+
+/** Revokes a token this request minted and won't keep (it was just issued with these secrets, so a 200 is meaningful). */
+async function revokeMinted(config: AppleConfig, clientId: string, refreshToken: string, deps: HandlerDeps): Promise<void> {
+  const revoked = await revokeRefreshToken(config, clientId, refreshToken, deps.fetch);
+  if (!revoked.ok) deps.log(`genesis-apple-revoke: couldn't revoke a token it refused to keep: ${revoked.error}`);
+}
+
+/**
+ * Works through due revocations. Each token is first checked at /auth/token
+ * (`checkRefreshToken`), because /auth/revoke's 200 proves nothing on its
+ * own: live → revoke, and only a 200 then forgets the row; already dead
+ * (`invalid_grant`) → nothing to revoke, forget it; anything else (wrong
+ * secrets, Apple down) → retry later. Returns the counts, for logs and tests.
+ */
+export async function revokeDue(config: AppleConfig, deps: HandlerDeps): Promise<{ revoked: number; gone: number; failed: number }> {
+  const counts = { revoked: 0, gone: 0, failed: 0 };
+  let due: DueRevocation[];
+  try {
+    due = await deps.store.claim(REVOKE_BATCH);
+  } catch (error) {
+    deps.log(`genesis-apple-revoke: couldn't read the queue: ${describe(error)}`);
+    return counts;
+  }
+  for (const row of due) {
+    // One row's trouble never stops the rest; a row whose result wasn't
+    // recorded comes round again when its lease ends.
+    try {
+      const check = await checkRefreshToken(config, row.client_id, row.refresh_token, deps.fetch);
+      if (!check.ok && check.error === "invalid_grant") {
+        await deps.store.done(row.id);
+        counts.gone++;
+        continue;
+      }
+      const result = check.ok ? await revokeRefreshToken(config, row.client_id, row.refresh_token, deps.fetch) : check;
+      if (result.ok) {
+        await deps.store.done(row.id);
+        counts.revoked++;
+        continue;
+      }
+      const why = `${check.ok ? "revoke" : "check"}: ${result.error}${result.status ? ` (HTTP ${result.status})` : ""}`;
+      counts.failed++;
+      const next = await deps.store.failed(row.id, why);
+      deps.log(
+        next === "gave_up"
+          ? `genesis-apple-revoke: GAVE UP on revocation ${row.id} for ${row.client_id} after ${row.attempts} attempts (${why}); its token is dropped and the row kept as a record`
+          : `genesis-apple-revoke: revocation ${row.id} for ${row.client_id} failed (attempt ${row.attempts}): ${why}; it will be retried`,
+      );
+    } catch (error) {
+      counts.failed++;
+      deps.log(`genesis-apple-revoke: revocation ${row.id} couldn't be recorded: ${describe(error)}; it will be retried`);
+    }
+  }
+  if (due.length) deps.log(`genesis-apple-revoke: ${counts.revoked} revoked, ${counts.gone} already invalid, ${counts.failed} failed`);
+  return counts;
+}

package/functions/genesis-apple-revoke/index.ts

@@ -0,0 +1,55 @@
+// genesis-apple-revoke: keeps Sign in with Apple refresh tokens server-side and
+// revokes them when the account is deleted (App Store Review Guideline 5.1.1(v)).
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0003 (see the package README).
+//
+// Secrets (`supabase secrets set …`): APPLE_TEAM_ID, APPLE_KEY_ID,
+// APPLE_PRIVATE_KEY (the .p8 file's text) and APPLE_CLIENT_IDS (your bundle ids,
+// comma-separated). SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are set by
+// Supabase. Deploy with `--no-verify-jwt` (or `verify_jwt = false` in
+// config.toml): the store action checks the caller itself, and the revoke
+// action must run after the caller's login is gone.
+import { createClient } from "npm:@supabase/supabase-js@2.118.0";
+import { handle, type CallerUser, type DueRevocation, type TokenStore } from "./handler.ts";
+
+const url = Deno.env.get("SUPABASE_URL") ?? "";
+const serviceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "";
+const admin = createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
+
+async function rpc<T>(fn: string, args: Record<string, unknown>): Promise<T> {
+  const { data, error } = await admin.rpc(fn, args);
+  if (error) throw new Error(`${fn}: ${error.code ?? ""} ${error.message}`);
+  return data as T;
+}
+
+const store: TokenStore = {
+  save: (userId, clientId, refreshToken) =>
+    rpc<"stored" | "queued">("genesis_apple_token_save", { p_user_id: userId, p_client_id: clientId, p_refresh_token: refreshToken }),
+  claim: (limit) => rpc<DueRevocation[]>("genesis_apple_revocations_claim", { p_limit: limit }),
+  done: (id) => rpc<void>("genesis_apple_revocation_done", { p_id: id }),
+  failed: (id, error) => rpc<"retry" | "gave_up">("genesis_apple_revocation_failed", { p_id: id, p_error: error }),
+};
+
+async function getUser(accessToken: string): Promise<CallerUser | null> {
+  const { data, error } = await admin.auth.getUser(accessToken);
+  if (error || !data.user) return null;
+  const appleUserIds = (data.user.identities ?? [])
+    .filter((i) => i.provider === "apple")
+    .map((i) => (typeof i.identity_data?.sub === "string" ? i.identity_data.sub : i.id))
+    .filter((sub): sub is string => typeof sub === "string" && sub.length > 0);
+  return { id: data.user.id, appleUserIds };
+}
+
+const runtime = (globalThis as { EdgeRuntime?: { waitUntil(work: Promise<unknown>): void } }).EdgeRuntime;
+
+Deno.serve((req) =>
+  handle(req, {
+    env: (name) => Deno.env.get(name),
+    fetch,
+    getUser,
+    store,
+    log: (message) => console.error(message),
+    // Supabase's edge runtime keeps the worker alive for this after the response.
+    background: runtime?.waitUntil ? (work) => runtime.waitUntil(work) : undefined,
+  }),
+);

package/functions/genesis-push-send/expo.ts

@@ -0,0 +1,117 @@
+/**
+ * Expo's push service, as the genesis-push-send function uses it:
+ * https://docs.expo.dev/push-notifications/sending-notifications/
+ *
+ *   POST /--/api/v2/push/send          up to 100 messages; one ticket each, in order
+ *   POST /--/api/v2/push/getReceipts   up to 1000 ticket ids; a receipt for each one ready
+ *
+ * Nothing here logs: a caller that logs uses `describeExpoError`, which
+ * names a status and Expo's error code, never a token or a message body.
+ */
+
+export const EXPO_SEND_URL = "https://exp.host/--/api/v2/push/send";
+export const EXPO_RECEIPTS_URL = "https://exp.host/--/api/v2/push/getReceipts";
+/** Expo takes up to 100 messages per send request. */
+export const EXPO_SEND_BATCH = 100;
+/** And up to 1000 ticket ids per receipts request. */
+export const EXPO_RECEIPTS_BATCH = 1000;
+const CALL_TIMEOUT_MS = 15_000;
+
+/** One message for Expo. `data` reaches the app (`notification.request.content.data`), not the screen. */
+export interface ExpoMessage {
+  to: string;
+  title?: string;
+  subtitle?: string;
+  body?: string;
+  data?: Record<string, unknown>;
+  sound?: "default" | null;
+  badge?: number;
+  /** Android: the notification channel (the app creates one per category). */
+  channelId?: string;
+  /** Seconds Apple and Google keep trying an offline phone. */
+  ttl?: number;
+  priority?: "default" | "normal" | "high";
+}
+
+/** Expo's answer for one message. */
+export type ExpoTicket =
+  | { status: "ok"; id: string }
+  | { status: "error"; message?: string; details?: { error?: string } };
+
+/** Expo's later word on one ticket. */
+export type ExpoReceipt = { status: "ok" } | { status: "error"; message?: string; details?: { error?: string } };
+
+/** Expo answered a whole request with an error status. */
+export class ExpoHttpError extends Error {
+  constructor(readonly status: number) {
+    super(`Expo push answered HTTP ${status}`);
+    this.name = "ExpoHttpError";
+  }
+}
+
+/**
+ * Expo refused the request itself (a 4xx other than 429), as it does for a
+ * batch that mixes projects. A timeout, a 429 or a 5xx may have been accepted
+ * or may recur, so those are never resent one by one.
+ */
+export function refusedOutright(error: unknown): boolean {
+  return error instanceof ExpoHttpError && error.status >= 400 && error.status < 500 && error.status !== 429;
+}
+
+/** An Expo error code (`DeviceNotRegistered`), safe to store and log; anything else becomes `Unknown`. */
+export function errorCode(value: { details?: { error?: string } } | undefined): string {
+  const code = value?.details?.error;
+  return typeof code === "string" && /^[A-Za-z_]{1,64}$/.test(code) ? code : "Unknown";
+}
+
+function headers(accessToken: string | undefined): Record<string, string> {
+  return {
+    accept: "application/json",
+    "content-type": "application/json",
+    ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
+  };
+}
+
+async function post(fetchFn: typeof fetch, url: string, body: unknown, accessToken: string | undefined): Promise<unknown> {
+  const response = await fetchFn(url, {
+    method: "POST",
+    headers: headers(accessToken),
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+  });
+  // The body of an error is never read: it can echo the request back.
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => {});
+    throw new ExpoHttpError(response.status);
+  }
+  return response.json();
+}
+
+/** Sends one batch (at most 100) and returns a ticket per message, in order. */
+export async function sendBatch(fetchFn: typeof fetch, messages: ExpoMessage[], accessToken?: string): Promise<ExpoTicket[]> {
+  if (messages.length > EXPO_SEND_BATCH) throw new Error(`sendBatch: at most ${EXPO_SEND_BATCH} messages`);
+  const json = (await post(fetchFn, EXPO_SEND_URL, messages, accessToken)) as { data?: unknown };
+  const tickets = Array.isArray(json?.data) ? (json.data as ExpoTicket[]) : [];
+  // A short or malformed answer: the messages without a ticket count as failed, never as sent.
+  return messages.map((_, i) => {
+    const ticket = tickets[i];
+    if (ticket && ticket.status === "ok" && typeof ticket.id === "string" && ticket.id.length > 0 && ticket.id.length <= 128) return ticket;
+    if (ticket && ticket.status === "error") return ticket;
+    return { status: "error", details: { error: "NoTicket" } };
+  });
+}
+
+/** Receipts for up to 1000 ticket ids; ids Expo has no receipt for yet are left out. */
+export async function getReceipts(fetchFn: typeof fetch, ids: string[], accessToken?: string): Promise<Record<string, ExpoReceipt>> {
+  if (ids.length > EXPO_RECEIPTS_BATCH) throw new Error(`getReceipts: at most ${EXPO_RECEIPTS_BATCH} ids`);
+  const json = (await post(fetchFn, EXPO_RECEIPTS_URL, { ids }, accessToken)) as { data?: unknown };
+  const data = json?.data;
+  return data && typeof data === "object" && !Array.isArray(data) ? (data as Record<string, ExpoReceipt>) : {};
+}
+
+/** A failed call, for a log line: the status or the error's name, never the request. */
+export function describeExpoError(error: unknown): string {
+  if (error instanceof ExpoHttpError) return `HTTP ${error.status}`;
+  if (error instanceof Error) return error.name === "TimeoutError" || error.name === "AbortError" ? "timeout" : error.name;
+  return "unknown error";
+}