@octane-xplat/auth 0.0.1 → 0.9.0

package/src/apple.ts

@@ -0,0 +1,95 @@
+// Sign in with Apple — native leaf over @nativescript/apple-sign-in.
+// iOS runs ASAuthorizationAppleIDProvider directly (entitlement-driven, no
+// configure step); the plugin's Android module is a stub that reports
+// unsupported, which this leaf surfaces as `supported: false` + an error
+// result rather than a throw.
+import { SignIn } from '@nativescript/apple-sign-in'
+import type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleSignInOptions,
+	AuthCredential,
+	SignInResult,
+} from './types'
+
+function isCancel(error: unknown): boolean {
+	// ASAuthorizationErrorCanceled = 1001 (NSError.code via SignInError.native).
+	const code = (error as any)?.native?.code ?? (error as any)?.code
+	if (code === 1001) {
+		return true
+	}
+
+	return /cancel/i.test(String((error as any)?.message ?? error))
+}
+
+function toCredential(user: any): AuthCredential {
+	const fullName = user.fullName
+	const name = [fullName?.givenName, fullName?.familyName].filter(Boolean).join(' ') || undefined
+	return {
+		provider: 'apple',
+		idToken: user.identityToken ?? undefined,
+		authorizationCode: user.authorizationCode ?? undefined,
+		scopes: (user.authorizedScopes ?? []).map((s: string) =>
+			s === 'EMAIL' ? 'email' : s === 'FULL_NAME' ? 'name' : s,
+		),
+		user: {
+			id: user.user,
+			email: user.email ?? undefined,
+			name,
+			givenName: fullName?.givenName ?? undefined,
+			familyName: fullName?.familyName ?? undefined,
+		},
+	}
+}
+
+export const appleAuth: AppleAuth = {
+	supported: SignIn.isSupported(),
+	configure(_config: AppleAuthConfig) {
+		// No native configuration — the flow is bound to the app id entitlement.
+	},
+	async signIn(options?: AppleSignInOptions): Promise<SignInResult> {
+		if (!SignIn.isSupported()) {
+			return {
+				status: 'error',
+				message: 'Sign in with Apple needs iOS 13+ (unsupported on Android)',
+			}
+		}
+
+		try {
+			const user = await SignIn.signIn({
+				// The plugin SHA-256s `nonce` before binding it into the request.
+				scopes: options?.scopes?.map((s) => (s === 'email' ? 'EMAIL' : 'FULL_NAME')) as any,
+				useNonce: options?.nonce !== undefined,
+				nonce: options?.nonce,
+			})
+
+			return { status: 'success', credential: toCredential(user) }
+		} catch (error) {
+			return isCancel(error)
+				? { status: 'cancelled' }
+				: { status: 'error', message: String((error as any)?.message ?? error) }
+		}
+	},
+	async getCredentialState(userId: string): Promise<AppleCredentialState> {
+		if (!SignIn.isSupported()) {
+			return 'unknown'
+		}
+
+		try {
+			const state = await SignIn.getState(userId)
+			switch (state) {
+				case 'Authorized':
+					return 'authorized'
+				case 'Revoked':
+					return 'revoked'
+				case 'Transferred':
+					return 'transferred'
+				default:
+					return 'notFound'
+			}
+		} catch {
+			return 'unknown'
+		}
+	},
+}

package/src/apple.web.ts

@@ -0,0 +1,114 @@
+// Sign in with Apple — web leaf over Apple's JS API
+// (appleid.cdn.apple.com/appleauth/js/jsapi/AppleID.auth.js), loaded lazily on
+// first use. The flow needs a Services ID (`clientId`) and a registered
+// `redirectURI` via `configure`; `usePopup` (default on) keeps the ceremony in
+// a popup so the app never leaves.
+import type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleSignInOptions,
+	AuthCredential,
+	SignInResult,
+} from './types'
+
+const APPLE_SDK_URL = 'https://appleid.cdn.apple.com/appleauth/js/jsapi/AppleID.auth.js'
+
+let config: AppleAuthConfig = {}
+let requestedScopes: string[] = []
+let sdkPromise: Promise<any> | null = null
+
+function loadSdk(): Promise<any> {
+	sdkPromise ??= new Promise((resolve, reject) => {
+		const script = document.createElement('script')
+		script.src = APPLE_SDK_URL
+		script.async = true
+		script.onload = () => resolve((globalThis as any).AppleID)
+		script.onerror = () => {
+			sdkPromise = null
+			reject(new Error('failed to load the Sign in with Apple JS SDK'))
+		}
+
+		document.head.appendChild(script)
+	})
+
+	return sdkPromise
+}
+
+function decodeJwt(token: string): Record<string, any> {
+	try {
+		const part = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')
+		return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(part), (c) => c.charCodeAt(0))))
+	} catch {
+		return {}
+	}
+}
+
+function toCredential(response: any): AuthCredential {
+	const auth = response?.authorization ?? {}
+	const claims = auth.id_token ? decodeJwt(auth.id_token) : {}
+	const name =
+		[response?.user?.name?.firstName, response?.user?.name?.lastName].filter(Boolean).join(' ') ||
+		undefined
+
+	return {
+		provider: 'apple',
+		idToken: auth.id_token ?? undefined,
+		authorizationCode: auth.code ?? undefined,
+		scopes: requestedScopes,
+		user: {
+			id: claims.sub ?? '',
+			email: response?.user?.email ?? claims.email ?? undefined,
+			name,
+			givenName: response?.user?.name?.firstName ?? undefined,
+			familyName: response?.user?.name?.lastName ?? undefined,
+		},
+	}
+}
+
+function isCancel(error: unknown): boolean {
+	const code = (error as any)?.error ?? (error as any)?.message ?? error
+	return /popup_closed_by_user|cancel/i.test(String(code))
+}
+
+export const appleAuth: AppleAuth = {
+	supported: typeof document !== 'undefined',
+	configure(next: AppleAuthConfig) {
+		config = { ...next }
+	},
+	async signIn(options?: AppleSignInOptions): Promise<SignInResult> {
+		if (!config.clientId || !config.redirectURI) {
+			return {
+				status: 'error',
+				message:
+					'appleAuth.configure({ clientId, redirectURI }) is required on web — the Services ID and a registered return URL',
+			}
+		}
+
+		try {
+			const sdk = await loadSdk()
+			requestedScopes = options?.scopes ?? ['name', 'email']
+			sdk.auth.init({
+				clientId: config.clientId,
+				scope: requestedScopes.join(' '),
+				redirectURI: config.redirectURI,
+				usePopup: config.usePopup !== false,
+				nonce: options?.nonce,
+			})
+
+			const response = await sdk.auth.signIn()
+			return { status: 'success', credential: toCredential(response) }
+		} catch (error) {
+			return isCancel(error)
+				? { status: 'cancelled' }
+				: {
+						status: 'error',
+						message: String((error as any)?.message ?? (error as any)?.error ?? error),
+					}
+		}
+	},
+	async getCredentialState(): Promise<AppleCredentialState> {
+		// The web SDK has no credential-state endpoint.
+		return 'unknown'
+	},
+}

package/src/google.macos.ts

@@ -0,0 +1,18 @@
+// Google Sign-In — macOS leaf. The AppKit host has no NativeScript plugin
+// runtime; apps that need Google sign-in on macOS run the hosted ceremony
+// through `@octane-xplat/platform`'s `authSession` instead.
+import type { GoogleAuth, SignInResult } from './types'
+
+const UNSUPPORTED: SignInResult = {
+	status: 'error',
+	message: 'Google Sign-In is unsupported by the AppKit host — use a hosted authSession flow',
+}
+
+export const googleAuth: GoogleAuth = {
+	supported: false,
+	async configure() {},
+	async signIn(): Promise<SignInResult> {
+		return UNSUPPORTED
+	},
+	async signOut() {},
+}

package/src/google.ts

@@ -0,0 +1,61 @@
+// Google Sign-In — native leaf over @nativescript/google-signin
+// (GIDSignIn on iOS, Credential Manager/Play services on Android). `configure`
+// forwards to the plugin — clientId is optional on iOS when GIDClientID sits
+// in Info.plist; Android resolves it from google-services resources.
+import { GoogleSignin } from '@nativescript/google-signin'
+import type { AuthCredential, GoogleAuth, GoogleAuthConfig, SignInResult } from './types'
+
+function isCancel(error: unknown): boolean {
+	const code =
+		(error as any)?.native?.code ?? // iOS: kGIDSignInErrorCodeCanceled = -5
+		(error as any)?.native?.getStatusCode?.() ?? // Android: ApiException
+		(error as any)?.code
+
+	if (code === -5 || code === 12501 /* SIGN_IN_CANCELLED */) {
+		return true
+	}
+
+	return /cancel/i.test(String((error as any)?.message ?? error))
+}
+
+function toCredential(user: any): AuthCredential {
+	return {
+		provider: 'google',
+		idToken: user.idToken || undefined,
+		accessToken: user.accessToken || undefined,
+		authorizationCode: user.serverAuthCode || undefined,
+		scopes: user.grantedScopes ?? [],
+		user: {
+			id: user.id,
+			email: user.email || undefined,
+			name: user.displayName || undefined,
+			givenName: user.givenName || undefined,
+			familyName: user.familyName || undefined,
+			photoUrl: user.photoUrl || undefined,
+		},
+	}
+}
+
+export const googleAuth: GoogleAuth = {
+	supported: true,
+	async configure(config?: GoogleAuthConfig) {
+		await GoogleSignin.configure(config)
+	},
+	async signIn(): Promise<SignInResult> {
+		try {
+			const user = await GoogleSignin.signIn()
+			return { status: 'success', credential: toCredential(user) }
+		} catch (error) {
+			return isCancel(error)
+				? { status: 'cancelled' }
+				: { status: 'error', message: String((error as any)?.message ?? error) }
+		}
+	},
+	async signOut() {
+		try {
+			await GoogleSignin.signOut()
+		} catch {
+			// A failed sign-out just means the next signIn re-shows the chooser.
+		}
+	},
+}

package/src/google.web.ts

@@ -0,0 +1,167 @@
+// Google Sign-In — web leaf over Google Identity Services
+// (accounts.google.com/gsi/client) in id_token mode, loaded lazily on first
+// use. Headless `signIn` drives One Tap (`google.accounts.id.prompt`); the
+// `GoogleSignInButton` leaf renders the official button via `renderButton`,
+// which is the reliable interactive path — One Tap can be skipped/cancelled
+// without user intent when there is no Google session.
+import type {
+	AuthCredential,
+	GoogleAuth,
+	GoogleAuthConfig,
+	GoogleSignInOptions,
+	SignInResult,
+} from './types'
+
+const GIS_URL = 'https://accounts.google.com/gsi/client'
+
+let config: GoogleAuthConfig = {}
+let sdkPromise: Promise<any> | null = null
+let credentialResolve: ((result: SignInResult) => void) | null = null
+let configuredNonce: string | undefined
+
+function loadSdk(): Promise<any> {
+	sdkPromise ??= new Promise((resolve, reject) => {
+		const script = document.createElement('script')
+		script.src = GIS_URL
+		script.async = true
+		script.onload = () => resolve((globalThis as any).google)
+		script.onerror = () => {
+			sdkPromise = null
+			reject(new Error('failed to load the Google Identity Services SDK'))
+		}
+
+		document.head.appendChild(script)
+	})
+
+	return sdkPromise
+}
+
+function decodeJwt(token: string): Record<string, any> {
+	try {
+		const part = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')
+		return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(part), (c) => c.charCodeAt(0))))
+	} catch {
+		return {}
+	}
+}
+
+function toCredential(response: any): AuthCredential {
+	const claims = decodeJwt(response?.credential ?? '')
+	return {
+		provider: 'google',
+		idToken: response?.credential ?? undefined,
+		scopes: claims.scope ? String(claims.scope).split(' ') : (config.scopes ?? []),
+		user: {
+			id: claims.sub ?? '',
+			email: claims.email ?? undefined,
+			name: claims.name ?? undefined,
+			givenName: claims.given_name ?? undefined,
+			familyName: claims.family_name ?? undefined,
+			photoUrl: claims.picture ?? undefined,
+		},
+	}
+}
+
+function initialize(google: any) {
+	google.accounts.id.initialize({
+		client_id: config.clientId,
+		callback: (response: any) => {
+			const resolve = credentialResolve
+			credentialResolve = null
+			resolve?.({ status: 'success', credential: toCredential(response) })
+		},
+		nonce: configuredNonce,
+		hosted_domain: config.hostedDomain,
+	})
+}
+
+/** Internal — the button leaf renders the official GIS button into `host`. */
+export async function renderGoogleButton(
+	host: HTMLElement,
+	options: {
+		theme?: 'dark' | 'light' | 'auto'
+		variant?: 'standard' | 'wide' | 'icon'
+		width?: number
+	},
+	onResult: (result: SignInResult) => void,
+): Promise<void> {
+	if (!config.clientId) {
+		onResult({
+			status: 'error',
+			message: 'googleAuth.configure({ clientId }) is required on web — the OAuth web client id',
+		})
+
+		return
+	}
+
+	try {
+		const google = await loadSdk()
+		initialize(google)
+		google.accounts.id.renderButton(host, {
+			type: options.variant === 'icon' ? 'icon' : 'standard',
+			theme: options.theme === 'dark' ? 'filled_black' : 'outline',
+			size: 'large',
+			width: options.width,
+		})
+
+		// The button's flow resolves through the initialize callback — park the
+		// consumer's onResult where the credential callback can find it. One
+		// flow at a time, matching the native ceremony.
+		credentialResolve = onResult
+	} catch (error) {
+		onResult({ status: 'error', message: String((error as any)?.message ?? error) })
+	}
+}
+
+export const googleAuth: GoogleAuth = {
+	supported: typeof document !== 'undefined',
+	async configure(next?: GoogleAuthConfig) {
+		config = { ...next }
+		configuredNonce = undefined
+	},
+	async signIn(options?: GoogleSignInOptions): Promise<SignInResult> {
+		if (!config.clientId) {
+			return {
+				status: 'error',
+				message: 'googleAuth.configure({ clientId }) is required on web — the OAuth web client id',
+			}
+		}
+
+		if (credentialResolve) {
+			return { status: 'error', message: 'a Google sign-in flow is already active' }
+		}
+
+		configuredNonce = options?.nonce
+		try {
+			const google = await loadSdk()
+			initialize(google)
+			return await new Promise<SignInResult>((resolve) => {
+				credentialResolve = resolve
+				google.accounts.id.prompt((notification: any) => {
+					if (
+						notification.isNotDisplayed?.() ||
+						notification.isSkippedMoment?.() ||
+						notification.isDismissedMoment?.()
+					) {
+						if (credentialResolve === resolve) {
+							credentialResolve = null
+							resolve({ status: 'cancelled' })
+						}
+					}
+				})
+			})
+		} catch (error) {
+			return { status: 'error', message: String((error as any)?.message ?? error) }
+		}
+	},
+	async signOut() {
+		// GIS id-token mode keeps no session — clearing Google's auto-select
+		// flag is the web equivalent of the native signOut.
+		try {
+			const google = await loadSdk()
+			google.accounts.id.disableAutoSelect()
+		} catch {
+			// Nothing to revoke — the credential is stateless.
+		}
+	},
+}

package/src/index.macos.ts

@@ -0,0 +1,19 @@
+export { appleAuth } from './apple.macos'
+export { googleAuth } from './google.macos'
+export { AppleSignInButton } from './AppleSignInButton.macos.tsrx'
+export { GoogleSignInButton } from './GoogleSignInButton.macos.tsrx'
+export type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleScope,
+	AppleSignInButtonProps,
+	AppleSignInOptions,
+	AuthCredential,
+	AuthUser,
+	GoogleAuth,
+	GoogleAuthConfig,
+	GoogleSignInButtonProps,
+	GoogleSignInOptions,
+	SignInResult,
+} from './types'

package/src/index.ts

@@ -0,0 +1,21 @@
+// Platform barrels — explicit .tsrx leaf imports (moduleSuffixes don't
+// reach .tsrx; same convention as @octane-xplat/ui index.*.ts).
+export { appleAuth } from './apple'
+export { googleAuth } from './google'
+export { AppleSignInButton } from './AppleSignInButton.tsrx'
+export { GoogleSignInButton } from './GoogleSignInButton.tsrx'
+export type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleScope,
+	AppleSignInButtonProps,
+	AppleSignInOptions,
+	AuthCredential,
+	AuthUser,
+	GoogleAuth,
+	GoogleAuthConfig,
+	GoogleSignInButtonProps,
+	GoogleSignInOptions,
+	SignInResult,
+} from './types'

package/src/index.web.ts

@@ -0,0 +1,21 @@
+// Platform barrels — explicit .tsrx leaf imports (moduleSuffixes don't
+// reach .tsrx; same convention as @octane-xplat/ui index.*.ts).
+export { appleAuth } from './apple.web'
+export { googleAuth } from './google.web'
+export { AppleSignInButton } from './AppleSignInButton.web.tsrx'
+export { GoogleSignInButton } from './GoogleSignInButton.web.tsrx'
+export type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleScope,
+	AppleSignInButtonProps,
+	AppleSignInOptions,
+	AuthCredential,
+	AuthUser,
+	GoogleAuth,
+	GoogleAuthConfig,
+	GoogleSignInButtonProps,
+	GoogleSignInOptions,
+	SignInResult,
+} from './types'

package/src/native-elements.d.ts

@@ -0,0 +1,10 @@
+import { SignInButton } from '@nativescript/apple-sign-in'
+import { GoogleSignInButton } from '@nativescript/google-signin'
+import type { Attributes } from '@nativescript-community/octane/intrinsics'
+
+declare module '@nativescript-community/octane/intrinsics' {
+	interface NativeScriptElements {
+		applesigninbutton: Attributes<typeof SignInButton>
+		googlesigninbutton: Attributes<typeof GoogleSignInButton>
+	}
+}

package/src/types.ts

@@ -0,0 +1,147 @@
+// Shared contract for @octane-xplat/auth — identical exports across platform
+// leaves (invariant #9). The platform modules (apple.ts / apple.web.ts /
+// apple.macos.ts, google.*) are implementation swaps behind this one API.
+
+/** The account the provider authenticated. */
+export interface AuthUser {
+	/** Stable subject id — Apple `user`, Google `id` (id-token `sub`). */
+	id: string
+	email?: string
+	/**
+	 * Best-effort display name. Apple only returns name parts on the first
+	 * authorization for an account — expect `undefined` on repeat sign-ins.
+	 */
+	name?: string
+	givenName?: string
+	familyName?: string
+	/** Google only. */
+	photoUrl?: string
+}
+
+/** The provider credential — hand it to your backend for verification. */
+export interface AuthCredential {
+	provider: 'apple' | 'google'
+	/** OIDC ID token (JWT). Apple `identityToken`; Google `idToken` / GIS `credential`. */
+	idToken?: string
+	/**
+	 * Server-side exchange code — Apple `authorizationCode`; Google
+	 * `serverAuthCode` (requires `serverClientId` in `GoogleAuthConfig`).
+	 */
+	authorizationCode?: string
+	/** Google only — short-lived API access token. */
+	accessToken?: string
+	/** Granted scopes where the provider reports them. */
+	scopes: string[]
+	user: AuthUser
+}
+
+export type SignInResult =
+	| { status: 'success'; credential: AuthCredential }
+	/** The user dismissed the flow, or it ended without a credential. */
+	| { status: 'cancelled' }
+	| { status: 'error'; message: string }
+
+export type AppleScope = 'email' | 'name'
+
+export interface AppleAuthConfig {
+	/**
+	 * Web only — the Services ID registered in the Apple developer portal
+	 * (e.g. `com.example.app.web`). Required on web; ignored natively, where
+	 * the app id + `com.apple.developer.applesignin` entitlement is the client.
+	 */
+	clientId?: string
+	/** Web only — a return URL registered on the Services ID. */
+	redirectURI?: string
+	/** Web only — run the flow in a popup instead of a full-page redirect (default true). */
+	usePopup?: boolean
+}
+
+export interface AppleSignInOptions {
+	/** Apple data to request — maps to `EMAIL`/`FULL_NAME` native scopes. */
+	scopes?: AppleScope[]
+	/** Nonce bound into the credential — pass the value your backend issued. */
+	nonce?: string
+}
+
+export type AppleCredentialState =
+	| 'authorized'
+	| 'revoked'
+	| 'notFound'
+	| 'transferred'
+	/** Anywhere the state check can't run — Android, web. */
+	| 'unknown'
+
+export interface AppleAuth {
+	/**
+	 * Whether the provider's native SDK can run here — iOS 13+ and the macOS
+	 * AppKit host (AuthenticationServices via the ObjC bridge; the packaged
+	 * app needs the applesignin entitlement for the sheet to complete).
+	 * False on Android. On web it reports whether a browser runtime exists;
+	 * `configure` still needs a `clientId` before `signIn` will succeed.
+	 */
+	readonly supported: boolean
+	/** Store configuration; the platform SDK loads lazily on first use. */
+	configure(config: AppleAuthConfig): void
+	signIn(options?: AppleSignInOptions): Promise<SignInResult>
+	/** iOS and macOS — credential state for a prior `user.id`. */
+	getCredentialState(userId: string): Promise<AppleCredentialState>
+}
+
+export interface GoogleAuthConfig {
+	/**
+	 * OAuth client id — the web client id on web (required there). On iOS it
+	 * is optional when `GIDClientID` is in the app's Info.plist; on Android the
+	 * id comes from the google-services resources.
+	 */
+	clientId?: string
+	/** Your backend's web client id — makes credentials carry `authorizationCode` (server auth code). */
+	serverClientId?: string
+	scopes?: string[]
+	/** Restrict to a Google Workspace domain. */
+	hostedDomain?: string
+}
+
+export interface GoogleSignInOptions {
+	/**
+	 * Web only — nonce bound into the id token. Scope requests go through
+	 * `GoogleAuthConfig.scopes`; neither provider SDK takes per-call scopes.
+	 */
+	nonce?: string
+}
+
+export interface GoogleAuth {
+	/**
+	 * Whether the provider SDK can run here — iOS/Android + browsers. False on
+	 * macOS (use a hosted `authSession` flow instead). Android devices without
+	 * Play services still report true — the sign-in call surfaces the failure.
+	 */
+	readonly supported: boolean
+	configure(config?: GoogleAuthConfig): Promise<void>
+	signIn(options?: GoogleSignInOptions): Promise<SignInResult>
+	/** Clear the SDK's account selection so the next `signIn` re-prompts. */
+	signOut(): Promise<void>
+}
+
+interface SignInButtonBaseProps {
+	id?: string
+	className?: any
+	style?: any
+	disabled?: boolean
+	/** Tap hook — fires alongside the sign-in flow (not a gate). */
+	onPress?: () => void
+	/** Called with the outcome of the flow the button started. */
+	onResult?: (result: SignInResult) => void
+}
+
+export interface AppleSignInButtonProps extends SignInButtonBaseProps {
+	/** Label variant — 'default' is "Sign in with Apple". */
+	type?: 'default' | 'signUp' | 'continue'
+	theme?: 'black' | 'white' | 'whiteOutline'
+}
+
+export interface GoogleSignInButtonProps extends SignInButtonBaseProps {
+	/** Native button color scheme — 'dark'/'light'/'auto'. */
+	theme?: 'dark' | 'light' | 'auto'
+	/** 'wide' and 'icon' are native-only shapes; web renders 'standard'. */
+	variant?: 'standard' | 'wide' | 'icon'
+}

package/types/generated/.tsrx-typegen-manifest.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "files": [
+    "AppleSignInButton.d.ts",
+    "AppleSignInButton.web.d.ts",
+    "GoogleSignInButton.d.ts",
+    "GoogleSignInButton.web.d.ts",
+    "apple.d.ts",
+    "apple.web.d.ts",
+    "google.d.ts",
+    "google.web.d.ts",
+    "index.d.ts",
+    "index.web.d.ts",
+    "types.d.ts"
+  ]
+}