@shware/security 4.0.0 → 5.0.0

package/dist/oauth2/name.d.cts

@@ -0,0 +1,49 @@
+import { PersonNameComponents, StandardClaims } from "./types.cjs";
+//#region src/oauth2/name.d.ts
+/**
+ * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+ * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+ * are capped before a host stores them; 64 leaves room for any real given or family name.
+ */
+export declare const MAX_NAME_PART_LENGTH = 64;
+/**
+ * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+ * Japanese and Korean names are written family name first without a space (`王小明`), every other
+ * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+ * one part only, that part is the name.
+ */
+export declare function composeName({ given_name, family_name }: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined;
+/**
+ * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+ * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+ * because the name is a nicety and must never cost the user their login.
+ */
+export declare function cleanNamePart(value: unknown): string | undefined;
+/** Name parts as Apple's form_post `user` carries them, after cleaning. */
+export interface AppleUser {
+  name?: {
+    firstName?: string;
+    lastName?: string;
+  };
+  email?: string;
+}
+/**
+ * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+ * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+ * persists stays small.
+ */
+export declare function parseAppleUser(raw: string | undefined): AppleUser | undefined;
+/**
+ * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+ * each a cleaned string; `undefined` when nothing usable is left.
+ */
+export declare function cleanPersonName(value: unknown): PersonNameComponents | undefined;
+type NameClaims = Pick<StandardClaims, 'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'>;
+/**
+ * The standard name claims from cleaned parts, with `name` composed from given and family name.
+ * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+ */
+export declare function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims;
+//#endregion
+export {};
+//# sourceMappingURL=name.d.cts.map

package/dist/oauth2/name.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.d.cts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}

package/dist/oauth2/name.d.mts

@@ -0,0 +1,49 @@
+import { PersonNameComponents, StandardClaims } from "./types.mjs";
+//#region src/oauth2/name.d.ts
+/**
+ * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+ * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+ * are capped before a host stores them; 64 leaves room for any real given or family name.
+ */
+export declare const MAX_NAME_PART_LENGTH = 64;
+/**
+ * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+ * Japanese and Korean names are written family name first without a space (`王小明`), every other
+ * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+ * one part only, that part is the name.
+ */
+export declare function composeName({ given_name, family_name }: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined;
+/**
+ * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+ * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+ * because the name is a nicety and must never cost the user their login.
+ */
+export declare function cleanNamePart(value: unknown): string | undefined;
+/** Name parts as Apple's form_post `user` carries them, after cleaning. */
+export interface AppleUser {
+  name?: {
+    firstName?: string;
+    lastName?: string;
+  };
+  email?: string;
+}
+/**
+ * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+ * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+ * persists stays small.
+ */
+export declare function parseAppleUser(raw: string | undefined): AppleUser | undefined;
+/**
+ * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+ * each a cleaned string; `undefined` when nothing usable is left.
+ */
+export declare function cleanPersonName(value: unknown): PersonNameComponents | undefined;
+type NameClaims = Pick<StandardClaims, 'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'>;
+/**
+ * The standard name claims from cleaned parts, with `name` composed from given and family name.
+ * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+ */
+export declare function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims;
+//#endregion
+export {};
+//# sourceMappingURL=name.d.mts.map

package/dist/oauth2/name.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.d.mts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}

package/dist/oauth2/name.mjs

@@ -0,0 +1,101 @@
+//#region src/oauth2/name.ts
+/**
+* Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+* a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+* are capped before a host stores them; 64 leaves room for any real given or family name.
+*/
+const MAX_NAME_PART_LENGTH = 64;
+/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */
+const MAX_APPLE_USER_LENGTH = 1024;
+const CJK = /^[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]+$/u;
+/**
+* Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+* Japanese and Korean names are written family name first without a space (`王小明`), every other
+* name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+* one part only, that part is the name.
+*/
+function composeName({ given_name, family_name }) {
+	const given = given_name?.trim();
+	const family = family_name?.trim();
+	if (given && family) return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;
+	return given || family || void 0;
+}
+/**
+* One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+* characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+* because the name is a nicety and must never cost the user their login.
+*/
+function cleanNamePart(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return Array.from(trimmed).slice(0, 64).join("");
+}
+/**
+* Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+* yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+* persists stays small.
+*/
+function parseAppleUser(raw) {
+	if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isObject(json)) return void 0;
+	const user = {};
+	if (isObject(json.name)) {
+		const firstName = cleanNamePart(json.name.firstName);
+		const lastName = cleanNamePart(json.name.lastName);
+		if (firstName || lastName) user.name = withoutUndefined({
+			firstName,
+			lastName
+		});
+	}
+	const email = typeof json.email === "string" ? json.email.trim().slice(0, 320) : void 0;
+	if (email) user.email = email;
+	return user.name || user.email ? user : void 0;
+}
+const PERSON_NAME_KEYS = [
+	"givenName",
+	"familyName",
+	"middleName",
+	"namePrefix",
+	"nameSuffix",
+	"nickname"
+];
+/**
+* Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+* each a cleaned string; `undefined` when nothing usable is left.
+*/
+function cleanPersonName(value) {
+	if (!isObject(value)) return void 0;
+	const name = {};
+	for (const key of PERSON_NAME_KEYS) {
+		const part = cleanNamePart(value[key]);
+		if (part) name[key] = part;
+	}
+	return Object.keys(name).length > 0 ? name : void 0;
+}
+/**
+* The standard name claims from cleaned parts, with `name` composed from given and family name.
+* Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+*/
+function nameClaims(parts) {
+	return withoutUndefined({
+		...parts,
+		name: composeName(parts)
+	});
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+//#endregion
+export { MAX_NAME_PART_LENGTH, cleanNamePart, cleanPersonName, composeName, nameClaims, parseAppleUser };
+
+//# sourceMappingURL=name.mjs.map

package/dist/oauth2/name.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.mjs","names":[],"sources":["../../src/oauth2/name.ts"],"sourcesContent":["import type { PersonNameComponents, StandardClaims } from './types';\n\n/**\n * Upper bound, in characters, on each name part taken from the client. Names that reach us outside\n * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they\n * are capped before a host stores them; 64 leaves room for any real given or family name.\n */\nexport const MAX_NAME_PART_LENGTH = 64;\n\n/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */\nconst MAX_APPLE_USER_LENGTH = 1024;\n\nconst CJK = /^[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]+$/u;\n\n/**\n * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,\n * Japanese and Korean names are written family name first without a space (`王小明`), every other\n * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With\n * one part only, that part is the name.\n */\nexport function composeName({\n  given_name,\n  family_name,\n}: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined {\n  const given = given_name?.trim();\n  const family = family_name?.trim();\n  if (given && family) {\n    return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;\n  }\n  return given || family || undefined;\n}\n\n/**\n * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`\n * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,\n * because the name is a nicety and must never cost the user their login.\n */\nexport function cleanNamePart(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  return Array.from(trimmed).slice(0, MAX_NAME_PART_LENGTH).join('');\n}\n\n/** Name parts as Apple's form_post `user` carries them, after cleaning. */\nexport interface AppleUser {\n  name?: { firstName?: string; lastName?: string };\n  email?: string;\n}\n\n/**\n * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape\n * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host\n * persists stays small.\n */\nexport function parseAppleUser(raw: string | undefined): AppleUser | undefined {\n  if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return undefined;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n  if (!isObject(json)) return undefined;\n  const user: AppleUser = {};\n  if (isObject(json.name)) {\n    const firstName = cleanNamePart(json.name.firstName);\n    const lastName = cleanNamePart(json.name.lastName);\n    if (firstName || lastName) user.name = withoutUndefined({ firstName, lastName });\n  }\n  // Kept as Apple sent it for the record only: the id token's email is signed, this one is not.\n  const email = typeof json.email === 'string' ? json.email.trim().slice(0, 320) : undefined;\n  if (email) user.email = email;\n  return user.name || user.email ? user : undefined;\n}\n\nconst PERSON_NAME_KEYS = [\n  'givenName',\n  'familyName',\n  'middleName',\n  'namePrefix',\n  'nameSuffix',\n  'nickname',\n] as const satisfies (keyof PersonNameComponents)[];\n\n/**\n * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,\n * each a cleaned string; `undefined` when nothing usable is left.\n */\nexport function cleanPersonName(value: unknown): PersonNameComponents | undefined {\n  if (!isObject(value)) return undefined;\n  const name: PersonNameComponents = {};\n  for (const key of PERSON_NAME_KEYS) {\n    const part = cleanNamePart(value[key]);\n    if (part) name[key] = part;\n  }\n  return Object.keys(name).length > 0 ? name : undefined;\n}\n\ntype NameClaims = Pick<\n  StandardClaims,\n  'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'\n>;\n\n/**\n * The standard name claims from cleaned parts, with `name` composed from given and family name.\n * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.\n */\nexport function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims {\n  return withoutUndefined({ ...parts, name: composeName(parts) });\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction withoutUndefined<T extends object>(value: T): T {\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as T;\n}\n"],"mappings":";;;;;;AAOA,MAAa,uBAAuB;;AAGpC,MAAM,wBAAwB;AAE9B,MAAM,MAAM;;;;;;;AAQZ,SAAgB,YAAY,EAC1B,YACA,eACyE;CACzE,MAAM,QAAQ,YAAY,KAAK;CAC/B,MAAM,SAAS,aAAa,KAAK;CACjC,IAAI,SAAS,QACX,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,UAAU,GAAG,MAAM,GAAG;CAEjF,OAAO,SAAS,UAAU,KAAA;AAC5B;;;;;;AAOA,SAAgB,cAAc,OAAoC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,GAAA,EAAuB,CAAC,CAAC,KAAK,EAAE;AACnE;;;;;;AAaA,SAAgB,eAAe,KAAgD;CAC7E,IAAI,CAAC,OAAO,IAAI,SAAS,uBAAuB,OAAO,KAAA;CACvD,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN;CACF;CACA,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,KAAA;CAC5B,MAAM,OAAkB,CAAC;CACzB,IAAI,SAAS,KAAK,IAAI,GAAG;EACvB,MAAM,YAAY,cAAc,KAAK,KAAK,SAAS;EACnD,MAAM,WAAW,cAAc,KAAK,KAAK,QAAQ;EACjD,IAAI,aAAa,UAAU,KAAK,OAAO,iBAAiB;GAAE;GAAW;EAAS,CAAC;CACjF;CAEA,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,KAAA;CACjF,IAAI,OAAO,KAAK,QAAQ;CACxB,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAA;AAC1C;AAEA,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,gBAAgB,OAAkD;CAChF,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,KAAA;CAC7B,MAAM,OAA6B,CAAC;CACpC,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,OAAO,cAAc,MAAM,IAAI;EACrC,IAAI,MAAM,KAAK,OAAO;CACxB;CACA,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA;AAC/C;;;;;AAWA,SAAgB,WAAW,OAA6C;CACtE,OAAO,iBAAiB;EAAE,GAAG;EAAO,MAAM,YAAY,KAAK;CAAE,CAAC;AAChE;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAmC,OAAa;CACvD,OAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AACpF"}

package/dist/oauth2/provider/apple-client-secret.cjs

@@ -8,9 +8,9 @@ let jose = require("jose");
 * differ only in `sub`.
 *
 * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
-* seconds before expiry, so the secret can be minted by the server at runtime (an
-* `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
-* rotated, as a static secret.
+* seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+* is called with each client's own id on every use, so the server mints the secrets at runtime
+* instead of generating, storing and rotating static ones by hand.
 */
 function createAppleClientSecret(options) {
 	const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;

package/dist/oauth2/provider/apple-client-secret.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.cjs","names":["importPKCS8","SignJWT"],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry, so the secret can be minted by the server at runtime (an\n * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and\n * rotated, as a static secret.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,SAAA,GAAQA,KAAAA,YAAAA,CAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAIC,KAAAA,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}
+{"version":3,"file":"apple-client-secret.cjs","names":["importPKCS8","SignJWT"],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it\n * is called with each client's own id on every use, so the server mints the secrets at runtime\n * instead of generating, storing and rotating static ones by hand.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,SAAA,GAAQA,KAAAA,YAAAA,CAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAIC,KAAAA,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}

package/dist/oauth2/provider/apple-client-secret.d.cts

@@ -18,9 +18,9 @@ export interface AppleClientSecretOptions {
  * differ only in `sub`.
  *
  * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
- * seconds before expiry, so the secret can be minted by the server at runtime (an
- * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
- * rotated, as a static secret.
+ * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+ * is called with each client's own id on every use, so the server mints the secrets at runtime
+ * instead of generating, storing and rotating static ones by hand.
  */
 export declare function createAppleClientSecret(options: AppleClientSecretOptions): (clientId: string) => Promise<string>;
 //#endregion

package/dist/oauth2/provider/apple-client-secret.d.mts

@@ -18,9 +18,9 @@ export interface AppleClientSecretOptions {
  * differ only in `sub`.
  *
  * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
- * seconds before expiry, so the secret can be minted by the server at runtime (an
- * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
- * rotated, as a static secret.
+ * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+ * is called with each client's own id on every use, so the server mints the secrets at runtime
+ * instead of generating, storing and rotating static ones by hand.
  */
 export declare function createAppleClientSecret(options: AppleClientSecretOptions): (clientId: string) => Promise<string>;
 //#endregion

package/dist/oauth2/provider/apple-client-secret.mjs

@@ -7,9 +7,9 @@ import { SignJWT, importPKCS8 } from "jose";
 * differ only in `sub`.
 *
 * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`
-* seconds before expiry, so the secret can be minted by the server at runtime (an
-* `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and
-* rotated, as a static secret.
+* seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it
+* is called with each client's own id on every use, so the server mints the secrets at runtime
+* instead of generating, storing and rotating static ones by hand.
 */
 function createAppleClientSecret(options) {
 	const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;

package/dist/oauth2/provider/apple-client-secret.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.mjs","names":[],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry, so the secret can be minted by the server at runtime (an\n * `OAuth2ClientConfig.registration` function) instead of being generated by hand and stored, and\n * rotated, as a static secret.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,QAAQ,YAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}
+{"version":3,"file":"apple-client-secret.mjs","names":[],"sources":["../../../src/oauth2/provider/apple-client-secret.ts"],"sourcesContent":["import { SignJWT, importPKCS8 } from 'jose';\n\nexport interface AppleClientSecretOptions {\n  /** Apple Developer Team ID (Membership details). */\n  teamId: string;\n  /** Key ID of a key with Sign in with Apple enabled (Certificates, Identifiers & Profiles → Keys). */\n  keyId: string;\n  /** Contents of that key's `.p8` file: a PKCS#8 PEM. */\n  privateKey: string;\n  /** Lifetime of each signed secret, in seconds. Apple caps it at six months. Default: one hour. */\n  expiresIn?: number;\n  /** Re-sign once fewer than this many seconds remain, so a cached secret never reaches Apple expired. Default: five minutes. */\n  renewBefore?: number;\n}\n\n/**\n * Sign in with Apple has no static client secret: the secret is a JWT the server signs with its\n * Sign in with Apple key (ES256, `iss` = team, `sub` = client id, `aud` = appleid.apple.com), and\n * a team signs one per client id — the app's bundle id and the web Services ID share the key and\n * differ only in `sub`.\n *\n * Returns `clientId => secret`, signing on demand and caching per client id until `renewBefore`\n * seconds before expiry. Pass it as the `clientSecret` of every Apple client (web and native): it\n * is called with each client's own id on every use, so the server mints the secrets at runtime\n * instead of generating, storing and rotating static ones by hand.\n */\nexport function createAppleClientSecret(options: AppleClientSecretOptions) {\n  const { teamId, keyId, privateKey, expiresIn = 3600, renewBefore = 300 } = options;\n  if (renewBefore >= expiresIn) {\n    throw new Error('renewBefore must be shorter than expiresIn');\n  }\n\n  // The import is cached as a promise so concurrent first calls share one; a failed import is\n  // dropped so the next call retries instead of failing forever.\n  let key: Promise<CryptoKey> | undefined;\n  const cache = new Map<string, { secret: string; exp: number }>();\n\n  function getKey() {\n    key ??= importPKCS8(privateKey, 'ES256').catch((error: unknown) => {\n      key = undefined;\n      throw error;\n    });\n    return key;\n  }\n\n  return async function appleClientSecret(clientId: string): Promise<string> {\n    const now = Math.floor(Date.now() / 1000);\n    const cached = cache.get(clientId);\n    if (cached && cached.exp - now > renewBefore) return cached.secret;\n\n    const exp = now + expiresIn;\n    const secret = await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: keyId })\n      .setIssuer(teamId)\n      .setSubject(clientId)\n      .setAudience('https://appleid.apple.com')\n      .setIssuedAt(now)\n      .setExpirationTime(exp)\n      .sign(await getKey());\n    cache.set(clientId, { secret, exp });\n    return secret;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,SAAgB,wBAAwB,SAAmC;CACzE,MAAM,EAAE,QAAQ,OAAO,YAAY,YAAY,MAAM,cAAc,QAAQ;CAC3E,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;CAK9D,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAA6C;CAE/D,SAAS,SAAS;EAChB,QAAQ,YAAY,YAAY,OAAO,CAAC,CAAC,OAAO,UAAmB;GACjE,MAAM,KAAA;GACN,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,OAAO,eAAe,kBAAkB,UAAmC;EACzE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,SAAS,MAAM,IAAI,QAAQ;EACjC,IAAI,UAAU,OAAO,MAAM,MAAM,aAAa,OAAO,OAAO;EAE5D,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACjC,mBAAmB;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAChD,UAAU,MAAM,CAAC,CACjB,WAAW,QAAQ,CAAC,CACpB,YAAY,2BAA2B,CAAC,CACxC,YAAY,GAAG,CAAC,CAChB,kBAAkB,GAAG,CAAC,CACtB,KAAK,MAAM,OAAO,CAAC;EACtB,MAAM,IAAI,UAAU;GAAE;GAAQ;EAAI,CAAC;EACnC,OAAO;CACT;AACF"}

package/dist/oauth2/provider/apple.cjs

@@ -1,8 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_oauth2_error = require("../error.cjs");
+const require_oauth2_name = require("../name.cjs");
 const require_oauth2_provider_common = require("./common.cjs");
 let _shware_utils = require("@shware/utils");
 //#region src/oauth2/provider/apple.ts
+/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */
+const APPLE_ISSUER = "https://appleid.apple.com";
 function createAppleProvider() {
 	return {
 		authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
@@ -32,20 +35,28 @@ function createAppleProvider() {
 			}
 			return await response.json();
 		},
-		async getUserInfo({ id_token }) {
+		async getUserInfo({ id_token }, { clientId, response }) {
 			(0, _shware_utils.invariant)(id_token, "id_token is required");
 			(0, _shware_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
-			const data = await require_oauth2_provider_common.verifyIdToken(id_token, this.jwkSetUri);
+			const token = await require_oauth2_provider_common.verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: APPLE_ISSUER,
+				audience: clientId
+			});
+			const user = require_oauth2_name.parseAppleUser(response?.user);
 			return {
-				data,
+				data: user ? {
+					...token,
+					user
+				} : token,
 				claims: {
-					sub: data.sub,
-					name: data.name,
-					email: data.email,
+					sub: token.sub,
+					email: token.email,
 					email_verified: true,
-					picture: data.picture,
-					given_name: data.user?.name.firstName,
-					family_name: data.user?.name.lastName
+					...require_oauth2_name.nameClaims({
+						given_name: user?.name?.firstName,
+						family_name: user?.name?.lastName
+					})
 				}
 			};
 		},
@@ -63,9 +74,26 @@ function createAppleProvider() {
 				throw new require_oauth2_error.OAuth2Error(response.status, error);
 			}
 			const token = await response.json();
+			const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });
+			const fullName = require_oauth2_name.cleanPersonName(credentials.fullName);
+			const name = require_oauth2_name.nameClaims({
+				given_name: fullName?.givenName ?? void 0,
+				family_name: fullName?.familyName ?? void 0,
+				middle_name: fullName?.middleName ?? void 0,
+				nickname: fullName?.nickname ?? void 0
+			});
 			return {
 				token,
-				userInfo: await this.getUserInfo(token)
+				userInfo: {
+					data: fullName ? {
+						...data,
+						fullName
+					} : data,
+					claims: {
+						...claims,
+						...name
+					}
+				}
 			};
 		}
 	};

package/dist/oauth2/provider/apple.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;AAMA,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY;GAC9B,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA6B,UAAU,KAAK,SAAS;GACxE,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,OAAO,KAAK;KACZ,gBAAgB;KAChB,SAAS,KAAK;KACd,YAAY,KAAK,MAAM,KAAK;KAC5B,aAAa,KAAK,MAAM,KAAK;IAC/B;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,KAAK;GACpB;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}
+{"version":3,"file":"apple.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken","parseAppleUser","nameClaims","cleanPersonName"],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAMC,+BAAAA,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAOC,oBAAAA,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAGC,oBAAAA,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAMJ,+BAAAA,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAWI,oBAAAA,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAOD,oBAAAA,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}

package/dist/oauth2/provider/apple.d.cts

@@ -1,25 +1,32 @@
-import { NativeCredential, OAuth2Token, Provider } from "../types.cjs";
+import { NativeCredential, OAuth2Token, PersonNameComponents, Provider } from "../types.cjs";
+import { AppleUser } from "../name.cjs";
 //#region src/oauth2/provider/apple.d.ts
 export declare function createAppleProvider(): Provider;
 export declare const apple: Provider;
-export interface AppleUserInfo {
+export interface AppleIdToken {
+  iss: string;
+  aud: string;
+  exp: number;
+  iat: number;
   sub: string;
   email: string;
   email_verified: true | 'true';
   is_private_email: boolean;
-  real_user_status: number;
-  name: string;
-  picture: string;
-  user?: {
-    name: {
-      firstName: string;
-      lastName: string;
-    };
-    email: string;
-  };
+  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */
+  real_user_status?: number;
   nonce?: string;
   nonce_supported?: boolean;
 }
+/**
+ * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client
+ * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).
+ */
+export interface AppleUserInfo extends AppleIdToken {
+  /** Web flow: Apple's form_post `user`, as Apple names it. */
+  user?: AppleUser;
+  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */
+  fullName?: PersonNameComponents;
+}
 export interface AppleToken extends OAuth2Token {
   access_token: string;
   token_type: string;
@@ -31,8 +38,6 @@ export interface AppleNativeCredential extends NativeCredential {
   state: string;
   code: string;
   id_token: string;
-  user: string;
-  email?: string;
 }
 export interface AppleErrorResponse {
   error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';

package/dist/oauth2/provider/apple.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.cts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAMgB,uBAAuB;qBAwD1B,OAAK;iBAGD;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;MAAQ;MAAmB;;IAC3B;;EAEF;EACA;;iBAKe,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;EAEA;EACA;;iBAIe;EACf"}
+{"version":3,"file":"apple.d.cts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;;wBAiBgB,uBAAuB;qBAgF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}

package/dist/oauth2/provider/apple.d.mts

@@ -1,25 +1,32 @@
-import { NativeCredential, OAuth2Token, Provider } from "../types.mjs";
+import { NativeCredential, OAuth2Token, PersonNameComponents, Provider } from "../types.mjs";
+import { AppleUser } from "../name.mjs";
 //#region src/oauth2/provider/apple.d.ts
 export declare function createAppleProvider(): Provider;
 export declare const apple: Provider;
-export interface AppleUserInfo {
+export interface AppleIdToken {
+  iss: string;
+  aud: string;
+  exp: number;
+  iat: number;
   sub: string;
   email: string;
   email_verified: true | 'true';
   is_private_email: boolean;
-  real_user_status: number;
-  name: string;
-  picture: string;
-  user?: {
-    name: {
-      firstName: string;
-      lastName: string;
-    };
-    email: string;
-  };
+  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */
+  real_user_status?: number;
   nonce?: string;
   nonce_supported?: boolean;
 }
+/**
+ * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client
+ * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).
+ */
+export interface AppleUserInfo extends AppleIdToken {
+  /** Web flow: Apple's form_post `user`, as Apple names it. */
+  user?: AppleUser;
+  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */
+  fullName?: PersonNameComponents;
+}
 export interface AppleToken extends OAuth2Token {
   access_token: string;
   token_type: string;
@@ -31,8 +38,6 @@ export interface AppleNativeCredential extends NativeCredential {
   state: string;
   code: string;
   id_token: string;
-  user: string;
-  email?: string;
 }
 export interface AppleErrorResponse {
   error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';

package/dist/oauth2/provider/apple.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.mts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;wBAMgB,uBAAuB;qBAwD1B,OAAK;iBAGD;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;MAAQ;MAAmB;;IAC3B;;EAEF;EACA;;iBAKe,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;EAEA;EACA;;iBAIe;EACf"}
+{"version":3,"file":"apple.d.mts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;;wBAiBgB,uBAAuB;qBAgF1B,OAAK;iBAID;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;EACA;;;;;;iBAOe,sBAAsB;;EAErC,OAAO;;EAEP,WAAW;;iBAKI,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;iBAGe,8BAA8B;EAC7C;EACA;EACA;;iBAIe;EACf"}

package/dist/oauth2/provider/apple.mjs

@@ -1,7 +1,10 @@
 import { OAuth2Error } from "../error.mjs";
+import { cleanPersonName, nameClaims, parseAppleUser } from "../name.mjs";
 import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
 import { invariant } from "@shware/utils";
 //#region src/oauth2/provider/apple.ts
+/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */
+const APPLE_ISSUER = "https://appleid.apple.com";
 function createAppleProvider() {
 	return {
 		authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
@@ -31,20 +34,28 @@ function createAppleProvider() {
 			}
 			return await response.json();
 		},
-		async getUserInfo({ id_token }) {
+		async getUserInfo({ id_token }, { clientId, response }) {
 			invariant(id_token, "id_token is required");
 			invariant(this.jwkSetUri, "jwkSetUri is required");
-			const data = await verifyIdToken(id_token, this.jwkSetUri);
+			const token = await verifyIdToken(id_token, {
+				jwkSetUri: this.jwkSetUri,
+				issuer: APPLE_ISSUER,
+				audience: clientId
+			});
+			const user = parseAppleUser(response?.user);
 			return {
-				data,
+				data: user ? {
+					...token,
+					user
+				} : token,
 				claims: {
-					sub: data.sub,
-					name: data.name,
-					email: data.email,
+					sub: token.sub,
+					email: token.email,
 					email_verified: true,
-					picture: data.picture,
-					given_name: data.user?.name.firstName,
-					family_name: data.user?.name.lastName
+					...nameClaims({
+						given_name: user?.name?.firstName,
+						family_name: user?.name?.lastName
+					})
 				}
 			};
 		},
@@ -62,9 +73,26 @@ function createAppleProvider() {
 				throw new OAuth2Error(response.status, error);
 			}
 			const token = await response.json();
+			const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });
+			const fullName = cleanPersonName(credentials.fullName);
+			const name = nameClaims({
+				given_name: fullName?.givenName ?? void 0,
+				family_name: fullName?.familyName ?? void 0,
+				middle_name: fullName?.middleName ?? void 0,
+				nickname: fullName?.nickname ?? void 0
+			});
 			return {
 				token,
-				userInfo: await this.getUserInfo(token)
+				userInfo: {
+					data: fullName ? {
+						...data,
+						fullName
+					} : data,
+					claims: {
+						...claims,
+						...name
+					}
+				}
 			};
 		}
 	};