godgpt-web-auth 0.1.11 → 0.1.12

package/dist/index.cjs

@@ -632,46 +632,166 @@ function initializeApple(config) {
   });
   appleInitialized = true;
 }
-async function testAppleCodeValidity(code, config) {
-  console.log("[Auth Apple Debug] Testing code validity with Apple...");
-  console.log("[Auth Apple Debug] Code:", code);
-  console.log("[Auth Apple Debug] Client ID:", config.apple?.clientId);
-  console.log("[Auth Apple Debug] Redirect URI:", window.location.origin);
-  try {
-    const params = new URLSearchParams({
-      client_id: config.apple?.clientId || "",
-      code,
-      grant_type: "authorization_code",
-      redirect_uri: window.location.origin
-    });
-    const response = await fetch("https://appleid.apple.com/auth/token", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: params.toString()
-    });
-    const data = await response.json();
+async function debugAppleAuth(code, idToken, config) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  console.log("\n" + "=".repeat(70));
+  console.log("\u{1F34E} APPLE AUTH DEBUG - COMPREHENSIVE ANALYSIS");
+  console.log("=".repeat(70));
+  console.log("\n\u{1F4C5} TIMING INFO:");
+  console.log("  Current time:", timestamp);
+  console.log(
+    "  Note: Apple codes expire in 5 minutes and can only be used ONCE!"
+  );
+  console.log("\n\u{1F4E6} APPLE SDK RESPONSE:");
+  console.log("  Authorization code:", code);
+  console.log("  Code length:", code.length, "chars");
+  console.log("  Has id_token:", idToken ? "YES" : "NO");
+  if (idToken) {
     console.log(
-      "[Auth Apple Debug] Apple token endpoint response status:",
-      response.status
+      "  id_token (first 50 chars):",
+      idToken.substring(0, 50) + "..."
     );
-    console.log("[Auth Apple Debug] Apple token endpoint response:", data);
-    if (data.error === "invalid_grant") {
-      console.error("[Auth Apple Debug] \u274C Code is INVALID or EXPIRED");
-    } else if (data.error === "invalid_client") {
-      console.log(
-        "[Auth Apple Debug] \u2713 Code appears valid (client_secret needed for full validation)"
-      );
+  }
+  console.log("\n\u2699\uFE0F YOUR CONFIG:");
+  console.log("  config.apple.clientId:", config.apple?.clientId || "NOT SET");
+  console.log(
+    "  config.apple.appId:",
+    config.apple?.appId || "NOT SET (will use clientId)"
+  );
+  console.log(
+    "  config.apple.redirectUri:",
+    config.apple?.redirectUri || "NOT SET (will use origin)"
+  );
+  console.log("  config.backendUrl:", config.backendUrl);
+  console.log("\n\u{1F310} ENVIRONMENT:");
+  console.log("  window.location.origin:", window.location.origin);
+  console.log("  window.location.hostname:", window.location.hostname);
+  console.log("  window.location.href:", window.location.href);
+  const backendPayload = {
+    grant_type: "apple",
+    client_id: "AevatarAuthServer",
+    scope: "Aevatar offline_access",
+    source: "web",
+    apple_app_id: config.apple?.appId || config.apple?.clientId || "NOT SET",
+    code
+  };
+  console.log("\n\u{1F4E4} WHAT WILL BE SENT TO BACKEND:");
+  console.log("  Endpoint:", `${config.backendUrl}/connect/token`);
+  console.log("  Method: POST");
+  console.log("  Content-Type: application/x-www-form-urlencoded");
+  console.log("  Body parameters:");
+  Object.entries(backendPayload).forEach(([key, value]) => {
+    if (key === "code") {
+      console.log(`    ${key}: ${value.substring(0, 30)}...`);
     } else {
-      console.log(
-        "[Auth Apple Debug] Response:",
-        JSON.stringify(data, null, 2)
-      );
+      console.log(`    ${key}: ${value}`);
     }
-  } catch (error) {
-    console.error("[Auth Apple Debug] Error testing code:", error);
+  });
+  const curlBody = Object.entries(backendPayload).map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
+  console.log("\n\u{1F527} EQUIVALENT CURL COMMAND:");
+  console.log(`curl '${config.backendUrl}/connect/token' \\`);
+  console.log("  -H 'accept: application/json' \\");
+  console.log("  -H 'content-type: application/x-www-form-urlencoded' \\");
+  console.log(`  -H 'origin: ${window.location.origin}' \\`);
+  console.log(`  --data-raw '${curlBody}'`);
+  if (idToken) {
+    console.log("\n\u{1F510} ID TOKEN ANALYSIS:");
+    try {
+      const parts = idToken.split(".");
+      if (parts.length === 3) {
+        const header = JSON.parse(atob(parts[0]));
+        console.log("  Header:", JSON.stringify(header));
+        const payload = JSON.parse(atob(parts[1]));
+        console.log("  Payload (full):", JSON.stringify(payload, null, 4));
+        console.log("\n  Key claims:");
+        console.log("    iss (issuer):", payload.iss);
+        console.log("    aud (audience/client_id):", payload.aud);
+        console.log("    sub (user ID):", payload.sub);
+        console.log("    email:", payload.email || "not provided");
+        console.log("    email_verified:", payload.email_verified);
+        console.log("    is_private_email:", payload.is_private_email);
+        console.log(
+          "    auth_time:",
+          payload.auth_time ? new Date(payload.auth_time * 1e3).toISOString() : "N/A"
+        );
+        console.log(
+          "    iat (issued at):",
+          new Date(payload.iat * 1e3).toISOString()
+        );
+        console.log(
+          "    exp (expires):",
+          new Date(payload.exp * 1e3).toISOString()
+        );
+        console.log("    nonce:", payload.nonce || "not set");
+        console.log("    nonce_supported:", payload.nonce_supported);
+        const now = Date.now() / 1e3;
+        const timeLeft = payload.exp - now;
+        if (timeLeft < 0) {
+          console.log(
+            "\n  \u274C TOKEN STATUS: EXPIRED by",
+            Math.abs(Math.round(timeLeft)),
+            "seconds"
+          );
+        } else {
+          console.log(
+            "\n  \u2705 TOKEN STATUS: Valid for",
+            Math.round(timeLeft),
+            "more seconds"
+          );
+        }
+        if (payload.aud === config.apple?.clientId) {
+          console.log(
+            "  \u2705 AUDIENCE MATCH: id_token.aud matches config.apple.clientId"
+          );
+        } else {
+          console.log("  \u26A0\uFE0F AUDIENCE MISMATCH:");
+          console.log("     id_token.aud:", payload.aud);
+          console.log("     config.apple.clientId:", config.apple?.clientId);
+        }
+        const appIdToSend = config.apple?.appId || config.apple?.clientId;
+        if (payload.aud === appIdToSend) {
+          console.log(
+            "  \u2705 BACKEND APP_ID MATCH: id_token.aud matches apple_app_id being sent"
+          );
+        } else {
+          console.log(
+            "  \u274C BACKEND APP_ID MISMATCH (THIS IS LIKELY YOUR ISSUE!):"
+          );
+          console.log("     id_token.aud (code was issued for):", payload.aud);
+          console.log("     apple_app_id (sending to backend):", appIdToSend);
+          console.log(
+            "     FIX: Set config.apple.appId to match the clientId, or don't set appId at all"
+          );
+        }
+      }
+    } catch (e) {
+      console.error("  Failed to decode id_token:", e);
+    }
+  } else {
+    console.log(
+      "\n\u{1F510} ID TOKEN: Not provided by Apple (this is normal for some flows)"
+    );
+  }
+  console.log("\n\u{1F4CB} COMMON ISSUES CHECKLIST:");
+  console.log("  1. source value: 'web' \u2705 (hardcoded correctly)");
+  if (config.apple?.appId && config.apple?.appId !== config.apple?.clientId) {
+    console.log("  2. apple_app_id mismatch: \u274C appId differs from clientId!");
+    console.log("     - SDK uses clientId:", config.apple?.clientId);
+    console.log("     - Backend gets appId:", config.apple?.appId);
+    console.log("     - These MUST match for code validation!");
+  } else {
+    console.log(
+      "  2. apple_app_id: \u2705 Using clientId for both SDK and backend"
+    );
+  }
+  if (!config.apple?.clientId) {
+    console.log("  3. clientId: \u274C NOT CONFIGURED!");
+  } else {
+    console.log("  3. clientId: \u2705 Set to", config.apple.clientId);
   }
+  console.log("\n" + "=".repeat(70));
+  console.log("\u{1F34E} END APPLE AUTH DEBUG");
+  console.log("=".repeat(70) + "\n");
 }
 async function signInWithApple(config) {
   console.log("[Auth Apple] Starting Apple sign-in");
@@ -710,7 +830,7 @@ async function signInWithApple(config) {
     const idToken = response.authorization?.id_token;
     if (code) {
       console.log("[Auth Apple] Exchanging authorization code", code);
-      await testAppleCodeValidity(code, config);
+      await debugAppleAuth(code, idToken, config);
       return await exchangeToken({ code }, "apple", config);
     } else if (idToken) {
       console.log("[Auth Apple] Exchanging id_token");