pyxpo-apple-authentication 0.1.0a1__tar.gz

pyxpo_apple_authentication-0.1.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vishal Chaubey
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pyxpo_apple_authentication-0.1.0a1/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: pyxpo-apple-authentication
+Version: 0.1.0a1
+Summary: Sign in with Apple for pyxpo apps (AuthenticationServices)
+Author: Vishal Chaubey
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/pyxpo/pyxpo-apple-authentication
+Project-URL: Documentation, https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/README.md
+Project-URL: Changelog, https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/CHANGELOG.md
+Project-URL: Source, https://github.com/pyxpo/pyxpo-apple-authentication
+Project-URL: Issues, https://github.com/pyxpo/pyxpo-apple-authentication/issues
+Keywords: pyxpo,pyxpo-module,mobile,ios,apple,sign-in-with-apple,authentication,id-token
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: iOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: Software Development :: User Interfaces
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyxpo<0.2,>=0.1.0a9
+Dynamic: license-file
+
+# pyxpo-apple-authentication
+
+[![CI](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml/badge.svg)](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![Python](https://img.shields.io/pypi/pyversions/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Sign in with Apple for [pyxpo](https://github.com/pyxpo/pyxpo) apps written in Python. The API follows
+[expo-apple-authentication](https://docs.expo.dev/versions/latest/sdk/apple-authentication/). It runs on iOS with
+AuthenticationServices. You get an **identity token** (a JWT signed by Apple) to verify on your server.
+
+```python
+import pyxpo_apple_authentication as AppleAuthentication
+from pyxpo_apple_authentication import AppleAuthenticationScope, AppleAuthenticationError
+
+if await AppleAuthentication.is_available_async():
+    try:
+        cred = await AppleAuthentication.sign_in_async(
+            requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+        await api.post("/auth/apple", {"identityToken": cred["identityToken"]})
+    except AppleAuthenticationError as e:
+        if e.code != "ERR_REQUEST_CANCELED":
+            raise
+```
+
+## Features
+
+- **Apple's own sheet**, with Face ID and the Hide My Email relay.
+- **Clear errors:** `AppleAuthenticationError.code` is `ERR_REQUEST_CANCELED` when the user closes the sheet.
+- **Credential state** checks, so you can sign out a user who revoked the app in Settings.
+- **Config plugin** for the `com.apple.developer.applesignin` entitlement, so you never edit the entitlements file.
+- **Safe on every platform:** `is_available_async()` is `False` on Android, the web and the desktop.
+- **camelCase too:** `signInAsync(requestedScopes=...)`.
+
+## Contents
+
+| If you are... | Start here |
+| --- | --- |
+| Setting up | [Install](#install) · [Apple Developer setup](#apple-developer-setup) |
+| Signing users in | [Quick start](#quick-start) |
+| Exact names | [API reference](#api-reference) · [Errors](#errors) |
+| Stuck | [Testing](#testing) · [Troubleshooting](#troubleshooting) |
+
+## Install
+
+```bash
+pip install pyxpo-apple-authentication
+```
+
+Add the module and its config plugin to your app's `pyproject.toml`:
+
+```toml
+[tool.pyxpo]
+modules = ["apple-authentication"]
+plugins = ["pyxpo_apple_authentication.plugin"]
+```
+
+Then rebuild the iOS app (`pyxpo run ios`). The plugin adds `com.apple.developer.applesignin = ["Default"]` to the
+app entitlements.
+
+| Platform | Engine | Minimum |
+| --- | --- | --- |
+| iOS | AuthenticationServices | iOS 13 |
+| Android, web, desktop | not supported (`is_available_async()` is `False`) | |
+
+## Apple Developer setup
+
+1. In Certificates, Identifiers & Profiles, open your App ID and turn on **Sign in with Apple**.
+2. Make a new provisioning profile for that App ID, or let Xcode signing make it.
+3. On your server, verify `identityToken` against Apple's keys at `https://appleid.apple.com/auth/keys`. Check
+   that `aud` is your bundle ID and `iss` is `https://appleid.apple.com`.
+
+The simulator needs an Apple ID signed in under Settings.
+
+## Quick start
+
+Apple sends `fullName` and `email` **only on the first sign-in** of a user for your app. Send them to your server
+then, with the token:
+
+```python
+cred = await AppleAuthentication.sign_in_async(
+    requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+name = cred["fullName"] or {}
+full = " ".join(p for p in (name.get("givenName"), name.get("familyName")) if p) or None
+await api.post("/auth/apple", {"identityToken": cred["identityToken"], "fullName": full})
+```
+
+Check later that the user still allows your app:
+
+```python
+from pyxpo_apple_authentication import AppleAuthenticationCredentialState as State
+
+if await AppleAuthentication.get_credential_state_async(saved_user) is State.REVOKED:
+    await sign_out()
+```
+
+Draw your own button that follows Apple's
+[Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/sign-in-with-apple)
+(black or white, the Apple logo, "Sign in with Apple" or "Continue with Apple").
+
+## API reference
+
+| Name | Returns | Notes |
+| --- | --- | --- |
+| `is_available_async()` | `bool` | `True` on iOS with the module linked. |
+| `sign_in_async(requested_scopes=None, state=None, nonce=None)` | credential `dict` | Shows Apple's sheet. |
+| `get_credential_state_async(user)` | `AppleAuthenticationCredentialState` | `user` is `credential["user"]`. |
+| `AppleAuthenticationScope` | `FULL_NAME`, `EMAIL` | |
+| `AppleAuthenticationCredentialState` | `REVOKED`, `AUTHORIZED`, `NOT_FOUND`, `TRANSFERRED` | |
+| `AppleAuthenticationUserDetectionStatus` | `UNSUPPORTED`, `UNKNOWN`, `LIKELY_REAL` | `credential["realUserStatus"]` |
+
+The credential has `user`, `state`, `fullName` (`namePrefix`, `givenName`, `middleName`, `familyName`,
+`nameSuffix`, `nickname`, or `None`), `email`, `realUserStatus`, `identityToken` and `authorizationCode`.
+
+## Errors
+
+`AppleAuthenticationError` has `code`:
+
+| Code | Meaning |
+| --- | --- |
+| `ERR_REQUEST_CANCELED` | The user closed the sheet. |
+| `ERR_REQUEST_FAILED` | The request failed, for example with no Apple ID on the device. |
+| `ERR_INVALID_RESPONSE` | Apple sent an answer without a user. |
+| `ERR_REQUEST_NOT_HANDLED` | No provider handled the request. |
+| `ERR_REQUEST_NOT_INTERACTIVE` | The request needed UI that the app cannot show now. |
+| `ERR_IN_PROGRESS` | A sign-in is already open. |
+| `ERR_REQUEST_UNKNOWN` | Anything else. |
+
+On other platforms `sign_in_async` raises `pyxpo.module_api.NotSupportedError`.
+
+## Testing
+
+Use `FakeBridge` from pyxpo to run your sign-in logic on the desktop:
+
+```python
+from pyxpo.module_testing import FakeBridge
+import pyxpo_apple_authentication as A
+
+def test_sign_in():
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: {"user": "001.a", "identityToken": "t"})
+        assert asyncio.run(A.sign_in_async())["identityToken"] == "t"
+```
+
+## Troubleshooting
+
+- **`ERR_REQUEST_UNKNOWN` with error 1000.** The entitlement is missing. Add the plugin and rebuild, and turn on
+  Sign in with Apple for the App ID.
+- **`fullName` is `None`.** It comes only on the first sign-in. Remove the app under Settings > Apple ID > Sign in
+  with Apple to test it again.
+- **Simulator: nothing happens.** Sign in to an Apple ID in the simulator's Settings.
+
+## License
+
+MIT

pyxpo_apple_authentication-0.1.0a1/README.md

@@ -0,0 +1,152 @@
+# pyxpo-apple-authentication
+
+[![CI](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml/badge.svg)](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![Python](https://img.shields.io/pypi/pyversions/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Sign in with Apple for [pyxpo](https://github.com/pyxpo/pyxpo) apps written in Python. The API follows
+[expo-apple-authentication](https://docs.expo.dev/versions/latest/sdk/apple-authentication/). It runs on iOS with
+AuthenticationServices. You get an **identity token** (a JWT signed by Apple) to verify on your server.
+
+```python
+import pyxpo_apple_authentication as AppleAuthentication
+from pyxpo_apple_authentication import AppleAuthenticationScope, AppleAuthenticationError
+
+if await AppleAuthentication.is_available_async():
+    try:
+        cred = await AppleAuthentication.sign_in_async(
+            requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+        await api.post("/auth/apple", {"identityToken": cred["identityToken"]})
+    except AppleAuthenticationError as e:
+        if e.code != "ERR_REQUEST_CANCELED":
+            raise
+```
+
+## Features
+
+- **Apple's own sheet**, with Face ID and the Hide My Email relay.
+- **Clear errors:** `AppleAuthenticationError.code` is `ERR_REQUEST_CANCELED` when the user closes the sheet.
+- **Credential state** checks, so you can sign out a user who revoked the app in Settings.
+- **Config plugin** for the `com.apple.developer.applesignin` entitlement, so you never edit the entitlements file.
+- **Safe on every platform:** `is_available_async()` is `False` on Android, the web and the desktop.
+- **camelCase too:** `signInAsync(requestedScopes=...)`.
+
+## Contents
+
+| If you are... | Start here |
+| --- | --- |
+| Setting up | [Install](#install) · [Apple Developer setup](#apple-developer-setup) |
+| Signing users in | [Quick start](#quick-start) |
+| Exact names | [API reference](#api-reference) · [Errors](#errors) |
+| Stuck | [Testing](#testing) · [Troubleshooting](#troubleshooting) |
+
+## Install
+
+```bash
+pip install pyxpo-apple-authentication
+```
+
+Add the module and its config plugin to your app's `pyproject.toml`:
+
+```toml
+[tool.pyxpo]
+modules = ["apple-authentication"]
+plugins = ["pyxpo_apple_authentication.plugin"]
+```
+
+Then rebuild the iOS app (`pyxpo run ios`). The plugin adds `com.apple.developer.applesignin = ["Default"]` to the
+app entitlements.
+
+| Platform | Engine | Minimum |
+| --- | --- | --- |
+| iOS | AuthenticationServices | iOS 13 |
+| Android, web, desktop | not supported (`is_available_async()` is `False`) | |
+
+## Apple Developer setup
+
+1. In Certificates, Identifiers & Profiles, open your App ID and turn on **Sign in with Apple**.
+2. Make a new provisioning profile for that App ID, or let Xcode signing make it.
+3. On your server, verify `identityToken` against Apple's keys at `https://appleid.apple.com/auth/keys`. Check
+   that `aud` is your bundle ID and `iss` is `https://appleid.apple.com`.
+
+The simulator needs an Apple ID signed in under Settings.
+
+## Quick start
+
+Apple sends `fullName` and `email` **only on the first sign-in** of a user for your app. Send them to your server
+then, with the token:
+
+```python
+cred = await AppleAuthentication.sign_in_async(
+    requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+name = cred["fullName"] or {}
+full = " ".join(p for p in (name.get("givenName"), name.get("familyName")) if p) or None
+await api.post("/auth/apple", {"identityToken": cred["identityToken"], "fullName": full})
+```
+
+Check later that the user still allows your app:
+
+```python
+from pyxpo_apple_authentication import AppleAuthenticationCredentialState as State
+
+if await AppleAuthentication.get_credential_state_async(saved_user) is State.REVOKED:
+    await sign_out()
+```
+
+Draw your own button that follows Apple's
+[Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/sign-in-with-apple)
+(black or white, the Apple logo, "Sign in with Apple" or "Continue with Apple").
+
+## API reference
+
+| Name | Returns | Notes |
+| --- | --- | --- |
+| `is_available_async()` | `bool` | `True` on iOS with the module linked. |
+| `sign_in_async(requested_scopes=None, state=None, nonce=None)` | credential `dict` | Shows Apple's sheet. |
+| `get_credential_state_async(user)` | `AppleAuthenticationCredentialState` | `user` is `credential["user"]`. |
+| `AppleAuthenticationScope` | `FULL_NAME`, `EMAIL` | |
+| `AppleAuthenticationCredentialState` | `REVOKED`, `AUTHORIZED`, `NOT_FOUND`, `TRANSFERRED` | |
+| `AppleAuthenticationUserDetectionStatus` | `UNSUPPORTED`, `UNKNOWN`, `LIKELY_REAL` | `credential["realUserStatus"]` |
+
+The credential has `user`, `state`, `fullName` (`namePrefix`, `givenName`, `middleName`, `familyName`,
+`nameSuffix`, `nickname`, or `None`), `email`, `realUserStatus`, `identityToken` and `authorizationCode`.
+
+## Errors
+
+`AppleAuthenticationError` has `code`:
+
+| Code | Meaning |
+| --- | --- |
+| `ERR_REQUEST_CANCELED` | The user closed the sheet. |
+| `ERR_REQUEST_FAILED` | The request failed, for example with no Apple ID on the device. |
+| `ERR_INVALID_RESPONSE` | Apple sent an answer without a user. |
+| `ERR_REQUEST_NOT_HANDLED` | No provider handled the request. |
+| `ERR_REQUEST_NOT_INTERACTIVE` | The request needed UI that the app cannot show now. |
+| `ERR_IN_PROGRESS` | A sign-in is already open. |
+| `ERR_REQUEST_UNKNOWN` | Anything else. |
+
+On other platforms `sign_in_async` raises `pyxpo.module_api.NotSupportedError`.
+
+## Testing
+
+Use `FakeBridge` from pyxpo to run your sign-in logic on the desktop:
+
+```python
+from pyxpo.module_testing import FakeBridge
+import pyxpo_apple_authentication as A
+
+def test_sign_in():
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: {"user": "001.a", "identityToken": "t"})
+        assert asyncio.run(A.sign_in_async())["identityToken"] == "t"
+```
+
+## Troubleshooting
+
+- **`ERR_REQUEST_UNKNOWN` with error 1000.** The entitlement is missing. Add the plugin and rebuild, and turn on
+  Sign in with Apple for the App ID.
+- **`fullName` is `None`.** It comes only on the first sign-in. Remove the app under Settings > Apple ID > Sign in
+  with Apple to test it again.
+- **Simulator: nothing happens.** Sign in to an Apple ID in the simulator's Settings.
+
+## License
+
+MIT

pyxpo_apple_authentication-0.1.0a1/pyproject.toml

@@ -0,0 +1,54 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pyxpo-apple-authentication"
+dynamic = ["version"]
+description = "Sign in with Apple for pyxpo apps (AuthenticationServices)"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Vishal Chaubey" }]
+keywords = ["pyxpo", "pyxpo-module", "mobile", "ios", "apple", "sign-in-with-apple", "authentication", "id-token"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: iOS",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries",
+    "Topic :: Software Development :: User Interfaces",
+    "Typing :: Typed",
+]
+requires-python = ">=3.9"
+dependencies = ["pyxpo>=0.1.0a9,<0.2"]
+
+[project.urls]
+Homepage = "https://github.com/pyxpo/pyxpo-apple-authentication"
+Documentation = "https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/README.md"
+Changelog = "https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/CHANGELOG.md"
+Source = "https://github.com/pyxpo/pyxpo-apple-authentication"
+Issues = "https://github.com/pyxpo/pyxpo-apple-authentication/issues"
+
+# How `pyxpo build` finds this module: the entry point name is the module name apps list in
+# `[tool.pyxpo] modules`, its value the import package holding pyxpo-module.json.
+[project.entry-points."pyxpo.modules"]
+apple-authentication = "pyxpo_apple_authentication"
+
+[tool.setuptools]
+packages = ["pyxpo_apple_authentication"]
+
+[tool.setuptools.dynamic]
+version = { attr = "pyxpo_apple_authentication.__version__" }
+
+[tool.setuptools.package-data]
+pyxpo_apple_authentication = ["pyxpo-module.json", "py.typed", "ios/**/*"]
+
+[tool.setuptools.exclude-package-data]
+"*" = ["__pycache__", "*.pyc", ".DS_Store"]

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication/__init__.py

@@ -0,0 +1,160 @@
+"""Sign in with Apple: the expo-apple-authentication API.
+
+    import pyxpo_apple_authentication as AppleAuthentication
+    from pyxpo_apple_authentication import AppleAuthenticationScope, AppleAuthenticationError
+
+    try:
+        cred = await AppleAuthentication.sign_in_async(
+            requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+        cred["identityToken"]          # send to your server, verify there
+    except AppleAuthenticationError as e:
+        if e.code == "ERR_REQUEST_CANCELED":
+            ...                        # the user closed the sheet
+
+iOS only (AuthenticationServices). On Android and the desktop `is_available_async()` is False and the other calls
+raise NotSupportedError. Apple sends the name and the email only on the first sign-in of a user: keep them then.
+"""
+from __future__ import annotations
+
+import re
+from enum import IntEnum
+from typing import Any, Dict, Iterable, Optional
+
+from pyxpo.module_api import NotSupportedError, call, platform, require_linked
+
+__version__ = "0.1.0a1"
+
+NATIVE = "AppleAuthentication"
+Credential = Dict[str, Any]
+
+
+class AppleAuthenticationScope(IntEnum):
+    FULL_NAME = 0
+    EMAIL = 1
+
+
+class AppleAuthenticationCredentialState(IntEnum):
+    REVOKED = 0
+    AUTHORIZED = 1
+    NOT_FOUND = 2
+    TRANSFERRED = 3
+
+
+class AppleAuthenticationUserDetectionStatus(IntEnum):
+    UNSUPPORTED = 0
+    UNKNOWN = 1
+    LIKELY_REAL = 2
+
+
+ERR_REQUEST_CANCELED = "ERR_REQUEST_CANCELED"
+ERR_REQUEST_FAILED = "ERR_REQUEST_FAILED"
+ERR_INVALID_RESPONSE = "ERR_INVALID_RESPONSE"
+ERR_REQUEST_NOT_HANDLED = "ERR_REQUEST_NOT_HANDLED"
+ERR_REQUEST_NOT_INTERACTIVE = "ERR_REQUEST_NOT_INTERACTIVE"
+ERR_REQUEST_UNKNOWN = "ERR_REQUEST_UNKNOWN"
+ERR_IN_PROGRESS = "ERR_IN_PROGRESS"
+
+
+class AppleAuthenticationError(Exception):
+    """A failed request. `code` is one of the `ERR_*` names; `ERR_REQUEST_CANCELED` when the user closed it."""
+
+    def __init__(self, code: str, message: str = "") -> None:
+        super().__init__(message or code)
+        self.code = code
+
+
+_CODE_RE = re.compile(r"^(ERR_[A-Z_]+):\s*(.*)$", re.S)
+_busy = False
+
+
+def _error(e: BaseException) -> AppleAuthenticationError:
+    m = _CODE_RE.match(str(e))
+    if m:
+        return AppleAuthenticationError(m.group(1), m.group(2))
+    return AppleAuthenticationError(ERR_REQUEST_UNKNOWN, str(e))
+
+
+def _ios(feature: str) -> None:
+    if platform() != "ios":
+        raise NotSupportedError("Sign in with Apple (%s) works on iOS only" % feature)
+    require_linked(NATIVE, "apple-authentication", package="pyxpo-apple-authentication")
+
+
+async def _native(method: str, *args: Any) -> Any:
+    try:
+        return await call(NATIVE, method, *args, reply=True)
+    except Exception as e:  # native replies "ERR_CODE: message"
+        raise _error(e) from None
+
+
+async def is_available_async() -> bool:
+    """True on iOS 13 and later with the module linked; False elsewhere."""
+    if platform() != "ios":
+        return False
+    try:
+        require_linked(NATIVE, "apple-authentication", package="pyxpo-apple-authentication")
+    except Exception:
+        return False
+    return bool(await _native("isAvailable"))
+
+
+def _scopes(scopes: Optional[Iterable[Any]]) -> list:
+    return sorted({int(AppleAuthenticationScope(s)) for s in (scopes or [])})
+
+
+def _credential(raw: Dict[str, Any]) -> Credential:
+    name = raw.get("fullName")
+    if isinstance(name, dict):
+        name = {k: name.get(k) for k in ("namePrefix", "givenName", "middleName", "familyName", "nameSuffix",
+                                         "nickname")}
+        if not any(name.values()):
+            name = None
+    else:
+        name = None
+    return {
+        "user": raw.get("user"), "state": raw.get("state"), "fullName": name, "email": raw.get("email"),
+        "realUserStatus": int(raw.get("realUserStatus") or 0), "identityToken": raw.get("identityToken"),
+        "authorizationCode": raw.get("authorizationCode"),
+    }
+
+
+async def sign_in_async(requested_scopes: Optional[Iterable[Any]] = None, state: Optional[str] = None,
+                        nonce: Optional[str] = None, **camel: Any) -> Credential:
+    """Shows Apple's sign-in sheet. Returns `{"user", "state", "fullName", "email", "realUserStatus",
+    "identityToken", "authorizationCode"}`. `fullName` and `email` come only on a user's first sign-in.
+    Raises `AppleAuthenticationError` (`ERR_REQUEST_CANCELED` when the user closes the sheet)."""
+    global _busy
+    requested_scopes = camel.pop("requestedScopes", requested_scopes)
+    if camel:
+        raise TypeError("sign_in_async() got unknown options %s" % sorted(camel))
+    _ios("sign_in_async")
+    if _busy:
+        raise AppleAuthenticationError(ERR_IN_PROGRESS, "a sign-in is already in progress")
+    _busy = True
+    try:
+        raw = await _native("signIn", {"scopes": _scopes(requested_scopes), "state": state or "",
+                                       "nonce": nonce or ""})
+    finally:
+        _busy = False
+    if not isinstance(raw, dict) or not raw.get("user"):
+        raise AppleAuthenticationError(ERR_INVALID_RESPONSE, "Apple returned no user")
+    return _credential(raw)
+
+
+async def get_credential_state_async(user: str) -> AppleAuthenticationCredentialState:
+    """Whether the Apple ID `user` (from a credential) still authorizes this app."""
+    if not user:
+        raise ValueError("user must be the `user` of an earlier credential")
+    _ios("get_credential_state_async")
+    return AppleAuthenticationCredentialState(int(await _native("credentialState", user)))
+
+
+isAvailableAsync = is_available_async
+signInAsync = sign_in_async
+getCredentialStateAsync = get_credential_state_async
+
+__all__ = ["is_available_async", "sign_in_async", "get_credential_state_async", "AppleAuthenticationScope",
+           "AppleAuthenticationCredentialState", "AppleAuthenticationUserDetectionStatus", "AppleAuthenticationError",
+           "ERR_REQUEST_CANCELED", "ERR_REQUEST_FAILED", "ERR_INVALID_RESPONSE", "ERR_REQUEST_NOT_HANDLED",
+           "ERR_REQUEST_NOT_INTERACTIVE", "ERR_REQUEST_UNKNOWN", "ERR_IN_PROGRESS", "isAvailableAsync",
+           "signInAsync", "getCredentialStateAsync"]

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication/ios/AppleAuthenticationModule.swift

@@ -0,0 +1,101 @@
+import AuthenticationServices
+import UIKit
+
+/// Sign in with Apple on ASAuthorizationController. Errors reply as "ERR_CODE: message" for the Python side.
+final class AppleAuthenticationModule: PxModule {
+    static let moduleName = "AppleAuthentication"
+
+    private var pending: Request?
+
+    required init() {}
+
+    func call(_ ctx: PxModuleContext, _ method: String, _ args: [Any], _ reply: @escaping PxReply) {
+        switch method {
+        case "isAvailable": reply(true, nil)
+        case "signIn": signIn(ctx, (args.first as? [String: Any]) ?? [:], reply)
+        case "credentialState":
+            guard let user = args.first as? String else { reply(nil, "ERR_REQUEST_FAILED: no user"); return }
+            ASAuthorizationAppleIDProvider().getCredentialState(forUserID: user) { state, error in
+                if let e = error { reply(nil, "ERR_REQUEST_FAILED: \(e.localizedDescription)"); return }
+                switch state {
+                case .revoked: reply(0, nil)
+                case .authorized: reply(1, nil)
+                case .transferred: reply(3, nil)
+                default: reply(2, nil)
+                }
+            }
+        default: reply(nil, "unknown native call AppleAuthentication.\(method)")
+        }
+    }
+
+    private func signIn(_ ctx: PxModuleContext, _ o: [String: Any], _ reply: @escaping PxReply) {
+        guard pending == nil else { reply(nil, "ERR_IN_PROGRESS: a sign-in is already in progress"); return }
+        guard let window = ctx.presenter()?.view.window else {
+            reply(nil, "ERR_REQUEST_FAILED: no window to present from"); return
+        }
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        var scopes: [ASAuthorization.Scope] = []
+        for s in (o["scopes"] as? [Int]) ?? [] { scopes.append(s == 0 ? .fullName : .email) }
+        request.requestedScopes = scopes
+        if let state = o["state"] as? String, !state.isEmpty { request.state = state }
+        if let nonce = o["nonce"] as? String, !nonce.isEmpty { request.nonce = nonce }
+        let r = Request(window: window) { [weak self] result, error in
+            self?.pending = nil
+            reply(result, error)
+        }
+        pending = r
+        let controller = ASAuthorizationController(authorizationRequests: [request])
+        controller.delegate = r
+        controller.presentationContextProvider = r
+        r.controller = controller
+        controller.performRequests()
+    }
+}
+
+private final class Request: NSObject, ASAuthorizationControllerDelegate,
+    ASAuthorizationControllerPresentationContextProviding {
+    let window: UIWindow
+    let done: (Any?, String?) -> Void
+    var controller: ASAuthorizationController?
+
+    init(window: UIWindow, done: @escaping (Any?, String?) -> Void) {
+        self.window = window
+        self.done = done
+    }
+
+    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor { window }
+
+    func authorizationController(controller: ASAuthorizationController,
+                                 didCompleteWithAuthorization authorization: ASAuthorization) {
+        guard let c = authorization.credential as? ASAuthorizationAppleIDCredential else {
+            done(nil, "ERR_INVALID_RESPONSE: not an Apple ID credential"); return
+        }
+        var name: Any = NSNull()
+        if let n = c.fullName {
+            name = [
+                "namePrefix": n.namePrefix ?? NSNull(), "givenName": n.givenName ?? NSNull(),
+                "middleName": n.middleName ?? NSNull(), "familyName": n.familyName ?? NSNull(),
+                "nameSuffix": n.nameSuffix ?? NSNull(), "nickname": n.nickname ?? NSNull(),
+            ]
+        }
+        func text(_ d: Data?) -> Any { d.flatMap { String(data: $0, encoding: .utf8) } ?? NSNull() }
+        done([
+            "user": c.user, "state": c.state ?? NSNull(), "fullName": name, "email": c.email ?? NSNull(),
+            "realUserStatus": c.realUserStatus.rawValue, "identityToken": text(c.identityToken),
+            "authorizationCode": text(c.authorizationCode),
+        ], nil)
+    }
+
+    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let code: String
+        switch (error as? ASAuthorizationError)?.code {
+        case .canceled: code = "ERR_REQUEST_CANCELED"
+        case .failed: code = "ERR_REQUEST_FAILED"
+        case .invalidResponse: code = "ERR_INVALID_RESPONSE"
+        case .notHandled: code = "ERR_REQUEST_NOT_HANDLED"
+        case .notInteractive: code = "ERR_REQUEST_NOT_INTERACTIVE"
+        default: code = "ERR_REQUEST_UNKNOWN"
+        }
+        done(nil, "\(code): \(error.localizedDescription)")
+    }
+}

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication/plugin.py

@@ -0,0 +1,27 @@
+"""Config plugin for Sign in with Apple: the `com.apple.developer.applesignin` entitlement on iOS.
+
+    [tool.pyxpo]
+    modules = ["apple-authentication"]
+    plugins = ["pyxpo_apple_authentication.plugin"]
+
+No options. The App ID in your Apple Developer account also needs the Sign in with Apple capability.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict
+
+from pyxpo.app_config import ConfigError
+from pyxpo.config_plugins import PluginConfig, with_entitlements
+
+ENTITLEMENT = "com.apple.developer.applesignin"
+
+
+def plugin(config: PluginConfig, props: Dict[str, Any]) -> PluginConfig:
+    if props:
+        raise ConfigError("pyxpo_apple_authentication.plugin: takes no options, got %s" % sorted(props))
+
+    def entitlements(d: Dict[str, Any]) -> None:
+        d[ENTITLEMENT] = ["Default"]
+
+    with_entitlements(config, entitlements)
+    return config

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication/pyxpo-module.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "nativeContract": 1,
+  "name": "apple-authentication",
+  "native": "AppleAuthentication",
+  "ios": {
+    "classes": ["AppleAuthenticationModule"]
+  }
+}

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: pyxpo-apple-authentication
+Version: 0.1.0a1
+Summary: Sign in with Apple for pyxpo apps (AuthenticationServices)
+Author: Vishal Chaubey
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/pyxpo/pyxpo-apple-authentication
+Project-URL: Documentation, https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/README.md
+Project-URL: Changelog, https://github.com/pyxpo/pyxpo-apple-authentication/blob/main/CHANGELOG.md
+Project-URL: Source, https://github.com/pyxpo/pyxpo-apple-authentication
+Project-URL: Issues, https://github.com/pyxpo/pyxpo-apple-authentication/issues
+Keywords: pyxpo,pyxpo-module,mobile,ios,apple,sign-in-with-apple,authentication,id-token
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: iOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: Software Development :: User Interfaces
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyxpo<0.2,>=0.1.0a9
+Dynamic: license-file
+
+# pyxpo-apple-authentication
+
+[![CI](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml/badge.svg)](https://github.com/pyxpo/pyxpo-apple-authentication/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![Python](https://img.shields.io/pypi/pyversions/pyxpo-apple-authentication)](https://pypi.org/project/pyxpo-apple-authentication/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Sign in with Apple for [pyxpo](https://github.com/pyxpo/pyxpo) apps written in Python. The API follows
+[expo-apple-authentication](https://docs.expo.dev/versions/latest/sdk/apple-authentication/). It runs on iOS with
+AuthenticationServices. You get an **identity token** (a JWT signed by Apple) to verify on your server.
+
+```python
+import pyxpo_apple_authentication as AppleAuthentication
+from pyxpo_apple_authentication import AppleAuthenticationScope, AppleAuthenticationError
+
+if await AppleAuthentication.is_available_async():
+    try:
+        cred = await AppleAuthentication.sign_in_async(
+            requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+        await api.post("/auth/apple", {"identityToken": cred["identityToken"]})
+    except AppleAuthenticationError as e:
+        if e.code != "ERR_REQUEST_CANCELED":
+            raise
+```
+
+## Features
+
+- **Apple's own sheet**, with Face ID and the Hide My Email relay.
+- **Clear errors:** `AppleAuthenticationError.code` is `ERR_REQUEST_CANCELED` when the user closes the sheet.
+- **Credential state** checks, so you can sign out a user who revoked the app in Settings.
+- **Config plugin** for the `com.apple.developer.applesignin` entitlement, so you never edit the entitlements file.
+- **Safe on every platform:** `is_available_async()` is `False` on Android, the web and the desktop.
+- **camelCase too:** `signInAsync(requestedScopes=...)`.
+
+## Contents
+
+| If you are... | Start here |
+| --- | --- |
+| Setting up | [Install](#install) · [Apple Developer setup](#apple-developer-setup) |
+| Signing users in | [Quick start](#quick-start) |
+| Exact names | [API reference](#api-reference) · [Errors](#errors) |
+| Stuck | [Testing](#testing) · [Troubleshooting](#troubleshooting) |
+
+## Install
+
+```bash
+pip install pyxpo-apple-authentication
+```
+
+Add the module and its config plugin to your app's `pyproject.toml`:
+
+```toml
+[tool.pyxpo]
+modules = ["apple-authentication"]
+plugins = ["pyxpo_apple_authentication.plugin"]
+```
+
+Then rebuild the iOS app (`pyxpo run ios`). The plugin adds `com.apple.developer.applesignin = ["Default"]` to the
+app entitlements.
+
+| Platform | Engine | Minimum |
+| --- | --- | --- |
+| iOS | AuthenticationServices | iOS 13 |
+| Android, web, desktop | not supported (`is_available_async()` is `False`) | |
+
+## Apple Developer setup
+
+1. In Certificates, Identifiers & Profiles, open your App ID and turn on **Sign in with Apple**.
+2. Make a new provisioning profile for that App ID, or let Xcode signing make it.
+3. On your server, verify `identityToken` against Apple's keys at `https://appleid.apple.com/auth/keys`. Check
+   that `aud` is your bundle ID and `iss` is `https://appleid.apple.com`.
+
+The simulator needs an Apple ID signed in under Settings.
+
+## Quick start
+
+Apple sends `fullName` and `email` **only on the first sign-in** of a user for your app. Send them to your server
+then, with the token:
+
+```python
+cred = await AppleAuthentication.sign_in_async(
+    requested_scopes=[AppleAuthenticationScope.FULL_NAME, AppleAuthenticationScope.EMAIL])
+name = cred["fullName"] or {}
+full = " ".join(p for p in (name.get("givenName"), name.get("familyName")) if p) or None
+await api.post("/auth/apple", {"identityToken": cred["identityToken"], "fullName": full})
+```
+
+Check later that the user still allows your app:
+
+```python
+from pyxpo_apple_authentication import AppleAuthenticationCredentialState as State
+
+if await AppleAuthentication.get_credential_state_async(saved_user) is State.REVOKED:
+    await sign_out()
+```
+
+Draw your own button that follows Apple's
+[Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/sign-in-with-apple)
+(black or white, the Apple logo, "Sign in with Apple" or "Continue with Apple").
+
+## API reference
+
+| Name | Returns | Notes |
+| --- | --- | --- |
+| `is_available_async()` | `bool` | `True` on iOS with the module linked. |
+| `sign_in_async(requested_scopes=None, state=None, nonce=None)` | credential `dict` | Shows Apple's sheet. |
+| `get_credential_state_async(user)` | `AppleAuthenticationCredentialState` | `user` is `credential["user"]`. |
+| `AppleAuthenticationScope` | `FULL_NAME`, `EMAIL` | |
+| `AppleAuthenticationCredentialState` | `REVOKED`, `AUTHORIZED`, `NOT_FOUND`, `TRANSFERRED` | |
+| `AppleAuthenticationUserDetectionStatus` | `UNSUPPORTED`, `UNKNOWN`, `LIKELY_REAL` | `credential["realUserStatus"]` |
+
+The credential has `user`, `state`, `fullName` (`namePrefix`, `givenName`, `middleName`, `familyName`,
+`nameSuffix`, `nickname`, or `None`), `email`, `realUserStatus`, `identityToken` and `authorizationCode`.
+
+## Errors
+
+`AppleAuthenticationError` has `code`:
+
+| Code | Meaning |
+| --- | --- |
+| `ERR_REQUEST_CANCELED` | The user closed the sheet. |
+| `ERR_REQUEST_FAILED` | The request failed, for example with no Apple ID on the device. |
+| `ERR_INVALID_RESPONSE` | Apple sent an answer without a user. |
+| `ERR_REQUEST_NOT_HANDLED` | No provider handled the request. |
+| `ERR_REQUEST_NOT_INTERACTIVE` | The request needed UI that the app cannot show now. |
+| `ERR_IN_PROGRESS` | A sign-in is already open. |
+| `ERR_REQUEST_UNKNOWN` | Anything else. |
+
+On other platforms `sign_in_async` raises `pyxpo.module_api.NotSupportedError`.
+
+## Testing
+
+Use `FakeBridge` from pyxpo to run your sign-in logic on the desktop:
+
+```python
+from pyxpo.module_testing import FakeBridge
+import pyxpo_apple_authentication as A
+
+def test_sign_in():
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: {"user": "001.a", "identityToken": "t"})
+        assert asyncio.run(A.sign_in_async())["identityToken"] == "t"
+```
+
+## Troubleshooting
+
+- **`ERR_REQUEST_UNKNOWN` with error 1000.** The entitlement is missing. Add the plugin and rebuild, and turn on
+  Sign in with Apple for the App ID.
+- **`fullName` is `None`.** It comes only on the first sign-in. Remove the app under Settings > Apple ID > Sign in
+  with Apple to test it again.
+- **Simulator: nothing happens.** Sign in to an Apple ID in the simulator's Settings.
+
+## License
+
+MIT

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+LICENSE
+README.md
+pyproject.toml
+pyxpo_apple_authentication/__init__.py
+pyxpo_apple_authentication/plugin.py
+pyxpo_apple_authentication/py.typed
+pyxpo_apple_authentication/pyxpo-module.json
+pyxpo_apple_authentication.egg-info/PKG-INFO
+pyxpo_apple_authentication.egg-info/SOURCES.txt
+pyxpo_apple_authentication.egg-info/dependency_links.txt
+pyxpo_apple_authentication.egg-info/entry_points.txt
+pyxpo_apple_authentication.egg-info/requires.txt
+pyxpo_apple_authentication.egg-info/top_level.txt
+pyxpo_apple_authentication/ios/AppleAuthenticationModule.swift
+tests/test_pkg_apple_authentication.py

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[pyxpo.modules]
+apple-authentication = pyxpo_apple_authentication

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/requires.txt

@@ -0,0 +1 @@
+pyxpo<0.2,>=0.1.0a9

pyxpo_apple_authentication-0.1.0a1/pyxpo_apple_authentication.egg-info/top_level.txt

@@ -0,0 +1 @@
+pyxpo_apple_authentication

pyxpo_apple_authentication-0.1.0a1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pyxpo_apple_authentication-0.1.0a1/tests/test_pkg_apple_authentication.py

@@ -0,0 +1,105 @@
+"""pyxpo-apple-authentication: availability, the credential, error codes and the entitlement plugin."""
+import asyncio
+
+import pytest
+
+from pyxpo.app_config import ConfigError
+from pyxpo.config_plugins import Mods, PluginConfig
+from pyxpo.module_api import NotSupportedError
+from pyxpo.module_testing import FakeBridge
+
+import pyxpo_apple_authentication as A
+from pyxpo_apple_authentication import AppleAuthenticationError, AppleAuthenticationScope as Scope
+from pyxpo_apple_authentication.plugin import ENTITLEMENT, plugin
+
+RAW = {"user": "001.abc", "state": "s1", "email": "a@privaterelay.appleid.com", "realUserStatus": 2,
+       "identityToken": "eyJ.a.b", "authorizationCode": "c0de",
+       "fullName": {"givenName": "Ada", "familyName": "Lovelace"}}
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+@pytest.fixture(autouse=True)
+def fresh():
+    A._busy = False
+    yield
+    A._busy = False
+
+
+def test_available_only_on_ios():
+    with FakeBridge("android"):
+        assert run(A.is_available_async()) is False
+        with pytest.raises(NotSupportedError):
+            run(A.sign_in_async())
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "isAvailable", lambda: True)
+        assert run(A.isAvailableAsync()) is True
+
+
+def test_sign_in_sends_scopes_and_shapes_credential():
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: RAW)
+        cred = run(A.sign_in_async(requested_scopes=[Scope.EMAIL, Scope.FULL_NAME, Scope.EMAIL], state="s1"))
+        assert fb.calls[-1][2][0] == {"scopes": [0, 1], "state": "s1", "nonce": ""}
+    assert cred["user"] == "001.abc" and cred["identityToken"] == "eyJ.a.b"
+    assert cred["fullName"]["givenName"] == "Ada" and cred["fullName"]["nickname"] is None
+    assert cred["realUserStatus"] == 2
+
+
+def test_camel_options_and_empty_name():
+    raw = dict(RAW, fullName={"givenName": None}, email=None)
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: raw)
+        cred = run(A.signInAsync(requestedScopes=[Scope.FULL_NAME]))
+        assert fb.calls[-1][2][0]["scopes"] == [0]
+        with pytest.raises(TypeError):
+            run(A.sign_in_async(bogus=1))
+    assert cred["fullName"] is None and cred["email"] is None
+
+
+def test_native_error_codes():
+    def cancel(o):
+        raise RuntimeError("ERR_REQUEST_CANCELED: The operation couldn't be completed.")
+
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", cancel)
+        with pytest.raises(AppleAuthenticationError) as e:
+            run(A.sign_in_async())
+        assert e.value.code == A.ERR_REQUEST_CANCELED
+        fb.on("AppleAuthentication", "signIn", lambda o: (_ for _ in ()).throw(RuntimeError("boom")))
+        with pytest.raises(AppleAuthenticationError) as e:
+            run(A.sign_in_async())
+        assert e.value.code == A.ERR_REQUEST_UNKNOWN and str(e.value) == "boom"
+        fb.on("AppleAuthentication", "signIn", lambda o: {})
+        with pytest.raises(AppleAuthenticationError) as e:
+            run(A.sign_in_async())
+        assert e.value.code == A.ERR_INVALID_RESPONSE
+    assert A._busy is False
+
+
+def test_in_progress_guard():
+    A._busy = True
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "signIn", lambda o: RAW)
+        with pytest.raises(AppleAuthenticationError) as e:
+            run(A.sign_in_async())
+        assert not fb.calls
+    assert e.value.code == A.ERR_IN_PROGRESS
+
+
+def test_credential_state():
+    with FakeBridge("ios") as fb:
+        fb.on("AppleAuthentication", "credentialState", lambda u: 1)
+        assert run(A.get_credential_state_async("001.abc")) is A.AppleAuthenticationCredentialState.AUTHORIZED
+        with pytest.raises(ValueError):
+            run(A.get_credential_state_async(""))
+
+
+def test_plugin_adds_entitlement(tmp_path):
+    mods = Mods()
+    plugin(PluginConfig({}, tmp_path, mods), {})
+    assert mods.apply_entitlements({})[ENTITLEMENT] == ["Default"]
+    with pytest.raises(ConfigError):
+        plugin(PluginConfig({}, tmp_path, Mods()), {"x": 1})