apple-secret.mjs

Functions

Imports

It imports no other module of this repo. Imported by sign-in.mjs.

Source

1/**
2 * The client secret Sign in with Apple wants: not a stored string but a short JWT the site signs with its Apple key
3 * (developer.apple.com, "Creating a client secret"). Apple refuses one that lives longer than six months, so a secret
4 * pasted once would stop sign-in on the day it expired. It is made here, from the key, when a site builds its auth.
5 *
6 * - ES256 with WebCrypto: the .p8 file Apple gives is a PKCS#8 P-256 key, and WebCrypto's ECDSA signature is already
7 *   the raw r||s form a JWS needs. No JWT library.
8 * - 30 days of life. A Worker isolate lasts hours, so every isolate builds a fresh one long before it runs out.
9 * - Any of the four settings missing: null, and the site offers no Apple button.
10 */
11
12const APPLE_AUDIENCE = "https://appleid.apple.com";
13const LIFETIME_SECONDS = 30 * 24 * 60 * 60;
14
15/** @param {string} text */
16const base64url = (text) => btoa(text).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
17/** @param {ArrayBuffer} bytes */
18const bytesToBase64url = (bytes) => base64url(String.fromCharCode(...new Uint8Array(bytes)));
19
20/** @param {string} pem */
21function pkcs8(pem) {
22  const body = pem.replace(/-----(BEGIN|END) PRIVATE KEY-----/g, "").replace(/\\n|\s/g, "");
23  return Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
24}
25
26/**
27 * @param {{ APPLE_CLIENT_ID?: string, APPLE_TEAM_ID?: string, APPLE_KEY_ID?: string, APPLE_PRIVATE_KEY?: string }} env
28 *   APPLE_CLIENT_ID is the Services ID, APPLE_PRIVATE_KEY the .p8 file's text.
29 * @param {number} [now] seconds since the epoch
30 * @returns {Promise<string | null>}
31 */
32export async function appleClientSecret(env, now = Math.floor(Date.now() / 1000)) {
33  const { APPLE_CLIENT_ID: clientId, APPLE_TEAM_ID: teamId, APPLE_KEY_ID: keyId, APPLE_PRIVATE_KEY: pem } = env;
34  if (!clientId || !teamId || !keyId || !pem) return null;
35  const key = await crypto.subtle.importKey("pkcs8", pkcs8(pem), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
36  const header = base64url(JSON.stringify({ alg: "ES256", kid: keyId }));
37  const claims = base64url(
38    JSON.stringify({ iss: teamId, iat: now, exp: now + LIFETIME_SECONDS, aud: APPLE_AUDIENCE, sub: clientId }),
39  );
40  const input = `${header}.${claims}`;
41  const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, new TextEncoder().encode(input));
42  return `${input}.${bytesToBase64url(signature)}`;
43}