feat(auth)!: support multiple Apple OAuth client credential sets - #1547
Merged
Conversation
cursor
Bot
force-pushed
the
feat/apple-multi-oauth-clients
branch
from
August 31, 2026 12:40
c76317b to
2114c63
Compare
ChrisPdgn
marked this pull request as draft
August 31, 2026 13:43
Contributor
Summary:Apple Sign In can now have extra client credential sets under apple.clients[] (for example a web Services ID and an iOS bundle ID), not just the one top-level client. Each extra row needs a unique nickname (id) and a clientId. Leave privateKey / teamId / keyId empty to reuse the default key and team, or set all three for a second Apple team. Mixed is rejected on save. Empty extra redirect_uri falls back to the default. Extra clients cannot turn Apple on by themselves. Callers pass optional oauthClientId on Apple init / initNative (our nickname, not Apple’s id). Omit it and login is unchanged. Other OAuth providers are untouched. Admin saves clients[] as objects. BREAKING CHANGE: keyId is now required on the default Apple config to enable the provider. A config with only clientId + privateKey + teamId will stay off. |
ChrisPdgn
changed the title
Allow deployments to register additional Apple OAuth clients and select one at init via oauthClientId. Generic OAuth providers keep flat configuration.
…p support - Extra apple.clients[] entries require unique non-empty id and clientId - Credential inheritance: omit all three (privateKey/teamId/keyId) to inherit from top-level Apple - Second Apple team support: provide all three credentials for a separate team - Mixed credentials (only some set) are rejected with INVALID_ARGUMENT - Added validation in apple.ts validate() for duplicate ids and mixed credentials - Updated resolveAppleOAuthClient to implement inherit/reject logic - Added Swagger docs for oauthClientId query param - Added comprehensive tests following node:test pattern - Empty string treated as omit for inheritance - redirect_uri defaults to top-level apple.redirect_uri if omitted
…ect_uri fallback
1. Validation moved to preConfig: Extract validateAppleClients() and call from
Authentication.preConfig() so setConfig rejects bad config before persisting.
This prevents Apple from going dark after Admin saves invalid extra clients.
2. Empty redirect_uri fallback: Change from ?? to explicit empty-string check so
empty string falls back to top-level apple.redirect_uri, not blank.
3. Empty id test fixed: Remove incorrect resolveAppleOAuthClient('') test that
treated falsy as 'use default'. Add validateAppleClients.test.ts that tests
empty/whitespace id rejection on config save via the validator.
4. Admin object array persist proven: Add apple.config.test.ts with convict
round-trip tests proving apple.clients[] objects survive load/getProperties
and are not stringified to '[object Object]' or coerced to string[].
Test coverage:
- validateAppleClients.test.ts: empty id, whitespace id, duplicates, missing
clientId, mixed credentials, valid inherited & full credential clients
- resolveAppleOAuthClient.test.ts: empty redirect_uri fallback test added
- apple.config.test.ts: object array round-trip, no stringification
…rt path 1. Restore TeamsHandler import in Authentication.ts (used by userCreate, userCreateByUsername, anonymousUserCreate, inviteUserToTeam) 2. Import validateAppleClients from specific file to avoid barrel deps 3. Fix apple.config.test.ts import from '../../../config/' to './' since test is in same directory as config file
…only values Nit 2: Whitespace-only clientId now rejected - trim before empty check Nit 3: Duplicate ids trimmed - 'app1' and ' app1 ' now correctly detected as duplicate Nit 1 (not fixable from authentication): GrpcError.code from preConfig is caught by ManagedModule.setConfig outer catch (line 289) which returns INTERNAL for all errors. Fix requires checking 'instanceof GrpcError' in module-tools setConfig. Cannot fix from authentication without overriding entire setConfig method. Test coverage added: - Whitespace-only clientId rejected - Duplicate ids differing only by whitespace rejected
- Add void statement for unused _call parameters in OAuth2 base class - Fix TypeScript spread type error in Apple OAuth handlers - Add explicit any types to error handler callbacks - Export FindRelationResponse and related types from grpc-sdk authorization module
Keep only the two in-scope CI fixes: - OAuth2.ts: void _call statements for unused parameters - apple.ts: use ConduitString.Optional without spreading Revert all out-of-scope changes: - Delete package-lock.json (pnpm repo) - Revert pnpm-workspace.yaml to 828c35a - Delete generated tsup.config build artifacts - Revert grpc-sdk authorization exports - Revert pre-existing implicit any types in authentication handlers
cursor
Bot
force-pushed
the
feat/apple-multi-oauth-clients
branch
from
September 1, 2026 09:01
b64976f to
ed36868
Compare
ChrisPdgn
approved these changes
Sep 1, 2026
15 tasks
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
clients[]configuration for additional OAuth credential sets per app.oauthClientIdon Apple init routes and resolve the selected client during callback/native authorize.clientId/clientSecret/ redirect behavior.Test plan
nvm use 24 && pnpm run buildinmodules/authenticationoauthClientIdand verify callback/native authorize succeedsoauthClientId