feat: add Sign in with Apple

Tier 1's last sub-item, and deliberately not a fifth mechanical
provider case — all three of Apple's differences are handled rather
than papered over:

- The client "secret" is an ES256 JWT this repo signs itself with the
  .p8 key from Apple's developer console (apple.go's
  appleClientSecret), not a static string. APPLE_CLIENT_ID,
  APPLE_TEAM_ID, APPLE_KEY_ID and APPLE_PRIVATE_KEY are all required;
  a partially configured Apple reads as unavailable, like any other
  unconfigured provider.
- There is no userinfo endpoint. The identity comes from the `id_token`
  in the token response, so it is parsed against Apple's published
  JWKS with issuer, audience, expiry and RS256 enforced — an unverified
  decode would let anyone who can reach the callback mint an account.
  The key set is cached with a TTL and refetched on an unknown kid.
- Authorization uses response_mode=query so the existing GET callback
  route works unchanged. The name/email Apple only sends on a first
  authorization arrives in the `user` form field under form_post,
  which this repo does not need: it stores the id_token's email.

exchangeCode now takes the client secret as an argument and returns
both the access token and the id_token, which is what lets the one
Apple path reuse the existing POST plumbing instead of duplicating it.

Verified offline by unit tests (apple_test.go): the generated secret
parses as a valid ES256 JWT with the console's kid and the right
iss/aud/sub; the id_token is accepted when signed by the served key
and rejected for a wrong audience, wrong issuer, expiry, a different
signing key, an unknown kid, a missing subject, and an `alg: none`
token. Real Apple credentials and a live round trip were not available
in this sandbox — that is stated in PROGRESS.md and the docs.

Author: raymondproguy

config/config.go

@@ -35,6 +35,21 @@ type Config struct {
 	GitLabClientID        string
 	GitLabClientSecret    string
 
+	// Apple is the one provider that needs more than an ID and a secret:
+	// its client "secret" is a short-lived ES256 JWT this repo signs
+	// itself, with a key downloaded from Apple's developer console, so
+	// the signing material is configuration here rather than a static
+	// string. All four must be set for the provider to be available.
+	//
+	// AppleClientID is the Services ID (e.g. "com.example.web"), not the
+	// app bundle ID. ApplePrivateKey is the .p8 file's contents; because
+	// a PEM cannot sit on one .env line, literal "\n" sequences are
+	// converted to real newlines when this is loaded.
+	AppleClientID   string
+	AppleTeamID     string
+	AppleKeyID      string
+	ApplePrivateKey string
+
 	// EncryptionKey encrypts TOTP secrets and WebAuthn ceremony state at
 	// rest. Required only if TOTP or WebAuthn is enabled — cryden refuses
 	// to construct an engine with either store set and this empty, since a
@@ -123,6 +138,17 @@ func Load() (Config, error) {
 	cfg.DiscordClientSecret = os.Getenv("DISCORD_CLIENT_SECRET")
 	cfg.GitLabClientID = os.Getenv("GITLAB_CLIENT_ID")
 	cfg.GitLabClientSecret = os.Getenv("GITLAB_CLIENT_SECRET")
+	cfg.AppleClientID = os.Getenv("APPLE_CLIENT_ID")
+	cfg.AppleTeamID = os.Getenv("APPLE_TEAM_ID")
+	cfg.AppleKeyID = os.Getenv("APPLE_KEY_ID")
+	// .env files are line-oriented, so a PEM arrives with its newlines
+	// written as \n. Only unescape when the value looks like it
+	// needs it, so a deployment that already passes a real multiline
+	// value through its own secret manager is left alone.
+	cfg.ApplePrivateKey = os.Getenv("APPLE_PRIVATE_KEY")
+	if strings.Contains(cfg.ApplePrivateKey, `\n`) {
+		cfg.ApplePrivateKey = strings.ReplaceAll(cfg.ApplePrivateKey, `\n`, "\n")
+	}
 
 	// Second factors are optional too, and for the same reason: a
 	// deployment that hasn't set ENCRYPTION_KEY should still run fine for

go.mod

@@ -4,6 +4,7 @@ go 1.25.0
 
 require (
 	github.com/crydensync/cryden/v2 v2.5.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/lib/pq v1.12.3
 )
 
@@ -14,7 +15,6 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/webauthn v0.18.0 // indirect
 	github.com/go-webauthn/x v0.3.0 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect

httpapi/apple.go

@@ -0,0 +1,209 @@
+package httpapi
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// appleIssuer is both the `iss` Apple puts in an id_token and the `aud`
+// our self-signed client secret must carry — Apple is the audience of
+// the secret, we are the audience of the id_token.
+const appleIssuer = "https://appleid.apple.com"
+
+// appleClientSecretTTL is how long a generated client secret is valid.
+// Apple's own limit is six months; ten minutes is short because the
+// secret is generated per exchange anyway, so there is nothing to gain
+// from a long-lived one — it just means a leaked secret is useless
+// almost immediately.
+const appleClientSecretTTL = 10 * time.Minute
+
+// appleJWKSURL is a var rather than a const so tests can point it at a
+// local server: signature verification is the part of this file worth
+// testing, and it cannot be tested against Apple's real endpoint from a
+// sandbox with no network.
+var appleJWKSURL = appleIssuer + "/auth/keys"
+
+// appleKeyCacheTTL bounds how long a fetched key set is reused. Apple
+// rotates signing keys rarely and publishes no cache lifetime we honor,
+// so an hour is short enough to pick up a rotation without re-fetching
+// per login.
+const appleKeyCacheTTL = time.Hour
+
+type appleKeyCache struct {
+	mu        sync.Mutex
+	keys      map[string]*rsa.PublicKey
+	fetchedAt time.Time
+}
+
+var appleKeys appleKeyCache
+
+// appleClientSecret builds the ES256 JWT Apple wants in place of a
+// static client secret. This is the whole reason Apple is not another
+// mechanical provider case: every other provider hands you a string,
+// Apple hands you a key and expects you to sign.
+func appleClientSecret(p oauthProvider) (string, error) {
+	if p.appleTeamID == "" || p.appleKeyID == "" || p.applePrivateKey == "" {
+		return "", errOAuthProviderNotConfigured
+	}
+
+	key, err := parseApplePrivateKey(p.applePrivateKey)
+	if err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+	tok := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
+		"iss": p.appleTeamID,
+		"iat": now.Unix(),
+		"exp": now.Add(appleClientSecretTTL).Unix(),
+		"aud": appleIssuer,
+		"sub": p.clientID,
+	})
+	tok.Header["kid"] = p.appleKeyID
+	return tok.SignedString(key)
+}
+
+// parseApplePrivateKey reads the PKCS#8 .p8 file Apple's developer
+// console hands out. A non-EC key is rejected here rather than left to
+// fail at signing time with a less obvious error.
+func parseApplePrivateKey(pemValue string) (*ecdsa.PrivateKey, error) {
+	block, _ := pem.Decode([]byte(pemValue))
+	if block == nil {
+		return nil, fmt.Errorf("httpapi: apple private key is not PEM-encoded")
+	}
+	parsed, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("httpapi: parsing apple private key: %w", err)
+	}
+	key, ok := parsed.(*ecdsa.PrivateKey)
+	if !ok {
+		return nil, fmt.Errorf("httpapi: apple private key is %T, want an EC (P-256) key", parsed)
+	}
+	return key, nil
+}
+
+// verifyAppleIDToken checks an id_token against Apple's published
+// signing keys and returns the account's stable identifier and email.
+// Apple is the only provider here with no userinfo endpoint: the
+// identity travels inside this signed JWT, so it is verified rather
+// than merely decoded — an unverified parse would let anyone who can
+// reach our callback mint an account.
+func verifyAppleIDToken(ctx context.Context, idToken, clientID string) (sub, email string, err error) {
+	claims := jwt.MapClaims{}
+	_, err = jwt.ParseWithClaims(idToken, claims, func(t *jwt.Token) (any, error) {
+		kid, _ := t.Header["kid"].(string)
+		return appleSigningKey(ctx, kid)
+	},
+		jwt.WithValidMethods([]string{"RS256"}),
+		jwt.WithIssuer(appleIssuer),
+		jwt.WithAudience(clientID),
+		jwt.WithExpirationRequired(),
+	)
+	if err != nil {
+		return "", "", fmt.Errorf("%w: %v", errOAuthIdentityVerificationFailed, err)
+	}
+
+	sub, _ = claims["sub"].(string)
+	email, _ = claims["email"].(string)
+	if sub == "" {
+		return "", "", errOAuthIdentityVerificationFailed
+	}
+	return sub, email, nil
+}
+
+// appleSigningKey returns the RSA key for kid, fetching (and caching)
+// Apple's key set as needed. A cache miss for a kid we already fetched
+// forces one refetch, which is how a key rotation is picked up without
+// waiting out the TTL.
+func appleSigningKey(ctx context.Context, kid string) (*rsa.PublicKey, error) {
+	if kid == "" {
+		return nil, errOAuthIdentityVerificationFailed
+	}
+
+	appleKeys.mu.Lock()
+	defer appleKeys.mu.Unlock()
+
+	_, known := appleKeys.keys[kid]
+	if known && time.Since(appleKeys.fetchedAt) < appleKeyCacheTTL {
+		return appleKeys.keys[kid], nil
+	}
+
+	keys, err := fetchAppleKeys(ctx)
+	if err != nil {
+		return nil, err
+	}
+	appleKeys.keys = keys
+	appleKeys.fetchedAt = time.Now()
+
+	key, ok := keys[kid]
+	if !ok {
+		return nil, errOAuthIdentityVerificationFailed
+	}
+	return key, nil
+}
+
+// fetchAppleKeys reads Apple's JWKS. Only RSA keys are accepted —
+// Apple signs id_tokens with RS256, and anything else in the set is not
+// something this flow will ever validate against.
+func fetchAppleKeys(ctx context.Context) (map[string]*rsa.PublicKey, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, appleJWKSURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("httpapi: apple key set request failed: status %d", resp.StatusCode)
+	}
+
+	var body struct {
+		Keys []struct {
+			Kty string `json:"kty"`
+			Kid string `json:"kid"`
+			N   string `json:"n"`
+			E   string `json:"e"`
+		} `json:"keys"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return nil, err
+	}
+
+	out := make(map[string]*rsa.PublicKey, len(body.Keys))
+	for _, k := range body.Keys {
+		if k.Kty != "RSA" || k.Kid == "" {
+			continue
+		}
+		nBytes, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(k.N, "="))
+		if err != nil {
+			return nil, fmt.Errorf("httpapi: decoding apple key modulus: %w", err)
+		}
+		eBytes, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(k.E, "="))
+		if err != nil {
+			return nil, fmt.Errorf("httpapi: decoding apple key exponent: %w", err)
+		}
+		out[k.Kid] = &rsa.PublicKey{
+			N: new(big.Int).SetBytes(nBytes),
+			E: int(new(big.Int).SetBytes(eBytes).Int64()),
+		}
+	}
+	if len(out) == 0 {
+		return nil, errOAuthIdentityVerificationFailed
+	}
+	return out, nil
+}