apple

package

v0.26.0 Latest Latest Go to latest Published: Oct 17, 2026 License: MIT Imports: 19 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/authara-org/authara

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
type Client
- func New(cfg Config) (*Client, error)
- func (c *Client) Exchange(ctx context.Context, code, expectedNonce string) (ExchangeResult, error)
- func (c *Client) Revoke(ctx context.Context, refreshToken string) error
type Config
type Credentials
- func NewCredentials(database *store.Store, activeKeyID string, keys map[string][]byte, ...) (*Credentials, error)
type ExchangeResult
type Identity

Constants ¶

View Source

const (
	Issuer    = "https://appleid.apple.com"
	JWKSURL   = "https://appleid.apple.com/auth/keys"
	TokenURL  = "https://appleid.apple.com/auth/token"
	RevokeURL = "https://appleid.apple.com/auth/revoke"
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

func New ¶

func New(cfg Config) (*Client, error)

func (*Client) Exchange ¶

func (c *Client) Exchange(ctx context.Context, code, expectedNonce string) (ExchangeResult, error)

func (*Client) Revoke ¶

func (c *Client) Revoke(ctx context.Context, refreshToken string) error

type Config ¶

type Config struct {
	ClientID    string
	TeamID      string
	KeyID       string
	PrivateKey  *ecdsa.PrivateKey
	RedirectURI string
	HTTPClient  *http.Client
	Issuer      string
	JWKSURL     string
	TokenURL    string
	RevokeURL   string
	Now         func() time.Time
}

type Credentials ¶

type Credentials struct {
	// contains filtered or unexported fields
}

func NewCredentials ¶

func NewCredentials(database *store.Store, activeKeyID string, keys map[string][]byte, revoker interface {
	Revoke(context.Context, string) error
}) (*Credentials, error)

func (*Credentials) ProcessRevocationBatch ¶

func (c *Credentials) ProcessRevocationBatch(ctx context.Context, now time.Time) (int64, bool, error)

ProcessRevocationBatch processes one token at a time. The maintenance coordinator supplies the transaction and leader fencing, while failures are committed with a later retry time so one unavailable token cannot block the rest of the queue.

func (*Credentials) PromoteProviderLink ¶

func (c *Credentials) PromoteProviderLink(ctx context.Context, userID uuid.UUID, linkID uuid.UUID) error

PromoteProviderLink turns a staged token into the linked account's current Apple credential. Callers invoke this inside the provider-link transaction.

func (*Credentials) QueueRevocation ¶

func (c *Credentials) QueueRevocation(ctx context.Context, refreshToken string) error

func (*Credentials) Revoke ¶

func (c *Credentials) Revoke(ctx context.Context, refreshToken string) error

func (*Credentials) Save ¶

func (c *Credentials) Save(ctx context.Context, userID uuid.UUID, refreshToken string) error

func (*Credentials) StageProviderLink ¶

func (c *Credentials) StageProviderLink(ctx context.Context, linkID uuid.UUID, refreshToken string, expiresAt time.Time) error

StageProviderLink keeps a newly issued refresh token encrypted until the existing account owner proves control. If the link is abandoned, the normal revocation worker processes the token when the pending link expires.

type ExchangeResult ¶

type ExchangeResult struct {
	Identity     Identity
	RefreshToken string
}

type Identity ¶

type Identity struct {
	OAuthID       string
	Email         string
	EmailVerified bool
	PrivateRelay  bool
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL