[Fix] [Feat] Update OAuth Sign-In and Get Token Functions to Work (#1130)

### Summary of Changes Previously, on the Swift SDK, the `signInWithOAuth` function wasn't working. In this PR, we fix it by having the `getOAuthUrl` function to actually redirect correctly. Note that to do so, we updated the `validRedirectUrl` check on the backend to accept app native redirects (from our new trusted url scheme). Another thing to note is that we added functionality to the `TokenStore` abstraction to conditionally refresh the access token that the user is trying to fetch if it is expired/close to expiring if possible. `getOAuthUrl` will attempt to get a valid access token, and thus will rely on our algorithm documented in `utilities.md`. The specs serve as the source of truth. We go further and implement Apple Native sign in. To do so, we have it hit a new route on the backend and verify the `jwtToken` retrieved by the sdk against an Apple-provided set of `jwks`. We use jose to do so, in line with the rest of the codebase. We take this opportunity to refactor the oauth provider route owing to the amount of duplicated logic. Additionally, to enable the apple sign in, users will have to update the Apple authentication method modal on the dashboard and add accepted bundle ids. These are identifiers for projects, and we will check the `JWT` on the backend to make sure the audience is set to an accepted bundleId. We also update the Apple modal to be more informative. ### Using the new Features To use the Apple native sign in, users will have to 1) sign up with an apple developer account, 2) set up their bundleids for their projects by connecting them to the apple developer account, 3) update the Stack-Auth Authentication Methods dashboard apple modal with the relevant fields. Then, trying to sign in with apple with our Swift SDK will use the apple native sign in. ### UI Changes Renamed the fields in the apple modal. Added a new field for bundle ids. See below. https://github.com/user-attachments/assets/0e760c0e-3198-4818-ac7f-4900d7a125bb Co-authored-by: Konstantin Wohlwend <[email protected]>
2026-07-20 21:29:36 +08:00 · 2026-01-28 02:17:27 +00:00
parent 2a6b17339a
commit c8694c7ff5
83 changed files with 16090 additions and 191 deletions
@@ -0,0 +1,100 @@
+name: Publish Swift SDK to prerelease repo
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'sdks/implementations/swift/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false  # Don't cancel publishing in progress
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source repo
+        uses: actions/checkout@v4
+        with:
+          path: source
+
+      - name: Read version from package.json
+        id: version
+        run: |
+          VERSION=$(jq -r '.version' source/sdks/implementations/swift/package.json)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Swift SDK version: $VERSION"
+
+      - name: Check if tag already exists in target repo
+        id: check-tag
+        run: |
+          TAG="v${{ steps.version.outputs.version }}"
+          echo "Checking if tag $TAG exists in stack-auth/swift-sdk-prerelease..."
+          
+          # Use the GitHub API to check if the tag exists
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: Bearer ${{ secrets.SWIFT_SDK_PUBLISH_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/stack-auth/swift-sdk-prerelease/git/refs/tags/$TAG")
+          
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "Tag $TAG already exists, skipping publish"
+            echo "exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "Tag $TAG does not exist, will publish"
+            echo "exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Clone target repo
+        if: steps.check-tag.outputs.exists == 'false'
+        run: |
+          git clone https://x-access-token:${{ secrets.SWIFT_SDK_PUBLISH_TOKEN }}@github.com/stack-auth/swift-sdk-prerelease.git target
+
+      - name: Copy Swift SDK to target repo
+        if: steps.check-tag.outputs.exists == 'false'
+        run: |
+          # Remove all files except .git from target
+          cd target
+          find . -maxdepth 1 -not -name '.git' -not -name '.' -exec rm -rf {} +
+          cd ..
+          
+          # Copy everything from Swift SDK
+          cp -r source/sdks/implementations/swift/* target/
+          cp source/sdks/implementations/swift/.gitignore target/ 2>/dev/null || true
+          
+          # Remove package.json (it's only for turborepo integration, not part of the Swift package)
+          rm -f target/package.json
+
+      - name: Commit and push to target repo
+        if: steps.check-tag.outputs.exists == 'false'
+        run: |
+          cd target
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          
+          git add -A
+          
+          # Check if there are changes to commit
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "Release v${{ steps.version.outputs.version }}"
+          fi
+          
+          # Create and push tag
+          TAG="v${{ steps.version.outputs.version }}"
+          git tag "$TAG"
+          git push origin main --tags
+          
+          echo "Successfully published Swift SDK v${{ steps.version.outputs.version }}"
+
+      - name: Summary
+        run: |
+          if [ "${{ steps.check-tag.outputs.exists }}" = "true" ]; then
+            echo "::notice::Skipped publishing - tag v${{ steps.version.outputs.version }} already exists"
+          else
+            echo "::notice::Published Swift SDK v${{ steps.version.outputs.version }} to stack-auth/swift-sdk-prerelease"
+          fi