fix(init): verify bundled iOS plist parsing

Author: seanperez29

bunfig.toml

@@ -1,3 +1,6 @@
 [install]
 # Only install package versions published at least 2 days ago
 minimumReleaseAge = 172800
+
+[test]
+preload = ["./packages/cli-core/src/test/version-preload.ts"]

packages/cli-core/src/commands/init/ios/apple-entitlement.ts

@@ -1,6 +1,5 @@
 import { lstat, readFile } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
-import plist from "@expo/plist";
 import {
   planIOSAssociatedDomain,
   type IOSAssociatedDomainBlockerCode,
@@ -19,6 +18,7 @@ import {
   type IOSMissingEntitlementsSettingsPlan,
 } from "./entitlements-settings.ts";
 import { isRecord } from "./pbx.ts";
+import { parseIOSPlist } from "./plist.ts";
 
 const APPLE_SIGN_IN_KEY = "com.apple.developer.applesignin";
 const APPLE_SIGN_IN_VALUE = "Default";
@@ -229,7 +229,7 @@ function inspectEntitlementsBytes(
     }
     const bom = bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf;
     const source = new TextDecoder("utf-8", { fatal: true }).decode(bom ? bytes.slice(3) : bytes);
-    const parsed: unknown = plist.parse(source);
+    const parsed = parseIOSPlist(source);
     if (!isRecord(parsed)) throw new Error("plist root is not a dictionary");
     const rawValue = parsed[APPLE_SIGN_IN_KEY];
     const structure = appleKeyStructure(source);

packages/cli-core/src/commands/init/ios/compiled-cli.test.ts

@@ -0,0 +1,143 @@
+import { expect, setDefaultTimeout, test } from "bun:test";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { createIOSFixture } from "./test-helpers.ts";
+
+setDefaultTimeout(30_000);
+
+const cliEntry = resolve(import.meta.dir, "../../../cli.ts");
+const repositoryRoot = resolve(import.meta.dir, "../../../../../..");
+
+function isolatedCLIEnvironment(configDir: string): Record<string, string | undefined> {
+  const env: Record<string, string | undefined> = { ...Bun.env };
+  for (const key of Object.keys(env)) {
+    if (key.includes("CLERK")) delete env[key];
+  }
+  delete env.CI;
+  delete env.DO_NOT_TRACK;
+  delete env.NO_UPDATE_NOTIFIER;
+  return {
+    ...env,
+    NO_COLOR: "1",
+    CLERK_CONFIG_DIR: configDir,
+    CLERK_TELEMETRY_DISABLED: "1",
+  };
+}
+
+async function run(
+  command: string[],
+  options: { cwd: string; env?: Record<string, string | undefined> },
+) {
+  const child = Bun.spawn(command, {
+    ...options,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  return { stdout, stderr, exitCode };
+}
+
+test("the compiled CLI semantically parses iOS XML plists", async () => {
+  const temporaryRoot = await mkdtemp(join(tmpdir(), "clerk-ios-compiled-cli-"));
+  try {
+    const binary = join(temporaryRoot, "clerk");
+    const fixtureRoot = join(temporaryRoot, "fixture");
+    const configDir = join(temporaryRoot, "config");
+    await mkdir(configDir);
+    await createIOSFixture(fixtureRoot, {
+      complete: true,
+      includeKey: false,
+      localSecrets: true,
+    });
+    await Bun.write(
+      join(fixtureRoot, "MyApp", "LocalSecrets.plist"),
+      '<?xml version="1.0" encoding="UTF-8"?><plist version="1.0"><dict><key>CLERK_PUBLISHABLE_KEY</key><string>replace-me</string></dict></plist>',
+    );
+    await Bun.write(
+      join(configDir, "config.json"),
+      `${JSON.stringify({
+        profiles: {},
+        telemetryNoticeShown: true,
+        machineUuid: "00000000-0000-4000-8000-000000000000",
+      })}\n`,
+    );
+
+    const compiled = await run(
+      [
+        process.execPath,
+        "build",
+        "--compile",
+        "--minify",
+        "--no-compile-autoload-dotenv",
+        "--no-compile-autoload-bunfig",
+        cliEntry,
+        "--outfile",
+        binary,
+      ],
+      { cwd: repositoryRoot },
+    );
+    expect(compiled.exitCode, `${compiled.stdout}\n${compiled.stderr}`).toBe(0);
+
+    const result = await run(
+      [binary, "--mode", "human", "init", "--dry-run", "--json", "--sign-in-with-apple"],
+      { cwd: fixtureRoot, env: isolatedCLIEnvironment(configDir) },
+    );
+    expect(result.exitCode, `${result.stdout}\n${result.stderr}`).toBe(0);
+    expect(result.stderr).toBe("");
+
+    const output = JSON.parse(result.stdout) as {
+      inspection: {
+        appTargets: Array<{
+          configurations: Array<{
+            entitlements?: {
+              associatedDomains: string[];
+              literalAppIdentifierPrefix?: string;
+            };
+          }>;
+        }>;
+        diagnostics: Array<{ code: string }>;
+      };
+      plan: {
+        steps: Array<{ id: string; status: string; automatable: boolean }>;
+      };
+    };
+    const configurations = output.inspection.appTargets[0]?.configurations ?? [];
+    expect(configurations).toHaveLength(2);
+    expect(configurations.map((configuration) => configuration.entitlements)).toEqual([
+      expect.objectContaining({
+        associatedDomains: ["webcredentials:clerk.example.test"],
+        literalAppIdentifierPrefix: "LEGACY1234",
+      }),
+      expect.objectContaining({
+        associatedDomains: ["webcredentials:clerk.example.test"],
+        literalAppIdentifierPrefix: "LEGACY1234",
+      }),
+    ]);
+    expect(output.inspection.diagnostics.map((diagnostic) => diagnostic.code)).not.toContain(
+      "xcode.unreadable-entitlements",
+    );
+    expect(output.plan.steps).toContainEqual(
+      expect.objectContaining({
+        id: "configure-publishable-key",
+        status: "required",
+        automatable: true,
+      }),
+    );
+    expect(output.plan.steps).toContainEqual(
+      expect.objectContaining({
+        id: "enable-native-apple",
+        status: "required",
+        automatable: true,
+      }),
+    );
+    expect(result.stdout).not.toContain("unreadable-entitlements");
+    expect(result.stdout).not.toContain("unreadable-local-secrets");
+  } finally {
+    await rm(temporaryRoot, { recursive: true, force: true });
+  }
+});

packages/cli-core/src/test/version-preload.ts

@@ -0,0 +1,4 @@
+// Bun macro imports can be order-dependent when a test first reaches the CLI
+// through a deeply mocked command graph. Load the real version module before
+// test files so every isolated worker resolves its macro deterministically.
+import "../lib/version.ts";