fix(init): verify preserved Apple configuration

Author: seanperez29

packages/cli-core/src/commands/init/ios/native-apple.test.ts

@@ -110,6 +110,9 @@ function statefulAPI(
     failActual?: unknown;
     malformedDryRun?: boolean;
     replaceProjection?: boolean;
+    dryRunProjectionOverride?: Record<string, unknown>;
+    actualProjectionOverride?: Record<string, unknown>;
+    persistedActualState?: AppleConnection;
     persistActual?: boolean;
   } = {},
 ): {
@@ -173,12 +176,20 @@ function statefulAPI(
           ? { ...(update as Record<string, unknown>) }
           : { ...current, ...(update as Record<string, unknown>) }
       ) as AppleConnection;
+      const projectionOverride = patchOptions.dryRun
+        ? options.dryRunProjectionOverride
+        : options.actualProjectionOverride;
+      if (projectionOverride) Object.assign(after, structuredClone(projectionOverride));
       if (patchOptions.dryRun && options.malformedDryRun) {
         return { config_version: version, dry_run: true, before: {}, after: {} };
       }
       if (!patchOptions.dryRun) {
         writes += 1;
-        if (options.persistActual !== false) current = after;
+        if (options.persistActual !== false) {
+          current = options.persistedActualState
+            ? structuredClone(options.persistedActualState)
+            : after;
+        }
         version = NEXT_CONFIG_VERSION;
       }
       return {
@@ -590,6 +601,100 @@ describe("native Sign in with Apple remote setup", () => {
     expect(captured.err).not.toContain(PRIVATE_KEY);
   });
 
+  test("rejects a dry-run projection that changes a nested preserved field", async () => {
+    const harness = statefulAPI({
+      initial: connection(false, false, {
+        unrelated_provider_setting: {
+          nested: { mode: "keep", secret: PRIVATE_KEY },
+        },
+      }),
+      dryRunProjectionOverride: {
+        unrelated_provider_setting: {
+          nested: { mode: "changed", secret: PRIVATE_KEY },
+        },
+      },
+    });
+    const prepared = await prepareIOSNativeAppleConnection(baseOptions(), {
+      api: harness.api,
+      prompts: unexpectedPrompts(),
+    });
+    if (prepared.status !== "ready") throw new Error("expected ready plan");
+
+    await expect(applyIOSNativeAppleConnection(prepared, harness.api)).rejects.toThrow(
+      "could not safely validate native Sign in with Apple",
+    );
+    expect(harness.patchCalls.map((call) => call.options.dryRun)).toEqual([true]);
+    expect(harness.actualWrites()).toBe(0);
+    expect(captured.err).not.toContain(PRIVATE_KEY);
+  });
+
+  test("rejects an actual-write projection that changes a preserved credential value", async () => {
+    const changedSecret = `${PRIVATE_KEY}_CHANGED`;
+    const harness = statefulAPI({
+      initial: connection(false, false, { client_secret: PRIVATE_KEY }),
+      actualProjectionOverride: { client_secret: changedSecret },
+    });
+    const prepared = await prepareIOSNativeAppleConnection(baseOptions(), {
+      api: harness.api,
+      prompts: unexpectedPrompts(),
+    });
+    if (prepared.status !== "ready") throw new Error("expected ready plan");
+
+    let thrown: unknown;
+    try {
+      await applyIOSNativeAppleConnection(prepared, harness.api);
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toMatchObject({
+      code: ERROR_CODE.PLAPI_UNEXPECTED_RESPONSE,
+      message: expect.stringContaining("removed or changed existing fields"),
+    });
+    expect(harness.patchCalls.map((call) => call.options.dryRun)).toEqual([true, false]);
+    expect(harness.actualWrites()).toBe(1);
+    expect(String(thrown)).not.toContain(PRIVATE_KEY);
+    expect(String(thrown)).not.toContain(changedSecret);
+    expect(captured.err).not.toContain(PRIVATE_KEY);
+    expect(captured.err).not.toContain(changedSecret);
+  });
+
+  test("rejects a final state that drops a secret despite preserving projections", async () => {
+    const initial = connection(false, true, {
+      client_id: SERVICES_ID,
+      client_secret: PRIVATE_KEY,
+      unrelated_provider_setting: { nested: { mode: "keep" } },
+    });
+    const harness = statefulAPI({
+      initial,
+      persistedActualState: connection(true, true, {
+        bundle_id: BUNDLE_IDENTIFIER,
+        client_id: SERVICES_ID,
+        unrelated_provider_setting: { nested: { mode: "keep" } },
+      }),
+    });
+    const prepared = await prepareIOSNativeAppleConnection(baseOptions(), {
+      api: harness.api,
+      prompts: unexpectedPrompts(),
+    });
+    if (prepared.status !== "ready") throw new Error("expected ready plan");
+
+    let thrown: unknown;
+    try {
+      await applyIOSNativeAppleConnection(prepared, harness.api);
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toMatchObject({
+      code: ERROR_CODE.IOS_REMOTE_VERIFY_FAILED,
+      message: expect.stringContaining("did not pass final verification"),
+    });
+    expect(harness.patchCalls.map((call) => call.options.dryRun)).toEqual([true, false]);
+    expect(harness.actualWrites()).toBe(1);
+    expect(String(thrown)).not.toContain(PRIVATE_KEY);
+    expect(JSON.stringify(prepared)).not.toContain(PRIVATE_KEY);
+    expect(captured.err).not.toContain(PRIVATE_KEY);
+  });
+
   test("rereads final state and rejects a write that did not persist", async () => {
     const harness = statefulAPI({ persistActual: false });
     const prepared = await prepareIOSNativeAppleConnection(baseOptions(), {

packages/cli-core/src/commands/init/ios/native-apple.ts

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import { dim, yellow } from "../../../lib/color.ts";
 import {
   ApiError,
@@ -19,6 +20,7 @@ import { withSpinner } from "../../../lib/spinner.ts";
 
 const APPLE_CONNECTION_KEY = "connection_oauth_apple";
 const CONFIG_VERSION_PATTERN = /^v1_[0-9a-f]{8}$/;
+const NATIVE_APPLE_PATCH_FIELDS = new Set(["enabled", "authenticatable", "bundle_id"]);
 
 function iosAppleError(
   message: string,
@@ -78,6 +80,11 @@ export type IOSNativeAppleSkipped = {
 
 export type IOSNativeApplePreparation = IOSNativeApplePlan | IOSNativeAppleSkipped;
 
+const preservedAppleFieldFingerprints = new WeakMap<
+  IOSNativeApplePlan,
+  ReadonlyMap<string, string>
+>();
+
 export interface IOSNativeApplePatchOptions {
   dryRun: boolean;
   /** Forwarded only by clients which explicitly advertise support. */
@@ -163,6 +170,50 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function canonicalConfigValue(value: unknown): string | undefined {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") return Number.isFinite(value) ? JSON.stringify(value) : undefined;
+  if (Array.isArray(value)) {
+    const items = value.map(canonicalConfigValue);
+    return items.some((item) => item == null) ? undefined : `[${items.join(",")}]`;
+  }
+  if (!isRecord(value)) return undefined;
+
+  const entries: string[] = [];
+  for (const key of Object.keys(value).sort()) {
+    const item = canonicalConfigValue(value[key]);
+    if (item == null) return undefined;
+    entries.push(`${JSON.stringify(key)}:${item}`);
+  }
+  return `{${entries.join(",")}}`;
+}
+
+function preservedFieldFingerprints(
+  container: Record<string, unknown>,
+): ReadonlyMap<string, string> | undefined {
+  const connection = container[APPLE_CONNECTION_KEY];
+  if (!isRecord(connection)) return undefined;
+
+  const fingerprints = new Map<string, string>();
+  for (const [key, value] of Object.entries(connection)) {
+    if (NATIVE_APPLE_PATCH_FIELDS.has(key)) continue;
+    const canonical = canonicalConfigValue(value);
+    if (canonical == null) return undefined;
+    fingerprints.set(key, new Bun.CryptoHasher("sha256").update(canonical).digest("hex"));
+  }
+  return fingerprints;
+}
+
+function preservedFieldsMatch(before: IOSNativeApplePlan, after: IOSNativeApplePlan): boolean {
+  const beforeFingerprints = preservedAppleFieldFingerprints.get(before);
+  const afterFingerprints = preservedAppleFieldFingerprints.get(after);
+  if (!beforeFingerprints || !afterFingerprints) return false;
+  return [...beforeFingerprints].every(
+    ([key, fingerprint]) => afterFingerprints.get(key) === fingerprint,
+  );
+}
+
 function blocker(code: IOSNativeAppleBlockerCode, message: string): IOSNativeAppleBlocker {
   return { code, message };
 }
@@ -319,7 +370,7 @@ export function buildIOSNativeApplePlan(
         ]
       : [];
 
-  return {
+  const plan: IOSNativeApplePlan = {
     schemaVersion: 1,
     kind: "clerk-ios-native-apple-connection",
     status,
@@ -334,6 +385,9 @@ export function buildIOSNativeApplePlan(
     actions,
     blockers,
   };
+  const fingerprints = preservedFieldFingerprints(options.config);
+  if (fingerprints) preservedAppleFieldFingerprints.set(plan, fingerprints);
+  return plan;
 }
 
 export async function auditIOSNativeAppleConnection(
@@ -422,10 +476,14 @@ function validatePatchProjection(
   if (
     !isRecord(beforeConnection) ||
     !isRecord(afterConnection) ||
-    Object.keys(beforeConnection).some((key) => !Object.hasOwn(afterConnection, key))
+    Object.entries(beforeConnection).some(
+      ([key, value]) =>
+        !Object.hasOwn(afterConnection, key) ||
+        (!NATIVE_APPLE_PATCH_FIELDS.has(key) && !isDeepStrictEqual(afterConnection[key], value)),
+    )
   ) {
     throw iosAppleError(
-      "Clerk returned an Apple configuration projection that removed existing fields.",
+      "Clerk returned an Apple configuration projection that removed or changed existing fields.",
       ERROR_CODE.PLAPI_UNEXPECTED_RESPONSE,
     );
   }
@@ -659,7 +717,7 @@ export async function applyIOSNativeAppleConnection(
       ERROR_CODE.IOS_REMOTE_VERIFY_FAILED,
     );
   }
-  if (finalPlan.status !== "satisfied") {
+  if (finalPlan.status !== "satisfied" || !preservedFieldsMatch(current, finalPlan)) {
     throw iosAppleError(
       "Native Sign in with Apple did not pass final verification. Rerun clerk init to reconcile the remote state safely.",
       ERROR_CODE.IOS_REMOTE_VERIFY_FAILED,