SIMON Master Console Rebuild

File viewer

guarded to /htdocs

/api/auth/apple_client_secret.php

<?php
declare(strict_types=1);

/**
 * /api/auth/apple_client_secret.php
 *
 * Builds a runtime Apple client secret JWT using:
 * - APPLE_TEAM_ID
 * - APPLE_KEY_ID
 * - APPLE_CLIENT_ID
 * - APPLE_PRIVATE_KEY_PATH
 *
 * Works with current /private/config.php
 */

function apple_base64url_encode(string $input): string
{
    return rtrim(strtr(base64_encode($input), '+/', '-_'), '=');
}

function apple_der_to_jose(string $der, int $partLength = 32): string
{
    $offset = 0;

if (!isset($der[$offset]) || ord($der[$offset++]) !== 0x30) {
        throw new RuntimeException('Invalid DER sequence.');
    }

if (!isset($der[$offset])) {
        throw new RuntimeException('Invalid DER sequence length.');
    }

$seqLen = ord($der[$offset++]);

if ($seqLen & 0x80) {
        $numBytes = $seqLen & 0x1f;
        $seqLen = 0;

for ($i = 0; $i < $numBytes; $i++) {
            if (!isset($der[$offset])) {
                throw new RuntimeException('Invalid DER length bytes.');
            }
            $seqLen = ($seqLen << 8) | ord($der[$offset++]);
        }
    }

if (!isset($der[$offset]) || ord($der[$offset++]) !== 0x02) {
        throw new RuntimeException('Invalid DER integer for R.');
    }

if (!isset($der[$offset])) {
        throw new RuntimeException('Invalid DER R length.');
    }

$rLen = ord($der[$offset++]);
    $r = substr($der, $offset, $rLen);
    $offset += $rLen;

if (!isset($der[$offset]) || ord($der[$offset++]) !== 0x02) {
        throw new RuntimeException('Invalid DER integer for S.');
    }

if (!isset($der[$offset])) {
        throw new RuntimeException('Invalid DER S length.');
    }

$sLen = ord($der[$offset++]);
    $s = substr($der, $offset, $sLen);

$r = ltrim($r, "\x00");
    $s = ltrim($s, "\x00");

$r = str_pad($r, $partLength, "\x00", STR_PAD_LEFT);
    $s = str_pad($s, $partLength, "\x00", STR_PAD_LEFT);

if (strlen($r) !== $partLength || strlen($s) !== $partLength) {
        throw new RuntimeException('Invalid DER signature length.');
    }

return $r . $s;
}

function build_apple_client_secret(): string
{
    foreach (['APPLE_TEAM_ID', 'APPLE_KEY_ID', 'APPLE_CLIENT_ID', 'APPLE_PRIVATE_KEY_PATH'] as $const) {
        if (!defined($const) || trim((string) constant($const)) === '') {
            throw new RuntimeException("Missing Apple config: {$const}");
        }
    }

$privateKeyPath = (string) APPLE_PRIVATE_KEY_PATH;

if (!is_file($privateKeyPath) || !is_readable($privateKeyPath)) {
        throw new RuntimeException('Apple private key file is missing or unreadable.');
    }

$pem = file_get_contents($privateKeyPath);
    if ($pem === false || trim($pem) === '') {
        throw new RuntimeException('Apple private key file is empty.');
    }

$privateKey = openssl_pkey_get_private($pem);
    if ($privateKey === false) {
        throw new RuntimeException('Apple private key could not be parsed.');
    }

$now = time();

$header = [
        'alg' => 'ES256',
        'kid' => (string) APPLE_KEY_ID,
        'typ' => 'JWT',
    ];

$payload = [
        'iss' => (string) APPLE_TEAM_ID,
        'iat' => $now,
        'exp' => $now + 86400 * 180,
        'aud' => 'https://appleid.apple.com',
        'sub' => (string) APPLE_CLIENT_ID,
    ];

$encodedHeader = apple_base64url_encode(json_encode($header, JSON_UNESCAPED_SLASHES));
    $encodedPayload = apple_base64url_encode(json_encode($payload, JSON_UNESCAPED_SLASHES));
    $signingInput = $encodedHeader . '.' . $encodedPayload;

$derSignature = '';
    $ok = openssl_sign($signingInput, $derSignature, $privateKey, OPENSSL_ALGO_SHA256);

if (!$ok || $derSignature === '') {
        throw new RuntimeException('Failed to sign Apple client secret JWT.');
    }

$joseSignature = apple_der_to_jose($derSignature, 32);

return $signingInput . '.' . apple_base64url_encode($joseSignature);
}

Quick jump

open a path

True command center for SIMON + WEB360

File viewer

Quick jump