Rork アプリの Sign in with Apple を、サーバー検証とアカウント削除まで本気で実装するガイド

-- D1: nonce は 5 分で失効する使い捨ての値
CREATE TABLE apple_nonces (
  nonce      TEXT PRIMARY KEY,
  expires_at INTEGER NOT NULL      -- UNIX 秒
);
 
CREATE TABLE users (
  id                       TEXT PRIMARY KEY,
  apple_sub                TEXT UNIQUE,
  email                    TEXT,
  display_name             TEXT,
  apple_refresh_token_enc  TEXT,
  status                   TEXT NOT NULL DEFAULT 'active', -- active | pending_deletion
  created_at               TEXT NOT NULL
);

// src/routes/auth-apple-nonce.ts
import { Hono } from "hono";
 
type Env = { DB: D1Database };
const app = new Hono<{ Bindings: Env }>();
 
app.post("/auth/apple/nonce", async (c) => {
  const bytes = crypto.getRandomValues(new Uint8Array(32));
  const raw = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
  const expiresAt = Math.floor(Date.now() / 1000) + 300;
 
  await c.env.DB.prepare(
    "INSERT INTO apple_nonces (nonce, expires_at) VALUES (?1, ?2)"
  )
    .bind(raw, expiresAt)
    .run();
 
  return c.json({ nonce: raw });
});
 
export default app;

// src/auth/nonce.ts
export async function consumeNonce(db: D1Database, raw: string): Promise<boolean> {
  const now = Math.floor(Date.now() / 1000);
  const row = await db
    .prepare("DELETE FROM apple_nonces WHERE nonce = ?1 AND expires_at > ?2 RETURNING nonce")
    .bind(raw, now)
    .first();
  return row !== null;
}

// app/(auth)/sign-in-apple.tsx
import * as AppleAuthentication from "expo-apple-authentication";
import * as Crypto from "expo-crypto";
import * as SecureStore from "expo-secure-store";
import { Alert, Platform } from "react-native";
import { useState } from "react";
import { useRouter } from "expo-router";
 
const API_BASE = process.env.EXPO_PUBLIC_API_BASE!;
 
async function fetchNonce(): Promise<string> {
  const res = await fetch(`${API_BASE}/auth/apple/nonce`, { method: "POST" });
  if (!res.ok) throw new Error("nonce_unavailable");
  return ((await res.json()) as { nonce: string }).nonce;
}
 
export function AppleSignInButton() {
  const router = useRouter();
  const [busy, setBusy] = useState(false);
 
  const handlePress = async () => {
    if (busy) return;
    setBusy(true);
    try {
      const raw = await fetchNonce();
      const hashed = await Crypto.digestStringAsync(
        Crypto.CryptoDigestAlgorithm.SHA256,
        raw,
        { encoding: Crypto.CryptoEncoding.HEX }
      );
 
      const credential = await AppleAuthentication.signInAsync({
        requestedScopes: [
          AppleAuthentication.AppleAuthenticationScope.FULL_NAME,
          AppleAuthentication.AppleAuthenticationScope.EMAIL,
        ],
        nonce: hashed, // Apple に渡すのはハッシュの方
      });
 
      const res = await fetch(`${API_BASE}/auth/apple`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          identityToken: credential.identityToken,
          authorizationCode: credential.authorizationCode,
          rawNonce: raw, // サーバーには元の値を戻す
          fullName: credential.fullName, // 初回の認可でしか入らない
        }),
      });
      if (!res.ok) throw new Error(`server_verification_failed:${res.status}`);
 
      const { sessionToken } = (await res.json()) as { sessionToken: string };
      await SecureStore.setItemAsync("session_token", sessionToken);
      await SecureStore.setItemAsync("apple_user", credential.user);
      router.replace("/(app)/home");
    } catch (e: unknown) {
      const code = (e as { code?: string }).code;
      if (code === "ERR_REQUEST_CANCELED") return; // ユーザーが閉じただけ
      Alert.alert("ログインに失敗しました", "時間をおいて、もう一度お試しください。");
    } finally {
      setBusy(false);
    }
  };
 
  if (Platform.OS !== "ios") return null;
 
  return (
    <AppleAuthentication.AppleAuthenticationButton
      buttonType={AppleAuthentication.AppleAuthenticationButtonType.SIGN_IN}
      buttonStyle={AppleAuthentication.AppleAuthenticationButtonStyle.BLACK}
      cornerRadius={8}
      style={{ width: "100%", height: 50 }}
      onPress={handlePress}
    />
  );
}

// src/auth/verify-apple.ts
import { jwtVerify, createRemoteJWKSet } from "jose";
 
const APPLE_ISSUER = "https://appleid.apple.com";
// モジュールスコープに置き、リクエストごとに作り直さない
export const APPLE_JWKS = createRemoteJWKSet(new URL("https://appleid.apple.com/auth/keys"));
 
// ネイティブは Bundle ID、Web や REST 経由は Service ID が aud に入る
export const ACCEPTED_AUDIENCES = ["com.example.myrorkapp", "com.example.myrorkapp.web"];
 
export type VerifiedAppleIdentity = {
  sub: string;
  email?: string;
  emailVerified: boolean;
  isPrivateEmail: boolean;
};
 
export async function verifyAppleIdentityToken(params: {
  identityToken: string;
  rawNonce: string;
}): Promise<VerifiedAppleIdentity> {
  // 署名・iss・aud・exp をまとめて検証
  const { payload } = await jwtVerify(params.identityToken, APPLE_JWKS, {
    issuer: APPLE_ISSUER,
    audience: ACCEPTED_AUDIENCES,
  });
 
  // nonce クレームには、クライアントが渡したハッシュがそのまま入る
  const expected = await sha256Hex(params.rawNonce);
  if (payload.nonce !== expected) throw new Error("nonce_mismatch");
 
  if (typeof payload.sub !== "string" || payload.sub.length === 0) {
    throw new Error("missing_sub");
  }
 
  return {
    sub: payload.sub,
    email: typeof payload.email === "string" ? payload.email : undefined,
    emailVerified: payload.email_verified === true || payload.email_verified === "true",
    isPrivateEmail: payload.is_private_email === true || payload.is_private_email === "true",
  };
}
 
async function sha256Hex(input: string): Promise<string> {
  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
  return [...new Uint8Array(hash)].map((b) => b.toString(16).padStart(2, "0")).join("");
}

// src/auth/apple-client.ts
import { SignJWT, importPKCS8 } from "jose";
 
export async function buildAppleClientSecret(p: {
  teamId: string;          // 10 桁の Team ID
  clientId: string;        // ネイティブなら Bundle ID、Web なら Service ID
  keyId: string;           // Sign in with Apple を有効にした鍵の Key ID
  privateKeyPkcs8: string; // .p8 の中身（PEM）
}): Promise<string> {
  const now = Math.floor(Date.now() / 1000);
  const key = await importPKCS8(p.privateKeyPkcs8, "ES256");
  return await new SignJWT({})
    .setProtectedHeader({ alg: "ES256", kid: p.keyId })
    .setIssuer(p.teamId)
    .setIssuedAt(now)
    .setExpirationTime(now + 300) // 都度生成するので短くてよい
    .setAudience("https://appleid.apple.com")
    .setSubject(p.clientId)
    .sign(key);
}
 
export async function exchangeAuthorizationCode(p: {
  code: string;
  clientId: string;
  clientSecret: string;
}): Promise<string> {
  const res = await fetch("https://appleid.apple.com/auth/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      client_id: p.clientId,
      client_secret: p.clientSecret,
      code: p.code,
      grant_type: "authorization_code",
    }),
  });
  if (!res.ok) throw new Error(`apple_token_exchange_failed:${res.status}`);
  return ((await res.json()) as { refresh_token: string }).refresh_token;
}
 
export async function revokeAppleToken(p: {
  refreshToken: string;
  clientId: string;
  clientSecret: string;
}): Promise<void> {
  const res = await fetch("https://appleid.apple.com/auth/revoke", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      client_id: p.clientId,
      client_secret: p.clientSecret,
      token: p.refreshToken,
      token_type_hint: "refresh_token",
    }),
  });
  if (!res.ok) throw new Error(`apple_revoke_failed:${res.status}`);
}

// src/auth/secret-box.ts
async function importKey(base64Key: string) {
  const raw = Uint8Array.from(atob(base64Key), (ch) => ch.charCodeAt(0));
  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
}
 
export async function encryptSecret(plain: string, base64Key: string): Promise<string> {
  const key = await importKey(base64Key);
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const ct = new Uint8Array(
    await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plain))
  );
  const out = new Uint8Array(iv.length + ct.length);
  out.set(iv);
  out.set(ct, iv.length);
  return btoa(String.fromCharCode(...out));
}
 
export async function decryptSecret(boxed: string, base64Key: string): Promise<string> {
  const key = await importKey(base64Key);
  const all = Uint8Array.from(atob(boxed), (ch) => ch.charCodeAt(0));
  const plain = await crypto.subtle.decrypt(
    { name: "AES-GCM", iv: all.slice(0, 12) },
    key,
    all.slice(12)
  );
  return new TextDecoder().decode(plain);
}

// src/routes/auth-apple.ts
import { Hono } from "hono";
import { consumeNonce } from "../auth/nonce";
import { verifyAppleIdentityToken } from "../auth/verify-apple";
import { buildAppleClientSecret, exchangeAuthorizationCode } from "../auth/apple-client";
import { encryptSecret } from "../auth/secret-box";
import { issueSessionToken } from "../auth/session";
 
type Env = {
  DB: D1Database;
  APPLE_TEAM_ID: string;
  APPLE_KEY_ID: string;
  APPLE_PRIVATE_KEY_P8: string;
  TOKEN_BOX_KEY: string;
};
const CLIENT_ID = "com.example.myrorkapp"; // ネイティブの Bundle ID
const app = new Hono<{ Bindings: Env }>();
 
app.post("/auth/apple", async (c) => {
  const body = await c.req.json<{
    identityToken: string;
    authorizationCode: string;
    rawNonce: string;
    fullName?: { givenName?: string | null; familyName?: string | null } | null;
  }>();
 
  // 1) nonce を原子的に消費（なければ 401）
  if (!(await consumeNonce(c.env.DB, body.rawNonce))) {
    return c.json({ error: "nonce_invalid" }, 401);
  }
 
  // 2) ID トークンの検証
  let identity;
  try {
    identity = await verifyAppleIdentityToken({
      identityToken: body.identityToken,
      rawNonce: body.rawNonce,
    });
  } catch {
    return c.json({ error: "token_invalid" }, 401);
  }
 
  const existing = await c.env.DB.prepare(
    "SELECT id, email, status, apple_refresh_token_enc FROM users WHERE apple_sub = ?1"
  )
    .bind(identity.sub)
    .first<{ id: string; email: string | null; status: string; apple_refresh_token_enc: string | null }>();
 
  if (existing?.status === "pending_deletion") {
    return c.json({ error: "account_deleting" }, 403);
  }
 
  // 3) authorizationCode は 5 分・一度きり。交換はこの場で行います
  const needsToken = !existing || !existing.apple_refresh_token_enc;
  let refreshTokenEnc: string | null = null;
  if (needsToken) {
    try {
      const clientSecret = await buildAppleClientSecret({
        teamId: c.env.APPLE_TEAM_ID,
        clientId: CLIENT_ID,
        keyId: c.env.APPLE_KEY_ID,
        privateKeyPkcs8: c.env.APPLE_PRIVATE_KEY_P8,
      });
      const refreshToken = await exchangeAuthorizationCode({
        code: body.authorizationCode,
        clientId: CLIENT_ID,
        clientSecret,
      });
      refreshTokenEnc = await encryptSecret(refreshToken, c.env.TOKEN_BOX_KEY);
    } catch {
      // 新規ユーザーは、revoke できないアカウントを作らないための停止点
      if (!existing) return c.json({ error: "token_exchange_failed" }, 502);
    }
  }
 
  let userId: string;
  if (existing) {
    userId = existing.id;
    if (refreshTokenEnc) {
      await c.env.DB.prepare("UPDATE users SET apple_refresh_token_enc = ?1 WHERE id = ?2")
        .bind(refreshTokenEnc, userId)
        .run();
    }
    if (!existing.email && identity.email) {
      await c.env.DB.prepare("UPDATE users SET email = ?1 WHERE id = ?2")
        .bind(identity.email, userId)
        .run();
    }
  } else {
    userId = crypto.randomUUID();
    const displayName = [body.fullName?.givenName ?? "", body.fullName?.familyName ?? ""]
      .filter(Boolean)
      .join(" ")
      .trim();
    await c.env.DB.prepare(
      `INSERT INTO users (id, apple_sub, email, display_name, apple_refresh_token_enc, created_at)
       VALUES (?1, ?2, ?3, ?4, ?5, ?6)`
    )
      .bind(
        userId,
        identity.sub,
        identity.email ?? null, // 検証済みクレームのみ
        displayName || null,
        refreshTokenEnc,
        new Date().toISOString()
      )
      .run();
  }
 
  return c.json({ sessionToken: await issueSessionToken(c.env, userId) });
});
 
export default app;

// src/routes/account-delete.ts
import { decryptSecret } from "../auth/secret-box";
import { buildAppleClientSecret, revokeAppleToken } from "../auth/apple-client";
 
export async function tryRevokeAndPurge(env: Env, userId: string): Promise<boolean> {
  const row = await env.DB.prepare(
    "SELECT apple_refresh_token_enc FROM users WHERE id = ?1"
  )
    .bind(userId)
    .first<{ apple_refresh_token_enc: string | null }>();
 
  if (row?.apple_refresh_token_enc) {
    try {
      const refreshToken = await decryptSecret(row.apple_refresh_token_enc, env.TOKEN_BOX_KEY);
      const clientSecret = await buildAppleClientSecret({
        teamId: env.APPLE_TEAM_ID,
        clientId: CLIENT_ID,
        keyId: env.APPLE_KEY_ID,
        privateKeyPkcs8: env.APPLE_PRIVATE_KEY_P8,
      });
      await revokeAppleToken({ refreshToken, clientId: CLIENT_ID, clientSecret });
    } catch (e) {
      console.error("apple_revoke_failed", String(e)); // トークン本体はログに含めません
      return false;
    }
  }
  await env.DB.prepare("DELETE FROM users WHERE id = ?1").bind(userId).run();
  return true;
}
 
app.post("/account/delete", async (c) => {
  const userId = c.get("userId");
  await c.env.DB.prepare("UPDATE users SET status = 'pending_deletion' WHERE id = ?1")
    .bind(userId)
    .run();
  const done = await tryRevokeAndPurge(c.env, userId);
  // 202 でも、ユーザーには「削除を受け付けました」と伝えて構いません
  return c.json({ ok: true, purged: done }, done ? 200 : 202);
});
 
// wrangler の Cron Triggers からの呼び出し口
export async function retryPendingDeletions(env: Env) {
  const { results } = await env.DB.prepare(
    "SELECT id FROM users WHERE status = 'pending_deletion' LIMIT 50"
  ).all<{ id: string }>();
  for (const r of results) await tryRevokeAndPurge(env, r.id);
}

// src/routes/webhooks-apple.ts
import { jwtVerify } from "jose";
import { APPLE_JWKS, ACCEPTED_AUDIENCES } from "../auth/verify-apple";
 
app.post("/webhooks/apple/siwa", async (c) => {
  const { payload } = await c.req.json<{ payload: string }>();
  const { payload: claims } = await jwtVerify(payload, APPLE_JWKS, {
    issuer: "https://appleid.apple.com",
    audience: ACCEPTED_AUDIENCES,
  });
 
  // events は JSON 文字列。実際の形は届いた実物で要確認
  const event = JSON.parse(claims.events as string) as { type: string; sub: string };
 
  if (event.type === "consent-revoked" || event.type === "account-delete") {
    await c.env.DB.prepare(
      "UPDATE users SET apple_refresh_token_enc = NULL WHERE apple_sub = ?1"
    )
      .bind(event.sub)
      .run();
    // 該当ユーザーのセッション失効はここ（自前の実装に合わせた処理）
  }
  return c.body(null, 200);
});

import * as AppleAuthentication from "expo-apple-authentication";
import * as SecureStore from "expo-secure-store";
 
export async function ensureAppleCredentialStillValid(): Promise<boolean> {
  const user = await SecureStore.getItemAsync("apple_user");
  if (!user) return true; // Apple 以外でのログインは対象外
  const state = await AppleAuthentication.getCredentialStateAsync(user);
  const S = AppleAuthentication.AppleAuthenticationCredentialState;
  return state === S.AUTHORIZED; // REVOKED / NOT_FOUND ならサインアウトへ
}

CREATE TABLE auth_providers (
  user_id          TEXT NOT NULL,
  provider         TEXT NOT NULL,   -- 'apple' | 'google' | 'password'
  provider_user_id TEXT NOT NULL,   -- Apple や Google の sub
  created_at       TEXT NOT NULL,
  PRIMARY KEY (provider, provider_user_id)
);

// src/auth/observability.ts
type AppleAuthEvent =
  | { stage: "nonce"; outcome: "ok" | "invalid" }
  | { stage: "jwt_verify"; outcome: "ok" | "bad_signature" | "wrong_audience" | "expired" }
  | { stage: "token_exchange"; outcome: "ok" | "failed" }
  | { stage: "user_resolve"; outcome: "existing" | "new" };
 
export function logAppleAuth(event: AppleAuthEvent, env: { LOG_SINK: Queue }) {
  // 生の nonce も ID トークンも対象外。段階と結果の形だけを記録
  env.LOG_SINK.send({ ts: new Date().toISOString(), flow: "apple_auth", ...event });
}