Rork アプリの Sign in with Apple を、サーバー検証とアカウント削除まで本気で実装するガイド

// app/(auth)/sign-in-apple.tsx
import * as AppleAuthentication from "expo-apple-authentication";
import * as Crypto from "expo-crypto";
import * as SecureStore from "expo-secure-store";
import { Alert, Platform } from "react-native";
import { useState } from "react";
import { useRouter } from "expo-router";
 
const API_BASE = process.env.EXPO_PUBLIC_API_BASE!;
 
// Apple のドキュメントが推奨する nonce 生成方式: 32 バイト乱数の base64 → SHA-256
async function generateNonce(): Promise<{ raw: string; hashed: string }> {
  const bytes = await Crypto.getRandomBytesAsync(32);
  const raw = btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=+$/, "");
  const hashed = await Crypto.digestStringAsync(
    Crypto.CryptoDigestAlgorithm.SHA256,
    raw,
    { encoding: Crypto.CryptoEncoding.HEX }
  );
  return { raw, hashed };
}
 
export function AppleSignInButton() {
  const router = useRouter();
  const [busy, setBusy] = useState(false);
 
  const handlePress = async () => {
    if (busy) return;
    setBusy(true);
    try {
      const { raw, hashed } = await generateNonce();
 
      const credential = await AppleAuthentication.signInAsync({
        requestedScopes: [
          AppleAuthentication.AppleAuthenticationScope.FULL_NAME,
          AppleAuthentication.AppleAuthenticationScope.EMAIL,
        ],
        nonce: hashed, // 注: ここに渡すのは hashed の方
      });
 
      // サーバー側で raw nonce と ID トークンの nonce ハッシュを照合する
      const res = await fetch(`${API_BASE}/auth/apple`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          identityToken: credential.identityToken,
          authorizationCode: credential.authorizationCode,
          rawNonce: raw,
          // 初回ログイン時のみ取得できる氏名・メール（再ログイン時は null になる）
          fullName: credential.fullName,
          email: credential.email,
        }),
      });
 
      if (!res.ok) {
        const err = await res.text();
        throw new Error(`Server verification failed: ${err}`);
      }
 
      const { sessionToken } = (await res.json()) as { sessionToken: string };
      await SecureStore.setItemAsync("session_token", sessionToken);
      router.replace("/(app)/home");
    } catch (e: unknown) {
      const msg = e instanceof Error ? e.message : "Unknown error";
      // ユーザーがキャンセルしたケースだけは無音で抜ける
      if (!msg.includes("ERR_REQUEST_CANCELED")) {
        Alert.alert("ログインに失敗しました", msg);
      }
    } finally {
      setBusy(false);
    }
  };
 
  if (Platform.OS !== "ios") return null;
 
  return (
    <AppleAuthentication.AppleAuthenticationButton
      buttonType={AppleAuthentication.AppleAuthenticationButtonType.SIGN_IN}
      buttonStyle={AppleAuthentication.AppleAuthenticationButtonStyle.BLACK}
      cornerRadius={8}
      style={{ width: "100%", height: 50 }}
      onPress={handlePress}
    />
  );
}

// src/auth/verify-apple.ts
import { jwtVerify, createRemoteJWKSet } from "jose";
 
const APPLE_ISSUER = "https://appleid.apple.com";
const APPLE_JWKS = createRemoteJWKSet(
  new URL("https://appleid.apple.com/auth/keys")
);
 
export type VerifiedAppleIdentity = {
  sub: string; // Apple のユーザー一意 ID（このアプリ内では永続）
  email?: string;
  emailVerified?: boolean;
  isPrivateEmail?: boolean;
};
 
export async function verifyAppleIdentityToken(params: {
  identityToken: string;
  expectedAudience: string; // Apple Developer の Service ID または Bundle ID
  rawNonce: string;
}): Promise<VerifiedAppleIdentity> {
  const { identityToken, expectedAudience, rawNonce } = params;
 
  // 1) JWS 署名検証 + iss / aud / exp の自動チェック
  const { payload } = await jwtVerify(identityToken, APPLE_JWKS, {
    issuer: APPLE_ISSUER,
    audience: expectedAudience,
  });
 
  // 2) nonce 検証 — Apple が hashed nonce を返してくる
  const expectedHashedNonce = await sha256Hex(rawNonce);
  if (payload.nonce !== expectedHashedNonce) {
    throw new Error("Nonce mismatch — possible replay attack");
  }
 
  // 3) sub を必ず確認
  if (typeof payload.sub !== "string" || payload.sub.length === 0) {
    throw new Error("Missing sub claim in Apple ID token");
  }
 
  return {
    sub: payload.sub,
    email: typeof payload.email === "string" ? payload.email : undefined,
    emailVerified: payload.email_verified === true || payload.email_verified === "true",
    isPrivateEmail:
      payload.is_private_email === true || payload.is_private_email === "true",
  };
}
 
async function sha256Hex(input: string): Promise<string> {
  const data = new TextEncoder().encode(input);
  const hash = await crypto.subtle.digest("SHA-256", data);
  return Array.from(new Uint8Array(hash))
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

// 複数の audience を許容する場合
const ACCEPTED_AUDIENCES = [
  "com.dolice.myrorkapp",      // iOS app
  "com.dolice.myrorkapp.web",  // Web (Service ID)
];
 
const { payload } = await jwtVerify(identityToken, APPLE_JWKS, {
  issuer: APPLE_ISSUER,
  audience: ACCEPTED_AUDIENCES,
});

// src/routes/auth-apple.ts
import { Hono } from "hono";
import { verifyAppleIdentityToken } from "../auth/verify-apple";
import { issueSessionToken } from "../auth/session";
 
const app = new Hono<{ Bindings: { DB: D1Database; KV: KVNamespace } }>();
 
app.post("/auth/apple", async (c) => {
  const body = await c.req.json<{
    identityToken: string;
    authorizationCode: string;
    rawNonce: string;
    fullName?: { givenName?: string | null; familyName?: string | null } | null;
    email?: string | null;
  }>();
 
  // 1) nonce が「そのセッションのために発行されたものか」を KV で確認
  const nonceKey = `apple:nonce:${body.rawNonce}`;
  const issued = await c.env.KV.get(nonceKey);
  if (!issued) {
    return c.json({ error: "Nonce expired or unknown" }, 401);
  }
  await c.env.KV.delete(nonceKey); // 使い捨て
 
  // 2) ID トークン検証
  const identity = await verifyAppleIdentityToken({
    identityToken: body.identityToken,
    expectedAudience: "com.dolice.myrorkapp",
    rawNonce: body.rawNonce,
  });
 
  // 3) 既存ユーザー検索
  const existing = await c.env.DB.prepare(
    "SELECT id, email FROM users WHERE apple_sub = ?1"
  )
    .bind(identity.sub)
    .first<{ id: string; email: string | null }>();
 
  let userId: string;
 
  if (existing) {
    userId = existing.id;
    // 既存ユーザーで、初回時に取り損ねていた email が今回の body に入っていれば補完
    if (!existing.email && body.email) {
      await c.env.DB.prepare("UPDATE users SET email = ?1 WHERE id = ?2")
        .bind(body.email, userId)
        .run();
    }
  } else {
    // 4) 新規ユーザー作成 — email がないケースを必ず許容する
    userId = crypto.randomUUID();
    const displayName = [
      body.fullName?.givenName ?? "",
      body.fullName?.familyName ?? "",
    ]
      .filter(Boolean)
      .join(" ")
      .trim();
    await c.env.DB.prepare(
      `INSERT INTO users (id, apple_sub, email, display_name, created_at)
       VALUES (?1, ?2, ?3, ?4, ?5)`
    )
      .bind(
        userId,
        identity.sub,
        body.email ?? identity.email ?? null,
        displayName || "Unnamed",
        new Date().toISOString()
      )
      .run();
  }
 
  const sessionToken = await issueSessionToken(c.env, userId);
  return c.json({ sessionToken });
});
 
export default app;

// src/auth/apple-revoke.ts
import { SignJWT, importPKCS8 } from "jose";
 
type AppleClientSecretParams = {
  teamId: string;        // Apple Developer の Team ID（10桁）
  clientId: string;      // Bundle ID または Service ID
  keyId: string;         // Sign in with Apple 用に作った p8 鍵の Key ID
  privateKeyPkcs8: string; // p8 鍵の中身（PEM 形式）
};
 
async function buildAppleClientSecret(p: AppleClientSecretParams) {
  const now = Math.floor(Date.now() / 1000);
  const key = await importPKCS8(p.privateKeyPkcs8, "ES256");
 
  return await new SignJWT({})
    .setProtectedHeader({ alg: "ES256", kid: p.keyId })
    .setIssuer(p.teamId)
    .setIssuedAt(now)
    .setExpirationTime(now + 60 * 5) // 最大 6 ヶ月だが短め推奨
    .setAudience("https://appleid.apple.com")
    .setSubject(p.clientId)
    .sign(key);
}
 
export async function revokeAppleToken(p: {
  refreshToken: string; // Apple から受け取った refresh_token
  clientId: string;
  clientSecret: string; // 上の buildAppleClientSecret の戻り値
}): Promise<void> {
  const body = new URLSearchParams({
    client_id: p.clientId,
    client_secret: p.clientSecret,
    token: p.refreshToken,
    token_type_hint: "refresh_token",
  });
 
  const res = await fetch("https://appleid.apple.com/auth/revoke", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body,
  });
 
  if (!res.ok) {
    const err = await res.text();
    throw new Error(`Apple revoke failed: ${res.status} ${err}`);
  }
}

// 初回ログイン時に refresh_token を取得して DB に保存
async function exchangeAuthCodeForRefreshToken(
  authorizationCode: string,
  clientId: string,
  clientSecret: string
): Promise<{ refreshToken: string }> {
  const body = new URLSearchParams({
    client_id: clientId,
    client_secret: clientSecret,
    code: authorizationCode,
    grant_type: "authorization_code",
  });
 
  const res = await fetch("https://appleid.apple.com/auth/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body,
  });
 
  if (!res.ok) throw new Error(`Token exchange failed: ${await res.text()}`);
  const json = (await res.json()) as { refresh_token: string };
  return { refreshToken: json.refresh_token };
}

app.post("/account/delete", async (c) => {
  const userId = c.get("userId"); // セッション認証ミドルウェアで設定済み
 
  const row = await c.env.DB.prepare(
    "SELECT apple_refresh_token FROM users WHERE id = ?1"
  )
    .bind(userId)
    .first<{ apple_refresh_token: string | null }>();
 
  // 1) Apple との連携解除を先にやる（失敗したらユーザーデータは消さない）
  if (row?.apple_refresh_token) {
    const clientSecret = await buildAppleClientSecret({
      teamId: c.env.APPLE_TEAM_ID,
      clientId: "com.dolice.myrorkapp",
      keyId: c.env.APPLE_KEY_ID,
      privateKeyPkcs8: c.env.APPLE_PRIVATE_KEY_P8,
    });
    await revokeAppleToken({
      refreshToken: row.apple_refresh_token,
      clientId: "com.dolice.myrorkapp",
      clientSecret,
    });
  }
 
  // 2) ユーザーデータ削除（外部キーは ON DELETE CASCADE 推奨）
  await c.env.DB.prepare("DELETE FROM users WHERE id = ?1").bind(userId).run();
 
  return c.json({ ok: true });
});

// server/apple-jwks.ts — kid が無ければ 1 度だけ強制再フェッチする
const JWKS_URL = "https://appleid.apple.com/auth/keys";
type Jwk = JsonWebKey & { kid: string };
 
async function fetchJwks(force = false): Promise<Jwk[]> {
  const cache = caches.default;
  const cacheKey = new Request(JWKS_URL);
  if (!force) {
    const hit = await cache.match(cacheKey);
    if (hit) return ((await hit.json()) as { keys: Jwk[] }).keys;
  }
  const res = await fetch(JWKS_URL); // Apple は Cache-Control: max-age=... を返す
  await cache.put(cacheKey, res.clone()); // max-age を尊重してそのままキャッシュ
  return ((await res.json()) as { keys: Jwk[] }).keys;
}
 
export async function getApplePublicKey(kid: string): Promise<Jwk> {
  let key = (await fetchJwks()).find((k) => k.kid === kid);
  if (!key) {
    // ローテーション直後はキャッシュに無い → 1 度だけ強制再取得
    key = (await fetchJwks(true)).find((k) => k.kid === kid);
  }
  if (!key) throw new Error(`Apple public key not found for kid=${kid}`);
  return key;
}