半年ぶりのアップデートで署名が切れていた — Rork アプリの証明書とプロファイルを機械的に見張る

// audit-signing.mjs — 外部依存なしで動きます（Node.js 18 以降）
import { createSign } from "node:crypto";
import { readFileSync } from "node:fs";
 
const ISSUER_ID = process.env.ASC_ISSUER_ID;   // 例: 57246542-96fe-1a63-e053-0824d011072a
const KEY_ID = process.env.ASC_KEY_ID;         // 例: 2X9R4HXF34
const PRIVATE_KEY = readFileSync(process.env.ASC_P8_PATH, "utf8");
 
const base64url = (input) =>
  Buffer.from(input).toString("base64")
    .replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 
function createToken() {
  const now = Math.floor(Date.now() / 1000);
 
  const header = { alg: "ES256", kid: KEY_ID, typ: "JWT" };
  const payload = {
    iss: ISSUER_ID,
    iat: now,
    exp: now + 15 * 60, // 上限は 20 分。余裕を持って 15 分にしています
    aud: "appstoreconnect-v1",
  };
 
  const signingInput =
    `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
 
  // ここが要点。dsaEncoding を省くと DER になり 401 が返ります
  const signature = createSign("SHA256")
    .update(signingInput)
    .sign({ key: PRIVATE_KEY, dsaEncoding: "ieee-p1363" });
 
  return `${signingInput}.${base64url(signature)}`;
}

const API = "https://api.appstoreconnect.apple.com/v1";
 
async function fetchAll(path, token) {
  const items = [];
  let url = `${API}${path}`;
 
  while (url) {
    const res = await fetch(url, {
      headers: { Authorization: `Bearer ${token}` },
    });
 
    if (!res.ok) {
      const body = await res.text();
      throw new Error(`${res.status} ${path}\n${body}`);
    }
 
    const json = await res.json();
    items.push(...json.data);
    url = json.links?.next ?? null; // ページングを取りこぼさない
  }
 
  return items;
}
 
const daysLeft = (iso) =>
  Math.floor((new Date(iso) - Date.now()) / 86_400_000);
 
async function audit() {
  const token = createToken();
 
  const certificates = await fetchAll(
    "/certificates?fields[certificates]=name,certificateType,expirationDate&limit=200",
    token,
  );
 
  const profiles = await fetchAll(
    "/profiles?fields[profiles]=name,profileType,profileState,expirationDate&limit=200",
    token,
  );
 
  const rows = [
    ...certificates.map((c) => ({
      kind: "certificate",
      name: c.attributes.name,
      type: c.attributes.certificateType,
      state: "-",
      days: daysLeft(c.attributes.expirationDate),
    })),
    ...profiles.map((p) => ({
      kind: "profile",
      name: p.attributes.name,
      type: p.attributes.profileType,
      state: p.attributes.profileState, // ACTIVE / INVALID
      days: daysLeft(p.attributes.expirationDate),
    })),
  ];
 
  return rows.sort((a, b) => a.days - b.days); // 期限が近い順
}
 
const rows = await audit();
for (const r of rows) {
  const mark = r.days <= 14 ? "🔴" : r.days <= 60 ? "🟡" : "  ";
  console.log(
    `${mark} ${String(r.days).padStart(5)}日  ${r.kind.padEnd(11)} ${r.type.padEnd(26)} ${r.name}`,
  );
}

// worker.js
async function createToken(env) {
  const key = await crypto.subtle.importKey(
    "pkcs8",
    pemToArrayBuffer(env.ASC_P8),
    { name: "ECDSA", namedCurve: "P-256" },
    false,
    ["sign"],
  );
 
  const now = Math.floor(Date.now() / 1000);
  const header = { alg: "ES256", kid: env.ASC_KEY_ID, typ: "JWT" };
  const payload = {
    iss: env.ASC_ISSUER_ID,
    iat: now,
    exp: now + 15 * 60,
    aud: "appstoreconnect-v1",
  };
 
  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
 
  // Web Crypto の ECDSA は最初から IEEE P1363 形式を返します
  const signature = await crypto.subtle.sign(
    { name: "ECDSA", hash: "SHA-256" },
    key,
    new TextEncoder().encode(signingInput),
  );
 
  return `${signingInput}.${b64url(new Uint8Array(signature))}`;
}
 
export default {
  async scheduled(event, env, ctx) {
    const rows = await audit(await createToken(env));
    const urgent = rows.filter((r) => r.days <= 60);
 
    if (urgent.length === 0) return; // 静かな週は何も送らない
 
    const lines = urgent.map(
      (r) => `・${r.days}日 — ${r.type} / ${r.name}`,
    );
 
    await fetch(env.WEBHOOK_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        text: `【署名アセット棚卸し】\n${lines.join("\n")}`,
      }),
    });
  },
};

[triggers]
crons = ["0 0 * * 1"] # 毎週月曜 09:00 JST（UTC 00:00）