feat: support native sign-in-with-apple on macOS (#856)

apps/readest-app/src-tauri/src/apple_auth.rs

@@ -0,0 +1,201 @@
+use std::cell::RefCell;
+
+use objc2::rc::Retained;
+use objc2::runtime::ProtocolObject;
+use objc2::{
+    define_class, msg_send, AllocAnyThread, DefinedClass, MainThreadMarker, MainThreadOnly,
+};
+use objc2_authentication_services::{
+    ASAuthorization, ASAuthorizationAppleIDCredential, ASAuthorizationAppleIDProvider,
+    ASAuthorizationController, ASAuthorizationControllerDelegate, ASAuthorizationRequest,
+    ASAuthorizationScopeEmail, ASAuthorizationScopeFullName,
+};
+use objc2_foundation::{NSArray, NSError, NSObject, NSObjectProtocol, NSString};
+
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+
+use tauri::{command, AppHandle, Emitter};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct AppleIDAuthorizationRequest {
+    pub scope: Vec<String>,
+    pub nonce: Option<String>,
+    pub state: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct AppleIDAuthorizationResponse {
+    pub user_identifier: Option<String>,
+    pub given_name: Option<String>,
+    pub family_name: Option<String>,
+    pub email: Option<String>,
+    pub authorization_code: Option<String>,
+    pub identity_token: Option<String>,
+    pub state: Option<String>,
+}
+
+thread_local! {
+    static APPLE_SIGN_IN_DELEGATE: RefCell<Option<Retained<ASAuthorizationControllerDelegateImpl>>> = RefCell::new(None);
+    static AUTHORIZATION_CONTROLLER: RefCell<Option<Retained<ASAuthorizationController>>> = RefCell::new(None);
+}
+
+#[derive(Clone)]
+pub struct Ivars {
+    app: AppHandle,
+}
+
+define_class!(
+    #[unsafe(super(NSObject))]
+    #[thread_kind = MainThreadOnly]
+    #[name = "ASAuthorizationControllerDelegateImpl"]
+    #[ivars = Ivars]
+    pub struct ASAuthorizationControllerDelegateImpl;
+
+    unsafe impl NSObjectProtocol for ASAuthorizationControllerDelegateImpl {}
+
+    unsafe impl ASAuthorizationControllerDelegate for ASAuthorizationControllerDelegateImpl {
+        #[unsafe(method(authorizationController:didCompleteWithAuthorization:))]
+        #[allow(non_snake_case)]
+        unsafe fn authorizationController_didCompleteWithAuthorization(
+            &self,
+            _controller: &ASAuthorizationController,
+            authorization: &ASAuthorization,
+        ) {
+            if let Ok(credential) = authorization
+                .credential()
+                .downcast::<ASAuthorizationAppleIDCredential>()
+            {
+                let user_identifier = {
+                    let user = credential.user();
+                    if user.len() > 0 {
+                        Some(user.to_string())
+                    } else {
+                        None
+                    }
+                };
+                let given_name = credential
+                    .fullName()
+                    .and_then(|name| name.givenName())
+                    .map(|nsstr| nsstr.to_string());
+                let family_name = credential
+                    .fullName()
+                    .and_then(|name| name.familyName())
+                    .map(|nsstr| nsstr.to_string());
+                let email = credential.email().map(|nsstr| nsstr.to_string());
+
+                let authorization_code = credential
+                    .authorizationCode()
+                    .and_then(|code_data| String::from_utf8(code_data.to_vec()).ok());
+
+                let identity_token = credential
+                    .identityToken()
+                    .and_then(|token_data| String::from_utf8(token_data.to_vec()).ok());
+
+                let state = credential.state().map(|nsstr| nsstr.to_string());
+
+                let resp = AppleIDAuthorizationResponse {
+                    user_identifier,
+                    given_name,
+                    family_name,
+                    email,
+                    authorization_code,
+                    identity_token,
+                    state,
+                };
+                let _ = self.ivars().app.emit("apple-sign-in-complete", json!(resp));
+                log::info!("Apple authorization complete");
+            } else {
+                let _ = self
+                    .ivars()
+                    .app
+                    .emit("apple-sign-in-error", "Invalid credential type");
+                log::error!("Invalid credential type received");
+            }
+        }
+
+        #[unsafe(method(authorizationController:didCompleteWithError:))]
+        #[allow(non_snake_case)]
+        unsafe fn authorizationController_didCompleteWithError(
+            &self,
+            _controller: &ASAuthorizationController,
+            error: &NSError,
+        ) {
+            let code = error.code();
+            let description = error.localizedDescription().to_string();
+            let _ = self.ivars().app.emit(
+                "apple-sign-in-error",
+                json!({
+                    "code": code,
+                    "description": description,
+                }),
+            );
+
+            log::error!(
+                "Authorization error: code={}, description={}",
+                code,
+                description
+            );
+        }
+    }
+);
+
+impl ASAuthorizationControllerDelegateImpl {
+    fn new(app: AppHandle) -> Retained<Self> {
+        let mtm = MainThreadMarker::new().expect("must run on main thread");
+        let this = Self::alloc(mtm).set_ivars(Ivars { app });
+        unsafe { msg_send![super(this), init] }
+    }
+}
+
+#[command]
+pub fn start_apple_sign_in(app: AppHandle, payload: AppleIDAuthorizationRequest) {
+    unsafe {
+        let provider = ASAuthorizationAppleIDProvider::new();
+        let request = provider.createRequest();
+
+        if let Some(ref nonce) = payload.nonce {
+            let ns_nonce = NSString::from_str(nonce);
+            request.setNonce(Some(&ns_nonce));
+        }
+
+        if let Some(ref state) = payload.state {
+            let ns_state = NSString::from_str(state);
+            request.setState(Some(&ns_state));
+        }
+
+        let mut scopes = Vec::new();
+        for scope in payload.scope.iter() {
+            match scope.as_str() {
+                "email" => scopes.push(ASAuthorizationScopeEmail),
+                "fullName" => scopes.push(ASAuthorizationScopeFullName),
+                _ => {
+                    log::warn!("[Apple Sign-In] Unsupported scope: {}", scope);
+                }
+            }
+        }
+        if !scopes.is_empty() {
+            request.setRequestedScopes(Some(&*NSArray::from_slice(&scopes)));
+        }
+
+        let auth_request = &request as &ASAuthorizationRequest;
+        let controller = ASAuthorizationController::initWithAuthorizationRequests(
+            ASAuthorizationController::alloc(),
+            &*NSArray::from_slice(&[auth_request]),
+        );
+
+        let delegate = ASAuthorizationControllerDelegateImpl::new(app.clone());
+        APPLE_SIGN_IN_DELEGATE.with(|cell| {
+            *cell.borrow_mut() = Some(delegate.clone());
+        });
+
+        AUTHORIZATION_CONTROLLER.with(|cell| {
+            *cell.borrow_mut() = Some(controller.clone());
+        });
+
+        controller.setDelegate(Some(ProtocolObject::from_ref(&*delegate)));
+
+        log::info!("Starting Apple Sign-In authorization request");
+        controller.performRequests();
+    }
+}

apps/readest-app/src-tauri/src/lib.rs

@@ -6,6 +6,10 @@ extern crate cocoa;
 #[macro_use]
 extern crate objc;
 
+#[cfg(target_os = "macos")]
+mod apple_auth;
+#[cfg(target_os = "macos")]
+use apple_auth::start_apple_sign_in;
 #[cfg(target_os = "macos")]
 mod menu;
 #[cfg(target_os = "macos")]
@@ -135,6 +139,8 @@ pub fn run() {
             download_file,
             upload_file,
             #[cfg(target_os = "macos")]
+            start_apple_sign_in,
+            #[cfg(target_os = "macos")]
             set_traffic_lights,
             #[cfg(desktop)]
             list_fonts