feeddeck/supabase/functions/_cmd/tools/apple-secret-key.ts

const base64URL = (value: string) => {
  return globalThis.btoa(value).replace(/[=]/g, '').replace(/[+]/g, '-')
    .replace(/[\/]/g, '_');
};

const stringToArrayBuffer = (value: string): ArrayBuffer => {
  const buf = new ArrayBuffer(value.length);
  const bufView = new Uint8Array(buf);
  for (let i = 0; i < value.length; i++) {
    bufView[i] = value.charCodeAt(i);
  }
  return buf;
};

const arrayBufferToString = (buf: ArrayBuffer): string => {
  return String.fromCharCode(...new Uint8Array(buf));
};

export const generateAppleSecretKey = async (
  kid: string,
  iss: string,
  sub: string,
  file: string,
): Promise<{ kid: string; jwt: string; exp: number }> => {
  const contents = await Deno.readTextFile(file);

  if (
    !contents.match(/^\s*-+BEGIN PRIVATE KEY-+[^-]+-+END PRIVATE KEY-+\s*$/i)
  ) {
    throw new Error(
      `Chosen file does not appear to be a PEM encoded PKCS8 private key file.`,
    );
  }

  // remove PEM headers and spaces
  const pkcs8 = stringToArrayBuffer(
    globalThis.atob(contents.replace(/-+[^-]+-+/g, '').replace(/\s+/g, '')),
  );

  const privateKey = await globalThis.crypto.subtle.importKey(
    'pkcs8',
    pkcs8,
    {
      name: 'ECDSA',
      namedCurve: 'P-256',
    },
    true,
    ['sign'],
  );

  const iat = Math.floor(Date.now() / 1000);
  const exp = iat + 180 * 24 * 60 * 60;

  const jwt = [
    base64URL(JSON.stringify({ typ: 'JWT', kid, alg: 'ES256' })),
    base64URL(
      JSON.stringify({
        iss,
        sub,
        iat,
        exp,
        aud: 'https://appleid.apple.com',
      }),
    ),
  ];

  const signature = await globalThis.crypto.subtle.sign(
    {
      name: 'ECDSA',
      hash: 'SHA-256',
    },
    privateKey,
    stringToArrayBuffer(jwt.join('.')),
  );

  jwt.push(base64URL(arrayBufferToString(signature)));

  return { kid, jwt: jwt.join('.'), exp };
};