AppleClientSecret.ts

import jwt from 'jsonwebtoken';

interface Config {
    teamId: string;
    redirectUri: string;
    keyId: string;
    privateKey: string;
}

export default class AppleClientSecret {
    constructor(private readonly config: Config) {
        if (this.config.redirectUri.includes('localhost')) {
            console.warn(
                'AppleClientSecret.ts: WARNING: `redirectUri` contains "localhost", code resolution will fail',
            );
        }
    }

    async generate(clientId: string): Promise<string> {
        const claims = {
            exp: Math.floor(Date.now() / 1000) + 86400 * 180, // 6 months
            iss: this.config.teamId,
            iat: Math.floor(Date.now() / 1000),
            aud: 'https://appleid.apple.com',
            sub: clientId,
        };
        return jwt.sign(claims, this.config.privateKey, {
            algorithm: 'ES256',
            keyid: this.config.keyId,
        });
    }
}