feat BREAKING auth feat/kn-apple-native-hosted-exchange #1 / 2
aaronrene · 27 days ago · Aug 9, 2026 · Diff

feat(auth): KN-APPLE-b Apple native hosted exchange (T15)

Implement POST /api/v1/auth/native-apple-exchange with Apple JWKS verify, issueToken mint provider:apple (type:session), providers.apple, env placeholders, docs/OpenAPI honesty, and seven-tier suite (13/13). BV pass. Code readiness only — no live Apple env, no Scooling gate flips.

sha256:789db7e78d560c8d35f83030cfc05c085c916e6229db62fd8d4191dd781c7c89 sha
+29 ~58 −4 symbols
sha256:0b3332438df3dd3729c80f5dbc408005b0abb76a9f02fdccd0cb11d082d8f00e snapshot
+29
symbols added
~58
symbols modified
−4
symbols removed
0
dead code introduced
Semantic Changes 91 symbols
+ Build verification — KN-APPLE-NATIVE-HOSTED-EXCHANGE-b round 1 section Build verification — KN-APPLE-NATIVE-HOSTED-EXCHANGE-b round 1 L1–35
+ Checklist section Checklist L15–28
+ table section table L17–27
+ Evidence section Evidence L9–15
+ table section table L11–14
+ Findings section Findings L28–32
+ Honest summary section Honest summary L32–35
~ hub/gateway/apple-identity-token.mjs .mjs 9 symbols added
+ appleNonceMatches function function appleNonceMatches L117–123
+ appleProviderAdvertised function function appleProviderAdvertised L46–50
+ clearJwksCache function function clearJwksCache L267–269
+ createAppleIdentityVerifier function function createAppleIdentityVerifier L134–277
+ jwtExpiryToSeconds function function jwtExpiryToSeconds L97–109
+ loadJwks function async_function loadJwks L149–175
+ parseAppleExchangeBody function function parseAppleExchangeBody L58–90
+ seedJwksCache function function seedJwksCache L262–264
+ verifyIdentityToken function async_function verifyIdentityToken L185–259
+ b64urlJson function function b64urlJson L39–41
+ createUnverifiedAcceptStub function function createUnverifiedAcceptStub L123–134
+ loadGateway function async_function loadGateway L139–185
+ request function function request L79–117
+ signAppleFixture function function signAppleFixture L43–48
+ startServer function function startServer L62–77
+ validAppleClaims function function validAppleClaims L50–60
+ verifyIdentityToken method async_method verifyIdentityToken L125–132
~ .env.example .example
~ docs/OVERSEER-HANDOVER.md .md 5 symbols added, 4 symbols removed, 46 symbols modified
~ table
~ table
NEXT SESSION — KN-APPLE-NATIVE-HOSTED-EXCHANGE-b Auto (PRIMARY — Knowtation-owned) section NEXT SESSION — KN-APPLE-NATIVE-HOSTED-EXCHANGE-b Auto (PRIMARY — Knowtation-owned) L21–508
After this (queued order) section After this (queued order) L111–119
THE ONE NEXT STEP — Apple assertion → hosted session build (KN-APPLE-b) section THE ONE NEXT STEP — Apple assertion → hosted session build (KN-APPLE-b) L33–61
code[text] variable variable code[text] L35–60
+ NEXT SESSION — KN-APPLE land + Operator T1 (PRIMARY — Knowtation-owned) section NEXT SESSION — KN-APPLE land + Operator T1 (PRIMARY — Knowtation-owned) L21–517
+ After this (queued order) section After this (queued order) L111–119
+ THE ONE NEXT STEP — Land KN-APPLE + configure/deploy Apple env (Operator T1) section THE ONE NEXT STEP — Land KN-APPLE + configure/deploy Apple env (Operator T1) L35–61
+ code[text] variable variable code[text] L37–60
+ This session — KN-APPLE-b Auto DONE + BV pass (2026-08-09) section This session — KN-APPLE-b Auto DONE + BV pass (2026-08-09) L119–128

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:789db7e78d560c8d35f83030cfc05c085c916e6229db62fd8d4191dd781c7c89 --body "your comment"