Module apple 

Sign in with Apple, from the iOS app and on the website (crate::apple checks what Apple gave).

The app: POST /api/auth/apple and DELETE /api/auth/apple.

• Sign in (no bearer token): the account linked to the Apple ID gets a new API token, as the OAuth flow would give. An Apple ID not linked yet makes a new account: the first answer is 409 choose_username with a suggestion, and the app sends the same request again with username. An Apple ID whose email another account has is refused (email_in_use): that person signs in as before and links Apple.
• Link (with the player’s bearer token): the Apple ID is linked to that account. No new token.
• Unlink (DELETE, bearer): unless it’s the account’s only way in; Apple is told.

The website (with CHESS_APPLE_SERVICES_ID): GET /auth/apple sends the browser to Apple, which posts its answer to /auth/apple/callback; the same rules decide, with a session instead of a token and a page to choose a username (/auth/apple/name). From the account page, ?link=1 links the signed-in account, and /account/apple/remove unlinks.

An account closed (DELETE /api/account) has its link revoked too.

Structs

SignIn

Functions

account_remove

POST /account/apple/remove: unlink from the account page.

account_section

The account page’s Apple ID section.

callback

POST /auth/apple/callback: Apple’s answer (code, id_token, state, the first time user with the name; or error).

choose_name

POST /auth/apple/name: the username for a new Apple ID (ticket, name).

notification

POST /auth/apple/notifications: Apple’s server-to-server notifications ({"payload": "<JWT>"}), the URL registered for Sign in with Apple. Checked as Apple’s, then:

on_web

Whether the website signs in with Apple.

revoke

Tell Apple a link has ended; a failure is logged, not fatal.

sign_in

POST /api/auth/apple.

start

GET /auth/apple?return=…[&link=1]: off to Apple.

unlink

DELETE /api/auth/apple: unlink the caller’s Apple ID.