Skip to content

Commit c2c67f1

Browse files
MattKiazykMattKiazyk
authored
Merge pull request #361 from RobotsAndPencils/hashcash
Implement hashcash for Apple ID Authentication
2 parents 2f37ae0 + 76bb3fb commit c2c67f1

File tree

4 files changed

+188
-10
lines changed

4 files changed

+188
-10
lines changed

‎Xcodes/AppleAPI/Sources/AppleAPI/Client.swift

+54-3
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,22 @@ public class Client {
1414
return Current.network.dataTask(with: URLRequest.itcServiceKey)
1515
.map(\.data)
1616
.decode(type: ServiceKeyResponse.self, decoder: JSONDecoder())
17-
.flatMap { serviceKeyResponse -> AnyPublisher<URLSession.DataTaskPublisher.Output, Swift.Error> in
17+
.flatMap { serviceKeyResponse -> AnyPublisher<(String, String), Swift.Error> in
1818
serviceKey = serviceKeyResponse.authServiceKey
19-
return Current.network.dataTask(with: URLRequest.signIn(serviceKey: serviceKey, accountName: accountName, password: password))
20-
.mapError { $0 as Swift.Error }
19+
20+
// Fixes issue https://github.com/RobotsAndPencils/XcodesApp/issues/360
21+
// On 2023-02-23, Apple added a custom implementation of hashcash to their auth flow
22+
// Without this addition, Apple ID's would get set to locked
23+
return self.loadHashcash(accountName: accountName, serviceKey: serviceKey)
24+
.map { return (serviceKey, $0)}
2125
.eraseToAnyPublisher()
2226
}
27+
.flatMap { (serviceKey, hashcash) -> AnyPublisher<URLSession.DataTaskPublisher.Output, Swift.Error> in
28+
29+
return Current.network.dataTask(with: URLRequest.signIn(serviceKey: serviceKey, accountName: accountName, password: password, hashcash: hashcash))
30+
.mapError { $0 as Swift.Error }
31+
.eraseToAnyPublisher()
32+
}
2333
.flatMap { result -> AnyPublisher<AuthenticationState, Swift.Error> in
2434
let (data, response) = result
2535
return Just(data)
@@ -56,6 +66,44 @@ public class Client {
5666
.mapError { $0 as Swift.Error }
5767
.eraseToAnyPublisher()
5868
}
69+
70+
func loadHashcash(accountName: String, serviceKey: String) -> AnyPublisher<String, Swift.Error> {
71+
72+
Result {
73+
try URLRequest.federate(account: accountName, serviceKey: serviceKey)
74+
}
75+
.publisher
76+
.flatMap { request in
77+
Current.network.dataTask(with: request)
78+
.mapError { $0 as Error }
79+
.tryMap { (data, response) throws -> (String) in
80+
guard let urlResponse = response as? HTTPURLResponse else {
81+
throw AuthenticationError.invalidSession
82+
}
83+
switch urlResponse.statusCode {
84+
case 200..<300:
85+
86+
let httpResponse = response as! HTTPURLResponse
87+
guard let bitsString = httpResponse.allHeaderFields["X-Apple-HC-Bits"] as? String, let bits = UInt(bitsString) else {
88+
throw AuthenticationError.invalidHashcash
89+
}
90+
guard let challenge = httpResponse.allHeaderFields["X-Apple-HC-Challenge"] as? String else {
91+
throw AuthenticationError.invalidHashcash
92+
}
93+
guard let hashcash = Hashcash().mint(resource: challenge, bits: bits) else {
94+
throw AuthenticationError.invalidHashcash
95+
}
96+
return (hashcash)
97+
case 400, 401:
98+
throw AuthenticationError.invalidHashcash
99+
case let code:
100+
throw AuthenticationError.badStatusCode(statusCode: code, data: data, response: urlResponse)
101+
}
102+
}
103+
}
104+
.eraseToAnyPublisher()
105+
106+
}
59107

60108
func handleTwoStepOrFactor(data: Data, response: URLResponse, serviceKey: String) -> AnyPublisher<AuthenticationState, Swift.Error> {
61109
let httpResponse = response as! HTTPURLResponse
@@ -190,6 +238,7 @@ public enum AuthenticationState: Equatable {
190238

191239
public enum AuthenticationError: Swift.Error, LocalizedError, Equatable {
192240
case invalidSession
241+
case invalidHashcash
193242
case invalidUsernameOrPassword(username: String)
194243
case incorrectSecurityCode
195244
case unexpectedSignInResponse(statusCode: Int, message: String?)
@@ -206,6 +255,8 @@ public enum AuthenticationError: Swift.Error, LocalizedError, Equatable {
206255
switch self {
207256
case .invalidSession:
208257
return "Your authentication session is invalid. Try signing in again."
258+
case .invalidHashcash:
259+
return "Could not create a hashcash for the session."
209260
case .invalidUsernameOrPassword:
210261
return "Invalid username and password combination."
211262
case .incorrectSecurityCode:

‎Xcodes/AppleAPI/Sources/AppleAPI/Hashcash.swift

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
//
2+
// Hashcash.swift
3+
//
4+
//
5+
// Created by Matt Kiazyk on 2023-02-23.
6+
//
7+
8+
import Foundation
9+
import CryptoKit
10+
import CommonCrypto
11+
12+
/*
13+
# This App Store Connect hashcash spec was generously donated by...
14+
#
15+
# __ _
16+
# __ _ _ __ _ __ / _|(_) __ _ _ _ _ __ ___ ___
17+
# / _` || '_ \ | '_ \ | |_ | | / _` || | | || '__|/ _ \/ __|
18+
# | (_| || |_) || |_) || _|| || (_| || |_| || | | __/\__ \
19+
# \__,_|| .__/ | .__/ |_| |_| \__, | \__,_||_| \___||___/
20+
# |_| |_| |___/
21+
#
22+
#
23+
*/
24+
public struct Hashcash {
25+
/// A function to returned a minted hash, using a bit and resource string
26+
///
27+
/**
28+
X-APPLE-HC: 1:11:20230223170600:4d74fb15eb23f465f1f6fcbf534e5877::6373
29+
^ ^ ^ ^ ^
30+
| | | | +-- Counter
31+
| | | +-- Resource
32+
| | +-- Date YYMMDD[hhmm[ss]]
33+
| +-- Bits (number of leading zeros)
34+
+-- Version
35+
36+
We can't use an off-the-shelf Hashcash because Apple's implementation is not quite the same as the spec/convention.
37+
1. The spec calls for a nonce called "Rand" to be inserted between the Ext and Counter. They don't do that at all.
38+
2. The Counter conventionally encoded as base-64 but Apple just uses the decimal number's string representation.
39+
40+
Iterate from Counter=0 to Counter=N finding an N that makes the SHA1(X-APPLE-HC) lead with Bits leading zero bits
41+
We get the "Resource" from the X-Apple-HC-Challenge header and Bits from X-Apple-HC-Bits
42+
*/
43+
/// - Parameters:
44+
/// - resource: a string to be used for minting
45+
/// - bits: grabbed from `X-Apple-HC-Bits` header
46+
/// - date: Default uses Date() otherwise used for testing to check.
47+
/// - Returns: A String hash to use in `X-Apple-HC` header on /signin
48+
public func mint(resource: String,
49+
bits: UInt = 10,
50+
date: String? = nil) -> String? {
51+
52+
let ver = "1"
53+
54+
var ts: String
55+
if let date = date {
56+
ts = date
57+
} else {
58+
let formatter = DateFormatter()
59+
formatter.dateFormat = "yyMMddHHmmss"
60+
ts = formatter.string(from: Date())
61+
}
62+
63+
let challenge = "\(ver):\(bits):\(ts):\(resource):"
64+
65+
var counter = 0
66+
67+
while true {
68+
guard let digest = ("\(challenge):\(counter)").sha1 else {
69+
print("ERROR: Can't generate SHA1 digest")
70+
return nil
71+
}
72+
73+
if digest == bits {
74+
return "\(challenge):\(counter)"
75+
}
76+
counter += 1
77+
}
78+
}
79+
}
80+
81+
extension String {
82+
var sha1: Int? {
83+
84+
let data = Data(self.utf8)
85+
var digest = [UInt8](repeating: 0, count:Int(CC_SHA1_DIGEST_LENGTH))
86+
data.withUnsafeBytes {
87+
_ = CC_SHA1($0.baseAddress, CC_LONG(data.count), &digest)
88+
}
89+
let bigEndianValue = digest.withUnsafeBufferPointer {
90+
($0.baseAddress!.withMemoryRebound(to: UInt32.self, capacity: 1) { $0 })
91+
}.pointee
92+
let value = UInt32(bigEndian: bigEndianValue)
93+
return value.leadingZeroBitCount
94+
}
95+
}
96+

‎Xcodes/AppleAPI/Sources/AppleAPI/URLRequest+Apple.swift

+20-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ public extension URL {
77
static let requestSecurityCode = URL(string: "https://idmsa.apple.com/appleauth/auth/verify/phone")!
88
static func submitSecurityCode(_ code: SecurityCode) -> URL { URL(string: "https://idmsa.apple.com/appleauth/auth/verify/\(code.urlPathComponent)/securitycode")! }
99
static let trust = URL(string: "https://idmsa.apple.com/appleauth/auth/2sv/trust")!
10+
static let federate = URL(string: "https://idmsa.apple.com/appleauth/auth/federate")!
1011
static let olympusSession = URL(string: "https://appstoreconnect.apple.com/olympus/v1/session")!
1112
}
1213

@@ -15,7 +16,7 @@ public extension URLRequest {
1516
return URLRequest(url: .itcServiceKey)
1617
}
1718

18-
static func signIn(serviceKey: String, accountName: String, password: String) -> URLRequest {
19+
static func signIn(serviceKey: String, accountName: String, password: String, hashcash: String) -> URLRequest {
1920
struct Body: Encodable {
2021
let accountName: String
2122
let password: String
@@ -27,6 +28,7 @@ public extension URLRequest {
2728
request.allHTTPHeaderFields?["Content-Type"] = "application/json"
2829
request.allHTTPHeaderFields?["X-Requested-With"] = "XMLHttpRequest"
2930
request.allHTTPHeaderFields?["X-Apple-Widget-Key"] = serviceKey
31+
request.allHTTPHeaderFields?["X-Apple-HC"] = hashcash
3032
request.allHTTPHeaderFields?["Accept"] = "application/json, text/javascript"
3133
request.httpMethod = "POST"
3234
request.httpBody = try! JSONEncoder().encode(Body(accountName: accountName, password: password))
@@ -117,4 +119,21 @@ public extension URLRequest {
117119
static var olympusSession: URLRequest {
118120
return URLRequest(url: .olympusSession)
119121
}
122+
123+
static func federate(account: String, serviceKey: String) throws -> URLRequest {
124+
struct FederateRequest: Encodable {
125+
let accountName: String
126+
let rememberMe: Bool
127+
}
128+
var request = URLRequest(url: .signIn)
129+
request.allHTTPHeaderFields?["Accept"] = "application/json"
130+
request.allHTTPHeaderFields?["Content-Type"] = "application/json"
131+
request.httpMethod = "GET"
132+
133+
// let encoder = JSONEncoder()
134+
// encoder.outputFormatting = .withoutEscapingSlashes
135+
// request.httpBody = try encoder.encode(FederateRequest(accountName: account, rememberMe: true))
136+
137+
return request
138+
}
120139
}

‎Xcodes/AppleAPI/Tests/AppleAPITests/AppleAPITests.swift

+18-6
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,26 @@ import XCTest
22
@testable import AppleAPI
33

44
final class AppleAPITests: XCTestCase {
5-
func testExample() {
6-
// This is an example of a functional test case.
7-
// Use XCTAssert and related functions to verify your tests produce the correct
8-
// results.
9-
XCTAssertEqual(AppleAPI().text, "Hello, World!")
5+
6+
func testValidHashCashMint() {
7+
let bits: UInt = 11
8+
let resource = "4d74fb15eb23f465f1f6fcbf534e5877"
9+
let testDate = "20230223170600"
10+
11+
let stamp = Hashcash().mint(resource: resource, bits: bits, date: testDate)
12+
XCTAssertEqual(stamp, "1:11:20230223170600:4d74fb15eb23f465f1f6fcbf534e5877::6373")
13+
}
14+
func testValidHashCashMint2() {
15+
let bits: UInt = 10
16+
let resource = "bb63edf88d2f9c39f23eb4d6f0281158"
17+
let testDate = "20230224001754"
18+
19+
let stamp = Hashcash().mint(resource: resource, bits: bits, date: testDate)
20+
XCTAssertEqual(stamp, "1:10:20230224001754:bb63edf88d2f9c39f23eb4d6f0281158::866")
1021
}
1122

1223
static var allTests = [
13-
("testExample", testExample),
24+
("testValidHashCashMint", testValidHashCashMint),
25+
("testValidHashCashMint2", testValidHashCashMint2),
1426
]
1527
}

0 commit comments

Comments
 (0)