auth/com.siddharth.kmp.auth

Package-level declarations

Types

class AndroidAppleSignIn(context: Context, config: AppleSignInConfig, nonceSource: () -> String = { newRawNonce() }, stateSource: () -> String = { newRawNonce() })

Sign in with Apple on Android. There is no native SDK — this is Apple's OAuth web flow, and it needs a server. AppleSiwaServer documents exactly which server, and why no client-only path exists once you ask for name and email.

AndroidGoogleSignIn

class AndroidGoogleSignIn(activityContext: Context, config: GoogleSignInConfig = GoogleSignInConfig(), credentialManager: CredentialManager = CredentialManager.create(activityContext), nonceSource: () -> String = { newRawNonce() }) : SocialSignIn

Google sign-in through Credential Manager — the only supported path since the legacy GoogleSignInClient was deprecated.

AppleScope

enum class AppleScope : Enum<AppleScope>

AppleSignInConfig

data class AppleSignInConfig(val appCallbackUri: String, val servicesId: String = APPLE_SERVICES_ID, val redirectUri: String = APPLE_SIWA_REDIRECT_URI, val scopes: Set<AppleScope> = setOf(AppleScope.NAME, AppleScope.EMAIL))

Client-side configuration for Sign in with Apple through the web flow (Android).

AppleSiwaServer

object AppleSiwaServer

The server half of Sign in with Apple on Android, written down because there is no client-only path and pretending otherwise is how this ships broken.

AppleWebFlow

object AppleWebFlow

The parts of Sign in with Apple on Android that are pure string work: building the authorize URL, and reading the callback your server bounced back. Platform-free on purpose — this is where the tests are, and it is identical whether the browser is a Custom Tab, an external browser, or a WebView you should not be using for OAuth.

AppleWebPending

data class AppleWebPending(val authorizeUrl: String, val state: String, val rawNonce: String)

A started Apple web sign-in. Hold it until the deep link comes back.

AppleWebStart

sealed interface AppleWebStart

Result of AndroidAppleSignIn.begin — either the browser is up, or the reason it is not.

AuthProvider

enum class AuthProvider : Enum<AuthProvider>

GoogleSignInConfig

data class GoogleSignInConfig(val serverClientId: String = GOOGLE_WEB_CLIENT_ID, val filterByAuthorizedAccounts: Boolean = true, val signUpFallback: Boolean = true, val autoSelectEnabled: Boolean = true)

Configuration for GetGoogleIdOption.

IosAppleSignIn

class IosAppleSignIn(anchor: () -> UIWindow, nonceSource: () -> String = { newRawNonce() }) : SocialSignIn

Sign in with Apple on iOS, natively — no Services ID, no redirect URI, no server bounce. The App ID's Sign In with Apple capability and the matching entitlement are the whole configuration, which is why none of the __PROVISION_APPLE_*__ values appear on this side. (Your server still needs them to exchange or revoke the code; see AppleSiwaServer.)

SignInAvailability

enum class SignInAvailability : Enum<SignInAvailability>

Reason-carrying capability flag. Four states, not a Boolean, because the three failures want three different UIs: hide the button, offer "add an account", say "not on this device".

SignInOutcome

sealed interface SignInOutcome

SocialIdentity

data class SocialIdentity(val provider: AuthProvider, val idToken: String, val rawNonce: String, val authorizationCode: String? = null, val userId: String? = null, val email: String? = null, val displayName: String? = null, val rawUserJson: String? = null)

What a provider hands back. Everything here is untrusted client input until a server verifies it — a debugger can hand your app any idToken it likes.

SocialSignIn

interface SocialSignIn

Third-party sign-in for the toolkit: the shared vocabulary, and the store rules attached to it.

TokenStore

class TokenStore(settings: Settings, persistedKey: String)

Where an app keeps its auth secrets, and nothing else.

Properties

APPLE_SERVICES_ID

const val APPLE_SERVICES_ID: String

Apple's Services ID — the OAuth client_id for Sign in with Apple on the web and on Android. Not the App ID: iOS uses the App ID capability and needs none of these three values.

APPLE_SIWA_KEY_ID

const val APPLE_SIWA_KEY_ID: String

Key ID of the Sign in with Apple .p8. Server-side only: it is the kid of the client secret JWT.

APPLE_SIWA_REDIRECT_URI

const val APPLE_SIWA_REDIRECT_URI: String

The redirect_uri registered against the Services ID. Must be an https URL you control that runs code — see AppleSiwaServer for why it cannot be an app link when scopes are requested.

APPLE_TEAM_ID

const val APPLE_TEAM_ID: String

Apple Developer Team ID. Server-side only: it is the iss of the client secret JWT.

GOOGLE_WEB_CLIENT_ID

const val GOOGLE_WEB_CLIENT_ID: String

The WEB OAuth client ID from the Google Cloud console, not the Android one.

Functions

newRawNonce

fun newRawNonce(bytes: Int = NONCE_BYTES): String

A fresh, cryptographically random nonce/state value as lowercase hex.

fun newRawNonce(bytes: Int = NONCE_BYTES): String

A fresh, cryptographically random nonce/state value as lowercase hex.