Apple callback redirects back to apple

[SchmellaKaa]

Package: passport-apple

Applied fix: Param merge fails in Express v5 because req.query is now a getter #59

Apple redirect back to callback URL succeeds ("/auth/apple/callback"), however the verify function of the AppleStrategy is not executed.

  passport.use(
        new AppleStrategy(
            {
                clientID: "AAA",
                teamID: "BBB",
                keyID: "CCC",
                privateKeyString: process.env.APPLE_CLIENT_SECRET,
                callbackURL: "/auth/apple/callback",
                passReqToCallback: true,
            },
            async (req, accessToken, refreshToken, idToken, profile, cb) => {
                   ...
                   return cb(null, user)
            }
        )

app.get("/auth/apple", (req, res, next) => {
    passport.authenticate("apple", {session: false})(req, res, next);
});

app.post("/auth/apple/callback", (req, res, next) => {
    passport.authenticate("apple", (err: any, user: Express.User | false, info: any) => {
        ...
        redirect("/")
    }
)

Behaviour:

• User click on the "Sign in with Apple" button
• User gets redirected to apple to authenticate
• Apple redirects back to "/auth/apple/callback" url (res.headers contains location pointing to https://appleid.apple.com/auth/authorize?state=c5bca4a976&response_type=code&scope=name%20email&response_mode=form_post&redirect_uri=https%3A%2F%2Fmy.domain.com%2Fauth%2Fapple%2Fcallback&client_id=AAA
• My "auth/apple/callback function gets executed, but the passport.authenticate("apple", (err, user, info) => {...})) function located inside the post call does not get executed.

[SchmellaKaa]

Follow up:

The first issue that caused my problem, was, that the _generateToken function returned a promise that was not awaited which resulted in the passport-apple strategies code not being run.

 async _generateToken(clientId, teamId, privateKey, exp, keyid) {
        return await new Promise((resolve, reject) => {
            // Curate the claims

Upon awaiting this promise i got to the next issue which was the req.user not being set correctly.
As it turns out, the POST request to get an apple token returns 'application/x-www-form-urlencoded', which means the response body is a buffer.

This means, additionally to the express v5 fix i had to apply a conversion of the response.body buffer to a json object.

Strategy.prototype.authenticate = function (req, options) {
    // Parse req.body if it's a Buffer
    if (Buffer.isBuffer(req.body)) {
        try {
            // Apple sends form-urlencoded, not JSON
            const bodyString = req.body.toString("utf8");
            req.body = querystring.parse(bodyString);
        } catch (e) {
            console.error("Failed to parse req.body buffer:", e);
            req.body = {};
        }
    }

    // Workaround instead of reimplementing authenticate function
    Object.defineProperty(req, "query", {
        value: { ...req.query, ...req.body },
        writable: true,
        configurable: true,
        enumerable: true,
    });
    if (req.body && req.body.user) {
        req.appleProfile = JSON.parse(req.body.user);
    }
    OAuth2Strategy.prototype.authenticate.call(this, req, options);
};

Hope this helps someone.