-
-
Notifications
You must be signed in to change notification settings - Fork 24
[codex] add mobile signing tool pages #549
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
6cf1ade
add mobile signing tool pages
riderx 2ab814a
avoid innerhtml in tool generators
riderx 1f2dc25
harden signing email validation
riderx b361c97
protect udid result payloads
riderx 0eb4eb9
Merge origin/main into codex/tools-signing-pages
riderx 0ba64a6
Address PR review feedback for signing tools
riderx 33cee23
Reduce duplication in tool API handlers
riderx 83ce35c
Add focus-visible states to tool index links
riderx ec82b21
Harden shared tool API request parsing
riderx ddd0b47
Require callback cookie challenge for UDID flow
riderx File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,6 @@ | ||
| PERSONAL_ACCESS_TOKEN="..." | ||
| OPENAI_API_KEY="..." | ||
| PUBLIC_IOS_UDID_CERTIFICATE_LINK="https://example.com/your-trust-certificate.crt" | ||
| IOS_UDID_PROFILE_SIGNING_CERT_PEM="-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" | ||
| IOS_UDID_PROFILE_SIGNING_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----" | ||
| IOS_UDID_PROFILE_SIGNING_CHAIN_PEM="" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| # iOS UDID Finder certificate setup | ||
|
|
||
| This runbook explains how to finish the optional certificate-backed configuration for the `/tools/ios-udid-finder/` flow. | ||
|
|
||
| The tool works without extra configuration, but if you want: | ||
|
|
||
| - a public "Download trust certificate" button on the page | ||
| - a signed `.mobileconfig` response instead of a plain profile payload | ||
|
|
||
| then fill in the environment variables described below. | ||
|
|
||
| ## What the page expects | ||
|
|
||
| The implementation uses these variables: | ||
|
|
||
| - `PUBLIC_IOS_UDID_CERTIFICATE_LINK` | ||
| - `IOS_UDID_PROFILE_SIGNING_CERT_PEM` | ||
| - `IOS_UDID_PROFILE_SIGNING_KEY_PEM` | ||
| - `IOS_UDID_PROFILE_SIGNING_CHAIN_PEM` (optional) | ||
|
|
||
| `PUBLIC_IOS_UDID_CERTIFICATE_LINK` is only used for the public button shown on the page. | ||
|
|
||
| The `IOS_UDID_PROFILE_SIGNING_*` values are server-only and are used to sign the downloaded `.mobileconfig`. | ||
|
|
||
| ## Option 1: use an existing TLS certificate | ||
|
|
||
| If you already terminate HTTPS with a certificate you control and can export: | ||
|
|
||
| 1. Export the certificate in PEM format. | ||
| 2. Export the matching private key in PEM format. | ||
| 3. If your provider gives you an intermediate certificate chain, export that in PEM format too. | ||
| 4. Publish the public certificate file at a stable HTTPS URL. | ||
| 5. Set: | ||
| - `PUBLIC_IOS_UDID_CERTIFICATE_LINK` to the public certificate URL | ||
| - `IOS_UDID_PROFILE_SIGNING_CERT_PEM` to the PEM certificate contents | ||
| - `IOS_UDID_PROFILE_SIGNING_KEY_PEM` to the PEM private key contents | ||
| - `IOS_UDID_PROFILE_SIGNING_CHAIN_PEM` to the concatenated intermediate certificates, if needed | ||
|
|
||
| ## Option 2: export from Let’s Encrypt or another host | ||
|
|
||
| If your host manages certificates for you: | ||
|
|
||
| 1. Find the PEM certificate file used by your HTTPS endpoint. | ||
| 2. Find the matching PEM private key. | ||
| 3. Copy the full chain PEM if one exists. | ||
| 4. Upload the public certificate to a stable HTTPS location if you want the page button. | ||
| 5. Set the environment variables with those PEM values. | ||
|
|
||
| ## Example `.env` | ||
|
|
||
| ```dotenv | ||
| PUBLIC_IOS_UDID_CERTIFICATE_LINK="https://example.com/certs/udid-finder.crt" | ||
| IOS_UDID_PROFILE_SIGNING_CERT_PEM="-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" | ||
| IOS_UDID_PROFILE_SIGNING_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----" | ||
| IOS_UDID_PROFILE_SIGNING_CHAIN_PEM="-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" | ||
| ``` | ||
|
|
||
| Keep the PEM values on the server only. Do not expose them in public client code and do not commit them to Git. | ||
|
|
||
| ## How to verify the page | ||
|
|
||
| 1. Start the site locally with the environment variables set. | ||
| 2. Open `/tools/ios-udid-finder/`. | ||
| 3. Confirm the page shows the "Download trust certificate" button if `PUBLIC_IOS_UDID_CERTIFICATE_LINK` is present. | ||
| 4. Download the profile from `/api/tools/ios-udid-finder/profile`. | ||
| 5. Confirm the response header is: | ||
| - `Content-Type: application/x-apple-aspen-config` | ||
| 6. Install the profile on a real iPhone or iPad. The device must be able to reach the host serving `/api/tools/ios-udid-finder/profile` and the optional `PUBLIC_IOS_UDID_CERTIFICATE_LINK`, so use a LAN-accessible hostname or IP address, or a tunnel such as ngrok or localhost.run, when testing from a local machine. | ||
| 7. Confirm the device lands on `/tools/ios-udid-finder/result/` with the UDID and device details rendered. | ||
|
|
||
| ## Notes | ||
|
|
||
| - The callback endpoint extracts the plist payload from the raw iOS response body server-side. | ||
| - The result page is intentionally `noindex` because it can contain device identifiers. | ||
| - If you want to hard-wire a specific certificate download link, send me that URL and I can drop it into the environment config for deployment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| --- | ||
| import { getRelativeLocaleUrl } from 'astro:i18n' | ||
| import { toolCatalog, type ToolSlug } from '@/lib/tools/catalog' | ||
|
|
||
| interface Props { | ||
| current?: ToolSlug | null | ||
| title?: string | ||
| intro?: string | ||
| } | ||
|
|
||
| const { | ||
| current = null, | ||
| title = 'More mobile delivery tools', | ||
| intro = 'Use these generators and device utilities together to keep signing, testing, and distribution moving without leaving the browser.', | ||
| } = Astro.props as Props | ||
| --- | ||
|
|
||
| <section class="py-16 sm:py-20"> | ||
| <div class="mx-auto max-w-6xl px-4 sm:px-6 lg:px-8"> | ||
| <div class="mb-10 flex flex-col gap-4 md:flex-row md:items-end md:justify-between"> | ||
| <div> | ||
| <p class="text-sm font-semibold tracking-[0.25em] text-cyan-300 uppercase">Tool stack</p> | ||
| <h2 class="mt-3 text-3xl font-bold text-white sm:text-4xl">{title}</h2> | ||
| </div> | ||
| <p class="max-w-2xl text-sm leading-7 text-slate-300">{intro}</p> | ||
| </div> | ||
|
|
||
| <div class="grid gap-5 md:grid-cols-3"> | ||
| { | ||
| toolCatalog | ||
| .filter((tool) => tool.slug !== current) | ||
| .map((tool) => ( | ||
| <a | ||
| href={getRelativeLocaleUrl(Astro.locals.locale, tool.href)} | ||
| class="group rounded-3xl border border-white/10 bg-white/5 p-6 transition hover:-translate-y-1 hover:border-cyan-400/50 hover:bg-white/8" | ||
| > | ||
| <p class="text-xs font-semibold tracking-[0.25em] text-cyan-300 uppercase">{tool.eyebrow}</p> | ||
| <h3 class="mt-3 text-2xl font-bold text-white">{tool.name}</h3> | ||
| <p class="mt-3 text-sm leading-7 text-slate-300">{tool.summary}</p> | ||
| <span class="mt-5 inline-flex items-center text-sm font-semibold text-cyan-200 transition group-hover:text-white">Open tool</span> | ||
| </a> | ||
| )) | ||
| } | ||
| </div> | ||
| </div> | ||
| </section> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| --- | ||
| interface FaqItem { | ||
| question: string | ||
| answer: string | ||
| } | ||
|
|
||
| interface Props { | ||
| title?: string | ||
| intro?: string | ||
| items: FaqItem[] | ||
| } | ||
|
|
||
| const { title = 'Frequently asked questions', intro = '', items } = Astro.props as Props | ||
| --- | ||
|
|
||
| <section id="faq" class="py-16 sm:py-20"> | ||
| <div class="mx-auto max-w-4xl px-4 sm:px-6 lg:px-8"> | ||
| <div class="mb-10"> | ||
| <p class="text-sm font-semibold tracking-[0.25em] text-cyan-300 uppercase">FAQ</p> | ||
| <h2 class="mt-3 text-3xl font-bold text-white sm:text-4xl">{title}</h2> | ||
| {intro && <p class="mt-4 max-w-2xl text-base text-slate-300">{intro}</p>} | ||
| </div> | ||
|
|
||
| <div class="space-y-4"> | ||
| { | ||
| items.map((item) => ( | ||
| <details class="rounded-2xl border border-white/10 bg-slate-900/80 p-6"> | ||
| <summary class="cursor-pointer list-none text-lg font-semibold text-white marker:hidden">{item.question}</summary> | ||
| <p class="mt-4 text-sm leading-7 text-slate-300">{item.answer}</p> | ||
| </details> | ||
| )) | ||
| } | ||
| </div> | ||
| </div> | ||
| </section> |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.