chore: apple secret gen tests

server/scripts/ec_key.pem

@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIKsqu3EEoLbVnrv15zNx+KhjdUgoXhSvXmRON5H5aKB2oAoGCCqGSM49
+AwEHoUQDQgAEAopbqqW7FTpow1J/03yo1rNdfCunyI9UMmYmKY1D7WrNbCXF2E7B
+eMIsSWXd+BFJzY2+vE+J6aQtGAy8XeJBLQ==
+-----END EC PRIVATE KEY-----

server/scripts/gen-apple-private-key-cert-for-testing.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+
+# Apple's secrets (as used in src/shared/lambda/oauth/apple.ts) use a cert downloaded from apple. This script generates a fake one for testing purposes
+
+# first generate a private key:
+
+##### openssl path
+# MAC SPECIFIC :/
+# NOTE: We need the non-mac bundled openssl for -addext (https://security.stackexchange.com/a/183973/40848)
+#  We're using homebrew installed v1.1 here and I tested with OpenSSL 1.1.1g  21 Apr 2020
+OPEN_SSL_BIN=/usr/local/opt/openssl\@1.1/bin/openssl
+#####
+
+ALGORITH=secp256r1
+echo "key:"
+openssl ecparam -out ec_key.pem -name $ALGORITH -genkey 
+
+echo ""
+
+echo "cert:"
+
+$OPEN_SSL_BIN req\
+  -new\
+  -key ec_key.pem\
+  -x509\
+  -nodes
+  -days 3650\
+  -subj '/CN=test-apple-cert.com/O=No Company/C=US'
+  -out cert.pem

server/src/shared/lambda/oauth/apple.spec.ts

@@ -0,0 +1,30 @@
+import { appleSecret } from "./apple"
+
+const APPLE_TEST_KEY = `-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIKsqu3EEoLbVnrv15zNx+KhjdUgoXhSvXmRON5H5aKB2oAoGCCqGSM49
+AwEHoUQDQgAEAopbqqW7FTpow1J/03yo1rNdfCunyI9UMmYmKY1D7WrNbCXF2E7B
+eMIsSWXd+BFJzY2+vE+J6aQtGAy8XeJBLQ==
+-----END EC PRIVATE KEY-----
+`
+const teamID = "ABCDEFGHIJ"
+const clientID = "com.test.foo-service-id"
+const keyID = "LMNOPQRSTU"
+const privateKey = APPLE_TEST_KEY
+
+describe("apple", () => {
+  it("should return a valid jwt", () => {
+    const secret = appleSecret(teamID, clientID, keyID, privateKey)
+
+    expect(secret).toBeTruthy()
+    expect(typeof secret).toEqual("string")
+    expect(secret.length).toBeGreaterThan(10)
+    // jwts have three parts split by period:
+    const parts = secret.split(".")
+    expect(parts).toHaveLength(3)
+  })
+
+  it("should reject invalid args", () => {
+    expect(() => appleSecret(teamID, clientID, "", privateKey)).toThrowError()
+    expect(() => appleSecret(teamID, clientID, keyID, "")).toThrowError()
+  })
+})