[docs] Add instructions for Apple Developer account program roles and permissions required for using EAS build

[amandeepmittal]

Why

Closes ENG-12321

How

Add instructions to explain how a developer on the team can create an EAS Build for iOS when an Individual Apple Developer account is used by an Organization. This doc provides the context of how the Apple Developer account owner is required to create a distribution certificate, provisioning profile, and push key (with necessary steps to EAS Tutorial that covers them) and then the steps the developer on the team needs to take to run eas build -p ios command to create a build.

This guide also adds a section about the when Apple Developer account owner will require to generate and update a new provisioning profile and add info about using EAS Build and EAS Submit for federated Apple Developer accounts.

Added this guide under EAS Build > App credentials since that section covers all info associated to app signing and credentials.

Test Plan

By running docs locally and visiting http://localhost:3002/app-signing/apple-team-permissions/. Or see Preview http://docs.expo.dev-pr-29949.s3-website-us-east-1.amazonaws.com/app-signing/apple-developer-program-roles-and-permissions/.

Checklist

• Documentation is up to date to reflect these changes (eg: https://docs.expo.dev and README.md).
• Conforms with the Documentation Writing Style Guide
• This diff will work correctly for npx expo prebuild & EAS Build (eg: updated a module plugin).

[linear]

ENG-12321 Documentation needed for Apple team member permissions required for using EAS build with an Apple account that is part of an organization

[expo-bot]

📘 Your docs preview website is ready!

[kadikraman]

Looks good for me! 😊

[keith-kurak]

We have this doc explaining the credential types, since we're explaining them in brief, we could deep link here: https://docs.expo.dev/app-signing/app-credentials/#ios

[amandeepmittal]

Added a callout to include that docs link to gracefully mention it.

[keith-kurak]

Suggested change

	With EAS CLI, all of the above credentials can be created and synced automatically with the Apple Developer account. Once the owner login to their [Expo account](/accounts/account-types/), they can create or update the provisioning profile by running `eas credentials` using the EAS CLI.
	With EAS CLI, all of the above credentials can be created and synced automatically with the Apple Developer account. Once the Apple Developer account owner logs in to their [Expo account](/accounts/account-types/), they can create or update the provisioning profile by running `eas credentials` using the EAS CLI.

[keith-kurak]

Suggested change

If the Apple Developer account is an individual account, only the account owner can generate the app signing credentials. This guide provides steps that the account owner has to follow to ensure app signing credentials are generated. It also provides steps for the team developer to create an EAS Build.

An Apple Developer user profile must have **Access to Certificates, Identifiers, and Profiles** enabled in their App Store Connect user permissions in order to generate app signing credentials. If the Apple Developer account is an individual account, only the owner of the account can have this access. On organization Apple Developer accounts, multiple team members can have this access, but some organizations choose to limit this access. This guide provides steps that a user with **Access to Certificates, Identifiers, and Profiles** can follow to ensure app signing credentials are generated and available to other EAS users. It also provides steps for the team developer to create an EAS Build by using the pre-generated credentials.

[keith-kurak]

My rough attempt to explain all scenarios where you may not have this access. This might also be the place to put a picture of this checkbox

[keith-kurak]

Suggested change

	## Steps for Apple Developer account owner
	## Steps for Apple Developer with access to certificates, identifiers, and profiles

I dunno how often we want to repeat this, but this is only way I know how to describe this user.

what you call this person can also drive what you change "owner" to in the proceeding paragraphs. Maybe "authorized user"?

[amandeepmittal]

Yeah, I realize "owner" might not be a good word to use here. Looking https://developer.apple.com/support/roles/, majorly, there are three to four types of account roles can have access to certificates and profiles. Let's go with "authorized users". Thanks for the suggestion!

[keith-kurak]

Suggested change

	### Uploading pre-generated Apple credentials
	Some development teams may choose to generate distribution certificates and provisioning profiles outside of EAS. These credentials can be added by any EAS user with Developer or higher permissions via `eas credentials` or in **Credentials** under **Project Settings** on the Expo dashboard. You will need the **.p12** and **.mobileprovision** files, as well as any passwords set when generating the distribution certificate, when uploading the credentials.

Context: bigger teams will generate these on their own and distribute the files to those who need them because a) everyone having access to certificates, identifiers, and profiles can be a security concern, and b) you only get, I think, 3 distribution certs at once. These certs might be shared with EAS apps, non-RN apps, etc. So, someone going wild with generating credentials in EAS could grind the built process somewhere else in the organization to a halt.

So, I think it's good to mention somewhere that generating them via EAS isn't the only option. Also, what's nice here is that the individual apple account owner or otherwise responsible for Apple credentials person doesn't even need to be a member of your Expo organization (in one case, I was working with someone from a security team in some area of the org I never otherwise interacted with).

[amandeepmittal]

I'm adding this as a sub section under Additional information as I'm not sure if this should come just after the introduction or something needs to be highlighted that early in the documentation.

[keith-kurak]

@amandeepmittal just wrapped up my attempts to inject some context about the specific permission in question and how it sometimes impacts Apple developer orgs, as well.