updated apple auth to have multiple client ids, & also more checks added

[UnderratedDev]

Added multiple client ids since if you sign in with apple from the watch it uses a different client ID than if you signed in from the website. I could not find any way to make the watch sign in with apple match the client id of the website. I looked online & seems like this is the expected behaviour so I updated parse server to be able to use multiple client ids & verify against them. I also fixed an issue that the jwt claims verify was throwing a error so the server would throw that exception 10 times, I made it throw a parse error which fixed the issue.

[dplewis]

@UnderratedDev Thanks for the PR. I've discovered a better way to handle your multiple client ID issue.

jwtClaims = jwt.verify(token, applePublicKey, {
  audience: '' // The audience can be checked against a string, a regular expression or a list of strings and/or regular expressions.
});

[UnderratedDev]

@UnderratedDev Thanks for the PR. I've discovered a better way to handle your multiple client ID issue.

jwtClaims = jwt.verify(token, applePublicKey, {
  audience: '' // The audience can be checked against a string, a regular expression or a list of strings and/or regular expressions.
});

That's a great idea, thanks @dplewis, I will implement that & update the PR

[dplewis]

I think it would be better to wait for #6416 since it will create a conflict.

[UnderratedDev]

Sure, I'll wait for that be approved. 👍

[tealshift]

Just bumping here since #6416 is now merged! :) Thank you @UnderratedDev!

[UnderratedDev]

@dplewis I used your suggestion of using the jwt.verify function for the client ids. It works!!! After reading the docs, I also found you can use it for validating the subject, & issuer so I modified to do all of that in there as well! There is a problem however, that if you want to use the verify, you must pass in a token that can be decoded via one of apple's keys so it is really annoying to write tests & I tried to make it testable however I had to use my own apple client id, generated id's & tokens so I have placeholder text in the tests that have to be replaced if developers want to test apple sign in. If there is a better way, please let me know. Any advice is appreciated on this.

jwtClaims = jwt.verify(token, signingKey, { algorithms: algorithm, audience: clientId, issuer: TOKEN_ISSUER, subject: id, });

[UnderratedDev]

I ruined this branch locally & pushed so instead redid the changes in a new branch: #6523, 🤦‍♂