cairn work

src/server/apple-notification.ts

@@ -0,0 +1,34 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+const APPLE_JWKS = new URL("https://appleid.apple.com/auth/keys");
+const appleJwks = createRemoteJWKSet(APPLE_JWKS);
+
+export type AppleNotification = {
+  notification_type: string;
+  sub: string;
+  email?: string;
+  event_time: number;
+  payload?: Record<string, unknown>;
+};
+
+export async function verifyAppleNotification(
+  payload: Record<string, unknown>
+): Promise<AppleNotification> {
+  const signedPayload = payload.signedPayload;
+
+  if (!signedPayload || typeof signedPayload !== "string") {
+    throw new Error("Missing signedPayload");
+  }
+
+  const { payload: decoded } = await jwtVerify(signedPayload, appleJwks, {
+    issuer: "https://appleid.apple.com"
+  });
+
+  return {
+    notification_type: decoded.notification_type as string,
+    sub: decoded.sub as string,
+    email: decoded.email as string | undefined,
+    event_time: decoded.event_time as number,
+    payload: decoded as Record<string, unknown>
+  };
+}