ee/psso: macOS 27 support

ak-platform/src/generated/sys_auth_apple/sys_auth_apple.rs

@@ -41,6 +41,8 @@ pub struct RegisterDeviceResponse {
     pub nonce_endpoint: ::prost::alloc::string::String,
     #[prost(string, tag="7")]
     pub device_token: ::prost::alloc::string::String,
+    #[prost(string, tag="8")]
+    pub authorization_endpoint: ::prost::alloc::string::String,
 }
 include!("sys_auth_apple.tonic.rs");
 include!("sys_auth_apple.serde.rs");

ak-platform/src/generated/sys_auth_apple/sys_auth_apple.serde.rs

@@ -174,6 +174,9 @@ impl serde::Serialize for RegisterDeviceResponse {
         if !self.device_token.is_empty() {
             len += 1;
         }
+        if !self.authorization_endpoint.is_empty() {
+            len += 1;
+        }
         let mut struct_ser = serializer.serialize_struct("sys_auth_apple.RegisterDeviceResponse", len)?;
         if !self.client_id.is_empty() {
             struct_ser.serialize_field("clientId", &self.client_id)?;
@@ -196,6 +199,9 @@ impl serde::Serialize for RegisterDeviceResponse {
         if !self.device_token.is_empty() {
             struct_ser.serialize_field("deviceToken", &self.device_token)?;
         }
+        if !self.authorization_endpoint.is_empty() {
+            struct_ser.serialize_field("authorizationEndpoint", &self.authorization_endpoint)?;
+        }
         struct_ser.end()
     }
 }
@@ -218,6 +224,8 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
             "nonceEndpoint",
             "device_token",
             "deviceToken",
+            "authorization_endpoint",
+            "authorizationEndpoint",
         ];
 
         #[allow(clippy::enum_variant_names)]
@@ -229,6 +237,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
             Audience,
             NonceEndpoint,
             DeviceToken,
+            AuthorizationEndpoint,
         }
         impl<'de> serde::Deserialize<'de> for GeneratedField {
             fn deserialize<D>(deserializer: D) -> std::result::Result<GeneratedField, D::Error>
@@ -257,6 +266,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                             "audience" => Ok(GeneratedField::Audience),
                             "nonceEndpoint" | "nonce_endpoint" => Ok(GeneratedField::NonceEndpoint),
                             "deviceToken" | "device_token" => Ok(GeneratedField::DeviceToken),
+                            "authorizationEndpoint" | "authorization_endpoint" => Ok(GeneratedField::AuthorizationEndpoint),
                             _ => Err(serde::de::Error::unknown_field(value, FIELDS)),
                         }
                     }
@@ -283,6 +293,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                 let mut audience__ = None;
                 let mut nonce_endpoint__ = None;
                 let mut device_token__ = None;
+                let mut authorization_endpoint__ = None;
                 while let Some(k) = map_.next_key()? {
                     match k {
                         GeneratedField::ClientId => {
@@ -327,6 +338,12 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                             }
                             device_token__ = Some(map_.next_value()?);
                         }
+                        GeneratedField::AuthorizationEndpoint => {
+                            if authorization_endpoint__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("authorizationEndpoint"));
+                            }
+                            authorization_endpoint__ = Some(map_.next_value()?);
+                        }
                     }
                 }
                 Ok(RegisterDeviceResponse {
@@ -337,6 +354,7 @@ impl<'de> serde::Deserialize<'de> for RegisterDeviceResponse {
                     audience: audience__.unwrap_or_default(),
                     nonce_endpoint: nonce_endpoint__.unwrap_or_default(),
                     device_token: device_token__.unwrap_or_default(),
+                    authorization_endpoint: authorization_endpoint__.unwrap_or_default(),
                 })
             }
         }

ee/psso/Bridge/SysdBridge.swift

@@ -182,7 +182,7 @@ public class SysdBridge {
                         }
                     ))
                 return ASAuthorizationProviderExtensionUserLoginConfiguration(
-                    loginUserName: reply.username
+                    loginUserName: reply.username,
                 )
             }
         }
@@ -211,6 +211,9 @@ public class SysdBridge {
                     jwksEndpointURL: URL(string: res.jwksEndpoint)!,
                     audience: res.audience
                 )
+                if #available(macOS 27.0, *) {
+                    cfg.authorizationURL = URL(string: res.authorizationEndpoint)!
+                }
                 cfg.nonceEndpointURL = URL(string: res.nonceEndpoint)!
                 cfg.customNonceRequestValues
                     .append(

ee/psso/authentikPlatform.xcodeproj/project.pbxproj

@@ -533,7 +533,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = "$(RECOMMENDED_MACOSX_DEPLOYMENT_TARGET)";
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
@@ -592,7 +592,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = "$(RECOMMENDED_MACOSX_DEPLOYMENT_TARGET)";
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				SDKROOT = macosx;

pkg/agent_system/auth/apple.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"fmt"
 
 	"goauthentik.io/api/v3"
 	"goauthentik.io/platform/pkg/ak"
@@ -43,12 +44,13 @@ func (auth *Server) RegisterDevice(ctx context.Context, req *pb.RegisterDeviceRe
 		return nil, err
 	}
 	return &pb.RegisterDeviceResponse{
-		ClientId:      d.ClientId,
-		Issuer:        d.Issuer,
-		TokenEndpoint: d.TokenEndpoint,
-		JwksEndpoint:  d.JwksEndpoint,
-		Audience:      d.Audience,
-		NonceEndpoint: d.NonceEndpoint,
-		DeviceToken:   dom.Token,
+		ClientId:              d.ClientId,
+		Issuer:                d.Issuer,
+		TokenEndpoint:         d.TokenEndpoint,
+		JwksEndpoint:          d.JwksEndpoint,
+		Audience:              d.Audience,
+		NonceEndpoint:         d.NonceEndpoint,
+		DeviceToken:           dom.Token,
+		AuthorizationEndpoint: fmt.Sprintf("%s/application/o/authorize/", dom.AuthentikURL),
 	}, nil
 }

pkg/agent_system/cli/troubleshoot_inspect.go

@@ -20,12 +20,16 @@ var troubleshootInspectCmd = &cobra.Command{
 		if err != nil {
 			return errors.Wrap(err, "failed to connect to ctrl")
 		}
+		dc, err := client.NewDefault()
+		if err != nil {
+			return errors.Wrap(err, "failed to connect to default")
+		}
 
 		r, err := sc.TroubleshootInspect(cmd.Context(), &emptypb.Empty{})
 		if err != nil {
 			return err
 		}
-		cap, err := sc.Capabilities(cmd.Context(), &emptypb.Empty{})
+		cap, err := dc.Capabilities(cmd.Context(), &emptypb.Empty{})
 		if err != nil {
 			return err
 		}

protobuf/sys_auth_apple.proto

@@ -34,4 +34,5 @@ message RegisterDeviceResponse {
   string audience = 5;
   string nonce_endpoint = 6;
   string device_token = 7;
+  string authorization_endpoint = 8;
 }