[PR #758] [MERGED] feat(web): detach experimental Apple web-session auth and app creation #771

New issue

Closed

opened 2026-02-26 22:32:29 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 22:32:29 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/758
Author: @JoshuaRileyDev
Created: 2/24/2026
Status: ✅ Merged
Merged: 2/25/2026
Merged by: @rudrankriyam

Base: main ← Head: srp-auth

📝 Commits (5)

000908e feat: add SRP authentication for app creation via IRIS API
839d1f5 ci(lint): use golangci-lint v1 config format
5eaaa84 add detached experimental web session command group
1aad2d5 docs: sync command reference after web command updates
e101f6b Merge origin/main into srp-auth

📊 Changes

14 files changed (+2352 additions, -28 deletions)

View changed files

📝 .golangci.yml (+23 -5)
📝 docs/COMMANDS.md (+2 -2)
📝 go.mod (+8 -5)
📝 go.sum (+44 -6)
📝 internal/asc/client_apps.go (+56 -0)
📝 internal/asc/notary.go (+1 -1)
📝 internal/cli/apps/apps.go (+340 -0)
📝 internal/cli/cmdtest/validate_testflight_test.go (+6 -6)
📝 internal/cli/cmdtest/web_commands_test.go (+3 -3)
➕ internal/iris/apps.go (+274 -0)
➕ internal/iris/auth.go (+981 -0)
➕ internal/iris/auth_test.go (+186 -0)
➕ internal/iris/errors.go (+45 -0)
➕ internal/iris/session_cache.go (+383 -0)

📄 Description

Summary

Move unofficial Apple web-session app creation out of the official asc apps flow into a detached asc web command family (web auth, web apps create).
Mark the flow as experimental / unofficial / discouraged in command help and docs.
Implement SRP + 2FA login and the internal web-session client in internal/web (Apple endpoint remains /iris/v1).
Add web-session caching (keychain/file backends), resume/status/logout behavior, secure password input (--password-stdin / ASC_WEB_PASSWORD), and duplicate-name auto-retry.
Add/adjust tests for command registration, auth behavior, and web app-create validation, and sync generated command docs.
Keep CI lint configuration compatible with the current runner.

Why

App creation is not available in the official public App Store Connect API. This PR keeps the unofficial path available for advanced workflows while isolating it from official API-key commands so users do not accidentally depend on unstable internals.

Usage

# Check cached session
asc web auth status

# Login (detached experimental flow)
asc web auth login --apple-id "user@example.com" --password-stdin

# Create app via internal web API
asc web apps create \
  --name "My App" \
  --bundle-id "com.example.app" \
  --sku "MYAPP123" \
  --apple-id "user@example.com" \
  --password-stdin

Test plan

make format
make lint
ASC_BYPASS_KEYCHAIN=1 make test
ASC_BYPASS_KEYCHAIN=1 go test ./internal/web ./internal/cli/web ./internal/cli/cmdtest -run Web
make check-command-docs

Notes

This remains an unofficial integration and can break without notice if Apple changes internal behavior.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/758 **Author:** [@JoshuaRileyDev](https://github.com/JoshuaRileyDev) **Created:** 2/24/2026 **Status:** ✅ Merged **Merged:** 2/25/2026 **Merged by:** [@rudrankriyam](https://github.com/rudrankriyam) **Base:** `main` ← **Head:** `srp-auth` --- ### 📝 Commits (5) - [`000908e`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/000908ef9dcc61f1d4c09f17a9f01d93d37af53c) feat: add SRP authentication for app creation via IRIS API - [`839d1f5`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/839d1f5c7158383984cfb70a2dc302d08c23303d) ci(lint): use golangci-lint v1 config format - [`5eaaa84`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/5eaaa84ab35786a3297a906ffe0a1c677e490713) add detached experimental web session command group - [`1aad2d5`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/1aad2d586ff579cdfb775c1cd7a03c1d0bd6eb0b) docs: sync command reference after web command updates - [`e101f6b`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/e101f6b56199da6fd249ba490572aa5fd67e45d1) Merge origin/main into srp-auth ### 📊 Changes **14 files changed** (+2352 additions, -28 deletions) <details> <summary>View changed files</summary> 📝 `.golangci.yml` (+23 -5) 📝 `docs/COMMANDS.md` (+2 -2) 📝 `go.mod` (+8 -5) 📝 `go.sum` (+44 -6) 📝 `internal/asc/client_apps.go` (+56 -0) 📝 `internal/asc/notary.go` (+1 -1) 📝 `internal/cli/apps/apps.go` (+340 -0) 📝 `internal/cli/cmdtest/validate_testflight_test.go` (+6 -6) 📝 `internal/cli/cmdtest/web_commands_test.go` (+3 -3) ➕ `internal/iris/apps.go` (+274 -0) ➕ `internal/iris/auth.go` (+981 -0) ➕ `internal/iris/auth_test.go` (+186 -0) ➕ `internal/iris/errors.go` (+45 -0) ➕ `internal/iris/session_cache.go` (+383 -0) </details> ### 📄 Description ## Summary - Move unofficial Apple web-session app creation out of the official `asc apps` flow into a detached `asc web` command family (`web auth`, `web apps create`). - Mark the flow as **experimental / unofficial / discouraged** in command help and docs. - Implement SRP + 2FA login and the internal web-session client in `internal/web` (Apple endpoint remains `/iris/v1`). - Add web-session caching (keychain/file backends), resume/status/logout behavior, secure password input (`--password-stdin` / `ASC_WEB_PASSWORD`), and duplicate-name auto-retry. - Add/adjust tests for command registration, auth behavior, and web app-create validation, and sync generated command docs. - Keep CI lint configuration compatible with the current runner. ## Why App creation is not available in the official public App Store Connect API. This PR keeps the unofficial path available for advanced workflows while isolating it from official API-key commands so users do not accidentally depend on unstable internals. ## Usage ```bash # Check cached session asc web auth status # Login (detached experimental flow) asc web auth login --apple-id "user@example.com" --password-stdin # Create app via internal web API asc web apps create \ --name "My App" \ --bundle-id "com.example.app" \ --sku "MYAPP123" \ --apple-id "user@example.com" \ --password-stdin ``` ## Test plan - [x] `make format` - [x] `make lint` - [x] `ASC_BYPASS_KEYCHAIN=1 make test` - [x] `ASC_BYPASS_KEYCHAIN=1 go test ./internal/web ./internal/cli/web ./internal/cli/cmdtest -run Web` - [x] `make check-command-docs` ## Notes - This remains an **unofficial** integration and can break without notice if Apple changes internal behavior. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>