{"record":{"id":"7abb5e02cb2af593","repo":"Freika/dawarich","slug":"client-id-not-configured","errorCode":null,"errorMessage":"client_id not configured","messagePattern":"client_id not configured","errorType":"exception","errorClass":"Auth::VerifyAppleToken::InvalidToken","httpStatus":401,"severity":"critical","filePath":"app/services/auth/verify_apple_token.rb","lineNumber":15,"sourceCode":"# frozen_string_literal: true\n\nmodule Auth\n  class VerifyAppleToken\n    class InvalidToken < StandardError; end\n\n    def initialize(id_token, nonce: nil, client_id: nil)\n      @id_token = id_token\n      @nonce = nonce\n      @client_id = client_id\n    end\n\n    def call\n      raise InvalidToken, 'blank token' if @id_token.blank?\n      raise InvalidToken, 'client_id not configured' if effective_client_id.blank?\n\n      decoded = AppleID::IdToken.decode(@id_token)\n      verify_args = { client: effective_client_id }\n      verify_args[:nonce] = expected_nonce_hash if @nonce.present?\n\n      decoded.verify!(**verify_args)\n\n      log_missing_nonce_breadcrumb if @nonce.blank?\n\n      {\n        sub: decoded.sub,\n        email: decoded.email,\n        email_verified: decoded.email_verified?,\n        is_private_email: decoded.is_private_email?\n      }\n    rescue AppleID::IdToken::VerificationFailed, JSON::JWT::Exception => e\n      raise InvalidToken, e.message\n    end","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/Freika/dawarich/blob/97fad417c5a11b0eb11157890635e015723a2e97/app/services/auth/verify_apple_token.rb#L1-L33","documentation":"VerifyAppleToken resolves the expected Apple audience as @client_id || ENV['APPLE_BUNDLE_ID']; when both are blank it raises InvalidToken 'client_id not configured' before decoding anything. AppleID's verify! needs the client (audience) to check the aud claim, so verification is impossible without it - this error is always a server configuration problem, never a bad user token.","triggerScenarios":"Calling the Apple sign-in endpoint on a server where APPLE_BUNDLE_ID is unset (fresh deployment, missed .env entry, production-only omission) and the caller did not pass client_id: explicitly - e.g. a web client that should pass the Services-Apple-Web client id vs the native bundle id.","commonSituations":"New environment/missing ENV var after deploying, container orchestration not propagating APPLE_BUNDLE_ID, using the web (Services ID) flow where the bundle id is wrong anyway, credentials-based config where the var lives in credentials but was never exported to ENV.","solutions":["Set APPLE_BUNDLE_ID in the environment where the app runs (e.g. APPLE_BUNDLE_ID=com.example.app) and restart","Or pass client_id explicitly when instantiating the service - required when web (Services ID) and native (bundle id) flows coexist","Verify with a print/日志 of ENV['APPLE_BUNDLE_ID'] presence (never the value) in the target environment","Add the variable to .env.example/deployment templates so new environments fail loudly at boot instead of at sign-in"],"exampleFix":"# before\nAuth::VerifyAppleToken.new(params[:id_token]).call # APPLE_BUNDLE_ID unset -> raises\n\n# after\nAuth::VerifyAppleToken.new(params[:id_token], client_id: ENV['APPLE_WEB_CLIENT_ID']).call\n# or ensure ENV['APPLE_BUNDLE_ID'] is set for this deployment","handlingStrategy":"validation","validationCode":"# Fail fast at boot or entry, before any Apple round-trip\nraise 'APPLE_BUNDLE_ID env var is required for Apple sign-in' if ENV['APPLE_BUNDLE_ID'].blank? && client_id.blank?","typeGuard":null,"tryCatchPattern":"begin\n  result = Auth::VerifyAppleToken.new(id_token, nonce:, client_id:).call\nrescue Auth::VerifyAppleToken::InvalidToken => e\n  render json: { error: e.message }, status: :unauthorized # 'client_id not configured' = server misconfig, page the ops channel\nend","preventionTips":["Add APPLE_BUNDLE_ID to .env.example and deployment checklists","When supporting both native and web Apple sign-in, pass client_id explicitly per flow instead of relying on ENV","Add a boot-time health check that fails startup when Apple sign-in is enabled but no client id resolves"],"tags":["authentication","apple-signin","configuration","env-vars"],"backgroundTag":"missing-env-var","analyzedSha":"97fad417c5a11b0eb11157890635e015723a2e97","analyzedAt":"2026-08-21T17:04:17.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}