apple-crates

@@ -31,13 +31,14 @@ return a replacement. Extract and save the token again after success to handle

 rotation. The library does not persist credentials or automatically fall back to

 a password when a token is rejected.

-Secondary-action responses can issue a token in `X-Apple-I-CK`. Before consuming

-the response body, call

-`ContinuationToken::from_response_headers(response.headers())` to base64-decode

-that header into a UTF-8 token. An absent header returns `Ok(None)`; malformed

-base64, invalid UTF-8, and empty tokens return an error. The `ck` plist value is

-already decoded and must not be decoded a second time. Tokens support serde for

-secure storage and redact their value in `Debug` output.

+Secondary-action response headers are separate from `ServerProvidedData`.

+Use `TokenBag::from_response_headers` to extract app and heartbeat tokens, and

+`ContinuationToken::from_response_headers`, `IdmsToken::from_response_headers`

+and `AltDsid::from_response_headers` for the individual values. Missing values

+return `Ok(None)` or an empty token bag; malformed values return `ResponseTokenError`.

+Callers decide which values are required to complete their operation.

+App-token expiry is calculated from the issue timestamp and duration carried

+in the header. These helpers do not construct a GrandSlam SPD dictionary.

 These details were traced in AuthKitWin 394.2 in Ghidra:

 `_CopyAuthParametersForAccount` (`0x18003ca60`) selects the SRP secret and flags;

@@ -14,10 +14,10 @@ use crate::http_session::{

     URLBagError, parse_status,

 };

 use crate::plist_request::dict_to_body;

+pub use account::*;

 use adi::proxy::{ADIError, ADIResult};

 use aes::cipher::block_padding;

 use aes::cipher::block_padding::Pkcs7;

-pub use account::*;

 pub use anisette::*;

 pub use app::*;

 use base64::Engine;

@@ -25,12 +25,11 @@ use base64::prelude::BASE64_STANDARD;

 use bytes::Bytes;

 use cbc::cipher::{BlockModeDecrypt, KeyIvInit};

 use chrono::{Local, SecondsFormat};

+pub use heartbeat::*;

 use hmac::{Hmac, KeyInit, Mac};

-use log::trace;

+pub use identity::*;

 use plist::{Dictionary, Value};

 use plist_macros::{array, dict};

-pub use heartbeat::*;

-pub use identity::*;

 use reqwest::{Certificate, Method};

 use sha2::{Digest, Sha256};

 use srp::groups::G2048;

@@ -241,6 +240,15 @@ impl TryFrom<u64> for StatusCode {

 #[serde(transparent)]

 pub struct ContinuationToken(String);

+impl ContinuationToken {

+    /// Read the continuation token independently of other response headers.

+    pub fn from_response_headers(

+        headers: &reqwest::header::HeaderMap,

+    ) -> Result<Option<ContinuationToken>, ResponseTokenError> {

+        Ok(account::header_text(headers, "x-apple-i-ck")?.map(ContinuationToken))

+    }

+}

+

 /// Authenticate with an Apple Account username or AltDSID and a password.

 /// Pass `alt_dsid.as_ref()` to use a typed `AltDsid`.

 pub async fn login(

@@ -380,9 +388,10 @@ async fn login_with_credential(

         .ok_or_else(|| AuthError::Structure(response_plist.clone()))?;

     let secret = match credential {

-        LoginCredential::Password(password) => { password },

-        LoginCredential::ContinuationToken(ck) => { ck.0.as_str() }

-    }.as_bytes();

+        LoginCredential::Password(password) => password,

+        LoginCredential::ContinuationToken(ck) => ck.0.as_str(),

+    }

+    .as_bytes();

     let hashed_password: Vec<u8> = match selected_protocol {

         // SRP with a 2048/4096-bit long A.

@@ -506,8 +515,6 @@ async fn login_with_credential(

                     error,

                 })?;

-            trace!("Parsed server provided data: {:#?}", server_provided_data);

-

             Ok(ServerProvidedData(server_provided_data))

         })

         .transpose()?;

@@ -19,6 +19,15 @@ use thiserror::Error;

 #[serde(transparent)]

 pub struct AltDsid(pub(super) String);

+impl AltDsid {

+    /// Read the account identifier without requiring any tokens.

+    pub fn from_response_headers(

+        headers: &reqwest::header::HeaderMap,

+    ) -> Result<Option<AltDsid>, ResponseTokenError> {

+        Ok(header_text(headers, "x-apple-alternate-id")?.map(AltDsid))

+    }

+}

+

 impl AsRef<str> for AltDsid {

     fn as_ref(&self) -> &str {

         &self.0

@@ -29,6 +38,24 @@ impl AsRef<str> for AltDsid {

 #[serde(transparent)]

 pub struct IdmsToken(pub(super) String);

+impl IdmsToken {

+    /// Read the identity token without requiring app tokens or an account identifier.

+    pub fn from_response_headers(

+        headers: &reqwest::header::HeaderMap,

+    ) -> Result<Option<IdmsToken>, ResponseTokenError> {

+        let name = "x-apple-identity-token";

+        let mut values = headers.get_all(name).iter();

+        let token = values

+            .next()

+            .map(|value| header_token(value, name))

+            .transpose()?;

+        if values.next().is_some() {

+            return Err(ResponseTokenError::InvalidHeader(name));

+        }

+        Ok(token.map(|(_, token)| IdmsToken(token.token)))

+    }

+}

+

 #[derive(Debug, Clone, Serialize, Deserialize)]

 #[serde(transparent)]

 pub struct SessionKey(Vec<u8>);

@@ -37,7 +64,8 @@ pub struct SessionKey(Vec<u8>);

 #[serde(transparent)]

 pub struct AuthCookie(Vec<u8>);

-#[derive(Debug, Clone)]

+#[derive(Debug, Clone, Deserialize)]

+#[serde(transparent)]

 pub struct ServerProvidedData(pub(super) Dictionary);

 impl ServerProvidedData {

@@ -256,3 +284,64 @@ impl<'lt, 'adi> AccountHTTPSession<'lt, 'adi> {

             .ok_or_else(|| AppTokenRequestError::InvalidResponse(tokens.0))

     }

 }

+

+pub(super) fn header_text(

+    headers: &reqwest::header::HeaderMap,

+    name: &'static str,

+) -> Result<Option<String>, ResponseTokenError> {

+    let mut values = headers.get_all(name).iter();

+    let value = values

+        .next()

+        .map(|value| {

+            value

+                .to_str()

+                .map(str::to_owned)

+                .map_err(|_| ResponseTokenError::InvalidHeader(name))

+        })

+        .transpose()?;

+    if values.next().is_some() || value.as_ref().is_some_and(String::is_empty) {

+        return Err(ResponseTokenError::InvalidHeader(name));

+    }

+    Ok(value)

+}

+

+pub(super) fn header_token(

+    value: &reqwest::header::HeaderValue,

+    name: &'static str,

+) -> Result<(String, Token), ResponseTokenError> {

+    use base64::{Engine, prelude::BASE64_STANDARD};

+    let bytes = BASE64_STANDARD

+        .decode(value.as_bytes())

+        .map_err(|_| ResponseTokenError::InvalidHeader(name))?;

+    let value = std::str::from_utf8(&bytes).map_err(|_| ResponseTokenError::InvalidHeader(name))?;

+    let fields: Vec<_> = value.split(':').collect();

+    if fields.len() != 4 || fields[0].is_empty() || fields[1].is_empty() {

+        return Err(ResponseTokenError::InvalidHeader(name));

+    }

+    let duration: u64 = fields[2]

+        .parse()

+        .map_err(|_| ResponseTokenError::InvalidHeader(name))?;

+    let issued: u64 = fields[3]

+        .parse()

+        .map_err(|_| ResponseTokenError::InvalidHeader(name))?;

+    let expiry_epoch_millis = duration

+        .checked_mul(1000)

+        .and_then(|duration| issued.checked_add(duration))

+        .ok_or(ResponseTokenError::InvalidHeader(name))?;

+    Ok((

+        fields[0].to_owned(),

+        Token {

+            token: fields[1].to_owned(),

+            duration,

+            expiry_epoch_millis,

+        },

+    ))

+}

+

+#[derive(Debug, Error)]

+pub enum ResponseTokenError {

+    #[error("Invalid authentication response header: {0}")]

+    InvalidHeader(&'static str),

+    #[error("Duplicate service token in authentication response")]

+    DuplicateService,

+}

@@ -75,6 +75,14 @@ pub async fn provision(

             "midStartProvisioning".into(),

         ))?;

+    let mid_finish_provisioning_url = http_session

+        .url_bag()

+        .get("midFinishProvisioning")

+        .and_then(Value::as_string)

+        .ok_or(ProvisioningError::URLNotFound(

+            "midFinishProvisioning".into(),

+        ))?;

+

     let start_provisioning_request_builder =

         http_session.simple_request_builder(Method::GET, mid_start_provisioning_url);

@@ -108,14 +116,6 @@ pub async fn provision(

         .start_provisioning(GRANDSLAM_DSID, &spim)

         .map_err(ProvisioningError::ADIError)?;

-    let mid_finish_provisioning_url = http_session

-        .url_bag()

-        .get("midFinishProvisioning")

-        .and_then(Value::as_string)

-        .ok_or(ProvisioningError::URLNotFound(

-            "midFinishProvisioning".into(),

-        ))?;

-

     // Soon try blocks will come to Rust :,)

     let ptm_tk_result = async {

         let finish_provisioning_request_builder =

@@ -1,4 +1,4 @@

-use super::account::AccountHTTPSession;

+use super::account::{AccountHTTPSession, ResponseTokenError, header_token};

 use adi::proxy::ADIResult;

 use plist::Dictionary;

 use reqwest::{Method, RequestBuilder};

@@ -22,6 +22,34 @@ pub trait AppToken: From<String> + AsRef<str> {

 pub struct TokenBag(pub(super) Dictionary);

 impl TokenBag {

+    /// Extract app and heartbeat tokens. Missing headers produce an empty bag.

+    pub fn from_response_headers(

+        headers: &reqwest::header::HeaderMap,

+    ) -> Result<Self, ResponseTokenError> {

+        let mut tokens = Dictionary::new();

+        for name in ["x-apple-gs-token", "x-apple-hb-token"] {

+            for value in headers.get_all(name) {

+                let (service, token) = header_token(value, name)?;

+                let value = plist_macros::dict! {

+                    "token": token.token,

+                    "duration": token.duration,

+                    "expiry": token.expiry_epoch_millis,

+                };

+                if tokens.insert(service, value.into()).is_some() {

+                    return Err(ResponseTokenError::DuplicateService);

+                }

+            }

+        }

+        Ok(Self(tokens))

+    }

+

+    pub fn entries(&self) -> Result<std::collections::BTreeMap<String, Token>, plist::Error> {

+        self.0

+            .iter()

+            .map(|(service, value)| Ok((service.clone(), plist::from_value(value)?)))

+            .collect()

+    }

+

     pub fn get<T: AppToken>(&self) -> Option<Token<T>> {

         let token: Token = plist::from_value(self.0.get(T::APP_TOKEN_IDENTIFIER)?).ok()?;

         Some(Token {

@@ -154,6 +154,7 @@ impl<'lt> BasicHTTPSession<'lt> {

         };

         let client = client_builder

+            .redirect(reqwest::redirect::Policy::none())

             .default_headers(headers)

             .connection_verbose(false)

             .build()