enable iOS devs to build the omi app onto their own iphone without needing the device registration via omi's apple developer portal (#3398)

beastoin · web-flow · commit cadf9d02c5b7 · 2025-11-09T17:52:01.000+07:00
* Mocking the dev bundle id with mocking development-&lt;rand&gt;

* Add use web auth env var

* With custom token

* Clean up stuff, default false for auth custom token

* Streamline app bundle id management ~ app, app.development, app.watchapp, app.development.watchapp; Add support custom app bundle id and auto generated new bundle in setup.sh

* Default false for use auth token in .env.template

* Default false for use custom token on the backend side
diff --git a/app/.env.template b/app/.env.template
@@ -2,4 +2,6 @@ OPENAI_API_KEY=
 API_BASE_URL=
 GOOGLE_MAPS_API_KEY=
 GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
+GOOGLE_CLIENT_SECRET=
+USE_WEB_AUTH=false
+USE_AUTH_CUSTOM_TOKEN=false
diff --git a/app/ios/Flutter/Base.xcconfig b/app/ios/Flutter/Base.xcconfig
@@ -0,0 +1 @@
+APP_BUNDLE_IDENTIFIER=com.friend-app-with-wearable.ios12
diff --git a/app/ios/Flutter/Custom.xcconfig b/app/ios/Flutter/Custom.xcconfig
@@ -1,2 +1,3 @@
 // This is a generated file; do not edit or check into version control.
 GOOGLE_REVERSE_CLIENT_ID=com.googleusercontent.apps.1031333818730-dusn243nct6i5rgfpfkj5mchuj1qnmde
+APP_BUNDLE_IDENTIFIER=com.friend-app-with-wearable.ios12-beastoinx
diff --git a/app/ios/Flutter/Debug.xcconfig b/app/ios/Flutter/Debug.xcconfig
@@ -1,3 +1,4 @@
 #include "Pods/Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
diff --git a/app/ios/Flutter/Release.xcconfig b/app/ios/Flutter/Release.xcconfig
@@ -1,3 +1,4 @@
 #include "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
diff --git a/app/ios/Flutter/devDebug.xcconfig b/app/ios/Flutter/devDebug.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=dev
diff --git a/app/ios/Flutter/devProfile.xcconfig b/app/ios/Flutter/devProfile.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=dev
diff --git a/app/ios/Flutter/devRelease.xcconfig b/app/ios/Flutter/devRelease.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=dev
diff --git a/app/ios/Flutter/prodDebug.xcconfig b/app/ios/Flutter/prodDebug.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=prod
diff --git a/app/ios/Flutter/prodProfile.xcconfig b/app/ios/Flutter/prodProfile.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=prod
diff --git a/app/ios/Flutter/prodRelease.xcconfig b/app/ios/Flutter/prodRelease.xcconfig
@@ -1,5 +1,6 @@
 #include? "Pods/Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"
 #include "Generated.xcconfig"
+#include "Base.xcconfig"
 #include "Custom.xcconfig"
 
 ASSET_PREFIX=prod
diff --git a/app/ios/Runner.xcodeproj/project.pbxproj b/app/ios/Runner.xcodeproj/project.pbxproj
diff --git a/app/lib/env/dev_env.dart b/app/lib/env/dev_env.dart
@@ -47,4 +47,12 @@ final class DevEnv implements EnvFields {
   @override
   @EnviedField(varName: 'GOOGLE_CLIENT_SECRET', obfuscate: true)
   final String? googleClientSecret = _DevEnv.googleClientSecret;
+
+  @override
+  @EnviedField(varName: 'USE_WEB_AUTH', obfuscate: false, defaultValue: false)
+  final bool? useWebAuth = _DevEnv.useWebAuth;
+
+  @override
+  @EnviedField(varName: 'USE_AUTH_CUSTOM_TOKEN', obfuscate: false, defaultValue: false)
+  final bool? useAuthCustomToken = _DevEnv.useAuthCustomToken;
 }
diff --git a/app/lib/env/env.dart b/app/lib/env/env.dart
@@ -27,6 +27,10 @@ abstract class Env {
   static String? get googleClientId => _instance.googleClientId;
 
   static String? get googleClientSecret => _instance.googleClientSecret;
+
+  static bool get useWebAuth => _instance.useWebAuth ?? false;
+
+  static bool get useAuthCustomToken => _instance.useAuthCustomToken ?? false;
 }
 
 abstract class EnvFields {
@@ -49,4 +53,8 @@ abstract class EnvFields {
   String? get googleClientId;
 
   String? get googleClientSecret;
+
+  bool? get useWebAuth;
+
+  bool? get useAuthCustomToken;
 }
diff --git a/app/lib/env/prod_env.dart b/app/lib/env/prod_env.dart
@@ -47,4 +47,12 @@ final class ProdEnv implements EnvFields {
   @override
   @EnviedField(varName: 'GOOGLE_CLIENT_SECRET', obfuscate: true)
   final String? googleClientSecret = _ProdEnv.googleClientSecret;
+
+  @override
+  @EnviedField(varName: 'USE_WEB_AUTH', obfuscate: false, defaultValue: false)
+  final bool? useWebAuth = _ProdEnv.useWebAuth;
+
+  @override
+  @EnviedField(varName: 'USE_AUTH_CUSTOM_TOKEN', obfuscate: false, defaultValue: false)
+  final bool? useAuthCustomToken = _ProdEnv.useAuthCustomToken;
 }
diff --git a/app/lib/providers/auth_provider.dart b/app/lib/providers/auth_provider.dart
@@ -1,6 +1,7 @@
 import 'package:firebase_auth/firebase_auth.dart';
 import 'package:flutter/material.dart';
 import 'package:omi/backend/preferences.dart';
+import 'package:omi/env/env.dart';
 import 'package:omi/providers/base_provider.dart';
 import 'package:omi/services/notifications.dart';
 import 'package:omi/services/auth_service.dart';
@@ -62,11 +63,12 @@ class AuthenticationProvider extends BaseProvider {
   }
 
   Future<void> onGoogleSignIn(Function() onSignIn) async {
+    final useWebAuth = Env.useWebAuth;
     if (!loading) {
       setLoadingState(true);
       try {
         UserCredential? credential;
-        if (PlatformService.isMobile) {
+        if (PlatformService.isMobile && !useWebAuth) {
           credential = await AuthService.instance.signInWithGoogleMobile();
         } else {
           credential = await AuthService.instance.authenticateWithProvider('google');
@@ -85,11 +87,12 @@ class AuthenticationProvider extends BaseProvider {
   }
 
   Future<void> onAppleSignIn(Function() onSignIn) async {
+    final useWebAuth = Env.useWebAuth;
     if (!loading) {
       setLoadingState(true);
       try {
         UserCredential? credential;
-        if (PlatformService.isMobile) {
+        if (PlatformService.isMobile && !useWebAuth) {
           credential = await AuthService.instance.signInWithAppleMobile();
         } else {
           credential = await AuthService.instance.authenticateWithProvider('apple');
diff --git a/app/lib/services/auth_service.dart b/app/lib/services/auth_service.dart
@@ -275,6 +275,8 @@ class AuthService {
 
   Future<Map<String, dynamic>?> _exchangeCodeForOAuthCredentials(String code, String redirectUri) async {
     try {
+      final useCustomToken = Env.useAuthCustomToken;
+
       final response = await http.post(
         Uri.parse('${Env.apiBaseUrl}v1/auth/token'),
         headers: {
@@ -284,6 +286,7 @@ class AuthService {
           'grant_type': 'authorization_code',
           'code': code,
           'redirect_uri': redirectUri,
+          'use_custom_token': useCustomToken.toString(),
         },
       );
 
@@ -304,6 +307,16 @@ class AuthService {
 
   Future<UserCredential> _signInWithOAuthCredentials(Map<String, dynamic> oauthCredentials) async {
     final provider = oauthCredentials['provider'];
+    final useCustomToken = Env.useAuthCustomToken;
+    final customToken = oauthCredentials['custom_token'];
+
+    // Use custom token if enabled and available
+    if (useCustomToken && customToken != null) {
+      debugPrint('Signing in with Firebase custom token from $provider');
+      return await FirebaseAuth.instance.signInWithCustomToken(customToken);
+    }
+
+    // Fallback to OAuth credentials
     final idToken = oauthCredentials['id_token'];
     final accessToken = oauthCredentials['access_token'];
 
diff --git a/app/setup.sh b/app/setup.sh
@@ -61,6 +61,27 @@ echo ""
 
 API_BASE_URL=https://api.omiapi.com/
 
+######################################
+# Generate device suffix from hostname
+######################################
+function generate_device_suffix() {
+  # Use hostname or a hash of it as suffix
+  HOSTNAME=$(hostname -s | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]')
+  echo "${HOSTNAME}"
+}
+
+######################################
+# Generate custom configs for iOS
+######################################
+function generate_ios_custom_config() {
+  bash scripts/generate_ios_custom_config.sh ios/Config/Dev/GoogleService-Info.plist ios/Flutter \
+
+  # Custom bundle identifier
+  SUFFIX=$(generate_device_suffix)
+  CUSTOM_BUNDLE="com.friend-app-with-wearable.ios12-${SUFFIX}"
+  echo APP_BUNDLE_IDENTIFIER=${CUSTOM_BUNDLE} >> "ios/Flutter/Custom.xcconfig"
+}
+
 ######################################
 # Setup Firebase with prebuilt configs
 ######################################
@@ -154,6 +175,8 @@ function setup_provisioning_profile_macos() {
 #################
 function setup_app_env() {
   echo API_BASE_URL=$API_BASE_URL > .dev.env
+  echo USE_WEB_AUTH=true >> .dev.env
+  echo USE_AUTH_CUSTOM_TOKEN=true >> .dev.env
 }
 
 # #######################
@@ -202,9 +225,9 @@ case "${1}" in
       && run_build_macos
     ;;
   ios)
-    setup_firebase \
+      setup_firebase \
+      && generate_ios_custom_config \
       && setup_app_env \
-      && setup_provisioning_profile \
       && run_build_ios
     ;;
   android)
@@ -213,12 +236,6 @@ case "${1}" in
       && setup_app_env \
       && run_build_android
     ;;
-  macos)
-    setup_firebase \
-      && setup_app_env \
-      && setup_provisioning_profile \
-      && build_macos
-    ;;
   *)
     error "Unexpected platform '${1}'"
     ;;
diff --git a/backend/routers/auth.py b/backend/routers/auth.py
@@ -140,10 +140,14 @@ async def auth_token(
     grant_type: str = Form(...),
     code: str = Form(...),
     redirect_uri: str = Form(...),
+    use_custom_token: bool = Form(False),
 ):
     """
     Exchange auth code for OAuth credentials
     Used for both initial sign-in and account linking flows
+
+    Args:
+        use_custom_token: If True, also generate Firebase custom token (default: True)
     """
     if grant_type != 'authorization_code':
         raise HTTPException(status_code=400, detail="Unsupported grant type")
@@ -159,16 +163,29 @@ async def auth_token(
     try:
         oauth_credentials = json.loads(oauth_credentials_json)
         provider = oauth_credentials.get('provider')
+        id_token = oauth_credentials.get('id_token')
+        access_token = oauth_credentials.get('access_token')
 
-        return {
+        response = {
             "provider": provider,
-            "id_token": oauth_credentials.get('id_token'),
-            "access_token": oauth_credentials.get('access_token'),
+            "id_token": id_token,
+            "access_token": access_token,
             "provider_id": oauth_credentials.get('provider_id'),
             "token_type": "Bearer",
             "expires_in": 3600,
         }
 
+        # Generate custom token if requested
+        if use_custom_token:
+            try:
+                custom_token = await _generate_custom_token(provider, id_token, access_token)
+                response["custom_token"] = custom_token
+            except Exception as e:
+                print(f"Error generating custom token: {e}")
+                # Don't fail the request, just log and continue without custom token
+
+        return response
+
     except Exception as e:
         print(f"Error parsing OAuth credentials: {e}")
         raise HTTPException(status_code=400, detail="Invalid OAuth credentials")
@@ -351,13 +368,72 @@ async def _exchange_apple_code_for_oauth_credentials(code: str, session_data: di
         raise HTTPException(status_code=500, detail="Failed to exchange Apple code for tokens")
 
 
+async def _generate_custom_token(provider: str, id_token: str, access_token: str = None) -> str:
+    """
+    Generate Firebase custom token by signing in with OAuth credentials
+    This ensures we get the same Firebase UID that client-side auth would create
+    Works with any bundle ID - perfect for multiple developers
+    """
+    try:
+        # Get Firebase API Key from environment
+        firebase_api_key = os.getenv('FIREBASE_API_KEY')
+        if not firebase_api_key:
+            raise Exception("FIREBASE_API_KEY not configured")
+
+        # Sign in with OAuth credential using Firebase Auth REST API
+        sign_in_url = f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key={firebase_api_key}"
+
+        # Prepare the postBody based on provider
+        if provider == 'google':
+            post_body = f'id_token={id_token}&providerId=google.com'
+            if access_token:
+                post_body += f'&access_token={access_token}'
+        elif provider == 'apple':
+            post_body = f'id_token={id_token}&providerId=apple.com'
+            if access_token:
+                post_body += f'&access_token={access_token}'
+        else:
+            raise Exception(f"Unsupported provider: {provider}")
+
+        payload = {
+            'postBody': post_body,
+            'requestUri': 'http://localhost',
+            'returnIdpCredential': True,
+            'returnSecureToken': True,
+        }
+
+        # Call Firebase Auth REST API to sign in
+        response = requests.post(sign_in_url, json=payload)
+
+        if response.status_code != 200:
+            print(f"Firebase sign-in failed: {response.text}")
+            raise Exception(f"Firebase sign-in failed: {response.text}")
+
+        result = response.json()
+        firebase_uid = result.get('localId')
+
+        if not firebase_uid:
+            raise Exception("No Firebase UID returned from sign-in")
+
+        print(f"Firebase sign-in successful for {provider}, UID: {firebase_uid}")
+
+        # Create custom token for this UID
+        custom_token = firebase_admin.auth.create_custom_token(firebase_uid)
+
+        return custom_token.decode('utf-8') if isinstance(custom_token, bytes) else custom_token
+
+    except Exception as e:
+        print(f"Error in _generate_custom_token: {e}")
+        raise
+
+
 def _generate_apple_client_secret(client_id: str, team_id: str, key_id: str, private_key_content: str) -> str:
     """
     Generate Apple client secret JWT as per Apple's requirements
     https://developer.apple.com/documentation/signinwithapplerestapi/generate_and_validate_tokens
     """
     try:
-        # Load the private key from direct PEM content
+        # Load the private key from PEM content
         private_key = serialization.load_pem_private_key(
             private_key_content.encode('utf-8'),
             password=None,

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+APP_BUNDLE_IDENTIFIER=com.friend-app-with-wearable.ios12`
Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`// This is a generated file; do not edit or check into version control.`
`2`	`2`	`GOOGLE_REVERSE_CLIENT_ID=com.googleusercontent.apps.1031333818730-dusn243nct6i5rgfpfkj5mchuj1qnmde`
	`3`	`+APP_BUNDLE_IDENTIFIER=com.friend-app-with-wearable.ios12-beastoinx`