Why

The iPhone app signed in through the web's pages in a browser sheet, which can't offer Apple, Google or GitHub: a trip to a provider loses the app's request. App Review 4.8 needs Sign in with Apple wherever Google or GitHub is offered, and Apple sign-ins must be revoked when the account is deleted.

What changes

• The app has its own sign-in screen with these ways in:

  • Sign in with Apple in iOS's sheet;
  • Google and GitHub in a private sheet (/app/sign-in/<provider>);
  • email with a password, or a 6-digit emailed code.

  Each one ends in the usual klipstack-mobile code and PKCE, so tokens, refresh, the share extension and the widget are unchanged. Consent is skipped for that client.

• Deleting the account asks "Confirm it's you" on the same form when the server needs a recent sign-in.

• Apple's refresh token is kept, encrypted with BETTER_AUTH_SECRET, and revoked at Apple when the account is deleted or Apple is disconnected. This is best effort: a failure is logged and the deletion goes on.

• The app creates no account, in any SIGNUP_MODE.

• Emailed codes are hashed and allow 3 tries in 10 minutes. At most 10 can be sent a day per address and 100 per IP.

• Self-hosting docs: the .p8 one-line command is now perl instead of awk.

Verification

• In the simulator (iPhone 17 Pro, iOS 26.3) against the dev server:

  • A wrong password is refused.
  • The right password reaches Home; the database showed rotating klipstack-mobile refresh tokens.
  • Emailed codes are sent (signing in with one is covered by the tests).
  • Delete after 31 minutes: the "Confirm it's you" sheet opens, signing in there deletes the account, and the app is back at the sign-in screen.

• New tests cover /app/sign-in*, Apple tokens and revocation, and unlinking in Settings. Each new behavior's test was seen failing without it.

• pnpm verify and pnpm ci:local pass. In e2e, 305 tests passed and 3 were flaky (feeds, Getting started, highlight resizing) and passed on retry. The image build first failed because the operator CLI now reaches the Apple revocation. It loads that module lazily now, and the image copies it. I checked that the module loads in the image.

• The review found, and this branch fixes:

  • app sign-ins created accounts when sign-up is open;
  • Apple's authorization was left behind when it signed in no account;
  • the code limit allowed about 27% a year to guess;
  • the delete sheet hid a late error;
  • a rerun of the tests hit a rate limit.

  Dismissed: the mobile app has no unit tests (CI skips it); revoking happens before the delete transaction (documented, best effort).

• Not verified: real Apple, Google and GitHub sign-ins and Apple's revocation (they need a signed build), and the share extension after a native sign-in.

Risk and follow-ups

• Apple from the app needs the Sign in with Apple key's primary App ID to be com.klipstack.mobile. Otherwise it answers "Apple's sign-in couldn't be checked".
• On an http server, any app that claims com.klipstack.app: can get a signed-in Safari reader's code without a prompt. A saved consent allowed this before too; it is documented in docs/security.md.
• Ten code requests for someone's address stop their emailed codes for a day. Their other ways in still work.
• Sign-up from the app is left for later.