Workaround for Apple auth problems (still in beta) (#12263)

* Workaround for Apple auth problems (still in beta)

* Fix spec

app/models/user.rb

@@ -530,7 +530,10 @@ class User < ApplicationRecord
   end
 
   def authenticated_with_all_providers?
-    identities_enabled.pluck(:provider).map(&:to_sym) == Authentication::Providers.enabled
+    # ga_providers refers to Generally Available (not in beta)
+    ga_providers = Authentication::Providers.enabled.reject { |sym| sym == :apple }
+    enabled_providers = identities.pluck(:provider).map(&:to_sym)
+    (ga_providers - enabled_providers).empty?
   end
 
   def rate_limiter

app/services/broadcasts/welcome_notification/generator.rb

@@ -92,7 +92,10 @@ module Broadcasts
       end
 
       def authenticated_with_all_providers?
-        identities.count == Authentication::Providers.enabled.size
+        # ga_providers refers to Generally Available (not in beta)
+        ga_providers = Authentication::Providers.enabled.reject { |sym| sym == :apple }
+        enabled_providers = identities.pluck(:provider).map(&:to_sym)
+        (ga_providers - enabled_providers).empty?
       end
 
       def user_is_following_tags?

app/views/users/_additional_authentication.html.erb

@@ -1,7 +1,13 @@
 <% unless @user.authenticated_with_all_providers? %>
   <div class="crayons-card crayons-card--content-rows block">
     <% authentication_enabled_providers.each do |provider| %>
-      <% next if provider.provider_name == :apple && !Flipper.enabled?(:apple_auth) %>
+      <!--
+        TODO: [@forem/oss] Only until we refactor our cookie configurations
+        we'll be able to connect existing accounts with SIWA. This should be
+        done when Apple Auth Provider is no longer in 'Beta':
+        https://github.com/forem/forem/pull/12114
+      -->
+      <% next if provider.provider_name == :apple %>
       <% unless @user.authenticated_through?(provider.provider_name) %>
         <%= form_with url: provider.sign_in_path(state: "profile"), class: "flex w-100", local: true do |f| %>
           <%= f.button type: :submit, class: "crayons-btn crayons-btn--icon-left crayons-btn--brand-#{provider.provider_name} m-1" do %>

config/initializers/devise.rb

@@ -19,7 +19,7 @@ APPLE_OMNIAUTH_SETUP = lambda do |env|
   env["omniauth.strategy"].options[:client_id] = SiteConfig.apple_client_id
   env["omniauth.strategy"].options[:scope] = "email name"
   env["omniauth.strategy"].options[:key_id] = SiteConfig.apple_key_id
-  env["omniauth.strategy"].options[:pem] = SiteConfig.apple_pem
+  env["omniauth.strategy"].options[:pem] = SiteConfig.apple_pem.to_s.gsub("\\n", "\n")
   env["omniauth.strategy"].options[:provider_ignores_state] = true
   env["omniauth.strategy"].options[:team_id] = SiteConfig.apple_team_id
 end

spec/models/user_spec.rb

@@ -913,7 +913,7 @@ RSpec.describe User, type: :model do
   end
 
   describe "#authenticated_with_all_providers?" do
-    let(:provider) { Authentication::Providers.available.first }
+    let(:provider) { (Authentication::Providers.available - [:apple]).first }
 
     it "returns false if the user has no related identity" do
       expect(user.authenticated_with_all_providers?).to be(false)