composer require codingwithrk/nativephp-social-auth
php artisan native:plugin:register codingwithrk/nativephp-social-auth

GOOGLE_IOS_CLIENT_ID=123456789-abc.apps.googleusercontent.com
GOOGLE_IOS_REVERSED_CLIENT_ID=com.googleusercontent.apps.123456789-abc
GOOGLE_SERVER_CLIENT_ID=123456789-xyz.apps.googleusercontent.com

php artisan vendor:publish --tag=nativephp-social-auth-config

use Codingwithrk\NativephpSocialAuth\Facades\NativephpSocialAuth;
use Codingwithrk\NativephpSocialAuth\Events\AppleSignInCompleted;
use Codingwithrk\NativephpSocialAuth\Events\GoogleSignInCompleted;
use Codingwithrk\NativephpSocialAuth\Events\AppleCredentialStateChecked;
use Codingwithrk\NativephpSocialAuth\Events\SignInFailed;
use Native\Mobile\Attributes\OnNative;
use Livewire\Component;
 
class LoginScreen extends Component
{
    public ?string $nonce = null;
 
    public function mount(): void
    {
        $this->nonce = bin2hex(random_bytes(16));
    }
 
    public function signInWithApple(): void
    {
        NativephpSocialAuth::appleSignIn(nonce: $this->nonce);
    }
 
    public function signInWithGoogle(): void
    {
        NativephpSocialAuth::googleSignIn(nonce: $this->nonce);
    }
 
    #[OnNative(AppleSignInCompleted::class)]
    public function onAppleSignIn(
        string $userId,
        ?string $identityToken = null,
        ?string $email = null,
        ?string $givenName = null,
        ?string $familyName = null,
    ) {
        // Verify $identityToken server-side, then find-or-create the user.
        // $email/$givenName/$familyName are ONLY sent on the user's first
        // authorization — store them then, because Apple won't send them again.
    }
 
    #[OnNative(GoogleSignInCompleted::class)]
    public function onGoogleSignIn(
        string $userId,
        ?string $identityToken = null,
        ?string $email = null,
        ?string $givenName = null,
        ?string $familyName = null,
        ?string $photoUrl = null,
    ) {
        // Verify $identityToken server-side, then find-or-create the user.
    }
 
    #[OnNative(AppleCredentialStateChecked::class)]
    public function onCredentialStateChecked(string $userId, string $state)
    {
        // $state is one of: authorized, revoked, notFound, transferred, unknown
        if ($state === 'revoked') {
            // Log the user out locally — they revoked access in Settings.
        }
    }
 
    #[OnNative(SignInFailed::class)]
    public function onSignInFailed(string $provider, string $error, ?string $errorCode = null)
    {
        // errorCode is one of: USER_CANCELLED, UNSUPPORTED_PLATFORM,
        // NO_PRESENTING_CONTROLLER, MISSING_CONFIGURATION, NO_CREDENTIALS,
        // INVALID_PARAMETERS, SIGN_IN_FAILED
        if ($errorCode !== 'USER_CANCELLED') {
            report(new \RuntimeException("$provider sign-in failed: $error"));
        }
    }
}

import nativephpSocialAuth, { generateNonce } from '@codingwithrk/nativephp-social-auth';
 
const nonce = generateNonce();
 
async function handleGoogleSignIn() {
    await nativephpSocialAuth.googleSignIn(nonce);
}
 
async function handleAppleSignIn() {
    await nativephpSocialAuth.appleSignIn({ nonce });
}
 
// Use NativePHP's global `On()` helper to receive the result.
On('Codingwithrk\\NativephpSocialAuth\\Events\\GoogleSignInCompleted', (payload) => {
    sendIdentityTokenToBackend(payload.identityToken);
});
 
On('Codingwithrk\\NativephpSocialAuth\\Events\\SignInFailed', (payload) => {
    console.error(`${payload.provider} sign-in failed: ${payload.error} (${payload.errorCode})`);
});

use Firebase\JWT\JWT;
use Firebase\JWT\JWK;
 
// Google — verify aud, iss, and (if you passed one) the nonce claim.
$keys = JWK::parseKeySet(json_decode(file_get_contents('https://www.googleapis.com/oauth2/v3/certs'), true));
$claims = JWT::decode($identityToken, $keys);
abort_unless($claims->aud === config('services.google.server_client_id'), 401);
abort_unless($claims->iss === 'https://accounts.google.com', 401);
 
// Apple — verify aud (your bundle ID), iss, and the nonce claim (hash your
// raw nonce with SHA-256 and compare — Apple hashes it the same way before
// embedding it in the token).
$keys = JWK::parseKeySet(json_decode(file_get_contents('https://appleid.apple.com/auth/keys'), true));
$claims = JWT::decode($identityToken, $keys);
abort_unless($claims->aud === config('nativephp.bundle_id'), 401);
abort_unless($claims->iss === 'https://appleid.apple.com', 401);
abort_unless(hash('sha256', $rawNonce) === ($claims->nonce ?? null), 401);