feat(cli): check and register the App ID in init apns, for every setup

[ArnabChatterjee20k]

What does this PR do?

appwrite init apns now makes sure the app's bundle ID is registered as an App ID with Push Notifications, on every run and with every key setup (appwrite, expo, fastlane). Without that, APNs refuses every push for the bundle ID with TopicDisallowed, even though the key and the Appwrite provider look fine.

Creating a key doesn't register the App ID. Xcode only registers it for a device build with the Push Notifications capability added. Projects built only for the Simulator, using manual signing, or set up before push was added never get one. I hit this while testing #2000: a working team key, a configured provider, and TopicDisallowed on the first push.

Usage

Nothing new to remember: every init apns checks the App ID.

$ appwrite init apns
✓ APNs is already set up for com.example.app.
Checking the App ID for com.example.app ...
Using the saved Apple sign-in for dev@example.com.
? Push Notifications is off for com.example.app, so APNs refuses pushes for it. Turn it on?  Yes
✓ Turned on Push Notifications for the App ID com.example.app.

How the check signs in:

Situation	What happens
A key was just created (--create-key)	Reuses that sign-in, with no extra prompt (including after --reset)
A saved Apple sign-in exists	Uses it without prompting
No saved sign-in	Asks: Sign in with your Apple ID to check the App ID for com.example.app? Choosing "Skip" moves on with a hint
No terminal (CI) and no saved sign-in	Skips with a hint; the setup still succeeds

Before any change (registering the App ID, or turning push on), it asks. If the App ID is already ready, it only reports that.

--register-app-id is the explicit form, for scripts or for skipping the questions:

$ appwrite init apns --register-app-id
✓ Registered com.example.app as an App ID with Push Notifications on team ABCDE12345.

It signs in if needed, makes the changes without asking, and fails the command if it can't. Without the flag, a failed check only warns.

How

• PrepareAppID is now part of apns.Adapter, next to CreateKey, so every setup must implement it.
  • apns.PrepareAppID holds adapters to the same contract as apns.CreateKey: a valid bundle ID and team ID go in, and a consistent result for the right team comes out.
  • apns.ConfirmAppIDChange and apns.AppIDName give every setup the same questions and the same App ID name.
  • Request.SavedSignInOnly lets the automatic check use only a saved sign-in. Without one, the adapter returns apns.ErrSignInNeeded instead of prompting.
• appwrite (native Go): uses the portal's services-account/v1/bundleIds API with the existing cookie session, following fastlane spaceship's web-session calls:
  • reads are POSTs with X-HTTP-Method-Override: GET;
  • creating an App ID is POST bundleIds;
  • enabling push is PATCH bundleIds/{id} with PUSH_NOTIFICATIONS.
  • The lookup matches the exact identifier, because the portal's filter also matches longer identifiers that start with the bundle ID.
• expo: the helper gets an --action app-id mode built on apple-utils:
  • BundleId.findAsync, createAsync, hasCapabilityAsync and updateBundleIdCapabilityAsync(PUSH_NOTIFICATIONS: ON);
  • a saved-only check restores apple-utils' saved session for the Apple ID.
• fastlane: the Fastfile gets a prepare_app_id lane built on spaceship's ConnectAPI::BundleId with the portal session:
  • a saved-only check uses spaceship's has_valid_session and never asks for a password;
  • it never offers to install fastlane.
• Questions for expo and fastlane: the helper checks, the Go side asks, then a second run applies the change. All three setups ask the same questions.

Test Plan

• apns: the PrepareAppID request checks and adapter contract (invalid team, wrong team, inconsistent results, ErrSignInNeeded), AppIDName, and ConfirmAppIDChange wording.
• appwrite adapter, against the fake Apple server (which now serves services-account/v1):
  • a missing App ID is registered with push after one question;
  • push is turned on for an existing App ID;
  • a ready App ID is left unchanged;
  • declining changes nothing;
  • a longer identifier returned by the prefix filter isn't treated as a match;
  • a saved-only check without a session asks nothing and makes no sign-in requests.
• expo and fastlane adapters, with stand-in node / fastlane:
  • without asking, it applies in one run;
  • a ready App ID is only checked;
  • check, then ask, then apply, with --reset only on the first run;
  • declining changes nothing;
  • saved-only: without an Apple ID, ErrSignInNeeded and no run; with one, the saved-only flag is passed and no password is asked;
  • fastlane never offers to install itself during a saved-only check.
• Command:
  • a check runs after --create-key without signing in again;
  • a check with the saved sign-in runs on every init apns, already set up or not;
  • with no saved sign-in, it asks, and skips on no answer;
  • --register-app-id signs in, doesn't ask, and fails the command on error.
• gofmt, go vet, go test ./internal/apns/... ./internal/cmd/; node --check helper.js; ruby -c Fastfile.
• Rector, the Twig lint and the Generation suite.
• Run against a real Apple account with each setup (io.appwrite.apnstest.native currently gets TopicDisallowed).

Related PRs and Issues

• Stacked on feat(cli): init apns and init push, with one-click APNs key creation #1963.
• Found while testing feat(apple): background push through APNs #2000.

[hansi-codes]

🟢 Tier S · Ready to merge

Adds bundle-ID validation and checks APNs setup selection before making provider changes. The init apns flow now gives clearer noninteractive Apple sign-in guidance, Expo setup hints include the APNs entitlement, and fastlane output is captured during saved-sign-in checks. Across the native, Expo, and fastlane adapters, the command continues to support checking and preparing the App ID and Push Notifications capability.

Latest changes: The newest commits add early bundle-ID and setup validation, improve noninteractive sign-in errors and the Expo entitlement hint, and capture fastlane output for saved-sign-in runs.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 16

File	Change
src/SDK/Language/CLI.php	Registers the APNs implementation and helper files in generated CLI output.
templates/cli/internal/apns/apns.go	Defines shared APNs App ID preparation behavior, validation, and prompts.
templates/cli/internal/apns/apns_test.go	Tests shared App ID validation, confirmation, and adapter contracts.
templates/cli/internal/apns/apnstest/apnstest.go	Provides a fake adapter for App ID preparation tests.
templates/cli/internal/apns/appwrite/adapter.go	Adds native App ID preparation and Apple sign-in session reuse.
templates/cli/internal/apns/appwrite/adapter_test.go	Tests native key creation and App ID portal flows.
templates/cli/internal/apns/appwrite/appid.go	Looks up, registers, and enables Push Notifications for native App IDs.
templates/cli/internal/apns/appwrite/auth.go	Tracks the Apple ID associated with the native portal session.
templates/cli/internal/apns/expo/adapter.go	Runs Expo App ID checks and changes, with saved-sign-in and reset handling.
templates/cli/internal/apns/expo/adapter_test.go	Tests Expo App ID flows and saved-sign-in handling.
templates/cli/internal/apns/expo/helper/helper.js	Adds Expo helper behavior for App ID lookup, registration, and push capability.
templates/cli/internal/apns/fastlane/adapter.go	Runs fastlane App ID lanes and carries sign-in state through checks and changes.
templates/cli/internal/apns/fastlane/adapter_test.go	Tests fastlane App ID flows and saved-sign-in handling.
templates/cli/internal/apns/fastlane/helper/Fastfile	Adds a spaceship lane to inspect and prepare App IDs.
templates/cli/internal/cmd/initpush.go	Integrates App ID preparation into APNs setup and improves validation and noninteractive guidance.
templates/cli/internal/cmd/initpush_test.go	Tests App ID checks during setup, validation, and setup selection.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding

Why

Protect the shared fastlane output buffer

Verifier: Both streams are assigned the exact same comparable *bytes.Buffer pointer (&log) at line 212, and runner.command returns a standard *exec.Cmd (lines 372–376). os/exec explicitly handles equal Stdout/Stderr writers by sharing the output pipe and guarantees that at most one goroutine calls Write at a time. command.Run also waits for copying to finish before the buffer is inspected at lines 225–227. The alleged concurrent buffer writes do not occur.

---

_{Reviewed the commits since 7b939ef · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · See the inline comments. Summary

[hansi-codes]

🔵 Tier A · See the inline comments. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[ArnabChatterjee20k]

Closing in favour of #2015, which has appwrite init apns on its own branch from main, with everything from this PR and the fixes since. Splitting it from init fcm (#1956), which is blocked on permissions, lets APNs merge on its own. init push is dropped: init apns and init fcm run separately.