Attest Providers

Attestation providers handle platform-specific device integrity verification. On Android, the Play Integrity is used, while on Huawei devices, the SysIntegrity provides device integrity verification. On iOS, App Attest provides secure hardware-backed attestation.

Please configure and implement the providers listed below in strict accordance with their official platform documentation.

Play Integrity (Android)

On Android, the Play Integrity API is used to verify app and device integrity. It generates an attestation token tied to a secure nonce provided by the backend.

class PlayIntegrityProvider(context: Context) : AttestProvider {

    private val integrityManager = IntegrityManagerFactory.create(context)

    override suspend fun getToken(nonce: String): String {
        val integrityTokenResponse: Task<IntegrityTokenResponse> =
            integrityManager.requestIntegrityToken(
                IntegrityTokenRequest.builder()
                    .setNonce(nonce)
                    .build()
            )

        return suspendCancellableCoroutine { cont ->
            integrityTokenResponse
                .addOnSuccessListener {
                    cont.resume(it.token())
                }
                .addOnFailureListener { e ->
                    cont.resumeWithException(
                        AttestationException(
                            message = "Attestation failure: ${e.localizedMessage}",
                            code = AttestationErrorCode.ATTESTATION_FAILED
                        )
                    )
                }
        }
    }
}

App Attest (iOS)

On iOS, Apple’s App Attest service is used to generate and validate a device-bound cryptographic attestation. It ensures the app instance is legitimate and unmodified.

class AppAttestProvider : AttestProvider {

    @OptIn(ExperimentalForeignApi::class)
    override suspend fun getToken(nonce: String): String = suspendCancellableCoroutine { cont ->
        val service = DCAppAttestService.sharedService

        if (!service.supported) {
            cont.resumeWithException(
                AttestationException(
                    message = "App Attest is not supported.",
                    code = AttestationErrorCode.ATTESTATION_FAILED
                )
            )
            return@suspendCancellableCoroutine
        }
        
        // Cache keyId for subsequent operations.
        service.generateKeyWithCompletionHandler { keyId, error ->
            if (error != null || keyId == null) {
                cont.resumeWithException(
                    AttestationException(
                        message = "Key could not be generated: ${error?.localizedDescription}",
                        code = AttestationErrorCode.ATTESTATION_FAILED
                    )
                )
                return@generateKeyWithCompletionHandler
            }

            val hash = nonce.encodeToByteArray().sha256()

            service.attestKey(keyId = keyId, clientDataHash = hash) { attestation, attestError ->
                when {
                    attestError != null -> cont.resumeWithException(
                        AttestationException(
                            message = "Attestation failure: ${attestError.localizedDescription}",
                            code = AttestationErrorCode.ATTESTATION_FAILED
                        )
                    )

                    attestation == null -> cont.resumeWithException(
                        AttestationException(
                            message = "Attestation value empty.",
                            code = AttestationErrorCode.ATTESTATION_FAILED
                        )
                    )

                    else -> cont.resume(attestation.base64Encoding())
                }
            }
        }
    }

    @OptIn(ExperimentalForeignApi::class)
    private fun ByteArray.sha256(): NSData = memScoped {
        val input  = allocArray<ByteVar>(size)
        val digest = allocArray<UByteVar>(CC_SHA256_DIGEST_LENGTH)
        forEachIndexed { i, b -> input[i] = b }
        CC_SHA256(input, size.toUInt(), digest)
        NSData.dataWithBytes(digest, CC_SHA256_DIGEST_LENGTH.toULong())
    }

    @OptIn(ExperimentalForeignApi::class)
    fun ByteArray.toNSData(): NSData = memScoped {
        val buf = allocArray<ByteVar>(size)
        forEachIndexed { i, b -> buf[i] = b }
        NSData.dataWithBytes(buf, size.toULong())
    }
}

SysIntegrity (Huawei)

class SysIntegrityProvider(
    private val context: Context,
    private val appId: String,
) : AttestProvider {

    override suspend fun getToken(nonce: String): String {
        val nonceBytes = nonce.toByteArray(StandardCharsets.UTF_8)

        val sysIntegrityRequest = SysIntegrityRequest().apply {
            this.appId = [e-mail]
            this.nonce = nonceBytes
            this.alg = "PS256"
        }

        return suspendCancellableCoroutine { continuation ->
            SafetyDetect.getClient(context)
                .sysIntegrity(sysIntegrityRequest)
                .addOnSuccessListener { response ->
                    val jwsStr = response.result

                    if (jwsStr.isNotBlank()) {
                        continuation.resume(jwsStr)
                    } else {
                        continuation.resumeWithException(
                            AttestationException(
                                message = "Attestation failure: SysIntegrity response result is null or empty",
                                code = AttestationErrorCode.ATTESTATION_FAILED
                            )
                        )
                    }
                }
                .addOnFailureListener { e ->
                    continuation.resumeWithException(
                        AttestationException(
                            message = "Attestation failure: ${e.localizedMessage}",
                            code = AttestationErrorCode.ATTESTATION_FAILED
                        )
                    )
                }
        }
    }
}