App Check App Attest: attestation request (#8059)

* App Attest provider API integration WIP

* update tests

* Draft attestation response parsing

* Attestation request draft

* style

* AppAttest Attestation API tests draft

* Error cases tests

* style

* Cleanup and API docs

* Merge fix

* Fix OCMock imports

* Fix nullability modifier

* Formatting

* comments

FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAPIService.h

@@ -17,20 +17,29 @@
 #import <Foundation/Foundation.h>
 
 @class FBLPromise<Result>;
+@class FIRAppAttestAttestationResponse;
 @class FIRAppCheckToken;
 @protocol FIRAppCheckAPIServiceProtocol;
 
 NS_ASSUME_NONNULL_BEGIN
 
+/// Methods to send API requests required for App Attest based attestation sequence.
 @protocol FIRAppAttestAPIServiceProtocol <NSObject>
 
 /// Request a random challenge from server.
 - (FBLPromise<NSData *> *)getRandomChallenge;
 
-/// Exchanges attestation data to FAC token.
-- (FBLPromise<FIRAppCheckToken *> *)appCheckTokenWithAttestation:(NSData *)attestation
-                                                           keyID:(NSString *)keyID
-                                                       challenge:(NSData *)challenge;
+/// Sends attestation data to Firebase backend for validation.
+/// @param attestation The App Attest key attestation data obtained from the method
+/// `-[DCAppAttestService attestKey:clientDataHash:completionHandler:]` using the random challenge
+/// received from Firebase backend.
+/// @param keyID The key ID used to generate the attestation.
+/// @param challenge The challenge used to generate the attestation.
+/// @return A promise that is fulfilled with a response object with an encrypted attestation
+/// artifact and an Firebase App Check token or rejected with an error.
+- (FBLPromise<FIRAppAttestAttestationResponse *> *)attestKeyWithAttestation:(NSData *)attestation
+                                                                      keyID:(NSString *)keyID
+                                                                  challenge:(NSData *)challenge;
 
 /// Exchanges attestation data (artifact & assertion) and a challenge for a FAC token.
 - (FBLPromise<FIRAppCheckToken *> *)appCheckTokenWithArtifact:(NSData *)artifact
@@ -39,8 +48,14 @@ NS_ASSUME_NONNULL_BEGIN
 
 @end
 
+/// A default implementation of `FIRAppAttestAPIServiceProtocol`.
 @interface FIRAppAttestAPIService : NSObject <FIRAppAttestAPIServiceProtocol>
 
+/// Default initializer.
+/// @param APIService An instance implementing `FIRAppCheckAPIServiceProtocol` to be used to send
+/// network requests to Firebase App Check backend.
+/// @param projectID A Firebase project ID for the requests (`FIRApp.options.projectID`).
+/// @param appID A Firebase app ID for the requests (`FIRApp.options.googleAppID`).
 - (instancetype)initWithAPIService:(id<FIRAppCheckAPIServiceProtocol>)APIService
                          projectID:(NSString *)projectID
                              appID:(NSString *)appID;

FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAPIService.m

@@ -22,11 +22,21 @@
 #import "FBLPromises.h"
 #endif
 
+#import "FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAttestationResponse.h"
 #import "FirebaseAppCheck/Sources/Core/APIService/FIRAppCheckAPIService.h"
 
 #import <GoogleUtilities/GULURLSessionDataResponse.h>
 #import "FirebaseAppCheck/Sources/Core/Errors/FIRAppCheckErrorUtil.h"
 
+NS_ASSUME_NONNULL_BEGIN
+
+static NSString *const kRequestFieldAttestation = @"attestation_statement";
+static NSString *const kRequestFieldKeyID = @"key_id";
+static NSString *const kRequestFieldChallenge = @"challenge";
+
+static NSString *const kContentTypeKey = @"Content-Type";
+static NSString *const kJSONContentType = @"application/json";
+
 @interface FIRAppAttestAPIService ()
 
 @property(nonatomic, readonly) id<FIRAppCheckAPIServiceProtocol> APIService;
@@ -50,28 +60,26 @@ - (instancetype)initWithAPIService:(id<FIRAppCheckAPIServiceProtocol>)APIService
   return self;
 }
 
+- (dispatch_queue_t)backgroundQueue {
+  return dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0);
+}
+
 - (FBLPromise<FIRAppCheckToken *> *)appCheckTokenWithArtifact:(NSData *)artifact
                                                     challenge:(NSData *)challenge
                                                     assertion:(NSData *)assertion {
   // TODO: Implement.
   return [FBLPromise resolvedWith:nil];
 }
 
-- (nonnull FBLPromise<FIRAppCheckToken *> *)
-    appCheckTokenWithAttestation:(nonnull NSData *)attestation
-                           keyID:(nonnull NSString *)keyID
-                       challenge:(nonnull NSData *)challenge {
-  // TODO: Implement.
-  return [FBLPromise resolvedWith:nil];
-}
+#pragma mark - Random Challenge
 
 - (nonnull FBLPromise<NSData *> *)getRandomChallenge {
   NSString *URLString =
       [NSString stringWithFormat:@"%@/projects/%@/apps/%@:generateAppAttestChallenge",
                                  self.APIService.baseURL, self.projectID, self.appID];
   NSURL *URL = [NSURL URLWithString:URLString];
 
-  return [FBLPromise onQueue:[self defaultQueue]
+  return [FBLPromise onQueue:[self backgroundQueue]
                           do:^id _Nullable {
                             return [self.APIService sendRequestWithURL:URL
                                                             HTTPMethod:@"POST"
@@ -86,7 +94,7 @@ - (instancetype)initWithAPIService:(id<FIRAppCheckAPIServiceProtocol>)APIService
 #pragma mark - Challenge response parsing
 
 - (FBLPromise<NSData *> *)randomChallengeWithAPIResponse:(GULURLSessionDataResponse *)response {
-  return [FBLPromise onQueue:[self defaultQueue]
+  return [FBLPromise onQueue:[self backgroundQueue]
                           do:^id _Nullable {
                             NSError *error;
 
@@ -98,7 +106,7 @@ - (instancetype)initWithAPIService:(id<FIRAppCheckAPIServiceProtocol>)APIService
                           }];
 }
 
-- (NSData *)randomChallengeFromResponseBody:(NSData *)response error:(NSError **)outError {
+- (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(NSError **)outError {
   if (response.length <= 0) {
     FIRAppCheckSetErrorToPointer(
         [FIRAppCheckErrorUtil errorWithFailureReason:@"Empty server response body."], outError);
@@ -126,8 +134,70 @@ - (NSData *)randomChallengeFromResponseBody:(NSData *)response error:(NSError **
   return randomChallenge;
 }
 
-- (dispatch_queue_t)defaultQueue {
-  return dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0);
+#pragma mark - Attestation request
+
+- (FBLPromise<FIRAppAttestAttestationResponse *> *)attestKeyWithAttestation:(NSData *)attestation
+                                                                      keyID:(NSString *)keyID
+                                                                  challenge:(NSData *)challenge {
+  NSString *URLString =
+      [NSString stringWithFormat:@"%@/projects/%@/apps/%@:exchangeAppAttestAttestation",
+                                 self.APIService.baseURL, self.projectID, self.appID];
+  NSURL *URL = [NSURL URLWithString:URLString];
+
+  return [self HTTPBodyWithAttestation:attestation keyID:keyID challenge:challenge]
+      .then(^FBLPromise<GULURLSessionDataResponse *> *(NSData *HTTPBody) {
+        return [self.APIService sendRequestWithURL:URL
+                                        HTTPMethod:@"POST"
+                                              body:HTTPBody
+                                 additionalHeaders:@{kContentTypeKey : kJSONContentType}];
+      })
+      .then(^id _Nullable(GULURLSessionDataResponse *_Nullable URLResponse) {
+        NSError *error;
+
+        __auto_type response =
+            [[FIRAppAttestAttestationResponse alloc] initWithResponseData:URLResponse.HTTPBody
+                                                              requestDate:[NSDate date]
+                                                                    error:&error];
+
+        return response ?: error;
+      });
+}
+
+- (FBLPromise<NSData *> *)HTTPBodyWithAttestation:(NSData *)attestation
+                                            keyID:(NSString *)keyID
+                                        challenge:(NSData *)challenge {
+  if (attestation.length <= 0 || keyID.length <= 0 || challenge.length <= 0) {
+    FBLPromise *rejectedPromise = [FBLPromise pendingPromise];
+    [rejectedPromise reject:[FIRAppCheckErrorUtil
+                                errorWithFailureReason:@"Missing or empty request parameter."]];
+    return rejectedPromise;
+  }
+
+  return [FBLPromise
+      onQueue:[self backgroundQueue]
+           do:^id _Nullable {
+             NSError *encodingError;
+             NSData *payloadJSON = [NSJSONSerialization dataWithJSONObject:@{
+               kRequestFieldKeyID : keyID,
+               kRequestFieldAttestation : [self base64StringWithData:attestation],
+               kRequestFieldChallenge : [self base64StringWithData:challenge]
+             }
+                                                                   options:0
+                                                                     error:&encodingError];
+
+             if (payloadJSON != nil) {
+               return payloadJSON;
+             } else {
+               return [FIRAppCheckErrorUtil JSONSerializationError:encodingError];
+             }
+           }];
+}
+
+- (NSString *)base64StringWithData:(NSData *)data {
+  // TODO: Need to encode in base64URL?
+  return [data base64EncodedStringWithOptions:0];
 }
 
 @end
+
+NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestInitialHandshakeResponse.h → FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAttestationResponse.h

@@ -20,7 +20,7 @@
 
 NS_ASSUME_NONNULL_BEGIN
 
-@interface FIRAppAttestInitialHandshakeResponse : NSObject
+@interface FIRAppAttestAttestationResponse : NSObject
 
 /// App Attest attestation artifact required to refresh Firebase App Check token.
 @property(nonatomic, readonly) NSData *artifact;
@@ -33,6 +33,11 @@ NS_ASSUME_NONNULL_BEGIN
 - (instancetype)initWithArtifact:(NSData *)artifact
                            token:(FIRAppCheckToken *)token NS_DESIGNATED_INITIALIZER;
 
+/// Init with the server response.
+- (nullable instancetype)initWithResponseData:(NSData *)response
+                                  requestDate:(NSDate *)requestDate
+                                        error:(NSError **)outError;
+
 @end
 
 NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAttestationResponse.m

@@ -0,0 +1,92 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAttestationResponse.h"
+
+#import "FirebaseAppCheck/Sources/Core/APIService/FIRAppCheckToken+APIResponse.h"
+#import "FirebaseAppCheck/Sources/Core/Errors/FIRAppCheckErrorUtil.h"
+
+@implementation FIRAppAttestAttestationResponse
+
+- (instancetype)initWithArtifact:(NSData *)artifact token:(FIRAppCheckToken *)token {
+  self = [super init];
+  if (self) {
+    _artifact = artifact;
+    _token = token;
+  }
+  return self;
+}
+
+- (nullable instancetype)initWithResponseData:(NSData *)response
+                                  requestDate:(NSDate *)requestDate
+                                        error:(NSError **)outError {
+  if (response.length <= 0) {
+    FIRAppCheckSetErrorToPointer(
+        [FIRAppCheckErrorUtil
+            errorWithFailureReason:
+                @"Failed to parse the initial handshake response. Empty server response body."],
+        outError);
+    return nil;
+  }
+
+  NSError *JSONError;
+  NSDictionary *responseDict = [NSJSONSerialization JSONObjectWithData:response
+                                                               options:0
+                                                                 error:&JSONError];
+
+  if (![responseDict isKindOfClass:[NSDictionary class]]) {
+    FIRAppCheckSetErrorToPointer([FIRAppCheckErrorUtil JSONSerializationError:JSONError], outError);
+    return nil;
+  }
+
+  NSString *artifactBase64String = responseDict[@"artifact"];
+  if (![artifactBase64String isKindOfClass:[NSString class]]) {
+    FIRAppCheckSetErrorToPointer(
+        [FIRAppCheckErrorUtil appAttestAttestationResponseErrorWithMissingField:@"artifact"],
+        outError);
+    return nil;
+  }
+  NSData *artifactData = [[NSData alloc] initWithBase64EncodedString:artifactBase64String
+                                                             options:0];
+  if (artifactData == nil) {
+    FIRAppCheckSetErrorToPointer(
+        [FIRAppCheckErrorUtil appAttestAttestationResponseErrorWithMissingField:@"artifact"],
+        outError);
+    return nil;
+  }
+
+  NSDictionary *attestationTokenDict = responseDict[@"attestationToken"];
+  if (![attestationTokenDict isKindOfClass:[NSDictionary class]]) {
+    FIRAppCheckSetErrorToPointer(
+        [FIRAppCheckErrorUtil
+            appAttestAttestationResponseErrorWithMissingField:@"attestationToken"],
+        outError);
+    return nil;
+  }
+
+  FIRAppCheckToken *appCheckToken =
+      [[FIRAppCheckToken alloc] initWithResponseDict:attestationTokenDict
+                                         requestDate:requestDate
+                                               error:outError];
+
+  if (appCheckToken == nil) {
+    return nil;
+  }
+
+  return [self initWithArtifact:artifactData token:appCheckToken];
+}
+
+@end

FirebaseAppCheck/Sources/AppAttestProvider/FIRAppAttestProvider.m

@@ -25,6 +25,7 @@
 #endif
 
 #import "FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAPIService.h"
+#import "FirebaseAppCheck/Sources/AppAttestProvider/API/FIRAppAttestAttestationResponse.h"
 #import "FirebaseAppCheck/Sources/AppAttestProvider/FIRAppAttestProviderState.h"
 #import "FirebaseAppCheck/Sources/AppAttestProvider/FIRAppAttestService.h"
 #import "FirebaseAppCheck/Sources/AppAttestProvider/Storage/FIRAppAttestArtifactStorage.h"
@@ -184,14 +185,28 @@ - (void)getTokenWithCompletion:(void (^)(FIRAppCheckToken *_Nullable, NSError *_
               })
       // TODO: Handle a possible key rejection - generate another key.
       .thenOn(self.queue,
-              ^FBLPromise<FIRAppCheckToken *> *(FIRAppAttestKeyAttestationResult *result) {
+              ^FBLPromise<FIRAppAttestAttestationResponse *> *(
+                  FIRAppAttestKeyAttestationResult *result) {
                 // 3. Exchange the attestation to FAC token.
-                return [self.APIService appCheckTokenWithAttestation:result.attestation
-                                                               keyID:result.keyID
-                                                           challenge:result.challenge];
+                return [self.APIService attestKeyWithAttestation:result.attestation
+                                                           keyID:result.keyID
+                                                       challenge:result.challenge];
+              })
+      .thenOn(self.queue,
+              ^FBLPromise<FIRAppCheckToken *> *(FIRAppAttestAttestationResponse *response) {
+                // 4. Save the artifact and return the received FAC token.
+                return [self saveArtifactAndGetAppCheckTokenFromResponse:response];
               });
 }
 
+- (FBLPromise<FIRAppCheckToken *> *)saveArtifactAndGetAppCheckTokenFromResponse:
+    (FIRAppAttestAttestationResponse *)response {
+  return [self.artifactStorage setArtifact:response.artifact].thenOn(
+      self.queue, ^FIRAppCheckToken *(id result) {
+        return response.token;
+      });
+}
+
 #pragma mark - Token refresh sequence
 
 - (FBLPromise<FIRAppCheckToken *> *)refreshTokenWithKeyID:(NSString *)keyID

FirebaseAppCheck/Sources/Core/APIService/FIRAppCheckToken+APIResponse.h

@@ -27,6 +27,10 @@ NS_ASSUME_NONNULL_BEGIN
                                            requestDate:(NSDate *)requestDate
                                                  error:(NSError **)outError;
 
+- (nullable instancetype)initWithResponseDict:(NSDictionary<NSString *, id> *)responseDict
+                                  requestDate:(NSDate *)requestDate
+                                        error:(NSError **)outError;
+
 @end
 
 NS_ASSUME_NONNULL_END