FIRAppAttestArtifactStorage implementation and tests (#8041)

* Update comments

* FIRAppAttestArtifactStorage implementation and tests

* Fix init

* API docs

* Clean up storage in tests

* Comments

* Disable Keychain dependent tests for SPM

FirebaseAppCheck/Sources/AppAttestProvider/FIRAppAttestProvider.m

@@ -112,7 +112,10 @@ - (nullable instancetype)initWithApp:(FIRApp *)app {
                                                projectID:app.options.projectID
                                                    appID:app.options.googleAppID];
 
-  FIRAppAttestArtifactStorage *artifactStorage = [[FIRAppAttestArtifactStorage alloc] init];
+  FIRAppAttestArtifactStorage *artifactStorage =
+      [[FIRAppAttestArtifactStorage alloc] initWithAppName:app.name
+                                                     appID:app.options.googleAppID
+                                               accessGroup:app.options.appGroupID];
 
   return [self initWithAppAttestService:DCAppAttestService.sharedService
                              APIService:appAttestAPIService
@@ -163,17 +166,17 @@ - (void)getTokenWithCompletion:(void (^)(FIRAppCheckToken *_Nullable, NSError *_
 #pragma mark - Initial handshake sequence
 
 - (FBLPromise<FIRAppCheckToken *> *)initialHandshakeWithKeyID:(nullable NSString *)keyID {
-  // 1. Check `DCAppAttestService.isSupported`.
+  // 1. Request a random challenge and get App Attest key ID concurrently.
   return [FBLPromise onQueue:self.queue
                          all:@[
-                           // 2. Request random challenge.
+                           // 1.1. Request random challenge.
                            [self.APIService getRandomChallenge],
-                           // 3. Get App Attest key ID.
+                           // 1.2. Get App Attest key ID.
                            [self generateAppAttestKeyIDIfNeeded:keyID]
                          ]]
       .thenOn(self.queue,
               ^FBLPromise<FIRAppAttestKeyAttestationResult *> *(NSArray *challengeAndKeyID) {
-                // 4. Attest the key.
+                // 2. Attest the key.
                 NSData *challenge = challengeAndKeyID.firstObject;
                 NSString *keyID = challengeAndKeyID.lastObject;
 
@@ -182,7 +185,7 @@ - (void)getTokenWithCompletion:(void (^)(FIRAppCheckToken *_Nullable, NSError *_
       // TODO: Handle a possible key rejection - generate another key.
       .thenOn(self.queue,
               ^FBLPromise<FIRAppCheckToken *> *(FIRAppAttestKeyAttestationResult *result) {
-                // 5. Exchange the attestation to FAC token.
+                // 3. Exchange the attestation to FAC token.
                 return [self.APIService appCheckTokenWithAttestation:result.attestation
                                                                keyID:result.keyID
                                                            challenge:result.challenge];

FirebaseAppCheck/Sources/AppAttestProvider/Storage/FIRAppAttestArtifactStorage.h

@@ -25,16 +25,32 @@ NS_ASSUME_NONNULL_BEGIN
 @protocol FIRAppAttestArtifactStorageProtocol <NSObject>
 
 /// Set the artifact.
-- (FBLPromise<NSData *> *)setArtifact:(NSData *)artifact;
+/// @param artifact The artifact data to store. Pass `nil` to remove the stored artifact.
+/// @return An artifact that is resolved with the artifact data passed into the method in case of
+/// success or is rejected with an error.
+- (FBLPromise<NSData *> *)setArtifact:(nullable NSData *)artifact;
 
 /// Get the artifact.
+/// @return A promise that is resolved with the artifact data if artifact exists, is resolved with
+/// `nil` if no artifact found or is rejected with an error.
 - (FBLPromise<NSData *> *)getArtifact;
 
 @end
 
 /// An implementation of FIRAppAttestArtifactStorageProtocol.
 @interface FIRAppAttestArtifactStorage : NSObject <FIRAppAttestArtifactStorageProtocol>
 
+- (instancetype)init NS_UNAVAILABLE;
+
+/// A default initializer.
+/// @param appName A Firebase App name (`FirebaseApp.name`). The app name will be used as a part of
+/// the key to store the token for the storage instance.
+/// @param appID A Firebase App identifier (`FirebaseOptions.googleAppID`). The app ID will be used
+/// as a part of the key to store the token for the storage instance.
+/// @param accessGroup The Keychain Access Group.
+- (instancetype)initWithAppName:(NSString *)appName
+                          appID:(NSString *)appID
+                    accessGroup:(nullable NSString *)accessGroup;
 @end
 
 NS_ASSUME_NONNULL_END

FirebaseAppCheck/Sources/AppAttestProvider/Storage/FIRAppAttestArtifactStorage.m

@@ -22,16 +22,82 @@
 #import "FBLPromises.h"
 #endif
 
+#import <GoogleUtilities/GULKeychainStorage.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+static NSString *const kKeychainService = @"com.firebase.app_check.app_attest_artifact_storage";
+
+@interface FIRAppAttestArtifactStorage ()
+
+@property(nonatomic, readonly) NSString *appName;
+@property(nonatomic, readonly) NSString *appID;
+@property(nonatomic, readonly) GULKeychainStorage *keychainStorage;
+@property(nonatomic, readonly, nullable) NSString *accessGroup;
+
+@end
+
 @implementation FIRAppAttestArtifactStorage
 
-- (nonnull FBLPromise<NSData *> *)getArtifact {
-  // TODO: Implement.
-  return [FBLPromise resolvedWith:nil];
+- (instancetype)initWithAppName:(NSString *)appName
+                          appID:(NSString *)appID
+                keychainStorage:(GULKeychainStorage *)keychainStorage
+                    accessGroup:(nullable NSString *)accessGroup {
+  self = [super init];
+  if (self) {
+    _appName = [appName copy];
+    _appID = [appID copy];
+    _keychainStorage = keychainStorage;
+    _accessGroup = [accessGroup copy];
+  }
+  return self;
 }
 
-- (nonnull FBLPromise<NSData *> *)setArtifact:(nonnull NSData *)artifact {
-  // TODO: Implement.
-  return [FBLPromise resolvedWith:nil];
+- (instancetype)initWithAppName:(NSString *)appName
+                          appID:(NSString *)appID
+                    accessGroup:(nullable NSString *)accessGroup {
+  GULKeychainStorage *keychainStorage =
+      [[GULKeychainStorage alloc] initWithService:kKeychainService];
+  return [self initWithAppName:appName
+                         appID:appID
+               keychainStorage:keychainStorage
+                   accessGroup:accessGroup];
+}
+
+- (FBLPromise<NSData *> *)getArtifact {
+  return [self.keychainStorage getObjectForKey:[self artifactKey]
+                                   objectClass:[NSData class]
+                                   accessGroup:self.accessGroup]
+      .then(^NSData *(id<NSSecureCoding> storedArtifact) {
+        if ([(NSObject *)storedArtifact isKindOfClass:[NSData class]]) {
+          return (NSData *)storedArtifact;
+        } else {
+          return nil;
+        }
+      });
+}
+
+- (FBLPromise<NSData *> *)setArtifact:(nullable NSData *)artifact {
+  if (artifact) {
+    return [self.keychainStorage setObject:artifact
+                                    forKey:[self artifactKey]
+                               accessGroup:self.accessGroup]
+        .then(^id _Nullable(NSNull *_Nullable value) {
+          return artifact;
+        });
+  } else {
+    return [self.keychainStorage removeObjectForKey:[self artifactKey] accessGroup:self.accessGroup]
+        .then(^id _Nullable(NSNull *_Nullable value) {
+          return nil;
+        });
+  }
+}
+
+- (NSString *)artifactKey {
+  return
+      [NSString stringWithFormat:@"app_check_app_attest_artifact.%@.%@", self.appName, self.appID];
 }
 
 @end
+
+NS_ASSUME_NONNULL_END

FirebaseAppCheck/Tests/Unit/AppAttestProvider/Storage/FIRAppAttestArtifactStorageTests.m

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import <XCTest/XCTest.h>
+
+#import "FBLPromise+Testing.h"
+
+#import "FirebaseAppCheck/Sources/AppAttestProvider/Storage/FIRAppAttestArtifactStorage.h"
+
+@interface FIRAppAttestArtifactStorageTests : XCTestCase
+
+@property(nonatomic) NSString *appName;
+@property(nonatomic) NSString *appID;
+@property(nonatomic) FIRAppAttestArtifactStorage *storage;
+
+@end
+
+@implementation FIRAppAttestArtifactStorageTests
+
+- (void)setUp {
+  [super setUp];
+
+  self.appName = @"FIRAppAttestArtifactStorageTests";
+  self.appID = @"1:100000000000:ios:aaaaaaaaaaaaaaaaaaaaaaaa";
+
+  self.storage = [[FIRAppAttestArtifactStorage alloc] initWithAppName:self.appName
+                                                                appID:self.appID
+                                                          accessGroup:nil];
+}
+
+- (void)tearDown {
+  // Cleanup the storage.
+  [self.storage setArtifact:nil];
+  self.storage = nil;
+  [super tearDown];
+}
+
+- (void)testSetAndGetArtifact {
+  [self assertSetGetForStorage];
+}
+
+- (void)testRemoveArtifact {
+  // 1. Save an artifact to storage and check it is stored.
+  [self assertSetGetForStorage];
+
+  // 2. Remove artifact.
+  __auto_type setPromise = [self.storage setArtifact:nil];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertNil(setPromise.value);
+  XCTAssertNil(setPromise.error);
+
+  // 3. Check it has been removed.
+  __auto_type getPromise = [self.storage getArtifact];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertNil(getPromise.value);
+  XCTAssertNil(getPromise.error);
+}
+
+- (void)testSetAndGetPerApp {
+  // Assert storages for apps with the same name can independently set/get artifact.
+  [self assertIndependentSetGetForStoragesWithAppName1:self.appName
+                                                appID1:@"app_id"
+                                              appName2:self.appName
+                                                appID2:@"app_id_2"];
+  // Assert storages for apps with the same app ID can independently set/get artifact.
+  [self assertIndependentSetGetForStoragesWithAppName1:@"app_1"
+                                                appID1:self.appID
+                                              appName2:@"app_2"
+                                                appID2:self.appID];
+  // Assert storages for apps with different info can independently set/get artifact.
+  [self assertIndependentSetGetForStoragesWithAppName1:@"app_1"
+                                                appID1:@"app_id_1"
+                                              appName2:@"app_2"
+                                                appID2:@"app_id_2"];
+}
+
+#pragma mark - Helpers
+
+- (void)assertSetGetForStorage {
+  NSData *artifactToSet = [[NSUUID UUID].UUIDString dataUsingEncoding:NSUTF8StringEncoding];
+
+  __auto_type setPromise = [self.storage setArtifact:artifactToSet];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(setPromise.value, artifactToSet);
+  XCTAssertNil(setPromise.error);
+
+  __auto_type getPromise = [self.storage getArtifact];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(getPromise.value, artifactToSet);
+  XCTAssertNil(getPromise.error);
+}
+
+- (void)assertIndependentSetGetForStoragesWithAppName1:(NSString *)appName1
+                                                appID1:(NSString *)appID1
+                                              appName2:(NSString *)appName2
+                                                appID2:(NSString *)appID2 {
+  // Create two storages.
+  FIRAppAttestArtifactStorage *storage1 =
+      [[FIRAppAttestArtifactStorage alloc] initWithAppName:appName1 appID:appID1 accessGroup:nil];
+  FIRAppAttestArtifactStorage *storage2 =
+      [[FIRAppAttestArtifactStorage alloc] initWithAppName:appName2 appID:appID2 accessGroup:nil];
+  // 1. Independently set artifacts for the two storages.
+  NSData *artifact1 = [@"app_attest_artifact1" dataUsingEncoding:NSUTF8StringEncoding];
+  FBLPromise *setPromise1 = [storage1 setArtifact:artifact1];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(setPromise1.value, artifact1);
+  XCTAssertNil(setPromise1.error);
+
+  NSData *artifact2 = [@"app_attest_artifact2" dataUsingEncoding:NSUTF8StringEncoding];
+  __auto_type setPromise2 = [storage2 setArtifact:artifact2];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(setPromise2.value, artifact2);
+  XCTAssertNil(setPromise2.error);
+
+  // 2. Get artifacts for the two storages.
+  __auto_type getPromise1 = [storage1 getArtifact];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(getPromise1.value, artifact1);
+  XCTAssertNil(getPromise1.error);
+
+  __auto_type getPromise2 = [storage2 getArtifact];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+  XCTAssertEqualObjects(getPromise2.value, artifact2);
+  XCTAssertNil(getPromise2.error);
+
+  // 3. Assert that artifacts were set and retrieved independently of one another.
+  XCTAssertNotEqualObjects(getPromise1.value, getPromise2.value);
+
+  // Cleanup storages.
+  [storage1 setArtifact:nil];
+  [storage2 setArtifact:nil];
+  XCTAssert(FBLWaitForPromisesWithTimeout(0.5));
+}
+
+@end

Package.swift

@@ -949,6 +949,7 @@ let package = Package(
 
         // Disable Keychain dependent tests as they require a host application on iOS.
         "Integration",
+        "Unit/AppAttestProvider/Storage/FIRAppAttestArtifactStorageTests.m",
         "Unit/Core/FIRAppCheckIntegrationTests.m",
         "Unit/Core/FIRAppCheckStorageTests.m",
       ],