feat: Add Recaptcha attestation provider

.github/workflows/app_check_core.yml

@@ -32,6 +32,15 @@ jobs:
       run: ./scripts/setup_bundler.sh
     - name: Select Xcode version
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
+    - name: Install simulators in case they are missing.
+      if: contains(matrix.target, 'macos') == false
+      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
+      with:
+        timeout_minutes: 15
+        max_attempts: 5
+        retry_wait_seconds: 120
+        continue_on_error: true
+        command: xcodebuild -downloadPlatform ${{ matrix.target }}
     - name: Build and test
       run: |
         scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb AppCheckCore.podspec \

.github/workflows/spm.yml

@@ -32,4 +32,4 @@ jobs:
     - name: Initialize xcodebuild
       run: xcodebuild -list
     - name: iOS Unit Tests
-      run: scripts/third_party/travis/retry.sh scripts/build.sh AppCheck ${{ matrix.platform }} spm
+      run: scripts/third_party/travis/retry.sh scripts/build.sh AppCheck-Package ${{ matrix.platform }} spm

AppCheckCore.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name             = 'AppCheckCore'
-  s.version          = '11.2.0'
+  s.version          = '11.3.0'
   s.summary          = 'App Check Core SDK.'
 
   s.description      = <<-DESC
@@ -37,15 +37,20 @@ Pod::Spec.new do |s|
   s.source_files = [
     base_dir + 'Sources/**/*.[mh]',
   ]
+  s.ios.source_files = [
+    'AppCheckRecaptchaProvider/Sources/**/*.swift',
+  ]
   s.public_header_files = base_dir + 'Sources/Public/AppCheckCore/*.h'
 
   s.ios.weak_framework = 'DeviceCheck'
   s.osx.weak_framework = 'DeviceCheck'
   s.tvos.weak_framework = 'DeviceCheck'
 
   s.dependency 'PromisesObjC', '~> 2.4'
+  s.dependency 'PromisesSwift', '~> 2.4'
   s.dependency 'GoogleUtilities/Environment', '~> 8.0'
   s.dependency 'GoogleUtilities/UserDefaults', '~> 8.0'
+  s.ios.dependency 'RecaptchaInterop', '~> 101.0'
 
   s.pod_target_xcconfig = {
     'GCC_C_LANGUAGE_STANDARD' => 'c99',

AppCheckCore/Sources/AppAttestProvider/API/GACAppAttestAPIService.h

@@ -19,7 +19,7 @@
 @class FBLPromise<Result>;
 @class GACAppAttestAttestationResponse;
 @class GACAppCheckToken;
-@protocol GACAppCheckAPIServiceProtocol;
+@protocol _GACAppCheckAPIServiceProtocol;
 
 NS_ASSUME_NONNULL_BEGIN
 
@@ -55,11 +55,11 @@ NS_ASSUME_NONNULL_BEGIN
 
 /// Default initializer.
 ///
-/// @param APIService An instance implementing `GACAppCheckAPIServiceProtocol` to be used to send
+/// @param APIService An instance implementing `_GACAppCheckAPIServiceProtocol` to be used to send
 /// network requests to the App Check backend.
 /// @param resourceName The name of the resource protected by App Check; for a Firebase App this is
 /// "projects/{project_id}/apps/{app_id}".
-- (instancetype)initWithAPIService:(id<GACAppCheckAPIServiceProtocol>)APIService
+- (instancetype)initWithAPIService:(id<_GACAppCheckAPIServiceProtocol>)APIService
                       resourceName:(NSString *)resourceName NS_DESIGNATED_INITIALIZER;
 
 - (instancetype)init NS_UNAVAILABLE;

AppCheckCore/Sources/AppAttestProvider/API/GACAppAttestAPIService.m

@@ -23,9 +23,9 @@
 #endif
 
 #import "AppCheckCore/Sources/AppAttestProvider/API/GACAppAttestAttestationResponse.h"
-#import "AppCheckCore/Sources/Core/APIService/GACAppCheckAPIService.h"
-#import "AppCheckCore/Sources/Core/APIService/GACURLSessionDataResponse.h"
-#import "AppCheckCore/Sources/Core/Errors/GACAppCheckErrorUtil.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckAPIService.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckErrorUtil.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACURLSessionDataResponse.h"
 
 NS_ASSUME_NONNULL_BEGIN
 
@@ -46,15 +46,15 @@
 
 @interface GACAppAttestAPIService ()
 
-@property(nonatomic, readonly) id<GACAppCheckAPIServiceProtocol> APIService;
+@property(nonatomic, readonly) id<_GACAppCheckAPIServiceProtocol> APIService;
 
 @property(nonatomic, readonly) NSString *resourceName;
 
 @end
 
 @implementation GACAppAttestAPIService
 
-- (instancetype)initWithAPIService:(id<GACAppCheckAPIServiceProtocol>)APIService
+- (instancetype)initWithAPIService:(id<_GACAppCheckAPIServiceProtocol>)APIService
                       resourceName:(NSString *)resourceName {
   self = [super init];
   if (self) {
@@ -76,13 +76,13 @@ - (instancetype)initWithAPIService:(id<GACAppCheckAPIServiceProtocol>)APIService
                           challenge:challenge
                           assertion:assertion
                          limitedUse:limitedUse]
-      .then(^FBLPromise<GACURLSessionDataResponse *> *(NSData *HTTPBody) {
+      .then(^FBLPromise<_GACURLSessionDataResponse *> *(NSData *HTTPBody) {
         return [self.APIService sendRequestWithURL:URL
                                         HTTPMethod:kHTTPMethodPost
                                               body:HTTPBody
                                  additionalHeaders:@{kContentTypeKey : kJSONContentType}];
       })
-      .then(^id _Nullable(GACURLSessionDataResponse *_Nullable response) {
+      .then(^id _Nullable(_GACURLSessionDataResponse *_Nullable response) {
         return [self.APIService appCheckTokenWithAPIResponse:response];
       });
 }
@@ -99,14 +99,14 @@ - (instancetype)initWithAPIService:(id<GACAppCheckAPIServiceProtocol>)APIService
                                                                   body:nil
                                                      additionalHeaders:nil];
                           }]
-      .then(^id _Nullable(GACURLSessionDataResponse *_Nullable response) {
+      .then(^id _Nullable(_GACURLSessionDataResponse *_Nullable response) {
         return [self randomChallengeWithAPIResponse:response];
       });
 }
 
 #pragma mark - Challenge response parsing
 
-- (FBLPromise<NSData *> *)randomChallengeWithAPIResponse:(GACURLSessionDataResponse *)response {
+- (FBLPromise<NSData *> *)randomChallengeWithAPIResponse:(_GACURLSessionDataResponse *)response {
   return [FBLPromise onQueue:[self backgroundQueue]
                           do:^id _Nullable {
                             NSError *error;
@@ -122,7 +122,7 @@ - (instancetype)initWithAPIService:(id<GACAppCheckAPIServiceProtocol>)APIService
 - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(NSError **)outError {
   if (response.length <= 0) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil errorWithFailureReason:@"Empty server response body."], outError);
+        [_GACAppCheckErrorUtil errorWithFailureReason:@"Empty server response body."], outError);
     return nil;
   }
 
@@ -132,14 +132,15 @@ - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(N
                                                                  error:&JSONError];
 
   if (![responseDict isKindOfClass:[NSDictionary class]]) {
-    GACAppCheckSetErrorToPointer([GACAppCheckErrorUtil JSONSerializationError:JSONError], outError);
+    GACAppCheckSetErrorToPointer([_GACAppCheckErrorUtil JSONSerializationError:JSONError],
+                                 outError);
     return nil;
   }
 
   NSString *challenge = responseDict[@"challenge"];
   if (![challenge isKindOfClass:[NSString class]]) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil appCheckTokenResponseErrorWithMissingField:@"challenge"], outError);
+        [_GACAppCheckErrorUtil appCheckTokenResponseErrorWithMissingField:@"challenge"], outError);
     return nil;
   }
 
@@ -159,14 +160,14 @@ - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(N
                                  keyID:keyID
                              challenge:challenge
                             limitedUse:limitedUse]
-      .then(^FBLPromise<GACURLSessionDataResponse *> *(NSData *HTTPBody) {
+      .then(^FBLPromise<_GACURLSessionDataResponse *> *(NSData *HTTPBody) {
         return [self.APIService sendRequestWithURL:URL
                                         HTTPMethod:kHTTPMethodPost
                                               body:HTTPBody
                                  additionalHeaders:@{kContentTypeKey : kJSONContentType}];
       })
       .thenOn(
-          [self backgroundQueue], ^id _Nullable(GACURLSessionDataResponse *_Nullable URLResponse) {
+          [self backgroundQueue], ^id _Nullable(_GACURLSessionDataResponse *_Nullable URLResponse) {
             NSError *error;
 
             __auto_type response =
@@ -186,7 +187,7 @@ - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(N
                                     limitedUse:(BOOL)limitedUse {
   if (artifact.length <= 0 || challenge.length <= 0 || assertion.length <= 0) {
     FBLPromise *rejectedPromise = [FBLPromise pendingPromise];
-    [rejectedPromise reject:[GACAppCheckErrorUtil
+    [rejectedPromise reject:[_GACAppCheckErrorUtil
                                 errorWithFailureReason:@"Missing or empty request parameter."]];
     return rejectedPromise;
   }
@@ -210,7 +211,7 @@ - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(N
                                        limitedUse:(BOOL)limitedUse {
   if (attestation.length <= 0 || keyID.length <= 0 || challenge.length <= 0) {
     FBLPromise *rejectedPromise = [FBLPromise pendingPromise];
-    [rejectedPromise reject:[GACAppCheckErrorUtil
+    [rejectedPromise reject:[_GACAppCheckErrorUtil
                                 errorWithFailureReason:@"Missing or empty request parameter."]];
     return rejectedPromise;
   }
@@ -237,7 +238,7 @@ - (nullable NSData *)randomChallengeFromResponseBody:(NSData *)response error:(N
   if (payloadJSON) {
     [HTTPBodyPromise fulfill:payloadJSON];
   } else {
-    [HTTPBodyPromise reject:[GACAppCheckErrorUtil JSONSerializationError:encodingError]];
+    [HTTPBodyPromise reject:[_GACAppCheckErrorUtil JSONSerializationError:encodingError]];
   }
   return HTTPBodyPromise;
 }

AppCheckCore/Sources/AppAttestProvider/API/GACAppAttestAttestationResponse.m

@@ -17,7 +17,7 @@
 #import "AppCheckCore/Sources/AppAttestProvider/API/GACAppAttestAttestationResponse.h"
 
 #import "AppCheckCore/Sources/Core/APIService/GACAppCheckToken+APIResponse.h"
-#import "AppCheckCore/Sources/Core/Errors/GACAppCheckErrorUtil.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckErrorUtil.h"
 
 static NSString *const kResponseFieldAppCheckTokenDict = @"appCheckToken";
 static NSString *const kResponseFieldArtifact = @"artifact";
@@ -38,7 +38,7 @@ - (nullable instancetype)initWithResponseData:(NSData *)response
                                         error:(NSError **)outError {
   if (response.length <= 0) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil
+        [_GACAppCheckErrorUtil
             errorWithFailureReason:
                 @"Failed to parse the initial handshake response. Empty server response body."],
         outError);
@@ -51,14 +51,15 @@ - (nullable instancetype)initWithResponseData:(NSData *)response
                                                                  error:&JSONError];
 
   if (![responseDict isKindOfClass:[NSDictionary class]]) {
-    GACAppCheckSetErrorToPointer([GACAppCheckErrorUtil JSONSerializationError:JSONError], outError);
+    GACAppCheckSetErrorToPointer([_GACAppCheckErrorUtil JSONSerializationError:JSONError],
+                                 outError);
     return nil;
   }
 
   NSString *artifactBase64String = responseDict[kResponseFieldArtifact];
   if (![artifactBase64String isKindOfClass:[NSString class]]) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil
+        [_GACAppCheckErrorUtil
             appAttestAttestationResponseErrorWithMissingField:kResponseFieldArtifact],
         outError);
     return nil;
@@ -67,7 +68,7 @@ - (nullable instancetype)initWithResponseData:(NSData *)response
                                                              options:0];
   if (artifactData == nil) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil
+        [_GACAppCheckErrorUtil
             appAttestAttestationResponseErrorWithMissingField:kResponseFieldArtifact],
         outError);
     return nil;
@@ -76,7 +77,7 @@ - (nullable instancetype)initWithResponseData:(NSData *)response
   NSDictionary *appCheckTokenDict = responseDict[kResponseFieldAppCheckTokenDict];
   if (![appCheckTokenDict isKindOfClass:[NSDictionary class]]) {
     GACAppCheckSetErrorToPointer(
-        [GACAppCheckErrorUtil
+        [_GACAppCheckErrorUtil
             appAttestAttestationResponseErrorWithMissingField:kResponseFieldAppCheckTokenDict],
         outError);
     return nil;

AppCheckCore/Sources/AppAttestProvider/Errors/GACAppAttestRejectionError.m

@@ -18,7 +18,7 @@
 
 #import "AppCheckCore/Sources/AppAttestProvider/Errors/GACAppAttestRejectionError.h"
 
-#import "AppCheckCore/Sources/Core/Errors/GACAppCheckErrorUtil.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckErrorUtil.h"
 
 @implementation GACAppAttestRejectionError
 

AppCheckCore/Sources/AppAttestProvider/GACAppAttestProvider.m

@@ -30,17 +30,17 @@
 #import "AppCheckCore/Sources/AppAttestProvider/GACAppAttestService.h"
 #import "AppCheckCore/Sources/AppAttestProvider/Storage/GACAppAttestArtifactStorage.h"
 #import "AppCheckCore/Sources/AppAttestProvider/Storage/GACAppAttestKeyIDStorage.h"
-#import "AppCheckCore/Sources/Core/APIService/GACAppCheckAPIService.h"
-#import "AppCheckCore/Sources/Core/Backoff/GACAppCheckBackoffWrapper.h"
 #import "AppCheckCore/Sources/Core/GACAppCheckLogger+Internal.h"
 #import "AppCheckCore/Sources/Public/AppCheckCore/GACAppCheckToken.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckAPIService.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckBackoffWrapper.h"
 
 #import "AppCheckCore/Sources/Core/Utils/GACAppCheckCryptoUtils.h"
 
 #import "AppCheckCore/Sources/AppAttestProvider/Errors/GACAppAttestRejectionError.h"
-#import "AppCheckCore/Sources/Core/Errors/GACAppCheckErrorUtil.h"
 #import "AppCheckCore/Sources/Core/Errors/GACAppCheckHTTPError.h"
 #import "AppCheckCore/Sources/Public/AppCheckCore/GACAppCheckErrors.h"
+#import "AppCheckCore/Sources/Public/AppCheckCore/_GACAppCheckErrorUtil.h"
 
 NS_ASSUME_NONNULL_BEGIN
 
@@ -108,7 +108,7 @@ @interface GACAppAttestProvider ()
 @property(nonatomic, readonly) id<GACAppAttestService> appAttestService;
 @property(nonatomic, readonly) id<GACAppAttestKeyIDStorageProtocol> keyIDStorage;
 @property(nonatomic, readonly) id<GACAppAttestArtifactStorageProtocol> artifactStorage;
-@property(nonatomic, readonly) id<GACAppCheckBackoffWrapperProtocol> backoffWrapper;
+@property(nonatomic, readonly) id<_GACAppCheckBackoffWrapperProtocol> backoffWrapper;
 
 @property(nonatomic, nullable) FBLPromise<GACAppCheckToken *> *ongoingGetTokenOperation;
 @property(nonatomic, assign) BOOL ongoingGetTokenOperationLimitedUse;
@@ -123,7 +123,7 @@ - (instancetype)initWithAppAttestService:(id<GACAppAttestService>)appAttestServi
                               APIService:(id<GACAppAttestAPIServiceProtocol>)APIService
                             keyIDStorage:(id<GACAppAttestKeyIDStorageProtocol>)keyIDStorage
                          artifactStorage:(id<GACAppAttestArtifactStorageProtocol>)artifactStorage
-                          backoffWrapper:(id<GACAppCheckBackoffWrapperProtocol>)backoffWrapper {
+                          backoffWrapper:(id<_GACAppCheckBackoffWrapperProtocol>)backoffWrapper {
   self = [super init];
   if (self) {
     _appAttestService = appAttestService;
@@ -151,11 +151,11 @@ - (instancetype)initWithServiceName:(NSString *)serviceName
   GACAppAttestKeyIDStorage *keyIDStorage =
       [[GACAppAttestKeyIDStorage alloc] initWithKeySuffix:storageKeySuffix];
 
-  GACAppCheckAPIService *APIService =
-      [[GACAppCheckAPIService alloc] initWithURLSession:URLSession
-                                                baseURL:baseURL
-                                                 APIKey:APIKey
-                                           requestHooks:requestHooks];
+  _GACAppCheckAPIService *APIService =
+      [[_GACAppCheckAPIService alloc] initWithURLSession:URLSession
+                                                 baseURL:baseURL
+                                                  APIKey:APIKey
+                                            requestHooks:requestHooks];
 
   GACAppAttestAPIService *appAttestAPIService =
       [[GACAppAttestAPIService alloc] initWithAPIService:APIService resourceName:resourceName];
@@ -164,7 +164,7 @@ - (instancetype)initWithServiceName:(NSString *)serviceName
       [[GACAppAttestArtifactStorage alloc] initWithKeySuffix:storageKeySuffix
                                                  accessGroup:accessGroup];
 
-  GACAppCheckBackoffWrapper *backoffWrapper = [[GACAppCheckBackoffWrapper alloc] init];
+  _GACAppCheckBackoffWrapper *backoffWrapper = [[_GACAppCheckBackoffWrapper alloc] init];
 
   return [self initWithAppAttestService:DCAppAttestService.sharedService
                              APIService:appAttestAPIService
@@ -341,9 +341,10 @@ - (void)getTokenWithLimitedUse:(BOOL)limitedUse
                                             completionHandler:handler];
                            }]
                     .recoverOn(self.queue, ^id(NSError *error) {
-                      return [GACAppCheckErrorUtil appAttestAttestKeyFailedWithError:error
-                                                                               keyId:keyID
-                                                                      clientDataHash:challengeHash];
+                      return
+                          [_GACAppCheckErrorUtil appAttestAttestKeyFailedWithError:error
+                                                                             keyId:keyID
+                                                                    clientDataHash:challengeHash];
                     });
               })
       .thenOn(self.queue, ^FBLPromise<GACAppAttestKeyAttestationResult *> *(NSData *attestation) {
@@ -488,7 +489,7 @@ - (void)getTokenWithLimitedUse:(BOOL)limitedUse
                                                 completionHandler:handler];
                        }]
                 .recoverOn(self.queue, ^id(NSError *appAttestError) {
-                  NSError *error = [GACAppCheckErrorUtil
+                  NSError *error = [_GACAppCheckErrorUtil
                       appAttestGenerateAssertionFailedWithError:appAttestError
                                                           keyId:keyID
                                                  clientDataHash:statementHash];
@@ -570,7 +571,7 @@ - (void)getTokenWithLimitedUse:(BOOL)limitedUse
   if (self.appAttestService.isSupported) {
     return [FBLPromise resolvedWith:[NSNull null]];
   } else {
-    NSError *error = [GACAppCheckErrorUtil unsupportedAttestationProvider:@"AppAttestProvider"];
+    NSError *error = [_GACAppCheckErrorUtil unsupportedAttestationProvider:@"AppAttestProvider"];
     FBLPromise *rejectedPromise = [FBLPromise pendingPromise];
     [rejectedPromise reject:error];
     return rejectedPromise;
@@ -596,7 +597,7 @@ - (void)getTokenWithLimitedUse:(BOOL)limitedUse
              }]
       .recoverOn(self.queue,
                  ^id(NSError *error) {
-                   return [GACAppCheckErrorUtil appAttestGenerateKeyFailedWithError:error];
+                   return [_GACAppCheckErrorUtil appAttestGenerateKeyFailedWithError:error];
                  })
       .thenOn(self.queue, ^FBLPromise<NSString *> *(NSString *keyID) {
         return [self.keyIDStorage setAppAttestKeyID:keyID];