Rewrite AppCheckCore in Swift

AppCheckCore.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name             = 'AppCheckCore'
-  s.version          = '11.3.1'
+  s.version          = '12.0.0'
   s.summary          = 'App Check Core SDK.'
 
   s.description      = <<-DESC
@@ -17,7 +17,7 @@ Pod::Spec.new do |s|
   }
   s.social_media_url = 'https://twitter.com/Firebase'
 
-  ios_deployment_target = '12.0'
+  ios_deployment_target = '13.0'
   osx_deployment_target = '10.15'
   tvos_deployment_target = '13.0'
   watchos_deployment_target = '7.0'
@@ -35,7 +35,7 @@ Pod::Spec.new do |s|
   base_dir = "AppCheckCore/"
 
   s.source_files = [
-    base_dir + 'Sources/**/*.[mh]',
+    base_dir + 'Sources/**/*.{h,m,swift}',
   ]
   s.ios.source_files = [
     'AppCheckRecaptchaProvider/Sources/**/*.swift',
@@ -45,9 +45,6 @@ Pod::Spec.new do |s|
   s.ios.weak_framework = 'DeviceCheck'
   s.osx.weak_framework = 'DeviceCheck'
   s.tvos.weak_framework = 'DeviceCheck'
-
-  s.dependency 'PromisesObjC', '~> 2.4'
-  s.dependency 'PromisesSwift', '~> 2.4'
   s.dependency 'GoogleUtilities/Environment', '~> 8.0'
   s.dependency 'GoogleUtilities/UserDefaults', '~> 8.0'
   s.ios.dependency 'RecaptchaInterop', '~> 101.0'
@@ -64,28 +61,13 @@ Pod::Spec.new do |s|
       :tvos => tvos_deployment_target
     }
     unit_tests.source_files = [
-      base_dir + 'Tests/Unit/**/*.[mh]',
-      base_dir + 'Tests/Utils/**/*.[mh]',
+      base_dir + 'Tests/Unit/**/*.swift',
     ]
 
     unit_tests.resources = base_dir + 'Tests/Fixture/**/*'
     unit_tests.requires_app_host = true
   end
 
-  s.test_spec 'integration' do |integration_tests|
-    integration_tests.platforms = {
-      :ios => ios_deployment_target,
-      :osx => osx_deployment_target,
-      :tvos => tvos_deployment_target
-    }
-    integration_tests.source_files = [
-      base_dir + 'Tests/Integration/**/*.[mh]',
-      base_dir + 'Tests/Integration/**/*.[mh]',
-    ]
-    integration_tests.resources = base_dir + 'Tests/Fixture/**/*'
-    integration_tests.requires_app_host = true
-  end
-
   s.test_spec 'swift-unit' do |swift_unit_tests|
     swift_unit_tests.platforms = {
       :ios => ios_deployment_target,

AppCheckCore/Sources/AppAttestProvider/API/AppCheckCoreAppAttestAPIService.swift

@@ -0,0 +1,201 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import Foundation
+
+private let kGenerateAppAttestChallengeEndpoint = "generateAppAttestChallenge"
+private let kExchangeAppAttestAttestationEndpoint = "exchangeAppAttestAttestation"
+private let kExchangeAppAttestAssertionEndpoint = "exchangeAppAttestAssertion"
+
+private let kRequestFieldArtifact = "artifact"
+private let kRequestFieldAssertion = "assertion"
+private let kRequestFieldChallenge = "challenge"
+private let kRequestFieldKeyID = "key_id"
+private let kRequestFieldAttestation = "attestation_statement"
+private let kRequestFieldLimitedUse = "limited_use"
+private let kContentTypeKey = "Content-Type"
+private let kJSONContentType = "application/json"
+private let kHTTPMethodPost = "POST"
+
+@objc(GACAppAttestAPIServiceProtocol)
+public protocol AppCheckCoreAppAttestAPIServiceProtocol: NSObjectProtocol {
+  @objc func getRandomChallenge() async throws -> Data
+
+  @objc
+  func attestKey(withAttestation attestation: Data, keyID: String, challenge: Data,
+                 limitedUse: Bool) async throws -> AppCheckCoreAppAttestAttestationResponse
+
+  @objc
+  func getAppCheckToken(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                        limitedUse: Bool) async throws -> AppCheckCoreToken
+}
+
+@objc(GACAppAttestAPIService)
+public class AppCheckCoreAppAttestAPIService: NSObject, AppCheckCoreAppAttestAPIServiceProtocol {
+  private let apiService: AppCheckCoreAPIServiceProtocol
+  private let resourceName: String
+
+  @objc(initWithAPIService:resourceName:)
+  public init(apiService: AppCheckCoreAPIServiceProtocol, resourceName: String) {
+    self.apiService = apiService
+    self.resourceName = resourceName
+    super.init()
+  }
+
+  // MARK: - API Calls
+
+  @objc
+  public func getRandomChallenge() async throws -> Data {
+    let url = urlForEndpoint(kGenerateAppAttestChallengeEndpoint)
+    let response = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: nil,
+      additionalHeaders: nil
+    )
+    return try randomChallengeWithAPIResponse(response)
+  }
+
+  @objc
+  public func attestKey(withAttestation attestation: Data, keyID: String, challenge: Data,
+                        limitedUse: Bool) async throws -> AppCheckCoreAppAttestAttestationResponse {
+    let url = urlForEndpoint(kExchangeAppAttestAttestationEndpoint)
+    let body = try httpBody(
+      withAttestation: attestation,
+      keyID: keyID,
+      challenge: challenge,
+      limitedUse: limitedUse
+    )
+
+    let urlResponse = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: body,
+      additionalHeaders: [kContentTypeKey: kJSONContentType]
+    )
+
+    guard let responseData = urlResponse.httpBody else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Invalid or missing response data.")
+    }
+    let response = try AppCheckCoreAppAttestAttestationResponse(
+      responseData: responseData,
+      requestDate: Date()
+    )
+
+    return response
+  }
+
+  @objc
+  public func getAppCheckToken(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                               limitedUse: Bool) async throws -> AppCheckCoreToken {
+    let url = urlForEndpoint(kExchangeAppAttestAssertionEndpoint)
+    let body = try httpBody(
+      withArtifact: artifact,
+      challenge: challenge,
+      assertion: assertion,
+      limitedUse: limitedUse
+    )
+
+    let urlResponse = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: body,
+      additionalHeaders: [kContentTypeKey: kJSONContentType]
+    )
+
+    let token = try await apiService.appCheckToken(withAPIResponse: urlResponse)
+    return token
+  }
+
+  // MARK: - Challenge parsing
+
+  private func randomChallengeWithAPIResponse(_ response: AppCheckCoreURLSessionDataResponse) throws
+    -> Data {
+    guard let responseData = response.httpBody else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Empty server response body.")
+    }
+
+    if responseData.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Empty server response body.")
+    }
+
+    guard let responseDict = try? JSONSerialization
+      .jsonObject(with: responseData, options: []) as? [String: Any] else {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(NSError(
+        domain: NSCocoaErrorDomain,
+        code: 0,
+        userInfo: nil
+      ))
+    }
+
+    guard let challengeBase64 = responseDict["challenge"] as? String else {
+      throw AppCheckCoreErrorUtil.appCheckTokenResponseError(withMissingField: "challenge")
+    }
+
+    guard let challenge = Data(base64Encoded: challengeBase64) else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Invalid base64 string for challenge.")
+    }
+
+    return challenge
+  }
+
+  // MARK: - Body Builders
+
+  private func httpBody(withAttestation attestation: Data, keyID: String, challenge: Data,
+                        limitedUse: Bool) throws -> Data {
+    if attestation.isEmpty || keyID.isEmpty || challenge.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Missing or empty request parameter.")
+    }
+
+    let jsonObject: [String: Any] = [
+      kRequestFieldKeyID: keyID,
+      kRequestFieldAttestation: attestation.base64EncodedString(),
+      kRequestFieldChallenge: challenge.base64EncodedString(),
+      kRequestFieldLimitedUse: limitedUse,
+    ]
+
+    return try httpBody(withJSONObject: jsonObject)
+  }
+
+  private func httpBody(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                        limitedUse: Bool) throws -> Data {
+    if artifact.isEmpty || challenge.isEmpty || assertion.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Missing or empty request parameter.")
+    }
+
+    let jsonObject: [String: Any] = [
+      kRequestFieldArtifact: artifact.base64EncodedString(),
+      kRequestFieldChallenge: challenge.base64EncodedString(),
+      kRequestFieldAssertion: assertion.base64EncodedString(),
+      kRequestFieldLimitedUse: limitedUse,
+    ]
+
+    return try httpBody(withJSONObject: jsonObject)
+  }
+
+  private func httpBody(withJSONObject jsonObject: Any) throws -> Data {
+    do {
+      return try JSONSerialization.data(withJSONObject: jsonObject, options: [])
+    } catch {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(error as NSError)
+    }
+  }
+
+  // MARK: - URL Helpers
+
+  private func urlForEndpoint(_ endpoint: String) -> URL {
+    let urlString = "\(apiService.baseURL)/\(resourceName):\(endpoint)"
+    return URL(string: urlString)!
+  }
+}

AppCheckCore/Sources/AppAttestProvider/API/AppCheckCoreAppAttestAttestationResponse.swift

@@ -0,0 +1,73 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import Foundation
+
+private let kResponseFieldAppCheckTokenDict = "appCheckToken"
+private let kResponseFieldArtifact = "artifact"
+
+@objc(GACAppAttestAttestationResponse)
+public class AppCheckCoreAppAttestAttestationResponse: NSObject {
+  @objc public let artifact: Data
+  @objc public let token: AppCheckCoreToken
+
+  @objc(initWithArtifact:token:)
+  public init(artifact: Data, token: AppCheckCoreToken) {
+    self.artifact = artifact
+    self.token = token
+    super.init()
+  }
+
+  @objc(initWithResponseData:requestDate:error:)
+  public init(responseData: Data, requestDate: Date) throws {
+    if responseData.isEmpty {
+      throw AppCheckCoreErrorUtil
+        .error(
+          withFailureReason: "Failed to parse the initial handshake response. Empty server response body."
+        )
+    }
+
+    let responseDict = try JSONSerialization
+      .jsonObject(with: responseData, options: []) as? [String: Any]
+
+    guard let responseDict = responseDict else {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(NSError(
+        domain: NSCocoaErrorDomain,
+        code: 0,
+        userInfo: nil
+      ))
+    }
+
+    guard let artifactBase64String = responseDict[kResponseFieldArtifact] as? String,
+          let artifactData = Data(base64Encoded: artifactBase64String) else {
+      throw AppCheckCoreErrorUtil
+        .appAttestAttestationResponseError(withMissingField: kResponseFieldArtifact)
+    }
+
+    guard let appCheckTokenDict = responseDict[kResponseFieldAppCheckTokenDict] as? [String: Any]
+    else {
+      throw AppCheckCoreErrorUtil
+        .appAttestAttestationResponseError(withMissingField: kResponseFieldAppCheckTokenDict)
+    }
+
+    let appCheckToken = try AppCheckCoreToken(
+      responseDict: appCheckTokenDict,
+      requestDate: requestDate
+    )
+
+    artifact = artifactData
+    token = appCheckToken
+    super.init()
+  }
+}