fixup! Add app/device attestation for gated info-server requests

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: paullinator

ios/edge/EdgeAttestation.m

@@ -13,4 +13,13 @@ @interface RCT_EXTERN_MODULE (EdgeAttestation, NSObject)
                   resolver:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 
+RCT_EXTERN_METHOD(generateAssertion
+                  : (NSString *)challenge
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(clearKey
+                  : (RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+
 @end

ios/edge/EdgeAttestation.swift

@@ -2,6 +2,7 @@ import CryptoKit
 import DeviceCheck
 import Foundation
 import React
+import Security
 
 /// Native bridge for iOS App Attest (app-level attestation).
 ///
@@ -16,6 +17,48 @@ class EdgeAttestation: NSObject {
     return false
   }
 
+  // Keychain persistence for the attested App Attest key id. App Attest private
+  // keys live in the Secure Enclave keyed by this id; Apple recommends storing
+  // the id in the Keychain so it survives across launches and is reused for
+  // assertions (no re-attestation).
+  private static let keychainService = "co.edgesecure.app.appattest"
+  private static let keychainAccount = "keyId"
+
+  private func storeKeyId(_ keyId: String) {
+    clearKeyId()
+    guard let data = keyId.data(using: .utf8) else { return }
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: EdgeAttestation.keychainService,
+      kSecAttrAccount as String: EdgeAttestation.keychainAccount,
+      kSecValueData as String: data
+    ]
+    SecItemAdd(query as CFDictionary, nil)
+  }
+
+  private func loadKeyId() -> String? {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: EdgeAttestation.keychainService,
+      kSecAttrAccount as String: EdgeAttestation.keychainAccount,
+      kSecReturnData as String: true,
+      kSecMatchLimit as String: kSecMatchLimitOne
+    ]
+    var item: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &item)
+    guard status == errSecSuccess, let data = item as? Data else { return nil }
+    return String(data: data, encoding: .utf8)
+  }
+
+  private func clearKeyId() {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: EdgeAttestation.keychainService,
+      kSecAttrAccount as String: EdgeAttestation.keychainAccount
+    ]
+    SecItemDelete(query as CFDictionary)
+  }
+
   @objc(isSupported:rejecter:)
   func isSupported(
     _ resolve: @escaping RCTPromiseResolveBlock,
@@ -69,6 +112,9 @@ class EdgeAttestation: NSObject {
           reject("attestKey", "Failed to produce an attestation object", nil)
           return
         }
+        // Persist the key id so subsequent handshakes refresh via assertions
+        // instead of a full (rate-limited) attestation.
+        self.storeKeyId(keyId)
         resolve([
           "keyId": keyId,
           "attestation": attestation.base64EncodedString(),
@@ -77,4 +123,51 @@ class EdgeAttestation: NSObject {
       }
     }
   }
+
+  @objc(generateAssertion:resolver:rejecter:)
+  func generateAssertion(
+    _ challenge: String,
+    resolver resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    guard #available(iOS 14.0, *), DCAppAttestService.shared.isSupported else {
+      reject("unsupported", "App Attest is not supported on this device", nil)
+      return
+    }
+    guard let keyId = loadKeyId() else {
+      reject("noKey", "No attested App Attest key is stored", nil)
+      return
+    }
+    let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
+    DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: clientDataHash) { assertion, error in
+      if let error = error as? DCError, error.code == .invalidKey {
+        // The key no longer exists (reinstall/restore); force re-attestation.
+        self.clearKeyId()
+        reject("invalidKey", "Stored App Attest key is invalid", error)
+        return
+      }
+      if let error = error {
+        reject("generateAssertion", error.localizedDescription, error)
+        return
+      }
+      guard let assertion = assertion else {
+        reject("generateAssertion", "Failed to produce an assertion", nil)
+        return
+      }
+      resolve([
+        "keyId": keyId,
+        "assertion": assertion.base64EncodedString(),
+        "bundleId": Bundle.main.bundleIdentifier ?? ""
+      ])
+    }
+  }
+
+  @objc(clearKey:rejecter:)
+  func clearKey(
+    _ resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    clearKeyId()
+    resolve(nil)
+  }
 }