iOS App Attest

gem 'ios_app_attest'

IosAppAttest.configure do |config|
  config.app_id = "TEAM_ID.BUNDLE_ID" # Your Apple Team ID and Bundle ID
  config.encryption_key = ENV.fetch("IOS_APP_ATTEST_TOKEN").byteslice(0, 32) # Your encryption key (32 bytes)
end

# Create a Redis client for nonce storage
redis = Redis.new(url: ENV["REDIS_URL"] || "redis://localhost:6379/0")

# Create a nonce generator
nonce_generator = IosAppAttest::NonceGenerator.new(
  redis_client: redis,
  logger: Rails.logger, # Optional
  expiry_seconds: 300 # Optional: Nonce expiry time in seconds (default: 120)
)

# Generate a nonce (this also stores it in Redis with the configured TTL)
nonce_data = nonce_generator.generate

# The nonce_data contains:
# - challenge_nonce_id: A unique identifier for the challenge (used as Redis key)
# - challenge_nonce: The encrypted challenge nonce (base64 encoded)
# - initialization_vector: The IV used for encryption (base64 encoded)

# Send this data to the client for attestation

# Attestation parameters from the client
attestation_params = {
  attestation_object: "base64_encoded_attestation_object",
  key_id: "base64_encoded_key_id",
  challenge_nonce: "base64_encoded_challenge", # The encrypted challenge nonce (base64 encoded)
  initialization_vector: "base64_encoded_initialization_vector", # The IV used for encryption (base64 encoded)
  challenge_nonce_id: "challenge_id" # The unique identifier for the challenge
}

# Create a verifier with Redis client for nonce verification
verifier = IosAppAttest::Verifier.new(
  attestation_params,
  redis_client: redis, # Redis client for nonce verification (required for TTL check)
  logger: Rails.logger # Optional: Logger for error logging
)

begin
  # Verify the attestation - this process includes:
  # 1. Decrypting the challenge nonce using the encryption key
  # 2. Checking if the nonce exists in Redis (validates TTL)
  # 3. Validating the attestation structure and certificates
  # 4. Verifying the nonce matches what was used in the attestation
  public_key, receipt = verifier.verify
  
  # Use the public_key and receipt for further processing
  # e.g., store the public_key for future authentications
rescue IosAppAttest::CertificateError => e
  # Handle certificate validation errors
  puts "Certificate validation failed: #{e.message}"
rescue IosAppAttest::ChallengeError => e
  # Handle challenge validation errors
  puts "Challenge validation failed: #{e.message}"
rescue IosAppAttest::AttestationError => e
  # Handle attestation format errors
  puts "Attestation format invalid: #{e.message}"
rescue IosAppAttest::AppIdentityError => e
  # Handle app identity validation errors
  puts "App identity validation failed: #{e.message}"
rescue IosAppAttest::NonceError => e
  # Handle nonce validation errors
  puts "Nonce validation failed: #{e.message}"
rescue IosAppAttest::VerificationError => e
  # Handle other verification errors
  puts "Verification failed: #{e.message}"
end