@appattest/react-native 0.1.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +42 -17
- package/ios/AppAttestModule.mm +2 -1
- package/ios/AppAttestModule.swift +10 -4
- package/lib/commonjs/NativeAppAttest.js.map +1 -1
- package/lib/commonjs/index.js +36 -6
- package/lib/commonjs/index.js.map +1 -1
- package/lib/module/NativeAppAttest.js.map +1 -1
- package/lib/module/index.js +36 -6
- package/lib/module/index.js.map +1 -1
- package/lib/typescript/NativeAppAttest.d.ts +6 -3
- package/lib/typescript/NativeAppAttest.d.ts.map +1 -1
- package/lib/typescript/index.d.ts +34 -5
- package/lib/typescript/index.d.ts.map +1 -1
- package/package.json +1 -1
- package/src/NativeAppAttest.ts +6 -3
- package/src/index.ts +36 -6
package/README.md
CHANGED
|
@@ -3,9 +3,7 @@
|
|
|
3
3
|
React Native bridge for [AppAttest](https://www.appattest.dev) — App-Attest-gated
|
|
4
4
|
secret delivery for iOS.
|
|
5
5
|
|
|
6
|
-
>
|
|
7
|
-
> `v0.1.0`. Not yet published to npm.
|
|
8
|
-
> The JS/TS API shape is stable.
|
|
6
|
+
> Ships in lockstep with the Swift SDK (current: `v0.4.0`).
|
|
9
7
|
|
|
10
8
|
## Platform support
|
|
11
9
|
|
|
@@ -17,9 +15,6 @@ secret delivery for iOS.
|
|
|
17
15
|
|
|
18
16
|
## Install
|
|
19
17
|
|
|
20
|
-
> Not yet on npm — publication is upcoming. Until then the bridge ships as
|
|
21
|
-
> source in `bridges/react-native` of the SDK repository. Once published:
|
|
22
|
-
|
|
23
18
|
```bash
|
|
24
19
|
npm install @appattest/react-native
|
|
25
20
|
cd ios && pod install
|
|
@@ -33,8 +28,8 @@ monorepo). That's wired automatically through the pod's `s.dependency`.
|
|
|
33
28
|
```tsx
|
|
34
29
|
import { AppAttest, useSecret } from '@appattest/react-native';
|
|
35
30
|
|
|
36
|
-
// Once, at app launch
|
|
37
|
-
AppAttest.start();
|
|
31
|
+
// Once, at app launch. `release` is required — see "Buckets" below.
|
|
32
|
+
AppAttest.start('production');
|
|
38
33
|
|
|
39
34
|
// In any component — re-renders when secrets land:
|
|
40
35
|
function Chat() {
|
|
@@ -52,7 +47,7 @@ const key = await AppAttest.getSecret('OPENAI_API_KEY'); // string | null
|
|
|
52
47
|
const all = await AppAttest.getAllSecrets(); // Record<string, string>
|
|
53
48
|
```
|
|
54
49
|
|
|
55
|
-
`start()` is fire-and-forget: the first launch attests the device once
|
|
50
|
+
`start(release)` is fire-and-forget: the first launch attests the device once
|
|
56
51
|
(persists across launches), then syncs secrets; later launches hydrate
|
|
57
52
|
from the Keychain and re-sync in the background. Foreground re-entry
|
|
58
53
|
re-syncs automatically — your app does no lifecycle wiring.
|
|
@@ -83,7 +78,7 @@ subscribe, top up, or investigate.
|
|
|
83
78
|
```ts
|
|
84
79
|
await AppAttest.retry(); // re-run the sync (no re-attestation)
|
|
85
80
|
await AppAttest.invalidateBundle(); // drop the cached bundle, force a fresh sync
|
|
86
|
-
await AppAttest.reset(); // full wipe; next start() re-attests
|
|
81
|
+
await AppAttest.reset(); // full wipe; next start(release) re-attests
|
|
87
82
|
```
|
|
88
83
|
|
|
89
84
|
`retry()` recovers from transient failures. `invalidateBundle()` forces
|
|
@@ -100,7 +95,7 @@ if (__DEV__) {
|
|
|
100
95
|
OPENAI_API_KEY: 'sk-test-stub',
|
|
101
96
|
});
|
|
102
97
|
}
|
|
103
|
-
AppAttest.start();
|
|
98
|
+
AppAttest.start('staging');
|
|
104
99
|
```
|
|
105
100
|
|
|
106
101
|
Pass `null` to return to real attestation. The native debug surface is
|
|
@@ -109,14 +104,44 @@ run real attestation; calling it there rejects with
|
|
|
109
104
|
`debug_mode_release_blocked`.
|
|
110
105
|
|
|
111
106
|
Dev builds on **real devices** don't need debug mode — they attest for
|
|
112
|
-
real and read the sandbox
|
|
107
|
+
real and read the sandbox column (below).
|
|
108
|
+
|
|
109
|
+
## Buckets and columns
|
|
110
|
+
|
|
111
|
+
Two independent axes. Keeping them apart is the whole model.
|
|
112
|
+
|
|
113
|
+
**1. Which server bucket you declare — you choose it, explicitly.**
|
|
114
|
+
|
|
115
|
+
`release` is a **required** argument on `AppAttest.start(release)`. There
|
|
116
|
+
is no default, and no inference from `__DEV__` or build flavor. The bucket
|
|
117
|
+
is exactly what you pass:
|
|
118
|
+
|
|
119
|
+
```ts
|
|
120
|
+
AppAttest.start('production'); // shipping build
|
|
121
|
+
AppAttest.start('staging'); // pre-ship verification build
|
|
122
|
+
```
|
|
123
|
+
|
|
124
|
+
`'staging'` and `'production'` are two functionally-identical,
|
|
125
|
+
separately-keyed, **metered** buckets. Neither is free.
|
|
126
|
+
|
|
127
|
+
**2. Which secrets column Apple puts you in — the AAGUID decides, not you.**
|
|
128
|
+
|
|
129
|
+
Apple's App Attest AAGUID is a build-time property stamped into every
|
|
130
|
+
attestation, and you cannot forge it:
|
|
131
|
+
|
|
132
|
+
- **Development-signed builds** (Xcode → device) → **sandbox** column.
|
|
133
|
+
- **Distribution builds** carrying the production App Attest entitlement
|
|
134
|
+
(TestFlight, App Store) → **production** column.
|
|
113
135
|
|
|
114
|
-
|
|
136
|
+
The two axes are orthogonal: **both servers have both columns.** Edge
|
|
137
|
+
resolves your declared bucket against the AAGUID. A development-signed
|
|
138
|
+
build declaring `'production'` is rejected with a loud
|
|
139
|
+
`403 bucket_not_permitted` — never silently re-routed.
|
|
115
140
|
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
141
|
+
For last-mile verification of production secrets before submitting to the
|
|
142
|
+
App Store, use TestFlight: it carries the real production AAGUID, so it
|
|
143
|
+
reads the production column. There is no debug-build path to the
|
|
144
|
+
production column.
|
|
120
145
|
|
|
121
146
|
## Error handling
|
|
122
147
|
|
package/ios/AppAttestModule.mm
CHANGED
|
@@ -11,7 +11,8 @@
|
|
|
11
11
|
#if __has_include(<React/RCTBridgeModule.h>)
|
|
12
12
|
@interface RCT_EXTERN_REMAP_MODULE(RNAppAttest, AppAttestModule, RCTEventEmitter)
|
|
13
13
|
|
|
14
|
-
RCT_EXTERN_METHOD(start:(
|
|
14
|
+
RCT_EXTERN_METHOD(start:(NSString *)release
|
|
15
|
+
resolve:(RCTPromiseResolveBlock)resolve
|
|
15
16
|
reject:(RCTPromiseRejectBlock)reject)
|
|
16
17
|
|
|
17
18
|
RCT_EXTERN_METHOD(waitForReady:(RCTPromiseResolveBlock)resolve
|
|
@@ -63,12 +63,18 @@ final class AppAttestModule: RCTEventEmitter {
|
|
|
63
63
|
|
|
64
64
|
// MARK: - Lifecycle
|
|
65
65
|
|
|
66
|
+
/// `release` is required — `"production"` or `"staging"`. The facade
|
|
67
|
+
/// rejects an unknown string with `invalid_argument` and does NOT
|
|
68
|
+
/// start; we forward that rejection to JS verbatim rather than
|
|
69
|
+
/// picking a bucket on the caller's behalf.
|
|
66
70
|
@objc func start(
|
|
67
|
-
_
|
|
71
|
+
_ release: NSString,
|
|
72
|
+
resolve: @escaping RCTPromiseResolveBlock,
|
|
68
73
|
reject: @escaping RCTPromiseRejectBlock
|
|
69
74
|
) {
|
|
70
|
-
client.start()
|
|
71
|
-
|
|
75
|
+
client.start(release: release as String) { error in
|
|
76
|
+
Self.complete((), error: error, resolve: resolve, reject: reject)
|
|
77
|
+
}
|
|
72
78
|
}
|
|
73
79
|
|
|
74
80
|
@objc func waitForReady(
|
|
@@ -145,7 +151,7 @@ final class AppAttestModule: RCTEventEmitter {
|
|
|
145
151
|
reject: @escaping RCTPromiseRejectBlock
|
|
146
152
|
) {
|
|
147
153
|
let dict = (stubs as? [String: String]) ?? [:]
|
|
148
|
-
client.
|
|
154
|
+
client.setDebug(name as String?, stubs: dict.isEmpty ? nil : dict) { error in
|
|
149
155
|
Self.complete((), error: error, resolve: resolve, reject: reject)
|
|
150
156
|
}
|
|
151
157
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["_reactNative","require","_default","exports","default","TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeAppAttest.ts"],"mappings":";;;;;;AAYA,IAAAA,YAAA,GAAAC,OAAA;AAZA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVA,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,
|
|
1
|
+
{"version":3,"names":["_reactNative","require","_default","exports","default","TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeAppAttest.ts"],"mappings":";;;;;;AAYA,IAAAA,YAAA,GAAAC,OAAA;AAZA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVA,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAwEeC,gCAAmB,CAACC,YAAY,CAAO,aAAa,CAAC","ignoreList":[]}
|
package/lib/commonjs/index.js
CHANGED
|
@@ -15,7 +15,7 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
|
|
|
15
15
|
* @appattest/react-native — public API.
|
|
16
16
|
*
|
|
17
17
|
* Surface mirrors the Swift SDK's bridge translation:
|
|
18
|
-
* - AppAttest.start() — fire-and-forget setup
|
|
18
|
+
* - AppAttest.start(release) — fire-and-forget setup; `release` required
|
|
19
19
|
* - AppAttest.getSecret(name) — Promise<string | null>
|
|
20
20
|
* - AppAttest.getAllSecrets() — Promise<Record<string, string>>
|
|
21
21
|
* - AppAttest.getState() — Promise<AppAttestState>
|
|
@@ -79,6 +79,23 @@ const ErrorCode = exports.ErrorCode = {
|
|
|
79
79
|
DebugModeReleaseBlocked: 'debug_mode_release_blocked',
|
|
80
80
|
InvalidArgument: 'invalid_argument'
|
|
81
81
|
};
|
|
82
|
+
|
|
83
|
+
/**
|
|
84
|
+
* Which metered server bucket this build attests against. Mirrors the
|
|
85
|
+
* Swift SDK's `ReleaseBucket`.
|
|
86
|
+
*
|
|
87
|
+
* Required on `AppAttest.start(release)` — no default, and never inferred
|
|
88
|
+
* from `__DEV__` or any other build-flavor signal. The bucket is exactly
|
|
89
|
+
* what you pass.
|
|
90
|
+
*
|
|
91
|
+
* - `'production'` — the live, metered bucket. Almost every shipped app.
|
|
92
|
+
* - `'staging'` — a functionally-identical, separately-keyed, **metered**
|
|
93
|
+
* bucket for pre-ship verification. Still fully metered — not a free tier.
|
|
94
|
+
*
|
|
95
|
+
* Distinct from the secrets *column* (sandbox vs production), which Apple's
|
|
96
|
+
* AAGUID decides at build time and you cannot choose. See the README.
|
|
97
|
+
*/
|
|
98
|
+
|
|
82
99
|
function buildError(e, native) {
|
|
83
100
|
return new AppAttestError(e.code ?? 'internal_error', e.message ?? String(native), {
|
|
84
101
|
subscribeUrl: e.userInfo?.subscribeUrl ?? e.subscribeUrl,
|
|
@@ -102,12 +119,25 @@ function decodeState(raw) {
|
|
|
102
119
|
}
|
|
103
120
|
const AppAttest = exports.AppAttest = {
|
|
104
121
|
/**
|
|
105
|
-
* Synchronous, idempotent setup.
|
|
106
|
-
*
|
|
107
|
-
* is bucket
|
|
122
|
+
* Synchronous, idempotent setup.
|
|
123
|
+
*
|
|
124
|
+
* `release` is **required** — the server bucket this build attests
|
|
125
|
+
* against. There is no default and no inference: the bucket is exactly
|
|
126
|
+
* what you pass.
|
|
127
|
+
*
|
|
128
|
+
* ```ts
|
|
129
|
+
* AppAttest.start('production');
|
|
130
|
+
* ```
|
|
131
|
+
*
|
|
132
|
+
* Edge resolves your declaration against Apple's AAGUID; a
|
|
133
|
+
* development-signed build declaring `'production'` is rejected with a
|
|
134
|
+
* loud `403 bucket_not_permitted` rather than quietly re-routed.
|
|
135
|
+
*
|
|
136
|
+
* Rejects with `invalid_argument` if `release` is not a known bucket —
|
|
137
|
+
* in which case the SDK does **not** start, rather than guessing one.
|
|
108
138
|
*/
|
|
109
|
-
start() {
|
|
110
|
-
return wrap(_NativeAppAttest.default.start());
|
|
139
|
+
start(release) {
|
|
140
|
+
return wrap(_NativeAppAttest.default.start(release));
|
|
111
141
|
},
|
|
112
142
|
/** Awaits a terminal state. Resolves on `ready`; rejects with
|
|
113
143
|
* AppAttestError on subscriptionRequired / creditsRequired / unavailable. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["_react","require","_reactNative","_NativeAppAttest","_interopRequireDefault","e","__esModule","default","eventEmitter","NativeEventEmitter","NativeModules","RNAppAttest","AppAttestError","Error","constructor","code","message","extras","name","subscribeUrl","topupUrl","nativeError","actionUrl","exports","ErrorCode","SubscriptionRequired","CreditsRequired","AttestationRejected","ServiceUnavailable","Network","DebugModeReleaseBlocked","InvalidArgument","buildError","native","String","userInfo","wrap","p","err","decodeState","raw","error","undefined","AppAttest","start","NativeAppAttest","waitForReady","retry","reset","invalidateBundle","getSecret","getAllSecrets","getState","addStateListener","listener","subscription","addListener","remove","setDebugMode","mode","stubs","useSecret","value","setValue","useState","useEffect","active","then","v","catch","unsubscribe","s","useAllSecrets","all","setAll","useAppAttestState","state","setState","_default"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;AAsBA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,gBAAA,GAAAC,sBAAA,CAAAH,OAAA;AAAgD,SAAAG,uBAAAC,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAxBhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;AACA,MAAMG,YAAY,GAAG,IAAIC,+BAAkB,CAACC,0BAAa,CAACC,WAAkB,CAAC;;AAE7E;AACA;AACA;;AAeA;AACA;AACA;AACA;AACO,MAAMC,cAAc,SAASC,KAAK,CAAC;EAExC;;EAEA;;EAIAC,WAAWA,CACTC,IAAY,EACZC,OAAe,EACfC,MAIC,EACD;IACA,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,gBAAgB;IAC5B,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACI,YAAY,GAAGF,MAAM,EAAEE,YAAY;IACxC,IAAI,CAACC,QAAQ,GAAGH,MAAM,EAAEG,QAAQ;IAChC,IAAI,CAACC,WAAW,GAAGJ,MAAM,EAAEI,WAAW;EACxC;;EAEA;AACF;AACA;AACA;AACA;EACE,IAAIC,SAASA,CAAA,EAAuB;IAClC,OAAO,IAAI,CAACH,YAAY,IAAI,IAAI,CAACC,QAAQ;EAC3C;AACF;;AAEA;AAAAG,OAAA,CAAAX,cAAA,GAAAA,cAAA;AACO,MAAMY,SAAS,GAAAD,OAAA,CAAAC,SAAA,GAAG;EACvBC,oBAAoB,EAAE,uBAAuB;EAC7CC,eAAe,EAAE,kBAAkB;EACnCC,mBAAmB,EAAE,sBAAsB;EAC3CC,kBAAkB,EAAE,qBAAqB;EACzCC,OAAO,EAAE,SAAS;EAClBC,uBAAuB,EAAE,4BAA4B;EACrDC,eAAe,EAAE;AACnB,CAAU;
|
|
1
|
+
{"version":3,"names":["_react","require","_reactNative","_NativeAppAttest","_interopRequireDefault","e","__esModule","default","eventEmitter","NativeEventEmitter","NativeModules","RNAppAttest","AppAttestError","Error","constructor","code","message","extras","name","subscribeUrl","topupUrl","nativeError","actionUrl","exports","ErrorCode","SubscriptionRequired","CreditsRequired","AttestationRejected","ServiceUnavailable","Network","DebugModeReleaseBlocked","InvalidArgument","buildError","native","String","userInfo","wrap","p","err","decodeState","raw","error","undefined","AppAttest","start","release","NativeAppAttest","waitForReady","retry","reset","invalidateBundle","getSecret","getAllSecrets","getState","addStateListener","listener","subscription","addListener","remove","setDebugMode","mode","stubs","useSecret","value","setValue","useState","useEffect","active","then","v","catch","unsubscribe","s","useAllSecrets","all","setAll","useAppAttestState","state","setState","_default"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;AAsBA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,gBAAA,GAAAC,sBAAA,CAAAH,OAAA;AAAgD,SAAAG,uBAAAC,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAxBhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;AACA,MAAMG,YAAY,GAAG,IAAIC,+BAAkB,CAACC,0BAAa,CAACC,WAAkB,CAAC;;AAE7E;AACA;AACA;;AAeA;AACA;AACA;AACA;AACO,MAAMC,cAAc,SAASC,KAAK,CAAC;EAExC;;EAEA;;EAIAC,WAAWA,CACTC,IAAY,EACZC,OAAe,EACfC,MAIC,EACD;IACA,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,gBAAgB;IAC5B,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACI,YAAY,GAAGF,MAAM,EAAEE,YAAY;IACxC,IAAI,CAACC,QAAQ,GAAGH,MAAM,EAAEG,QAAQ;IAChC,IAAI,CAACC,WAAW,GAAGJ,MAAM,EAAEI,WAAW;EACxC;;EAEA;AACF;AACA;AACA;AACA;EACE,IAAIC,SAASA,CAAA,EAAuB;IAClC,OAAO,IAAI,CAACH,YAAY,IAAI,IAAI,CAACC,QAAQ;EAC3C;AACF;;AAEA;AAAAG,OAAA,CAAAX,cAAA,GAAAA,cAAA;AACO,MAAMY,SAAS,GAAAD,OAAA,CAAAC,SAAA,GAAG;EACvBC,oBAAoB,EAAE,uBAAuB;EAC7CC,eAAe,EAAE,kBAAkB;EACnCC,mBAAmB,EAAE,sBAAsB;EAC3CC,kBAAkB,EAAE,qBAAqB;EACzCC,OAAO,EAAE,SAAS;EAClBC,uBAAuB,EAAE,4BAA4B;EACrDC,eAAe,EAAE;AACnB,CAAU;;AAMV;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAeA,SAASC,UAAUA,CAAC3B,CAAgB,EAAE4B,MAAe,EAAkB;EACrE,OAAO,IAAIrB,cAAc,CAACP,CAAC,CAACU,IAAI,IAAI,gBAAgB,EAAEV,CAAC,CAACW,OAAO,IAAIkB,MAAM,CAACD,MAAM,CAAC,EAAE;IACjFd,YAAY,EAAEd,CAAC,CAAC8B,QAAQ,EAAEhB,YAAY,IAAId,CAAC,CAACc,YAAY;IACxDC,QAAQ,EAAEf,CAAC,CAAC8B,QAAQ,EAAEf,QAAQ,IAAIf,CAAC,CAACe,QAAQ;IAC5CC,WAAW,EAAEY;EACf,CAAC,CAAC;AACJ;AAEA,eAAeG,IAAIA,CAAIC,CAAa,EAAc;EAChD,IAAI;IACF,OAAO,MAAMA,CAAC;EAChB,CAAC,CAAC,OAAOC,GAAG,EAAE;IACZ,MAAMN,UAAU,CAACM,GAAG,EAAmBA,GAAG,CAAC;EAC7C;AACF;AAOA,SAASC,WAAWA,CAACC,GAAmB,EAAkB;EACxD,MAAMC,KAAK,GAAGD,GAAG,CAACC,KAAK,GAAGT,UAAU,CAACQ,GAAG,CAACC,KAAK,EAAED,GAAG,CAACC,KAAK,CAAC,GAAGC,SAAS;EACtE,OAAO;IAAExB,IAAI,EAAEsB,GAAG,CAACtB,IAA0B;IAAEuB;EAAM,CAAC;AACxD;AAEO,MAAME,SAAS,GAAApB,OAAA,CAAAoB,SAAA,GAAG;EACvB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,KAAKA,CAACC,OAAsB,EAAiB;IAC3C,OAAOT,IAAI,CAACU,wBAAe,CAACF,KAAK,CAACC,OAAO,CAAC,CAAC;EAC7C,CAAC;EAED;AACF;EACEE,YAAYA,CAAA,EAAkB;IAC5B,OAAOX,IAAI,CAACU,wBAAe,CAACC,YAAY,CAAC,CAAC,CAAC;EAC7C,CAAC;EAED;EACAC,KAAKA,CAAA,EAAkB;IACrB,OAAOZ,IAAI,CAACU,wBAAe,CAACE,KAAK,CAAC,CAAC,CAAC;EACtC,CAAC;EAED;EACAC,KAAKA,CAAA,EAAkB;IACrB,OAAOb,IAAI,CAACU,wBAAe,CAACG,KAAK,CAAC,CAAC,CAAC;EACtC,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAAgBA,CAAA,EAAkB;IAChC,OAAOd,IAAI,CAACU,wBAAe,CAACI,gBAAgB,CAAC,CAAC,CAAC;EACjD,CAAC;EAED;EACAC,SAASA,CAACjC,IAAY,EAA0B;IAC9C,OAAOkB,IAAI,CAACU,wBAAe,CAACK,SAAS,CAACjC,IAAI,CAAC,CAAC;EAC9C,CAAC;EAED;EACAkC,aAAaA,CAAA,EAAoC;IAC/C,OAAOhB,IAAI,CAACU,wBAAe,CAACM,aAAa,CAAC,CAAC,CAAC;EAC9C,CAAC;EAED;EACA,MAAMC,QAAQA,CAAA,EAA4B;IACxC,MAAMb,GAAG,GAAG,MAAMJ,IAAI,CAACU,wBAAe,CAACO,QAAQ,CAAC,CAAC,CAAC;IAClD,OAAOd,WAAW,CAACC,GAAqB,CAAC;EAC3C,CAAC;EAED;EACAc,gBAAgBA,CAACC,QAAyC,EAAc;IACtE,MAAMC,YAAY,GAAGhD,YAAY,CAACiD,WAAW,CAAC,cAAc,EAAGjB,GAAG,IAAK;MACrEe,QAAQ,CAAChB,WAAW,CAACC,GAAqB,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,OAAO,MAAMgB,YAAY,CAACE,MAAM,CAAC,CAAC;EACpC,CAAC;EAED;EACAC,YAAYA,CAACC,IAAsB,EAAEC,KAA8B,EAAiB;IAClF,OAAOzB,IAAI,CAACU,wBAAe,CAACa,YAAY,CAACC,IAAI,EAAEC,KAAK,IAAI,IAAI,CAAC,CAAC;EAChE;;EAEA;EACA;AACF,CAAC;;AAED;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,SAASA,CAAC5C,IAAY,EAAiB;EACrD,MAAM,CAAC6C,KAAK,EAAEC,QAAQ,CAAC,GAAG,IAAAC,eAAQ,EAAgB,IAAI,CAAC;EACvD,IAAAC,gBAAS,EAAC,MAAM;IACd,IAAIC,MAAM,GAAG,IAAI;IACjBxB,SAAS,CAACQ,SAAS,CAACjC,IAAI,CAAC,CAACkD,IAAI,CAAEC,CAAC,IAAK;MAAE,IAAIF,MAAM,EAAEH,QAAQ,CAACK,CAAC,CAAC;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,MAAMC,WAAW,GAAG5B,SAAS,CAACW,gBAAgB,CAAC,MAAOkB,CAAC,IAAK;MAC1D,IAAIA,CAAC,CAACtD,IAAI,KAAK,OAAO,EAAE;QACtB,IAAI;UACF,MAAMmD,CAAC,GAAG,MAAM1B,SAAS,CAACQ,SAAS,CAACjC,IAAI,CAAC;UACzC,IAAIiD,MAAM,EAAEH,QAAQ,CAACK,CAAC,CAAC;QACzB,CAAC,CAAC,MAAM,CAAE;MACZ;IACF,CAAC,CAAC;IACF,OAAO,MAAM;MACXF,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,CAACrD,IAAI,CAAC,CAAC;EACV,OAAO6C,KAAK;AACd;;AAEA;AACA;AACA;AACO,SAASU,aAAaA,CAAA,EAA2B;EACtD,MAAM,CAACC,GAAG,EAAEC,MAAM,CAAC,GAAG,IAAAV,eAAQ,EAAyB,CAAC,CAAC,CAAC;EAC1D,IAAAC,gBAAS,EAAC,MAAM;IACd,IAAIC,MAAM,GAAG,IAAI;IACjBxB,SAAS,CAACS,aAAa,CAAC,CAAC,CAACgB,IAAI,CAAEC,CAAC,IAAK;MAAE,IAAIF,MAAM,EAAEQ,MAAM,CAACN,CAAC,CAAC;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,MAAMC,WAAW,GAAG5B,SAAS,CAACW,gBAAgB,CAAC,MAAOkB,CAAC,IAAK;MAC1D,IAAIA,CAAC,CAACtD,IAAI,KAAK,OAAO,EAAE;QACtB,IAAI;UACF,MAAMmD,CAAC,GAAG,MAAM1B,SAAS,CAACS,aAAa,CAAC,CAAC;UACzC,IAAIe,MAAM,EAAEQ,MAAM,CAACN,CAAC,CAAC;QACvB,CAAC,CAAC,MAAM,CAAE;MACZ;IACF,CAAC,CAAC;IACF,OAAO,MAAM;MACXF,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,EAAE,CAAC;EACN,OAAOG,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACO,SAASE,iBAAiBA,CAAA,EAAmB;EAClD,MAAM,CAACC,KAAK,EAAEC,QAAQ,CAAC,GAAG,IAAAb,eAAQ,EAAiB;IAAE/C,IAAI,EAAE;EAAe,CAAC,CAAC;EAC5E,IAAAgD,gBAAS,EAAC,MAAM;IACd,IAAIC,MAAM,GAAG,IAAI;IACjBxB,SAAS,CAACU,QAAQ,CAAC,CAAC,CAACe,IAAI,CAAEI,CAAC,IAAK;MAAE,IAAIL,MAAM,EAAEW,QAAQ,CAACN,CAAC,CAAC;IAAE,CAAC,CAAC,CAACF,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAMC,WAAW,GAAG5B,SAAS,CAACW,gBAAgB,CAAEkB,CAAC,IAAK;MACpD,IAAIL,MAAM,EAAEW,QAAQ,CAACN,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,OAAO,MAAM;MACXL,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,EAAE,CAAC;EACN,OAAOM,KAAK;AACd;AAAC,IAAAE,QAAA,GAAAxD,OAAA,CAAAhB,OAAA,GAEcoC,SAAS","ignoreList":[]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeAppAttest.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,mBAAmB,QAAQ,cAAc;
|
|
1
|
+
{"version":3,"names":["TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeAppAttest.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,mBAAmB,QAAQ,cAAc;AA4DlD,eAAeA,mBAAmB,CAACC,YAAY,CAAO,aAAa,CAAC","ignoreList":[]}
|
package/lib/module/index.js
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
* @appattest/react-native — public API.
|
|
5
5
|
*
|
|
6
6
|
* Surface mirrors the Swift SDK's bridge translation:
|
|
7
|
-
* - AppAttest.start() — fire-and-forget setup
|
|
7
|
+
* - AppAttest.start(release) — fire-and-forget setup; `release` required
|
|
8
8
|
* - AppAttest.getSecret(name) — Promise<string | null>
|
|
9
9
|
* - AppAttest.getAllSecrets() — Promise<Record<string, string>>
|
|
10
10
|
* - AppAttest.getState() — Promise<AppAttestState>
|
|
@@ -71,6 +71,23 @@ export const ErrorCode = {
|
|
|
71
71
|
DebugModeReleaseBlocked: 'debug_mode_release_blocked',
|
|
72
72
|
InvalidArgument: 'invalid_argument'
|
|
73
73
|
};
|
|
74
|
+
|
|
75
|
+
/**
|
|
76
|
+
* Which metered server bucket this build attests against. Mirrors the
|
|
77
|
+
* Swift SDK's `ReleaseBucket`.
|
|
78
|
+
*
|
|
79
|
+
* Required on `AppAttest.start(release)` — no default, and never inferred
|
|
80
|
+
* from `__DEV__` or any other build-flavor signal. The bucket is exactly
|
|
81
|
+
* what you pass.
|
|
82
|
+
*
|
|
83
|
+
* - `'production'` — the live, metered bucket. Almost every shipped app.
|
|
84
|
+
* - `'staging'` — a functionally-identical, separately-keyed, **metered**
|
|
85
|
+
* bucket for pre-ship verification. Still fully metered — not a free tier.
|
|
86
|
+
*
|
|
87
|
+
* Distinct from the secrets *column* (sandbox vs production), which Apple's
|
|
88
|
+
* AAGUID decides at build time and you cannot choose. See the README.
|
|
89
|
+
*/
|
|
90
|
+
|
|
74
91
|
function buildError(e, native) {
|
|
75
92
|
return new AppAttestError(e.code ?? 'internal_error', e.message ?? String(native), {
|
|
76
93
|
subscribeUrl: e.userInfo?.subscribeUrl ?? e.subscribeUrl,
|
|
@@ -94,12 +111,25 @@ function decodeState(raw) {
|
|
|
94
111
|
}
|
|
95
112
|
export const AppAttest = {
|
|
96
113
|
/**
|
|
97
|
-
* Synchronous, idempotent setup.
|
|
98
|
-
*
|
|
99
|
-
* is bucket
|
|
114
|
+
* Synchronous, idempotent setup.
|
|
115
|
+
*
|
|
116
|
+
* `release` is **required** — the server bucket this build attests
|
|
117
|
+
* against. There is no default and no inference: the bucket is exactly
|
|
118
|
+
* what you pass.
|
|
119
|
+
*
|
|
120
|
+
* ```ts
|
|
121
|
+
* AppAttest.start('production');
|
|
122
|
+
* ```
|
|
123
|
+
*
|
|
124
|
+
* Edge resolves your declaration against Apple's AAGUID; a
|
|
125
|
+
* development-signed build declaring `'production'` is rejected with a
|
|
126
|
+
* loud `403 bucket_not_permitted` rather than quietly re-routed.
|
|
127
|
+
*
|
|
128
|
+
* Rejects with `invalid_argument` if `release` is not a known bucket —
|
|
129
|
+
* in which case the SDK does **not** start, rather than guessing one.
|
|
100
130
|
*/
|
|
101
|
-
start() {
|
|
102
|
-
return wrap(NativeAppAttest.start());
|
|
131
|
+
start(release) {
|
|
132
|
+
return wrap(NativeAppAttest.start(release));
|
|
103
133
|
},
|
|
104
134
|
/** Awaits a terminal state. Resolves on `ready`; rejects with
|
|
105
135
|
* AppAttestError on subscriptionRequired / creditsRequired / unavailable. */
|
package/lib/module/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["useEffect","useState","NativeEventEmitter","NativeModules","NativeAppAttest","eventEmitter","RNAppAttest","AppAttestError","Error","constructor","code","message","extras","name","subscribeUrl","topupUrl","nativeError","actionUrl","ErrorCode","SubscriptionRequired","CreditsRequired","AttestationRejected","ServiceUnavailable","Network","DebugModeReleaseBlocked","InvalidArgument","buildError","e","native","String","userInfo","wrap","p","err","decodeState","raw","error","undefined","AppAttest","start","waitForReady","retry","reset","invalidateBundle","getSecret","getAllSecrets","getState","addStateListener","listener","subscription","addListener","remove","setDebugMode","mode","stubs","useSecret","value","setValue","active","then","v","catch","unsubscribe","s","useAllSecrets","all","setAll","useAppAttestState","state","setState"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,EAAEC,QAAQ,QAAQ,OAAO;AAC3C,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,cAAc;AAChE,OAAOC,eAAe,MAAM,mBAAmB;;AAE/C;AACA,MAAMC,YAAY,GAAG,IAAIH,kBAAkB,CAACC,aAAa,CAACG,WAAkB,CAAC;;AAE7E;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA,OAAO,MAAMC,cAAc,SAASC,KAAK,CAAC;EAExC;;EAEA;;EAIAC,WAAWA,CACTC,IAAY,EACZC,OAAe,EACfC,MAIC,EACD;IACA,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,gBAAgB;IAC5B,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACI,YAAY,GAAGF,MAAM,EAAEE,YAAY;IACxC,IAAI,CAACC,QAAQ,GAAGH,MAAM,EAAEG,QAAQ;IAChC,IAAI,CAACC,WAAW,GAAGJ,MAAM,EAAEI,WAAW;EACxC;;EAEA;AACF;AACA;AACA;AACA;EACE,IAAIC,SAASA,CAAA,EAAuB;IAClC,OAAO,IAAI,CAACH,YAAY,IAAI,IAAI,CAACC,QAAQ;EAC3C;AACF;;AAEA;AACA,OAAO,MAAMG,SAAS,GAAG;EACvBC,oBAAoB,EAAE,uBAAuB;EAC7CC,eAAe,EAAE,kBAAkB;EACnCC,mBAAmB,EAAE,sBAAsB;EAC3CC,kBAAkB,EAAE,qBAAqB;EACzCC,OAAO,EAAE,SAAS;EAClBC,uBAAuB,EAAE,4BAA4B;EACrDC,eAAe,EAAE;AACnB,CAAU;
|
|
1
|
+
{"version":3,"names":["useEffect","useState","NativeEventEmitter","NativeModules","NativeAppAttest","eventEmitter","RNAppAttest","AppAttestError","Error","constructor","code","message","extras","name","subscribeUrl","topupUrl","nativeError","actionUrl","ErrorCode","SubscriptionRequired","CreditsRequired","AttestationRejected","ServiceUnavailable","Network","DebugModeReleaseBlocked","InvalidArgument","buildError","e","native","String","userInfo","wrap","p","err","decodeState","raw","error","undefined","AppAttest","start","release","waitForReady","retry","reset","invalidateBundle","getSecret","getAllSecrets","getState","addStateListener","listener","subscription","addListener","remove","setDebugMode","mode","stubs","useSecret","value","setValue","active","then","v","catch","unsubscribe","s","useAllSecrets","all","setAll","useAppAttestState","state","setState"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,EAAEC,QAAQ,QAAQ,OAAO;AAC3C,SAASC,kBAAkB,EAAEC,aAAa,QAAQ,cAAc;AAChE,OAAOC,eAAe,MAAM,mBAAmB;;AAE/C;AACA,MAAMC,YAAY,GAAG,IAAIH,kBAAkB,CAACC,aAAa,CAACG,WAAkB,CAAC;;AAE7E;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA,OAAO,MAAMC,cAAc,SAASC,KAAK,CAAC;EAExC;;EAEA;;EAIAC,WAAWA,CACTC,IAAY,EACZC,OAAe,EACfC,MAIC,EACD;IACA,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,gBAAgB;IAC5B,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACI,YAAY,GAAGF,MAAM,EAAEE,YAAY;IACxC,IAAI,CAACC,QAAQ,GAAGH,MAAM,EAAEG,QAAQ;IAChC,IAAI,CAACC,WAAW,GAAGJ,MAAM,EAAEI,WAAW;EACxC;;EAEA;AACF;AACA;AACA;AACA;EACE,IAAIC,SAASA,CAAA,EAAuB;IAClC,OAAO,IAAI,CAACH,YAAY,IAAI,IAAI,CAACC,QAAQ;EAC3C;AACF;;AAEA;AACA,OAAO,MAAMG,SAAS,GAAG;EACvBC,oBAAoB,EAAE,uBAAuB;EAC7CC,eAAe,EAAE,kBAAkB;EACnCC,mBAAmB,EAAE,sBAAsB;EAC3CC,kBAAkB,EAAE,qBAAqB;EACzCC,OAAO,EAAE,SAAS;EAClBC,uBAAuB,EAAE,4BAA4B;EACrDC,eAAe,EAAE;AACnB,CAAU;;AAMV;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAeA,SAASC,UAAUA,CAACC,CAAgB,EAAEC,MAAe,EAAkB;EACrE,OAAO,IAAIrB,cAAc,CAACoB,CAAC,CAACjB,IAAI,IAAI,gBAAgB,EAAEiB,CAAC,CAAChB,OAAO,IAAIkB,MAAM,CAACD,MAAM,CAAC,EAAE;IACjFd,YAAY,EAAEa,CAAC,CAACG,QAAQ,EAAEhB,YAAY,IAAIa,CAAC,CAACb,YAAY;IACxDC,QAAQ,EAAEY,CAAC,CAACG,QAAQ,EAAEf,QAAQ,IAAIY,CAAC,CAACZ,QAAQ;IAC5CC,WAAW,EAAEY;EACf,CAAC,CAAC;AACJ;AAEA,eAAeG,IAAIA,CAAIC,CAAa,EAAc;EAChD,IAAI;IACF,OAAO,MAAMA,CAAC;EAChB,CAAC,CAAC,OAAOC,GAAG,EAAE;IACZ,MAAMP,UAAU,CAACO,GAAG,EAAmBA,GAAG,CAAC;EAC7C;AACF;AAOA,SAASC,WAAWA,CAACC,GAAmB,EAAkB;EACxD,MAAMC,KAAK,GAAGD,GAAG,CAACC,KAAK,GAAGV,UAAU,CAACS,GAAG,CAACC,KAAK,EAAED,GAAG,CAACC,KAAK,CAAC,GAAGC,SAAS;EACtE,OAAO;IAAExB,IAAI,EAAEsB,GAAG,CAACtB,IAA0B;IAAEuB;EAAM,CAAC;AACxD;AAEA,OAAO,MAAME,SAAS,GAAG;EACvB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,KAAKA,CAACC,OAAsB,EAAiB;IAC3C,OAAOT,IAAI,CAAC3B,eAAe,CAACmC,KAAK,CAACC,OAAO,CAAC,CAAC;EAC7C,CAAC;EAED;AACF;EACEC,YAAYA,CAAA,EAAkB;IAC5B,OAAOV,IAAI,CAAC3B,eAAe,CAACqC,YAAY,CAAC,CAAC,CAAC;EAC7C,CAAC;EAED;EACAC,KAAKA,CAAA,EAAkB;IACrB,OAAOX,IAAI,CAAC3B,eAAe,CAACsC,KAAK,CAAC,CAAC,CAAC;EACtC,CAAC;EAED;EACAC,KAAKA,CAAA,EAAkB;IACrB,OAAOZ,IAAI,CAAC3B,eAAe,CAACuC,KAAK,CAAC,CAAC,CAAC;EACtC,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,gBAAgBA,CAAA,EAAkB;IAChC,OAAOb,IAAI,CAAC3B,eAAe,CAACwC,gBAAgB,CAAC,CAAC,CAAC;EACjD,CAAC;EAED;EACAC,SAASA,CAAChC,IAAY,EAA0B;IAC9C,OAAOkB,IAAI,CAAC3B,eAAe,CAACyC,SAAS,CAAChC,IAAI,CAAC,CAAC;EAC9C,CAAC;EAED;EACAiC,aAAaA,CAAA,EAAoC;IAC/C,OAAOf,IAAI,CAAC3B,eAAe,CAAC0C,aAAa,CAAC,CAAC,CAAC;EAC9C,CAAC;EAED;EACA,MAAMC,QAAQA,CAAA,EAA4B;IACxC,MAAMZ,GAAG,GAAG,MAAMJ,IAAI,CAAC3B,eAAe,CAAC2C,QAAQ,CAAC,CAAC,CAAC;IAClD,OAAOb,WAAW,CAACC,GAAqB,CAAC;EAC3C,CAAC;EAED;EACAa,gBAAgBA,CAACC,QAAyC,EAAc;IACtE,MAAMC,YAAY,GAAG7C,YAAY,CAAC8C,WAAW,CAAC,cAAc,EAAGhB,GAAG,IAAK;MACrEc,QAAQ,CAACf,WAAW,CAACC,GAAqB,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,OAAO,MAAMe,YAAY,CAACE,MAAM,CAAC,CAAC;EACpC,CAAC;EAED;EACAC,YAAYA,CAACC,IAAsB,EAAEC,KAA8B,EAAiB;IAClF,OAAOxB,IAAI,CAAC3B,eAAe,CAACiD,YAAY,CAACC,IAAI,EAAEC,KAAK,IAAI,IAAI,CAAC,CAAC;EAChE;;EAEA;EACA;AACF,CAAC;;AAED;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,SAASA,CAAC3C,IAAY,EAAiB;EACrD,MAAM,CAAC4C,KAAK,EAAEC,QAAQ,CAAC,GAAGzD,QAAQ,CAAgB,IAAI,CAAC;EACvDD,SAAS,CAAC,MAAM;IACd,IAAI2D,MAAM,GAAG,IAAI;IACjBrB,SAAS,CAACO,SAAS,CAAChC,IAAI,CAAC,CAAC+C,IAAI,CAAEC,CAAC,IAAK;MAAE,IAAIF,MAAM,EAAED,QAAQ,CAACG,CAAC,CAAC;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,MAAMC,WAAW,GAAGzB,SAAS,CAACU,gBAAgB,CAAC,MAAOgB,CAAC,IAAK;MAC1D,IAAIA,CAAC,CAACnD,IAAI,KAAK,OAAO,EAAE;QACtB,IAAI;UACF,MAAMgD,CAAC,GAAG,MAAMvB,SAAS,CAACO,SAAS,CAAChC,IAAI,CAAC;UACzC,IAAI8C,MAAM,EAAED,QAAQ,CAACG,CAAC,CAAC;QACzB,CAAC,CAAC,MAAM,CAAE;MACZ;IACF,CAAC,CAAC;IACF,OAAO,MAAM;MACXF,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,CAAClD,IAAI,CAAC,CAAC;EACV,OAAO4C,KAAK;AACd;;AAEA;AACA;AACA;AACA,OAAO,SAASQ,aAAaA,CAAA,EAA2B;EACtD,MAAM,CAACC,GAAG,EAAEC,MAAM,CAAC,GAAGlE,QAAQ,CAAyB,CAAC,CAAC,CAAC;EAC1DD,SAAS,CAAC,MAAM;IACd,IAAI2D,MAAM,GAAG,IAAI;IACjBrB,SAAS,CAACQ,aAAa,CAAC,CAAC,CAACc,IAAI,CAAEC,CAAC,IAAK;MAAE,IAAIF,MAAM,EAAEQ,MAAM,CAACN,CAAC,CAAC;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,MAAMC,WAAW,GAAGzB,SAAS,CAACU,gBAAgB,CAAC,MAAOgB,CAAC,IAAK;MAC1D,IAAIA,CAAC,CAACnD,IAAI,KAAK,OAAO,EAAE;QACtB,IAAI;UACF,MAAMgD,CAAC,GAAG,MAAMvB,SAAS,CAACQ,aAAa,CAAC,CAAC;UACzC,IAAIa,MAAM,EAAEQ,MAAM,CAACN,CAAC,CAAC;QACvB,CAAC,CAAC,MAAM,CAAE;MACZ;IACF,CAAC,CAAC;IACF,OAAO,MAAM;MACXF,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,EAAE,CAAC;EACN,OAAOG,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASE,iBAAiBA,CAAA,EAAmB;EAClD,MAAM,CAACC,KAAK,EAAEC,QAAQ,CAAC,GAAGrE,QAAQ,CAAiB;IAAEY,IAAI,EAAE;EAAe,CAAC,CAAC;EAC5Eb,SAAS,CAAC,MAAM;IACd,IAAI2D,MAAM,GAAG,IAAI;IACjBrB,SAAS,CAACS,QAAQ,CAAC,CAAC,CAACa,IAAI,CAAEI,CAAC,IAAK;MAAE,IAAIL,MAAM,EAAEW,QAAQ,CAACN,CAAC,CAAC;IAAE,CAAC,CAAC,CAACF,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAMC,WAAW,GAAGzB,SAAS,CAACU,gBAAgB,CAAEgB,CAAC,IAAK;MACpD,IAAIL,MAAM,EAAEW,QAAQ,CAACN,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,OAAO,MAAM;MACXL,MAAM,GAAG,KAAK;MACdI,WAAW,CAAC,CAAC;IACf,CAAC;EACH,CAAC,EAAE,EAAE,CAAC;EACN,OAAOM,KAAK;AACd;AAEA,eAAe/B,SAAS","ignoreList":[]}
|
|
@@ -11,9 +11,12 @@
|
|
|
11
11
|
*/
|
|
12
12
|
import type { TurboModule } from 'react-native';
|
|
13
13
|
export interface Spec extends TurboModule {
|
|
14
|
-
/** Synchronous, idempotent setup.
|
|
15
|
-
*
|
|
16
|
-
|
|
14
|
+
/** Synchronous, idempotent setup. `release` is REQUIRED and must be
|
|
15
|
+
* `'production'` or `'staging'` — the native side rejects anything
|
|
16
|
+
* else with `invalid_argument` and does NOT start, rather than
|
|
17
|
+
* guessing a bucket. Typed as `string` because TurboModule codegen
|
|
18
|
+
* cannot serialize a union; the union is enforced in `index.ts`. */
|
|
19
|
+
start(release: string): Promise<void>;
|
|
17
20
|
/** Awaits the next terminal state. Resolves on `ready`; rejects on
|
|
18
21
|
* subscriptionRequired / creditsRequired / unavailable. */
|
|
19
22
|
waitForReady(): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"NativeAppAttest.d.ts","sourceRoot":"","sources":["../../src/NativeAppAttest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,WAAW,IAAK,SAAQ,WAAW;IAGvC;
|
|
1
|
+
{"version":3,"file":"NativeAppAttest.d.ts","sourceRoot":"","sources":["../../src/NativeAppAttest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,WAAW,IAAK,SAAQ,WAAW;IAGvC;;;;yEAIqE;IACrE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;gEAC4D;IAC5D,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,mCAAmC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;8DAC0D;IAC1D,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAIlC;4BACwB;IACxB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEhD,8DAA8D;IAC9D,aAAa,IAAI,OAAO,CAAC;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAEpD,2CAA2C;IAC3C,QAAQ,IAAI,OAAO,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC,CAAC;IAIH;iDAC6C;IAC7C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAM1F,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;;AAED,wBAAqE"}
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* @appattest/react-native — public API.
|
|
3
3
|
*
|
|
4
4
|
* Surface mirrors the Swift SDK's bridge translation:
|
|
5
|
-
* - AppAttest.start() — fire-and-forget setup
|
|
5
|
+
* - AppAttest.start(release) — fire-and-forget setup; `release` required
|
|
6
6
|
* - AppAttest.getSecret(name) — Promise<string | null>
|
|
7
7
|
* - AppAttest.getAllSecrets() — Promise<Record<string, string>>
|
|
8
8
|
* - AppAttest.getState() — Promise<AppAttestState>
|
|
@@ -62,13 +62,42 @@ export declare const ErrorCode: {
|
|
|
62
62
|
};
|
|
63
63
|
export type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
|
|
64
64
|
export type DebugMode = 'production' | 'local';
|
|
65
|
+
/**
|
|
66
|
+
* Which metered server bucket this build attests against. Mirrors the
|
|
67
|
+
* Swift SDK's `ReleaseBucket`.
|
|
68
|
+
*
|
|
69
|
+
* Required on `AppAttest.start(release)` — no default, and never inferred
|
|
70
|
+
* from `__DEV__` or any other build-flavor signal. The bucket is exactly
|
|
71
|
+
* what you pass.
|
|
72
|
+
*
|
|
73
|
+
* - `'production'` — the live, metered bucket. Almost every shipped app.
|
|
74
|
+
* - `'staging'` — a functionally-identical, separately-keyed, **metered**
|
|
75
|
+
* bucket for pre-ship verification. Still fully metered — not a free tier.
|
|
76
|
+
*
|
|
77
|
+
* Distinct from the secrets *column* (sandbox vs production), which Apple's
|
|
78
|
+
* AAGUID decides at build time and you cannot choose. See the README.
|
|
79
|
+
*/
|
|
80
|
+
export type ReleaseBucket = 'production' | 'staging';
|
|
65
81
|
export declare const AppAttest: {
|
|
66
82
|
/**
|
|
67
|
-
* Synchronous, idempotent setup.
|
|
68
|
-
*
|
|
69
|
-
* is bucket
|
|
83
|
+
* Synchronous, idempotent setup.
|
|
84
|
+
*
|
|
85
|
+
* `release` is **required** — the server bucket this build attests
|
|
86
|
+
* against. There is no default and no inference: the bucket is exactly
|
|
87
|
+
* what you pass.
|
|
88
|
+
*
|
|
89
|
+
* ```ts
|
|
90
|
+
* AppAttest.start('production');
|
|
91
|
+
* ```
|
|
92
|
+
*
|
|
93
|
+
* Edge resolves your declaration against Apple's AAGUID; a
|
|
94
|
+
* development-signed build declaring `'production'` is rejected with a
|
|
95
|
+
* loud `403 bucket_not_permitted` rather than quietly re-routed.
|
|
96
|
+
*
|
|
97
|
+
* Rejects with `invalid_argument` if `release` is not a known bucket —
|
|
98
|
+
* in which case the SDK does **not** start, rather than guessing one.
|
|
70
99
|
*/
|
|
71
|
-
start(): Promise<void>;
|
|
100
|
+
start(release: ReleaseBucket): Promise<void>;
|
|
72
101
|
/** Awaits a terminal state. Resolves on `ready`; rejects with
|
|
73
102
|
* AppAttestError on subscriptionRequired / creditsRequired / unavailable. */
|
|
74
103
|
waitForReady(): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,WAAW,GACX,SAAS,GACT,OAAO,GACP,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;gBAG7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB;IAUH;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;CACF;AAED,0EAA0E;AAC1E,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,WAAW,GACX,SAAS,GACT,OAAO,GACP,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;gBAG7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB;IAUH;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;CACF;AAED,0EAA0E;AAC1E,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;AAwCrD,eAAO,MAAM,SAAS;IACpB;;;;;;;;;;;;;;;;;OAiBG;mBACY,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C;kFAC8E;oBAC9D,OAAO,CAAC,IAAI,CAAC;IAI7B,mCAAmC;aAC1B,OAAO,CAAC,IAAI,CAAC;IAItB,4CAA4C;aACnC,OAAO,CAAC,IAAI,CAAC;IAItB;;;;;;;OAOG;wBACiB,OAAO,CAAC,IAAI,CAAC;IAIjC,gDAAgD;oBAChC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI/C,uCAAuC;qBACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAIhD,8BAA8B;gBACZ,OAAO,CAAC,cAAc,CAAC;IAKzC,iEAAiE;+BACtC,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;IAOvE,+DAA+D;uBAC5C,SAAS,GAAG,IAAI,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpF,CAAC;AAIF;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBrD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBtD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAclD;AAED,eAAe,SAAS,CAAC"}
|
package/package.json
CHANGED
package/src/NativeAppAttest.ts
CHANGED
|
@@ -15,9 +15,12 @@ import { TurboModuleRegistry } from 'react-native';
|
|
|
15
15
|
export interface Spec extends TurboModule {
|
|
16
16
|
// Lifecycle
|
|
17
17
|
|
|
18
|
-
/** Synchronous, idempotent setup.
|
|
19
|
-
*
|
|
20
|
-
start
|
|
18
|
+
/** Synchronous, idempotent setup. `release` is REQUIRED and must be
|
|
19
|
+
* `'production'` or `'staging'` — the native side rejects anything
|
|
20
|
+
* else with `invalid_argument` and does NOT start, rather than
|
|
21
|
+
* guessing a bucket. Typed as `string` because TurboModule codegen
|
|
22
|
+
* cannot serialize a union; the union is enforced in `index.ts`. */
|
|
23
|
+
start(release: string): Promise<void>;
|
|
21
24
|
|
|
22
25
|
/** Awaits the next terminal state. Resolves on `ready`; rejects on
|
|
23
26
|
* subscriptionRequired / creditsRequired / unavailable. */
|
package/src/index.ts
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* @appattest/react-native — public API.
|
|
3
3
|
*
|
|
4
4
|
* Surface mirrors the Swift SDK's bridge translation:
|
|
5
|
-
* - AppAttest.start() — fire-and-forget setup
|
|
5
|
+
* - AppAttest.start(release) — fire-and-forget setup; `release` required
|
|
6
6
|
* - AppAttest.getSecret(name) — Promise<string | null>
|
|
7
7
|
* - AppAttest.getAllSecrets() — Promise<Record<string, string>>
|
|
8
8
|
* - AppAttest.getState() — Promise<AppAttestState>
|
|
@@ -98,6 +98,23 @@ export type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
|
|
|
98
98
|
|
|
99
99
|
export type DebugMode = 'production' | 'local';
|
|
100
100
|
|
|
101
|
+
/**
|
|
102
|
+
* Which metered server bucket this build attests against. Mirrors the
|
|
103
|
+
* Swift SDK's `ReleaseBucket`.
|
|
104
|
+
*
|
|
105
|
+
* Required on `AppAttest.start(release)` — no default, and never inferred
|
|
106
|
+
* from `__DEV__` or any other build-flavor signal. The bucket is exactly
|
|
107
|
+
* what you pass.
|
|
108
|
+
*
|
|
109
|
+
* - `'production'` — the live, metered bucket. Almost every shipped app.
|
|
110
|
+
* - `'staging'` — a functionally-identical, separately-keyed, **metered**
|
|
111
|
+
* bucket for pre-ship verification. Still fully metered — not a free tier.
|
|
112
|
+
*
|
|
113
|
+
* Distinct from the secrets *column* (sandbox vs production), which Apple's
|
|
114
|
+
* AAGUID decides at build time and you cannot choose. See the README.
|
|
115
|
+
*/
|
|
116
|
+
export type ReleaseBucket = 'production' | 'staging';
|
|
117
|
+
|
|
101
118
|
interface ErrorEnvelope {
|
|
102
119
|
code?: string;
|
|
103
120
|
message?: string;
|
|
@@ -138,12 +155,25 @@ function decodeState(raw: NativeStateRaw): AppAttestState {
|
|
|
138
155
|
|
|
139
156
|
export const AppAttest = {
|
|
140
157
|
/**
|
|
141
|
-
* Synchronous, idempotent setup.
|
|
142
|
-
*
|
|
143
|
-
* is bucket
|
|
158
|
+
* Synchronous, idempotent setup.
|
|
159
|
+
*
|
|
160
|
+
* `release` is **required** — the server bucket this build attests
|
|
161
|
+
* against. There is no default and no inference: the bucket is exactly
|
|
162
|
+
* what you pass.
|
|
163
|
+
*
|
|
164
|
+
* ```ts
|
|
165
|
+
* AppAttest.start('production');
|
|
166
|
+
* ```
|
|
167
|
+
*
|
|
168
|
+
* Edge resolves your declaration against Apple's AAGUID; a
|
|
169
|
+
* development-signed build declaring `'production'` is rejected with a
|
|
170
|
+
* loud `403 bucket_not_permitted` rather than quietly re-routed.
|
|
171
|
+
*
|
|
172
|
+
* Rejects with `invalid_argument` if `release` is not a known bucket —
|
|
173
|
+
* in which case the SDK does **not** start, rather than guessing one.
|
|
144
174
|
*/
|
|
145
|
-
start(): Promise<void> {
|
|
146
|
-
return wrap(NativeAppAttest.start());
|
|
175
|
+
start(release: ReleaseBucket): Promise<void> {
|
|
176
|
+
return wrap(NativeAppAttest.start(release));
|
|
147
177
|
},
|
|
148
178
|
|
|
149
179
|
/** Awaits a terminal state. Resolves on `ready`; rejects with
|