@cap-kit/integrity 8.0.0-next.6

package/ios/Sources/IntegrityPlugin/Utils/IntegrityUtils.swift

@@ -0,0 +1,144 @@
+import Foundation
+
+/**
+ Utility helpers for the Integrity plugin (iOS).
+
+ PURPOSE:
+ - Host pure Swift utility functions that are:
+ - platform-agnostic
+ - side-effect free
+ - independent from Capacitor APIs
+
+ CURRENT STATE:
+ - This type is intentionally empty.
+ - iOS does not require explicit JSON serialization helpers
+ because Capacitor accepts native `[String: Any]` payloads.
+
+ FUTURE USE CASES:
+ - Cross-platform payload normalization
+ - Remote attestation artifact encoding
+ - Data redaction or canonicalization
+ - Shared, testable transformation logic
+
+ CONTRACT:
+ - Utilities defined here MUST NOT:
+ - access Capacitor APIs
+ - reference Plugin or Impl layers
+ - perform I/O or side effects
+ */
+struct IntegrityUtils {
+
+    /**
+     Builds a JSON-compatible integrity signal dictionary.
+
+     - Parameters:
+     - id: Stable signal identifier.
+     - category: High-level signal category.
+     - confidence: Confidence level ("low", "medium", "high").
+     - description: Optional human-readable description.
+     - metadata: Optional diagnostic metadata.
+     - includeDebug: Whether debug fields should be included.
+
+     - Returns: A `[String: Any]` dictionary safe to cross the JS bridge.
+     */
+    static func buildSignal(
+        id: String,
+        category: String,
+        confidence: String,
+        description: String?,
+        metadata: [String: Any]? = nil,
+        includeDebug: Bool
+    ) -> [String: Any] {
+
+        var signal: [String: Any] = [
+            "id": id,
+            "category": category,
+            "confidence": confidence
+        ]
+
+        if includeDebug, let description {
+            signal["description"] = description
+        }
+
+        if let metadata {
+            signal["metadata"] = metadata
+        }
+
+        return signal
+    }
+}
+
+enum IntegrityCorrelationUtils {
+
+    static func jailbreakCorrelation(
+        from signals: [[String: Any]],
+        includeDebug: Bool
+    ) -> [String: Any]? {
+
+        let jailbreakSignals = signals.filter {
+            ($0["category"] as? String) == "jailbreak"
+        }
+
+        guard jailbreakSignals.count >= 2 else {
+            return nil
+        }
+
+        let sources: Set<String> = Set(
+            jailbreakSignals.compactMap {
+                ($0["metadata"] as? [String: Any])?["source"] as? String
+            }
+        )
+
+        guard sources.count >= 2 else {
+            return nil
+        }
+
+        return [
+            "id": "ios_jailbreak_multiple_indicators",
+            "category": "jailbreak",
+            "confidence": "high",
+            "description": includeDebug
+                ? "Multiple independent jailbreak indicators detected simultaneously"
+                : nil,
+            "metadata": [
+                "indicatorCount": jailbreakSignals.count,
+                "sources": Array(sources)
+            ]
+        ].compactMapValues { $0 }
+    }
+
+    static func jailbreakAndHookCorrelation(
+        from signals: [[String: Any]],
+        includeDebug: Bool
+    ) -> [String: Any]? {
+
+        let hasJailbreak = signals.contains {
+            ($0["category"] as? String) == "jailbreak"
+        }
+
+        let hasHook = signals.contains {
+            ($0["category"] as? String) == "hook"
+        }
+
+        guard hasJailbreak && hasHook else {
+            return nil
+        }
+
+        return [
+            "id": "ios_jailbreak_and_hook_detected",
+            "category": "tamper",
+            "confidence": "high",
+            "description": includeDebug
+                ? "Device appears to be jailbroken and actively instrumented at runtime"
+                : nil,
+            "metadata": [
+                "jailbreakIndicators": signals.filter {
+                    ($0["category"] as? String) == "jailbreak"
+                }.count,
+                "hookIndicators": signals.filter {
+                    ($0["category"] as? String) == "hook"
+                }.count
+            ]
+        ].compactMapValues { $0 }
+    }
+}

package/ios/Sources/IntegrityPlugin/Version.swift

@@ -0,0 +1,16 @@
+// This file is automatically generated. Do not modify manually.
+import Foundation
+
+/**
+  Container for the plugin's version information.
+  This enum provides a centralized, single source of truth for the native 
+  version string, synchronized directly from the project's 'package.json'.
+  It ensures parity across JavaScript, Android, and iOS platforms.
+ */
+public enum PluginVersion {
+    /**
+      The semantic version string of the plugin.
+      Value synchronized from package.json: "8.0.0-next.6"
+     */
+    public static let number = "8.0.0-next.6"
+}

package/ios/Sources/IntegrityPlugin/filesystem/IntegrityFilesystemChecks.swift

@@ -0,0 +1,86 @@
+import Foundation
+
+/**
+ Filesystem integrity checks related to sandbox escape
+ and suspicious redirections.
+ */
+struct IntegrityFilesystemChecks {
+
+    /**
+     Attempts to detect sandbox escape by testing write access
+     to a restricted filesystem location.
+
+     Characteristics:
+     - Best-effort heuristic
+     - Synchronous
+     - No persistent side effects (temporary file is removed)
+
+     IMPORTANT:
+     - A successful write strongly suggests a sandbox escape.
+     - A failure does NOT guarantee a secure environment.
+     */
+    static func canEscapeSandbox() -> Bool {
+
+        // Target path intentionally chosen inside a protected directory.
+        let testPath = "/private/integrity_test.txt"
+        let testString = "integrity_test"
+
+        do {
+            // Attempt to write a temporary file outside the app sandbox.
+            try testString.write(
+                toFile: testPath,
+                atomically: true,
+                encoding: .utf8
+            )
+
+            // Cleanup if the write unexpectedly succeeds.
+            try? FileManager.default.removeItem(atPath: testPath)
+            return true
+        } catch {
+            // Write failed as expected on non-compromised devices.
+            return false
+        }
+    }
+
+    /**
+     Detects suspicious symbolic links that may indicate
+     filesystem redirection caused by a jailbreak.
+
+     Characteristics:
+     - Read-only inspection
+     - No recursion
+     - Limited to well-known system paths
+
+     NOTES:
+     - This check intentionally avoids deep filesystem traversal
+     to reduce overhead and false positives.
+     */
+    static func hasSuspiciousSymlinks() -> Bool {
+
+        // Well-known system directories that should never be symbolic links.
+        let pathsToCheck = [
+            "/Applications",
+            "/Library",
+            "/usr/libexec",
+            "/usr/share"
+        ]
+
+        for path in pathsToCheck {
+            do {
+                let attributes =
+                    try FileManager.default.attributesOfItem(atPath: path)
+
+                // Any symbolic link at these locations is highly suspicious.
+                if attributes[.type] as? FileAttributeType == .typeSymbolicLink {
+                    return true
+                }
+            } catch {
+                // Ignore inaccessible paths and continue checking others.
+                continue
+            }
+        }
+
+        // No suspicious filesystem redirections detected.
+        return false
+    }
+}

package/ios/Sources/IntegrityPlugin/hook/IntegrityHookChecks.swift

@@ -0,0 +1,85 @@
+import Foundation
+import MachO
+
+/**
+ Runtime integrity checks related to instrumentation frameworks (e.g., Frida).
+ */
+struct IntegrityHookChecks {
+
+    /**
+     Scans loaded dynamic libraries for suspicious instrumentation frameworks.
+     */
+    static func hookingSignal(
+        includeDebug: Bool
+    ) -> [String: Any]? {
+
+        // Total number of images currently loaded by dyld.
+        let imageCount = _dyld_image_count()
+
+        // Substrings commonly found in instrumentation or hooking frameworks.
+        // Matching is intentionally heuristic-based.
+        let suspicious = ["frida", "gadget", "substrate", "cydia", "substitute"]
+
+        for index in 0..<imageCount {
+            guard let cName = _dyld_get_image_name(index) else { continue }
+            let imageName = String(cString: cName).lowercased()
+
+            // Optimization: skip standard system libraries to reduce
+            // both runtime cost and false positives.
+            if imageName.contains("/usr/lib/")
+                || imageName.contains("/system/library/") {
+
+                // Still inspect non-standard subpaths for suspicious fragments.
+                if !suspicious.contains(where: { imageName.contains($0) }) {
+                    continue
+                }
+            }
+
+            // Emit a hooking signal as soon as a suspicious library is found.
+            // Only the first match is reported to limit noise.
+            if suspicious.contains(where: { imageName.contains($0) }) {
+                return [
+                    "id": "ios_hooking_library_detected",
+                    "category": "hook",
+                    "confidence": "high",
+                    "description": includeDebug
+                        ? "Detected suspicious instrumentation library: \(imageName)"
+                        : nil,
+                    "metadata": ["library_path": imageName]
+                ].compactMapValues { $0 }
+            }
+        }
+
+        return nil
+    }
+
+    /**
+     Detects if a known instrumentation port (Frida) is open on localhost.
+     */
+    static func isFridaPortOpen() -> Bool {
+
+        // Known default Frida server port.
+        // This check is intentionally limited to a single, well-known port.
+        var serverAddress = sockaddr_in()
+        serverAddress.sin_family = sa_family_t(AF_INET)
+        serverAddress.sin_addr.s_addr = inet_addr("127.0.0.1")
+        serverAddress.sin_port = UInt16(27042).bigEndian
+
+        // Create a TCP socket to test local connectivity.
+        let sock = socket(AF_INET, SOCK_STREAM, 0)
+        if sock < 0 { return false }
+        defer { close(sock) }
+
+        // Attempt to connect to the local Frida server port.
+        // A successful connection suggests an active instrumentation service.
+        return withUnsafePointer(to: &serverAddress) {
+            $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                connect(
+                    sock,
+                    $0,
+                    socklen_t(MemoryLayout<sockaddr_in>.size)
+                ) == 0
+            }
+        }
+    }
+}

package/ios/Sources/IntegrityPlugin/jailbreak/IntegrityJailbreakDetector.swift

@@ -0,0 +1,74 @@
+import Foundation
+
+/**
+ Performs filesystem-based jailbreak detection.
+ All checks are synchronous and deterministic.
+ */
+struct IntegrityJailbreakDetector {
+
+    /**
+     Performs filesystem-based jailbreak detection.
+
+     This detector relies exclusively on the presence of well-known
+     filesystem paths commonly introduced by jailbreak tools.
+
+     Characteristics:
+     - Deterministic
+     - Synchronous
+     - No side effects
+     - Safe to execute at application boot time
+
+     IMPORTANT:
+     - This detector intentionally emits at most ONE signal.
+     - The first matching path short-circuits further checks
+     to minimize noise and overhead.
+     */
+    static func detect(
+        includeDebug: Bool
+    ) -> [[String: Any]] {
+
+        // Well-known filesystem paths associated with common jailbreaks.
+        // This list is intentionally conservative and may evolve over time.
+        let suspiciousPaths = [
+            "/Applications/Cydia.app",
+            "/Library/MobileSubstrate/MobileSubstrate.dylib",
+            "/bin/bash",
+            "/usr/sbin/sshd",
+            "/etc/apt",
+            "/usr/bin/ssh",
+            "/private/var/lib/apt",
+            "/private/var/lib/cydia",
+            "/usr/libexec/sftp-server",
+            "/Applications/Sileo.app",
+            "/Applications/Zebra.app"
+        ]
+
+        // Iterate through known paths and emit a signal
+        // as soon as a single match is found.
+        for path in suspiciousPaths
+        where FileManager.default.fileExists(atPath: path) {
+
+            return [[
+                "id": "ios_jailbreak_path",
+                "category": "jailbreak",
+                "confidence": "high",
+
+                // Description is included only when debug output is enabled.
+                "description": includeDebug
+                    ? "Filesystem contains paths commonly associated with jailbroken devices"
+                    : nil,
+
+                // Include the matched path for diagnostic purposes only.
+                "metadata": [
+                    "path": path,
+                    "source": "filesystem",
+                    // Added explicit detection method to metadata
+                    "detection_method": "file_exists"
+                ]
+            ].compactMapValues { $0 }]
+        }
+
+        // No jailbreak-related filesystem indicators detected.
+        return []
+    }
+}

package/ios/Sources/IntegrityPlugin/jailbreak/IntegrityJailbreakUrlSchemeDetector.swift

@@ -0,0 +1,42 @@
+import UIKit
+
+/**
+ Detects jailbreak-related applications by probing URL schemes.
+
+ IMPORTANT:
+ - This detection is opt-in via native configuration.
+ - Requires LSApplicationQueriesSchemes to be declared in Info.plist.
+ - This is a LOW confidence heuristic and must never be used alone.
+ */
+struct IntegrityJailbreakUrlSchemeDetector {
+
+    static func detect(
+        schemes: [String],
+        includeDebug: Bool
+    ) -> [String: Any]? {
+
+        guard !schemes.isEmpty else { return nil }
+
+        for scheme in schemes {
+            let urlString = "\(scheme)://"
+            guard let url = URL(string: urlString) else { continue }
+
+            if UIApplication.shared.canOpenURL(url) {
+                return [
+                    "id": "ios_jailbreak_url_scheme",
+                    "category": "jailbreak",
+                    "confidence": "low",
+                    "description": includeDebug
+                        ? "Detected jailbreak-related application via URL scheme probing"
+                        : nil,
+                    "metadata": [
+                        "scheme": scheme,
+                        "source": "url_scheme"
+                    ]
+                ].compactMapValues { $0 }
+            }
+        }
+
+        return nil
+    }
+}

package/ios/Sources/IntegrityPlugin/remote/IntegrityRemoteAttestor.swift

@@ -0,0 +1,40 @@
+import Foundation
+import DeviceCheck
+
+/**
+ Handles remote attestation signals using Apple's DeviceCheck (App Attest) framework.
+
+ IMPORTANT:
+ - App Attest is NOT implemented yet.
+ - This component explicitly reports unavailability instead of failing silently.
+ - The emitted signal is observational only and LOW confidence.
+ */
+struct IntegrityRemoteAttestor {
+
+    /**
+     Returns a LOW confidence signal indicating that App Attest
+     is currently not available or not implemented.
+
+     This signal is emitted only when strict mode is requested.
+     */
+    static func getAppAttestSignal(options: IntegrityCheckOptions) -> [String: Any]? {
+
+        guard options.level == "strict" else {
+            return nil
+        }
+
+        return [
+            "id": "ios_app_attest_unavailable",
+            "category": "environment",
+            "confidence": "low",
+            "description": options.includeDebugInfo == true
+                ? "Apple App Attest is not implemented or not available on this device"
+                : nil,
+            "metadata": [
+                "attestation": "unsupported",
+                "framework": "DeviceCheck",
+                "reason": "not_implemented"
+            ]
+        ].compactMapValues { $0 }
+    }
+}

package/ios/Sources/IntegrityPlugin/runtime/IntegrityRuntimeChecks.swift

@@ -0,0 +1,63 @@
+import Foundation
+
+/**
+ Runtime integrity checks related to debugging
+ and instrumentation frameworks.
+ */
+struct IntegrityRuntimeChecks {
+
+    static func debugSignals(
+        includeDebug: Bool
+    ) -> [[String: Any]] {
+
+        // Collected runtime debug-related signals.
+        var signals: [[String: Any]] = []
+
+        // 1. Check if a debugger is attached via sysctl
+        var info = kinfo_proc()
+        var size = MemoryLayout.size(ofValue: info)
+        var mib: [Int32] = [
+            CTL_KERN,
+            KERN_PROC,
+            KERN_PROC_PID,
+            getpid()
+        ]
+
+        if sysctl(&mib, UInt32(mib.count), &info, &size, nil, 0) == 0 {
+            if (info.kp_proc.p_flag & P_TRACED) != 0 {
+                signals.append([
+                    "id": "ios_debugger_attached",
+                    "category": "debug",
+                    "confidence": "high",
+                    "description": includeDebug
+                        ? "A debugger is currently attached to the running process"
+                        : nil,
+                    "metadata": ["method": "sysctl_p_traced"]
+                ].compactMapValues { $0 })
+            }
+        }
+
+        // 2. Check for development/debug provisioning profile
+        // This mirrors the Android FLAG_DEBUGGABLE check.
+        if let path = Bundle.main.path(forResource: "embedded", ofType: "mobileprovision") {
+            do {
+                let profileContent = try String(contentsOfFile: path, encoding: .ascii)
+                if profileContent.contains("<key>get-task-allow</key>\n\t\t<true/>") {
+                    signals.append([
+                        "id": "ios_runtime_debuggable",
+                        "category": "debug",
+                        "confidence": "medium",
+                        "description": includeDebug
+                            ? "Application is signed with a profile that allows debugging"
+                            : nil,
+                        "metadata": ["entitlement": "get-task-allow"]
+                    ].compactMapValues { $0 })
+                }
+            } catch {
+                // Ignore errors reading the profile
+            }
+        }
+
+        return signals
+    }
+}

package/ios/Sources/IntegrityPlugin/simulator/IntegritySimulatorChecks.swift

@@ -0,0 +1,20 @@
+import Foundation
+
+/**
+ * Detects if the application is running in an iOS simulator environment.
+ */
+struct IntegritySimulatorChecks {
+
+    /**
+     * Determines whether the current process is running under the iOS Simulator.
+     *
+     * NOTE: This uses compile-time environment checks and is not spoofable at runtime.
+     */
+    static func isSimulator() -> Bool {
+        #if targetEnvironment(simulator)
+        return true
+        #else
+        return false
+        #endif
+    }
+}