@capawesome/capacitor-app-integrity 0.0.1

package/CapawesomeCapacitorAppIntegrity.podspec

@@ -0,0 +1,17 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name = 'CapawesomeCapacitorAppIntegrity'
+  s.version = package['version']
+  s.summary = package['description']
+  s.license = package['license']
+  s.homepage = package['repository']['url']
+  s.author = package['author']
+  s.source = { :git => package['repository']['url'], :tag => s.version.to_s }
+  s.source_files = 'ios/Plugin/**/*.{swift,h,m,c,cc,mm,cpp}'
+  s.ios.deployment_target = '15.0'
+  s.dependency 'Capacitor'
+  s.swift_version = '5.1'
+end

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Robin Genz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/Package.swift

@@ -0,0 +1,28 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "CapawesomeCapacitorAppIntegrity",
+    platforms: [.iOS(.v15)],
+    products: [
+        .library(
+            name: "CapawesomeCapacitorAppIntegrity",
+            targets: ["AppIntegrityPlugin"])
+    ],
+    dependencies: [
+        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")
+    ],
+    targets: [
+        .target(
+            name: "AppIntegrityPlugin",
+            dependencies: [
+                .product(name: "Capacitor", package: "capacitor-swift-pm"),
+                .product(name: "Cordova", package: "capacitor-swift-pm")
+            ],
+            path: "ios/Plugin"),
+        .testTarget(
+            name: "AppIntegrityPluginTests",
+            dependencies: ["AppIntegrityPlugin"],
+            path: "ios/PluginTests")
+    ]
+)

package/README.md

@@ -0,0 +1,385 @@
+# @capawesome/capacitor-app-integrity
+
+Capacitor plugin to verify app and device integrity using the Play Integrity API (Android) and App Attest (iOS).
+
+<div class="capawesome-z29o10a">
+  <a href="https://cloud.capawesome.io/" target="_blank">
+    <img alt="Deliver Live Updates to your Capacitor app with Capawesome Cloud" src="https://cloud.capawesome.io/assets/banners/cloud-build-and-deploy-capacitor-apps.png?t=1" />
+  </a>
+</div>
+
+## Features
+
+- 🤖 **Play Integrity**: Request standard and classic integrity tokens from the Play Integrity API on Android.
+- 🍏 **App Attest**: Generate hardware-backed keys, attest them and generate assertions with App Attest on iOS.
+- 🛡️ **Server-verifiable**: Tokens and assertions are verified on your backend via Google and Apple, so they cannot be spoofed on the device.
+- 🔗 **Compatibility**: Works alongside the [Root Detection](https://capawesome.io/plugins/root-detection/) plugin for additional client-side checks.
+- 📦 **SPM**: Supports Swift Package Manager and CocoaPods for iOS.
+- 🔁 **Up-to-date**: Always supports the latest Capacitor version.
+
+Missing a feature? Just [open an issue](https://github.com/capawesome-team/capacitor-plugins/issues) and we'll take a look!
+
+## Newsletter
+
+Stay up to date with the latest news and updates about the Capawesome, Capacitor, and Ionic ecosystem by subscribing to our [Capawesome Newsletter](https://cloud.capawesome.io/newsletter/).
+
+## Compatibility
+
+| Plugin Version | Capacitor Version | Status         |
+| -------------- | ----------------- | -------------- |
+| 0.x.x          | >=8.x.x           | Active support |
+
+## Installation
+
+You can use our **AI-Assisted Setup** to install the plugin.
+Add the [Capawesome Skills](https://github.com/capawesome-team/skills) to your AI tool using the following command:
+
+```bash
+npx skills add capawesome-team/skills --skill capacitor-plugins
+```
+
+Then use the following prompt:
+
+```
+ Use the `capacitor-plugins` skill from `capawesome-team/skills` to install the `@capawesome/capacitor-app-integrity` plugin in my project.
+```
+
+If you prefer **Manual Setup**, install the plugin by running the following commands and follow the platform-specific instructions below:
+
+```bash
+npm install @capawesome/capacitor-app-integrity
+npx cap sync
+```
+
+### Android
+
+The Play Integrity API must be set up in the Google Play Console before you can request integrity tokens. Follow the [official setup instructions](https://developer.android.com/google/play/integrity/setup) to link a Google Cloud project to your app. You need the **Google Cloud project number** of the linked project for the standard request flow.
+
+#### Variables
+
+This plugin will use the following project variables (defined in your app's `variables.gradle` file):
+
+- `$playIntegrityVersion` version of `com.google.android.play:integrity` (default: `1.6.0`)
+
+### iOS
+
+App Attest requires the **App Attest capability**. Add it to your app in Xcode under **Signing & Capabilities** or add the following entitlement to your `.entitlements` file:
+
+```xml
+<key>com.apple.developer.devicecheck.appattest-environment</key>
+<string>development</string>
+```
+
+Use the value `development` to attest against Apple's sandbox servers during development and `production` for App Store builds. Note that App Attest is not supported on simulators, so you need a real device for testing.
+
+## Configuration
+
+No configuration required for this plugin.
+
+## Usage
+
+```typescript
+import { AppIntegrity } from '@capawesome/capacitor-app-integrity';
+import { Capacitor } from '@capacitor/core';
+
+const isAvailable = async () => {
+  const { available } = await AppIntegrity.isAvailable();
+  return available;
+};
+
+const prepareIntegrityToken = async () => {
+  // Only available on Android
+  await AppIntegrity.prepareIntegrityToken({
+    cloudProjectNumber: 123456789012,
+  });
+};
+
+const requestIntegrityToken = async () => {
+  // Only available on Android
+  if (Capacitor.getPlatform() === 'android') {
+    // Standard request (recommended, requires a prior call to `prepareIntegrityToken(...)`)
+    const { token } = await AppIntegrity.requestIntegrityToken({
+      requestHash: '2cp24z...',
+    });
+    // Classic request
+    const { token: classicToken } = await AppIntegrity.requestIntegrityToken({
+      nonce: 'R2Rra24fVm5xa2Mg',
+    });
+    // Send the token to your server for verification
+  }
+};
+
+const attestKey = async () => {
+  // Only available on iOS
+  if (Capacitor.getPlatform() === 'ios') {
+    // 1. Generate a new key pair and store the key identifier
+    const { keyId } = await AppIntegrity.generateKey();
+    // 2. Attest the key with a one-time challenge received from your server
+    const { attestationObject } = await AppIntegrity.attestKey({
+      keyId,
+      challenge: 'dGhpc2lzYWNoYWxsZW5nZQ==',
+    });
+    // 3. Send the attestation object to your server for verification
+  }
+};
+
+const generateAssertion = async () => {
+  // Only available on iOS
+  if (Capacitor.getPlatform() === 'ios') {
+    const { assertion } = await AppIntegrity.generateAssertion({
+      keyId: 'Kh0DIEwVJTDJUyIRZ4M9BvJn/i4RSSGDkFvUZOaSm5g=',
+      clientData: 'eyJjaGFsbGVuZ2UiOiJkR2hwYzJsellXTm9ZV3hzWlc1blpRPT0ifQ==',
+    });
+    // Send the assertion to your server for verification
+  }
+};
+```
+
+## API
+
+<docgen-index>
+
+* [`attestKey(...)`](#attestkey)
+* [`generateAssertion(...)`](#generateassertion)
+* [`generateKey()`](#generatekey)
+* [`isAvailable()`](#isavailable)
+* [`prepareIntegrityToken(...)`](#prepareintegritytoken)
+* [`requestIntegrityToken(...)`](#requestintegritytoken)
+* [Interfaces](#interfaces)
+
+</docgen-index>
+
+<docgen-api>
+<!--Update the source file JSDoc comments and rerun docgen to update the docs below-->
+
+### attestKey(...)
+
+```typescript
+attestKey(options: AttestKeyOptions) => Promise<AttestKeyResult>
+```
+
+Attest a key generated with `generateKey()` using Apple's App Attest service.
+
+The returned attestation object must be sent to your server, which verifies
+it with Apple and stores the key identifier for future assertions.
+
+Only available on iOS.
+
+| Param         | Type                                                          |
+| ------------- | ------------------------------------------------------------- |
+| **`options`** | <code><a href="#attestkeyoptions">AttestKeyOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#attestkeyresult">AttestKeyResult</a>&gt;</code>
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### generateAssertion(...)
+
+```typescript
+generateAssertion(options: GenerateAssertionOptions) => Promise<GenerateAssertionResult>
+```
+
+Generate an assertion for the given client data using an attested key.
+
+The returned assertion must be sent to your server along with the client
+data, where it is verified using the previously stored key identifier.
+
+Only available on iOS.
+
+| Param         | Type                                                                          |
+| ------------- | ----------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#generateassertionoptions">GenerateAssertionOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#generateassertionresult">GenerateAssertionResult</a>&gt;</code>
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### generateKey()
+
+```typescript
+generateKey() => Promise<GenerateKeyResult>
+```
+
+Generate a new App Attest key pair.
+
+The private key is stored in the Secure Enclave. Store the returned key
+identifier in your app to attest the key and generate assertions later.
+
+Only available on iOS.
+
+**Returns:** <code>Promise&lt;<a href="#generatekeyresult">GenerateKeyResult</a>&gt;</code>
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### isAvailable()
+
+```typescript
+isAvailable() => Promise<IsAvailableResult>
+```
+
+Check whether app integrity attestation is available on this device.
+
+On Android, this checks whether Google Play Services is available.
+On iOS, this checks whether the App Attest service is supported.
+On iOS, the App Attest service is not supported on simulators.
+
+**Returns:** <code>Promise&lt;<a href="#isavailableresult">IsAvailableResult</a>&gt;</code>
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### prepareIntegrityToken(...)
+
+```typescript
+prepareIntegrityToken(options: PrepareIntegrityTokenOptions) => Promise<void>
+```
+
+Prepare the integrity token provider for standard integrity token requests.
+
+Call this method once, for example at app start, before calling
+`requestIntegrityToken(...)` with a request hash. The preparation can take
+several seconds, so it should be done well ahead of the first request.
+
+Only available on Android.
+
+| Param         | Type                                                                                  |
+| ------------- | ------------------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#prepareintegritytokenoptions">PrepareIntegrityTokenOptions</a></code> |
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### requestIntegrityToken(...)
+
+```typescript
+requestIntegrityToken(options: RequestIntegrityTokenOptions) => Promise<RequestIntegrityTokenResult>
+```
+
+Request an integrity token from the Play Integrity API.
+
+Provide a `requestHash` for a standard request (recommended, requires a
+prior call to `prepareIntegrityToken(...)`) or a `nonce` for a classic request.
+
+The returned token must be sent to your server, which decrypts and
+verifies it via Google's servers.
+
+Only available on Android.
+
+| Param         | Type                                                                                  |
+| ------------- | ------------------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#requestintegritytokenoptions">RequestIntegrityTokenOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#requestintegritytokenresult">RequestIntegrityTokenResult</a>&gt;</code>
+
+**Since:** 0.1.0
+
+--------------------
+
+
+### Interfaces
+
+
+#### AttestKeyResult
+
+| Prop                    | Type                | Description                                                                                               | Since |
+| ----------------------- | ------------------- | --------------------------------------------------------------------------------------------------------- | ----- |
+| **`attestationObject`** | <code>string</code> | The attestation object, encoded as a base64 string. Send this to your server for verification with Apple. | 0.1.0 |
+
+
+#### AttestKeyOptions
+
+| Prop            | Type                | Description                                                                                                                                                                     | Since |
+| --------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| **`challenge`** | <code>string</code> | The one-time challenge received from your server, encoded as a base64 string. The challenge is hashed with SHA-256 on the device before it is passed to the App Attest service. | 0.1.0 |
+| **`keyId`**     | <code>string</code> | The identifier of the key to attest, as returned by `generateKey()`.                                                                                                            | 0.1.0 |
+
+
+#### GenerateAssertionResult
+
+| Prop            | Type                | Description                                                                                  | Since |
+| --------------- | ------------------- | -------------------------------------------------------------------------------------------- | ----- |
+| **`assertion`** | <code>string</code> | The assertion object, encoded as a base64 string. Send this to your server for verification. | 0.1.0 |
+
+
+#### GenerateAssertionOptions
+
+| Prop             | Type                | Description                                                                                                                                                                                                                                           | Since |
+| ---------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| **`clientData`** | <code>string</code> | The client data to sign, encoded as a base64 string. This is usually a JSON payload that includes a one-time challenge received from your server. The client data is hashed with SHA-256 on the device before it is passed to the App Attest service. | 0.1.0 |
+| **`keyId`**      | <code>string</code> | The identifier of an attested key, as returned by `generateKey()`.                                                                                                                                                                                    | 0.1.0 |
+
+
+#### GenerateKeyResult
+
+| Prop        | Type                | Description                               | Since |
+| ----------- | ------------------- | ----------------------------------------- | ----- |
+| **`keyId`** | <code>string</code> | The identifier of the generated key pair. | 0.1.0 |
+
+
+#### IsAvailableResult
+
+| Prop            | Type                 | Description                                                    | Since |
+| --------------- | -------------------- | -------------------------------------------------------------- | ----- |
+| **`available`** | <code>boolean</code> | Whether app integrity attestation is available on this device. | 0.1.0 |
+
+
+#### PrepareIntegrityTokenOptions
+
+| Prop                     | Type                | Description                                                                                           | Since |
+| ------------------------ | ------------------- | ----------------------------------------------------------------------------------------------------- | ----- |
+| **`cloudProjectNumber`** | <code>number</code> | The Google Cloud project number of the project that is linked to your Play Console developer account. | 0.1.0 |
+
+
+#### RequestIntegrityTokenResult
+
+| Prop        | Type                | Description                                                                                         | Since |
+| ----------- | ------------------- | --------------------------------------------------------------------------------------------------- | ----- |
+| **`token`** | <code>string</code> | The integrity token. Send this to your server, which decrypts and verifies it via Google's servers. | 0.1.0 |
+
+
+#### RequestIntegrityTokenOptions
+
+| Prop                     | Type                | Description                                                                                                                                                                                             | Since |
+| ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
+| **`cloudProjectNumber`** | <code>number</code> | The Google Cloud project number of the project that is linked to your Play Console developer account. Only used for classic requests. It is required if your app is distributed outside of Google Play. | 0.1.0 |
+| **`nonce`**              | <code>string</code> | The one-time nonce for a classic request, encoded as a base64 web-safe no-wrap string. Provide either `nonce` or `requestHash`.                                                                         | 0.1.0 |
+| **`requestHash`**        | <code>string</code> | The request hash for a standard request. Requires a prior call to `prepareIntegrityToken(...)`. Provide either `nonce` or `requestHash`.                                                                | 0.1.0 |
+
+</docgen-api>
+
+## How Verification Works
+
+This plugin only provides the **client-side** part of the attestation flow. The returned tokens, attestation objects, and assertions are opaque to your app and **must** be verified on your own server. Never make security decisions based on the client-side result alone.
+
+The typical flow looks like this:
+
+1. Your app requests a one-time challenge (or nonce) from your server.
+2. Your app calls this plugin to obtain an integrity token (Android) or an attestation object/assertion (iOS) that is bound to the challenge.
+3. Your app sends the result to your server.
+4. Your server verifies the result:
+   - **Android**: Decrypt and verify the integrity token via the [Play Integrity API](https://developer.android.com/google/play/integrity/verdicts) and evaluate the verdicts.
+   - **iOS**: Validate the attestation object or assertion as described in [Validating Apps That Connect to Your Server](https://developer.apple.com/documentation/devicecheck/validating-apps-that-connect-to-your-server).
+5. Your server grants or denies access based on the verification result.
+
+On Android, Google recommends the **standard request** flow (`prepareIntegrityToken(...)` + `requestIntegrityToken({ requestHash })`) for frequent integrity checks. Use the **classic request** flow (`requestIntegrityToken({ nonce })`) only for infrequent, high-value actions.
+
+## Changelog
+
+See [CHANGELOG.md](https://github.com/capawesome-team/capacitor-plugins/blob/main/packages/app-integrity/CHANGELOG.md).
+
+## License
+
+See [LICENSE](https://github.com/capawesome-team/capacitor-plugins/blob/main/packages/app-integrity/LICENSE).

package/android/build.gradle

@@ -0,0 +1,60 @@
+ext {
+    junitVersion = project.hasProperty('junitVersion') ? rootProject.ext.junitVersion : '4.13.2'
+    androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.1'
+    androidxJunitVersion = project.hasProperty('androidxJunitVersion') ? rootProject.ext.androidxJunitVersion : '1.3.0'
+    androidxEspressoCoreVersion = project.hasProperty('androidxEspressoCoreVersion') ? rootProject.ext.androidxEspressoCoreVersion : '3.7.0'
+    playIntegrityVersion = project.hasProperty('playIntegrityVersion') ? rootProject.ext.playIntegrityVersion : '1.6.0'
+}
+
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+    }
+}
+
+apply plugin: 'com.android.library'
+
+android {
+    namespace = "io.capawesome.capacitorjs.plugins.appintegrity"
+    compileSdk = project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 36
+    defaultConfig {
+        minSdkVersion project.hasProperty('minSdkVersion') ? rootProject.ext.minSdkVersion : 24
+        targetSdkVersion project.hasProperty('targetSdkVersion') ? rootProject.ext.targetSdkVersion : 36
+        versionCode 1
+        versionName "1.0"
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+        }
+    }
+    lintOptions {
+        abortOnError = false
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+
+dependencies {
+    implementation fileTree(dir: 'libs', include: ['*.jar'])
+    implementation project(':capacitor-android')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "com.google.android.play:integrity:$playIntegrityVersion"
+    testImplementation "junit:junit:$junitVersion"
+    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
+    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+</manifest>