@capgo/capacitor-device-integrity 8.0.2

package/README.md

@@ -0,0 +1,346 @@
+# @capgo/capacitor-device-integrity
+
+<a href="https://capgo.app/"><img src="https://capgo.app/readme-banner.svg?repo=Cap-go/capacitor-device-integrity" alt="Capgo - Instant updates for Capacitor" /></a>
+
+<div align="center">
+  <h2><a href="https://capgo.app/?ref=plugin_device_integrity">Get Instant updates for your App with Capgo</a></h2>
+  <h2><a href="https://capgo.app/consulting/?ref=plugin_device_integrity">Missing a feature? We will build the plugin for you</a></h2>
+</div>
+
+Device integrity and fraud signals for Capacitor:
+
+- Android: Widevine DRM fingerprint and Play Integrity Standard API attestation.
+- iOS: Apple App Attest and DeviceCheck.
+- Web: unsupported fallback that reports no native capabilities.
+
+## Security model
+
+This plugin is designed for fraud and abuse detection. It does not make client-side values trustworthy by itself.
+
+- Verify App Attest and Play Integrity tokens on your backend.
+- Treat Widevine values as sensitive identifiers.
+- Disclose identifier use in your privacy policy.
+- Do not use Android Widevine values for advertising or cross-app tracking.
+- Do not attempt iOS fingerprinting. Apple does not provide a public review-safe stable device ID for this use case.
+
+## Compatibility
+
+| Plugin version | Capacitor compatibility | Maintained |
+| -------------- | ----------------------- | ---------- |
+| v8.*.*         | v8.*.*                  | Yes        |
+| v7.*.*         | v7.*.*                  | On demand  |
+| v6.*.*         | v6.*.*                  | On demand  |
+
+## Install
+
+```bash
+npm install @capgo/capacitor-device-integrity
+npx cap sync
+```
+
+## Platform setup
+
+### Android
+
+Widevine fingerprinting does not require extra permissions.
+
+Play Integrity requires Google Play services and a Cloud project number:
+
+```ts
+// capacitor.config.ts
+plugins: {
+  DeviceIntegrity: {
+    cloudProjectNumber: '123456789012'
+  }
+}
+```
+
+You can also pass `cloudProjectNumber` directly to the attestation methods.
+
+### iOS
+
+Enable the App Attest capability in Xcode:
+
+1. Open your app target.
+2. Go to Signing & Capabilities.
+3. Add App Attest.
+4. Test on a physical device when validating real App Attest and DeviceCheck behavior.
+
+## Usage
+
+```ts
+import { DeviceIntegrity } from '@capgo/capacitor-device-integrity';
+
+const capabilities = await DeviceIntegrity.getCapabilities();
+
+if (capabilities.platform === 'android' && capabilities.widevine.fingerprintAvailable) {
+  const widevine = await DeviceIntegrity.getWidevineFingerprint();
+  await api.saveDeviceSignal({
+    widevineIdSha256: widevine.widevineIdSha256,
+    fingerprint: widevine.fingerprint,
+    securityLevel: widevine.securityLevel,
+  });
+}
+
+if (capabilities.appAttest.supported || capabilities.playIntegrity.supported) {
+  const prepared = await DeviceIntegrity.prepareAttestation();
+  const challenge = await api.createDeviceChallenge();
+
+  const attestation = await DeviceIntegrity.createAttestation({
+    keyId: prepared.keyId,
+    challenge,
+  });
+
+  await api.verifyDeviceAttestation(attestation);
+}
+
+if (capabilities.deviceCheck.supported) {
+  const deviceCheck = await DeviceIntegrity.getDeviceCheckToken();
+  await api.verifyDeviceCheckToken(deviceCheck.token);
+}
+```
+
+## Backend handling
+
+Store the platform-specific evidence with the user record only after server-side checks:
+
+- Android Widevine: store `widevineIdSha256` and optionally the raw `widevineIdBase64` only when you explicitly need it.
+- Android Play Integrity: decode the returned token with Google's server API and validate request hash, package name, certificate digest, and device/app integrity verdicts.
+- iOS App Attest: verify the attestation object/assertion against Apple's App Attest rules, app identity, nonce, public key, and counter.
+- iOS DeviceCheck: send the token to Apple's DeviceCheck server API and maintain fraud bits on your backend.
+
+## API
+
+<docgen-index>
+
+* [`getCapabilities()`](#getcapabilities)
+* [`getWidevineFingerprint(...)`](#getwidevinefingerprint)
+* [`prepareAttestation(...)`](#prepareattestation)
+* [`createAttestation(...)`](#createattestation)
+* [`createAssertion(...)`](#createassertion)
+* [`getDeviceCheckToken()`](#getdevicechecktoken)
+* [Interfaces](#interfaces)
+* [Type Aliases](#type-aliases)
+
+</docgen-index>
+
+<docgen-api>
+<!--Update the source file JSDoc comments and rerun docgen to update the docs below-->
+
+### getCapabilities()
+
+```typescript
+getCapabilities() => Promise<DeviceIntegrityCapabilities>
+```
+
+Returns the native integrity capabilities available on the current platform.
+
+**Returns:** <code>Promise&lt;<a href="#deviceintegritycapabilities">DeviceIntegrityCapabilities</a>&gt;</code>
+
+--------------------
+
+
+### getWidevineFingerprint(...)
+
+```typescript
+getWidevineFingerprint(options?: WidevineFingerprintOptions | undefined) => Promise<WidevineFingerprintResult>
+```
+
+Returns an Android Widevine-derived fingerprint.
+
+The default `fingerprint` is SHA-256 over the Widevine device unique ID and a salt.
+If `hashSalt` is not provided, Android uses the app package name as the salt.
+
+The raw Widevine ID is sensitive and is only returned as base64 when `includeRawId` is true.
+
+| Param         | Type                                                                              |
+| ------------- | --------------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#widevinefingerprintoptions">WidevineFingerprintOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#widevinefingerprintresult">WidevineFingerprintResult</a>&gt;</code>
+
+--------------------
+
+
+### prepareAttestation(...)
+
+```typescript
+prepareAttestation(options?: PrepareAttestationOptions | undefined) => Promise<PrepareAttestationResult>
+```
+
+Prepares native attestation state and returns the key/provider handle.
+
+iOS: creates an App Attest key.
+Android: prepares a Play Integrity Standard token provider.
+
+| Param         | Type                                                                            |
+| ------------- | ------------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#prepareattestationoptions">PrepareAttestationOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#prepareattestationresult">PrepareAttestationResult</a>&gt;</code>
+
+--------------------
+
+
+### createAttestation(...)
+
+```typescript
+createAttestation(options: CreateAttestationOptions) => Promise<AttestationTokenResult>
+```
+
+Creates a registration attestation token bound to a backend-issued challenge.
+
+| Param         | Type                                                                          |
+| ------------- | ----------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#createattestationoptions">CreateAttestationOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#attestationtokenresult">AttestationTokenResult</a>&gt;</code>
+
+--------------------
+
+
+### createAssertion(...)
+
+```typescript
+createAssertion(options: CreateAssertionOptions) => Promise<AttestationTokenResult>
+```
+
+Creates a request assertion token bound to a request payload.
+
+| Param         | Type                                                                      |
+| ------------- | ------------------------------------------------------------------------- |
+| **`options`** | <code><a href="#createassertionoptions">CreateAssertionOptions</a></code> |
+
+**Returns:** <code>Promise&lt;<a href="#attestationtokenresult">AttestationTokenResult</a>&gt;</code>
+
+--------------------
+
+
+### getDeviceCheckToken()
+
+```typescript
+getDeviceCheckToken() => Promise<DeviceCheckTokenResult>
+```
+
+Creates an iOS DeviceCheck token for server-side fraud-state lookups.
+
+**Returns:** <code>Promise&lt;<a href="#devicechecktokenresult">DeviceCheckTokenResult</a>&gt;</code>
+
+--------------------
+
+
+### Interfaces
+
+
+#### DeviceIntegrityCapabilities
+
+| Prop                | Type                                                                        | Description                              |
+| ------------------- | --------------------------------------------------------------------------- | ---------------------------------------- |
+| **`platform`**      | <code><a href="#deviceintegrityplatform">DeviceIntegrityPlatform</a></code> | Platform currently executing the plugin. |
+| **`widevine`**      | <code><a href="#widevinecapabilities">WidevineCapabilities</a></code>       | Android Widevine DRM support.            |
+| **`appAttest`**     | <code><a href="#supportstatus">SupportStatus</a></code>                     | iOS App Attest support.                  |
+| **`deviceCheck`**   | <code><a href="#supportstatus">SupportStatus</a></code>                     | iOS DeviceCheck support.                 |
+| **`playIntegrity`** | <code><a href="#supportstatus">SupportStatus</a></code>                     | Android Play Integrity support.          |
+
+
+#### WidevineCapabilities
+
+| Prop                             | Type                 | Description                                                 |
+| -------------------------------- | -------------------- | ----------------------------------------------------------- |
+| **`supported`**                  | <code>boolean</code> | Whether the Widevine DRM scheme is supported by the device. |
+| **`fingerprintAvailable`**       | <code>boolean</code> | Whether the Widevine device unique ID can be read.          |
+| **`securityLevelScanSupported`** | <code>boolean</code> | Whether the Widevine security level property can be read.   |
+
+
+#### SupportStatus
+
+| Prop            | Type                 | Description                                                |
+| --------------- | -------------------- | ---------------------------------------------------------- |
+| **`supported`** | <code>boolean</code> | Whether the capability is available on the current device. |
+
+
+#### WidevineFingerprintResult
+
+| Prop                   | Type                    | Description                                                                                 |
+| ---------------------- | ----------------------- | ------------------------------------------------------------------------------------------- |
+| **`platform`**         | <code>'android'</code>  | Always `android`.                                                                           |
+| **`source`**           | <code>'widevine'</code> | Always `widevine`.                                                                          |
+| **`fingerprint`**      | <code>string</code>     | Salted SHA-256 fingerprint for storing alongside a user record.                             |
+| **`widevineIdSha256`** | <code>string</code>     | Unsalted SHA-256 hash of the Widevine device unique ID.                                     |
+| **`widevineIdBase64`** | <code>string</code>     | Raw Widevine device unique ID encoded as base64. Returned only when `includeRawId` is true. |
+| **`securityLevel`**    | <code>string</code>     | Widevine security level when available, for example `L1` or `L3`.                           |
+| **`vendor`**           | <code>string</code>     | DRM vendor when available.                                                                  |
+| **`version`**          | <code>string</code>     | DRM plugin version when available.                                                          |
+| **`description`**      | <code>string</code>     | DRM plugin description when available.                                                      |
+
+
+#### WidevineFingerprintOptions
+
+| Prop               | Type                 | Description                                                                                 |
+| ------------------ | -------------------- | ------------------------------------------------------------------------------------------- |
+| **`includeRawId`** | <code>boolean</code> | Return the raw Widevine device unique ID as base64. Defaults to `false`.                    |
+| **`hashSalt`**     | <code>string</code>  | Optional salt used to derive `fingerprint`. Android uses the app package name when omitted. |
+
+
+#### PrepareAttestationResult
+
+| Prop         | Type                                                            | Description                                                         |
+| ------------ | --------------------------------------------------------------- | ------------------------------------------------------------------- |
+| **`keyId`**  | <code>string</code>                                             | iOS App Attest key ID or Android Play Integrity provider handle ID. |
+| **`format`** | <code><a href="#attestationformat">AttestationFormat</a></code> | Native attestation format used by the current platform.             |
+
+
+#### PrepareAttestationOptions
+
+| Prop                     | Type                | Description                                                                                                                                |
+| ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| **`cloudProjectNumber`** | <code>string</code> | Android only. Google Cloud project number for Play Integrity. Can be configured globally via `plugins.DeviceIntegrity.cloudProjectNumber`. |
+
+
+#### AttestationTokenResult
+
+| Prop         | Type                                                            | Description                                             |
+| ------------ | --------------------------------------------------------------- | ------------------------------------------------------- |
+| **`token`**  | <code>string</code>                                             | Token/assertion that must be verified server-side.      |
+| **`keyId`**  | <code>string</code>                                             | Key/provider handle used to create the token.           |
+| **`format`** | <code><a href="#attestationformat">AttestationFormat</a></code> | Native attestation format used by the current platform. |
+
+
+#### CreateAttestationOptions
+
+| Prop                     | Type                | Description                                                   |
+| ------------------------ | ------------------- | ------------------------------------------------------------- |
+| **`keyId`**              | <code>string</code> | Key/provider handle returned from `prepareAttestation()`.     |
+| **`challenge`**          | <code>string</code> | Backend-issued one-time challenge.                            |
+| **`cloudProjectNumber`** | <code>string</code> | Android only. Google Cloud project number for Play Integrity. |
+
+
+#### CreateAssertionOptions
+
+| Prop                     | Type                | Description                                                   |
+| ------------------------ | ------------------- | ------------------------------------------------------------- |
+| **`keyId`**              | <code>string</code> | Key/provider handle returned from `prepareAttestation()`.     |
+| **`payload`**            | <code>string</code> | Backend-issued one-time request payload or nonce.             |
+| **`cloudProjectNumber`** | <code>string</code> | Android only. Google Cloud project number for Play Integrity. |
+
+
+#### DeviceCheckTokenResult
+
+| Prop        | Type                | Description                              |
+| ----------- | ------------------- | ---------------------------------------- |
+| **`token`** | <code>string</code> | iOS DeviceCheck token encoded as base64. |
+
+
+### Type Aliases
+
+
+#### DeviceIntegrityPlatform
+
+<code>'android' | 'ios' | 'web'</code>
+
+
+#### AttestationFormat
+
+<code>'apple-app-attest' | 'google-play-integrity-standard'</code>
+
+</docgen-api>

package/android/build.gradle

@@ -0,0 +1,61 @@
+ext {
+    junitVersion = project.hasProperty('junitVersion') ? rootProject.ext.junitVersion : '4.13.2'
+    androidxAppCompatVersion = project.hasProperty('androidxAppCompatVersion') ? rootProject.ext.androidxAppCompatVersion : '1.7.1'
+    androidxJunitVersion = project.hasProperty('androidxJunitVersion') ? rootProject.ext.androidxJunitVersion : '1.3.0'
+    androidxEspressoCoreVersion = project.hasProperty('androidxEspressoCoreVersion') ? rootProject.ext.androidxEspressoCoreVersion : '3.7.0'
+    playIntegrityVersion = project.hasProperty('playIntegrityVersion') ? rootProject.ext.playIntegrityVersion : '1.6.0'
+}
+
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:8.13.0'
+    }
+}
+
+apply plugin: 'com.android.library'
+
+android {
+    namespace = "app.capgo.deviceintegrity"
+    compileSdk = project.hasProperty('compileSdkVersion') ? rootProject.ext.compileSdkVersion : 36
+    defaultConfig {
+        minSdkVersion project.hasProperty('minSdkVersion') ? rootProject.ext.minSdkVersion : 24
+        targetSdkVersion project.hasProperty('targetSdkVersion') ? rootProject.ext.targetSdkVersion : 36
+        versionCode 1
+        versionName "1.0"
+        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+        }
+    }
+    lint {
+        abortOnError = false
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_21
+        targetCompatibility JavaVersion.VERSION_21
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+
+dependencies {
+    implementation fileTree(dir: 'libs', include: ['*.jar'])
+    implementation project(':capacitor-android')
+    annotationProcessor project(':capacitor-android')
+    implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "com.google.android.play:integrity:$playIntegrityVersion"
+    testImplementation "junit:junit:$junitVersion"
+    androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
+    androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+</manifest>

package/android/src/main/java/app/capgo/deviceintegrity/DeviceIntegrity.java

@@ -0,0 +1,276 @@
+package app.capgo.deviceintegrity;
+
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.media.MediaDrm;
+import android.media.UnsupportedSchemeException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.UUID;
+
+public class DeviceIntegrity {
+
+    private static final UUID WIDEVINE_UUID = UUID.fromString("edef8ba9-79d6-4ace-a3c8-27dcd51d21ed");
+    private static final String PROPERTY_SECURITY_LEVEL = "securityLevel";
+    private static final String STANDARD_BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    private static final String URL_SAFE_BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+    private final WidevineDrmReader widevineDrmReader;
+
+    public DeviceIntegrity() {
+        this(new AndroidWidevineDrmReader());
+    }
+
+    DeviceIntegrity(WidevineDrmReader widevineDrmReader) {
+        this.widevineDrmReader = widevineDrmReader;
+    }
+
+    public WidevineCapabilities getWidevineCapabilities() {
+        if (!widevineDrmReader.isWidevineSupported()) {
+            return new WidevineCapabilities(false, false, false);
+        }
+
+        try {
+            WidevineData data = widevineDrmReader.readWidevineData();
+            return new WidevineCapabilities(
+                true,
+                data.deviceUniqueId != null && data.deviceUniqueId.length > 0,
+                !isBlank(data.securityLevel)
+            );
+        } catch (DeviceIntegrityException error) {
+            return new WidevineCapabilities(true, false, false);
+        }
+    }
+
+    public WidevineFingerprint getWidevineFingerprint(String packageName, boolean includeRawId, String hashSalt)
+        throws DeviceIntegrityException {
+        if (!widevineDrmReader.isWidevineSupported()) {
+            throw new DeviceIntegrityException("Widevine DRM is not supported on this device");
+        }
+
+        WidevineData data = widevineDrmReader.readWidevineData();
+        if (data.deviceUniqueId == null || data.deviceUniqueId.length == 0) {
+            throw new DeviceIntegrityException("Widevine device unique ID is not available on this device");
+        }
+
+        String salt = isBlank(hashSalt) ? packageName : hashSalt;
+        byte[] fingerprintInput = joinSaltAndId(salt, data.deviceUniqueId);
+
+        return new WidevineFingerprint(
+            sha256Hex(fingerprintInput),
+            sha256Hex(data.deviceUniqueId),
+            includeRawId ? base64Encode(data.deviceUniqueId, false, true) : null,
+            data.securityLevel,
+            data.vendor,
+            data.version,
+            data.description
+        );
+    }
+
+    public boolean isPlayIntegritySupported(Context context) {
+        try {
+            context.getPackageManager().getPackageInfo("com.android.vending", 0);
+            return true;
+        } catch (PackageManager.NameNotFoundException error) {
+            return false;
+        }
+    }
+
+    public String createRequestHash(String payload) throws NoSuchAlgorithmException {
+        byte[] hash = sha256(payload.getBytes(StandardCharsets.UTF_8));
+        return base64Encode(hash, true, false);
+    }
+
+    static String sha256Hex(byte[] value) throws DeviceIntegrityException {
+        try {
+            byte[] hash = sha256(value);
+            StringBuilder result = new StringBuilder(hash.length * 2);
+            for (byte b : hash) {
+                result.append(String.format("%02x", b & 0xff));
+            }
+            return result.toString();
+        } catch (NoSuchAlgorithmException error) {
+            throw new DeviceIntegrityException("SHA-256 is not available", error);
+        }
+    }
+
+    private static byte[] sha256(byte[] value) throws NoSuchAlgorithmException {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        return digest.digest(value);
+    }
+
+    private static byte[] joinSaltAndId(String salt, byte[] deviceUniqueId) {
+        byte[] saltBytes = salt.getBytes(StandardCharsets.UTF_8);
+        byte[] result = new byte[saltBytes.length + 1 + deviceUniqueId.length];
+        System.arraycopy(saltBytes, 0, result, 0, saltBytes.length);
+        result[saltBytes.length] = 0;
+        System.arraycopy(deviceUniqueId, 0, result, saltBytes.length + 1, deviceUniqueId.length);
+        return result;
+    }
+
+    static String base64Encode(byte[] input, boolean urlSafe, boolean padding) {
+        if (input.length == 0) {
+            return "";
+        }
+
+        String alphabet = urlSafe ? URL_SAFE_BASE64 : STANDARD_BASE64;
+        StringBuilder output = new StringBuilder(((input.length + 2) / 3) * 4);
+
+        for (int index = 0; index < input.length; index += 3) {
+            int remaining = input.length - index;
+            int first = input[index] & 0xff;
+            int second = remaining > 1 ? input[index + 1] & 0xff : 0;
+            int third = remaining > 2 ? input[index + 2] & 0xff : 0;
+
+            int triple = (first << 16) | (second << 8) | third;
+            output.append(alphabet.charAt((triple >> 18) & 0x3f));
+            output.append(alphabet.charAt((triple >> 12) & 0x3f));
+
+            if (remaining > 1) {
+                output.append(alphabet.charAt((triple >> 6) & 0x3f));
+            } else if (padding) {
+                output.append('=');
+            }
+
+            if (remaining > 2) {
+                output.append(alphabet.charAt(triple & 0x3f));
+            } else if (padding) {
+                output.append('=');
+            }
+        }
+
+        return output.toString();
+    }
+
+    private static boolean isBlank(String value) {
+        return value == null || value.trim().isEmpty();
+    }
+
+    interface WidevineDrmReader {
+        boolean isWidevineSupported();
+
+        WidevineData readWidevineData() throws DeviceIntegrityException;
+    }
+
+    static final class AndroidWidevineDrmReader implements WidevineDrmReader {
+
+        @Override
+        public boolean isWidevineSupported() {
+            try {
+                return MediaDrm.isCryptoSchemeSupported(WIDEVINE_UUID);
+            } catch (RuntimeException error) {
+                return false;
+            }
+        }
+
+        @Override
+        public WidevineData readWidevineData() throws DeviceIntegrityException {
+            MediaDrm mediaDrm = null;
+            try {
+                mediaDrm = new MediaDrm(WIDEVINE_UUID);
+                return new WidevineData(
+                    readDeviceUniqueId(mediaDrm),
+                    readStringProperty(mediaDrm, PROPERTY_SECURITY_LEVEL),
+                    readStringProperty(mediaDrm, MediaDrm.PROPERTY_VENDOR),
+                    readStringProperty(mediaDrm, MediaDrm.PROPERTY_VERSION),
+                    readStringProperty(mediaDrm, MediaDrm.PROPERTY_DESCRIPTION)
+                );
+            } catch (UnsupportedSchemeException error) {
+                throw new DeviceIntegrityException("Widevine DRM is not supported on this device", error);
+            } catch (RuntimeException error) {
+                throw new DeviceIntegrityException("Unable to read Widevine DRM properties", error);
+            } finally {
+                if (mediaDrm != null) {
+                    mediaDrm.release();
+                }
+            }
+        }
+
+        private byte[] readDeviceUniqueId(MediaDrm mediaDrm) {
+            try {
+                return mediaDrm.getPropertyByteArray(MediaDrm.PROPERTY_DEVICE_UNIQUE_ID);
+            } catch (RuntimeException error) {
+                return null;
+            }
+        }
+
+        private String readStringProperty(MediaDrm mediaDrm, String propertyName) {
+            try {
+                return mediaDrm.getPropertyString(propertyName);
+            } catch (RuntimeException error) {
+                return null;
+            }
+        }
+    }
+
+    static final class WidevineCapabilities {
+
+        final boolean supported;
+        final boolean fingerprintAvailable;
+        final boolean securityLevelScanSupported;
+
+        WidevineCapabilities(boolean supported, boolean fingerprintAvailable, boolean securityLevelScanSupported) {
+            this.supported = supported;
+            this.fingerprintAvailable = fingerprintAvailable;
+            this.securityLevelScanSupported = securityLevelScanSupported;
+        }
+    }
+
+    static final class WidevineData {
+
+        final byte[] deviceUniqueId;
+        final String securityLevel;
+        final String vendor;
+        final String version;
+        final String description;
+
+        WidevineData(byte[] deviceUniqueId, String securityLevel, String vendor, String version, String description) {
+            this.deviceUniqueId = deviceUniqueId;
+            this.securityLevel = securityLevel;
+            this.vendor = vendor;
+            this.version = version;
+            this.description = description;
+        }
+    }
+
+    static final class WidevineFingerprint {
+
+        final String fingerprint;
+        final String widevineIdSha256;
+        final String widevineIdBase64;
+        final String securityLevel;
+        final String vendor;
+        final String version;
+        final String description;
+
+        WidevineFingerprint(
+            String fingerprint,
+            String widevineIdSha256,
+            String widevineIdBase64,
+            String securityLevel,
+            String vendor,
+            String version,
+            String description
+        ) {
+            this.fingerprint = fingerprint;
+            this.widevineIdSha256 = widevineIdSha256;
+            this.widevineIdBase64 = widevineIdBase64;
+            this.securityLevel = securityLevel;
+            this.vendor = vendor;
+            this.version = version;
+            this.description = description;
+        }
+    }
+
+    static final class DeviceIntegrityException extends Exception {
+
+        DeviceIntegrityException(String message) {
+            super(message);
+        }
+
+        DeviceIntegrityException(String message, Throwable cause) {
+            super(message, cause);
+        }
+    }
+}