Rewrite AppCheckCore in Swift

.github/workflows/app_check_core.yml

@@ -17,12 +17,11 @@ jobs:
   pod_lib_lint:
     strategy:
       matrix:
-        # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-        target: [ios, tvos, macos --skip-tests, watchos]
+        target: [ios, tvos, macos, watchos]
         os: [macos-15, macos-26]
         include:
           - os: macos-15
-            xcode: Xcode_16.4
+            xcode: Xcode_26.2
           - os: macos-26
             xcode: Xcode_26.2
     runs-on: ${{ matrix.os }}

.github/workflows/spm.yml

@@ -18,12 +18,8 @@ jobs:
     strategy:
       matrix:
         os: [macos-15]
-        xcode: [Xcode_16.4]
+        xcode: [Xcode_26.2]
         platform: [iOS, tvOS, macOS, catalyst]
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            platform: iOS
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -36,3 +32,17 @@ jobs:
       run: xcodebuild -list
     - name: iOS Unit Tests
       run: scripts/third_party/travis/retry.sh scripts/build.sh AppCheck-Package ${{ matrix.platform }} spm
+
+  # SwiftPM emits Swift diagnostics but still exits 0, so warnings scroll past
+  # unnoticed in the job above. `pod lib lint` escalates the same warnings to
+  # fatal, which previously made CocoaPods the only gate able to reject them --
+  # a ~5 minute round-trip, and an accidental dependency rather than a designed
+  # one. This job makes the cheap gate as strict as the expensive one.
+  warnings-as-errors:
+    runs-on: macos-15
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer
+    - name: Build sources and tests with warnings as errors
+      run: swift build --build-tests -Xswiftc -warnings-as-errors

AppCheckCore.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name             = 'AppCheckCore'
-  s.version          = '11.3.2'
+  s.version          = '12.0.0'
   s.summary          = 'App Check Core SDK.'
 
   s.description      = <<-DESC
@@ -17,12 +17,12 @@ Pod::Spec.new do |s|
   }
   s.social_media_url = 'https://twitter.com/Firebase'
 
-  ios_deployment_target = '12.0'
-  osx_deployment_target = '10.15'
-  tvos_deployment_target = '13.0'
-  watchos_deployment_target = '7.0'
+  ios_deployment_target = '15.0'
+  osx_deployment_target = '11.0'
+  tvos_deployment_target = '15.0'
+  watchos_deployment_target = '8.0'
 
-  s.swift_version = '5.5'
+  s.swift_version = '5.9'
 
   s.ios.deployment_target = ios_deployment_target
   s.osx.deployment_target = osx_deployment_target
@@ -35,7 +35,7 @@ Pod::Spec.new do |s|
   base_dir = "AppCheckCore/"
 
   s.source_files = [
-    base_dir + 'Sources/**/*.[mh]',
+    base_dir + 'Sources/**/*.{h,m,swift}',
   ]
   s.ios.source_files = [
     'AppCheckRecaptchaProvider/Sources/**/*.swift',
@@ -45,9 +45,6 @@ Pod::Spec.new do |s|
   s.ios.weak_framework = 'DeviceCheck'
   s.osx.weak_framework = 'DeviceCheck'
   s.tvos.weak_framework = 'DeviceCheck'
-
-  s.dependency 'PromisesObjC', '~> 2.4'
-  s.dependency 'PromisesSwift', '~> 2.4'
   s.dependency 'GoogleUtilities/Environment', '~> 8.0'
   s.dependency 'GoogleUtilities/UserDefaults', '~> 8.0'
   s.ios.dependency 'RecaptchaInterop', '~> 101.0'
@@ -64,8 +61,8 @@ Pod::Spec.new do |s|
       :tvos => tvos_deployment_target
     }
     unit_tests.source_files = [
-      base_dir + 'Tests/Unit/**/*.[mh]',
-      base_dir + 'Tests/Utils/**/*.[mh]',
+      base_dir + 'Tests/Unit/**/*.swift',
+      base_dir + 'Tests/Unit/ObjC/**/*.m',
     ]
 
     unit_tests.resources = base_dir + 'Tests/Fixture/**/*'
@@ -79,13 +76,13 @@ Pod::Spec.new do |s|
       :tvos => tvos_deployment_target
     }
     integration_tests.source_files = [
-      base_dir + 'Tests/Integration/**/*.[mh]',
-      base_dir + 'Tests/Integration/**/*.[mh]',
+      base_dir + 'Tests/Integration/**/*.swift',
     ]
     integration_tests.resources = base_dir + 'Tests/Fixture/**/*'
     integration_tests.requires_app_host = true
   end
 
+
   s.test_spec 'swift-unit' do |swift_unit_tests|
     swift_unit_tests.platforms = {
       :ios => ios_deployment_target,

AppCheckCore/Sources/AppAttestProvider/API/AppCheckCoreAppAttestAPIService.swift

@@ -0,0 +1,196 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import Foundation
+
+private let kGenerateAppAttestChallengeEndpoint = "generateAppAttestChallenge"
+private let kExchangeAppAttestAttestationEndpoint = "exchangeAppAttestAttestation"
+private let kExchangeAppAttestAssertionEndpoint = "exchangeAppAttestAssertion"
+
+private let kRequestFieldArtifact = "artifact"
+private let kRequestFieldAssertion = "assertion"
+private let kRequestFieldChallenge = "challenge"
+private let kRequestFieldKeyID = "key_id"
+private let kRequestFieldAttestation = "attestation_statement"
+private let kRequestFieldLimitedUse = "limited_use"
+private let kContentTypeKey = "Content-Type"
+private let kJSONContentType = "application/json"
+private let kHTTPMethodPost = "POST"
+
+protocol AppCheckCoreAppAttestAPIServiceProtocol: NSObjectProtocol {
+  func getRandomChallenge() async throws -> Data
+
+  func attestKey(withAttestation attestation: Data, keyID: String, challenge: Data,
+                 limitedUse: Bool) async throws -> AppCheckCoreAppAttestAttestationResponse
+
+  func getAppCheckToken(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                        limitedUse: Bool) async throws -> AppCheckCoreToken
+}
+
+class AppCheckCoreAppAttestAPIService: NSObject, AppCheckCoreAppAttestAPIServiceProtocol {
+  private let apiService: AppCheckCoreAPIServiceProtocol
+  private let resourceName: String
+
+  init(apiService: AppCheckCoreAPIServiceProtocol, resourceName: String) {
+    self.apiService = apiService
+    self.resourceName = resourceName
+    super.init()
+  }
+
+  // MARK: - API Calls
+
+  func getRandomChallenge() async throws -> Data {
+    let url = try urlForEndpoint(kGenerateAppAttestChallengeEndpoint)
+    let response = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: nil,
+      additionalHeaders: nil
+    )
+    return try randomChallengeWithAPIResponse(response)
+  }
+
+  func attestKey(withAttestation attestation: Data, keyID: String, challenge: Data,
+                 limitedUse: Bool) async throws -> AppCheckCoreAppAttestAttestationResponse {
+    let url = try urlForEndpoint(kExchangeAppAttestAttestationEndpoint)
+    let body = try httpBody(
+      withAttestation: attestation,
+      keyID: keyID,
+      challenge: challenge,
+      limitedUse: limitedUse
+    )
+
+    let urlResponse = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: body,
+      additionalHeaders: [kContentTypeKey: kJSONContentType]
+    )
+
+    guard let responseData = urlResponse.httpBody else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Invalid or missing response data.")
+    }
+    let response = try AppCheckCoreAppAttestAttestationResponse(
+      responseData: responseData,
+      requestDate: urlResponse.requestDate
+    )
+
+    return response
+  }
+
+  func getAppCheckToken(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                        limitedUse: Bool) async throws -> AppCheckCoreToken {
+    let url = try urlForEndpoint(kExchangeAppAttestAssertionEndpoint)
+    let body = try httpBody(
+      withArtifact: artifact,
+      challenge: challenge,
+      assertion: assertion,
+      limitedUse: limitedUse
+    )
+
+    let urlResponse = try await apiService.sendRequest(
+      withURL: url,
+      httpMethod: kHTTPMethodPost,
+      body: body,
+      additionalHeaders: [kContentTypeKey: kJSONContentType]
+    )
+
+    let token = try apiService.appCheckToken(withAPIResponse: urlResponse)
+    return token
+  }
+
+  // MARK: - Challenge parsing
+
+  private func randomChallengeWithAPIResponse(_ response: AppCheckCoreURLSessionDataResponse) throws
+    -> Data {
+    guard let responseData = response.httpBody else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Empty server response body.")
+    }
+
+    if responseData.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Empty server response body.")
+    }
+
+    guard let responseDict = try? JSONSerialization
+      .jsonObject(with: responseData, options: []) as? [String: Any] else {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(NSError(
+        domain: NSCocoaErrorDomain,
+        code: 0,
+        userInfo: nil
+      ))
+    }
+
+    guard let challengeBase64 = responseDict["challenge"] as? String else {
+      throw AppCheckCoreErrorUtil.appCheckTokenResponseError(withMissingField: "challenge")
+    }
+
+    guard let challenge = Data(base64Encoded: challengeBase64) else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Invalid base64 string for challenge.")
+    }
+
+    return challenge
+  }
+
+  // MARK: - Body Builders
+
+  private func httpBody(withAttestation attestation: Data, keyID: String, challenge: Data,
+                        limitedUse: Bool) throws -> Data {
+    if attestation.isEmpty || keyID.isEmpty || challenge.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Missing or empty request parameter.")
+    }
+
+    let jsonObject: [String: Any] = [
+      kRequestFieldKeyID: keyID,
+      kRequestFieldAttestation: attestation.base64EncodedString(),
+      kRequestFieldChallenge: challenge.base64EncodedString(),
+      kRequestFieldLimitedUse: limitedUse,
+    ]
+
+    return try httpBody(withJSONObject: jsonObject)
+  }
+
+  private func httpBody(withArtifact artifact: Data, challenge: Data, assertion: Data,
+                        limitedUse: Bool) throws -> Data {
+    if artifact.isEmpty || challenge.isEmpty || assertion.isEmpty {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Missing or empty request parameter.")
+    }
+
+    let jsonObject: [String: Any] = [
+      kRequestFieldArtifact: artifact.base64EncodedString(),
+      kRequestFieldChallenge: challenge.base64EncodedString(),
+      kRequestFieldAssertion: assertion.base64EncodedString(),
+      kRequestFieldLimitedUse: limitedUse,
+    ]
+
+    return try httpBody(withJSONObject: jsonObject)
+  }
+
+  private func httpBody(withJSONObject jsonObject: Any) throws -> Data {
+    do {
+      return try JSONSerialization.data(withJSONObject: jsonObject, options: [])
+    } catch {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(error as NSError)
+    }
+  }
+
+  // MARK: - URL Helpers
+
+  private func urlForEndpoint(_ endpoint: String) throws -> URL {
+    let urlString = "\(apiService.baseURL)/\(resourceName):\(endpoint)"
+    guard let url = URL(string: urlString) else {
+      throw AppCheckCoreErrorUtil.error(withFailureReason: "Invalid URL.")
+    }
+    return url
+  }
+}

AppCheckCore/Sources/AppAttestProvider/API/AppCheckCoreAppAttestAttestationResponse.swift

@@ -0,0 +1,70 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import Foundation
+
+private let kResponseFieldAppCheckTokenDict = "appCheckToken"
+private let kResponseFieldArtifact = "artifact"
+
+class AppCheckCoreAppAttestAttestationResponse: NSObject {
+  let artifact: Data
+  let token: AppCheckCoreToken
+
+  init(artifact: Data, token: AppCheckCoreToken) {
+    self.artifact = artifact
+    self.token = token
+    super.init()
+  }
+
+  init(responseData: Data, requestDate: Date) throws {
+    if responseData.isEmpty {
+      throw AppCheckCoreErrorUtil
+        .error(
+          withFailureReason: "Failed to parse the initial handshake response. Empty server response body."
+        )
+    }
+
+    let responseDict = try JSONSerialization
+      .jsonObject(with: responseData, options: []) as? [String: Any]
+
+    guard let responseDict = responseDict else {
+      throw AppCheckCoreErrorUtil.jsonSerializationError(NSError(
+        domain: NSCocoaErrorDomain,
+        code: 0,
+        userInfo: nil
+      ))
+    }
+
+    guard let artifactBase64String = responseDict[kResponseFieldArtifact] as? String,
+          let artifactData = Data(base64Encoded: artifactBase64String) else {
+      throw AppCheckCoreErrorUtil
+        .appAttestAttestationResponseError(withMissingField: kResponseFieldArtifact)
+    }
+
+    guard let appCheckTokenDict = responseDict[kResponseFieldAppCheckTokenDict] as? [String: Any]
+    else {
+      throw AppCheckCoreErrorUtil
+        .appAttestAttestationResponseError(withMissingField: kResponseFieldAppCheckTokenDict)
+    }
+
+    let appCheckToken = try AppCheckCoreToken(
+      responseDict: appCheckTokenDict,
+      requestDate: requestDate
+    )
+
+    artifact = artifactData
+    token = appCheckToken
+    super.init()
+  }
+}