crossmate

PushRequestAuthenticator.swift (19708B)

---

 import CryptoKit
 import DeviceCheck
 import Foundation
 
 enum PushRequestAuthError: LocalizedError {
     case appAttestUnsupported
     case missingChallenge
     case malformedKeyID
     case challengeBadRequest(reason: String)
     case challengeRouteMissing
     case challengeRateLimited(retryAfter: TimeInterval?)
     case challengeServerError(status: Int)
     case challengeRejected(status: Int)
     case attestationRejected(status: Int)
     case invalidResponse
 
     var errorDescription: String? {
         switch self {
         case .appAttestUnsupported:
             "App Attest is not available on this device."
         case .missingChallenge:
             "The push worker did not return an App Attest challenge."
         case .malformedKeyID:
             "App Attest returned an invalid key identifier."
         case let .challengeBadRequest(reason):
             "The push worker rejected the App Attest challenge request (HTTP 400: \(reason))."
         case .challengeRouteMissing:
             "The push worker has no App Attest challenge route (HTTP 404)."
         case let .challengeRateLimited(retryAfter):
             if let retryAfter {
                 "The push worker rate-limited App Attest enrollment (HTTP 429; retry after \(Int(retryAfter.rounded(.up))) seconds)."
             } else {
                 "The push worker rate-limited App Attest enrollment (HTTP 429)."
             }
         case let .challengeServerError(status):
             "The push worker failed while issuing an App Attest challenge (HTTP \(status))."
         case let .challengeRejected(status):
             "The push worker rejected the App Attest challenge request (HTTP \(status))."
         case let .attestationRejected(status):
             "The push worker rejected this app installation's attestation (HTTP \(status))."
         case .invalidResponse:
             "The push worker returned an invalid authentication response."
         }
     }
 
     var retryAfter: TimeInterval? {
         if case let .challengeRateLimited(retryAfter) = self { retryAfter } else { nil }
     }
 }
 
 protocol AppAttestServicing: Sendable {
     var isSupported: Bool { get }
     func generateKey() async throws -> String
     func attestKey(_ keyID: String, clientDataHash: Data) async throws -> Data
     func generateAssertion(_ keyID: String, clientDataHash: Data) async throws -> Data
 }
 
 private struct SystemAppAttestService: AppAttestServicing {
     var isSupported: Bool { DCAppAttestService.shared.isSupported }
 
     func generateKey() async throws -> String {
         try await DCAppAttestService.shared.generateKey()
     }
 
     func attestKey(_ keyID: String, clientDataHash: Data) async throws -> Data {
         try await DCAppAttestService.shared.attestKey(keyID, clientDataHash: clientDataHash)
     }
 
     func generateAssertion(_ keyID: String, clientDataHash: Data) async throws -> Data {
         try await DCAppAttestService.shared.generateAssertion(keyID, clientDataHash: clientDataHash)
     }
 }
 
 struct PushAuthKeyStore: Sendable {
     var load: @Sendable (String) -> Data?
     var save: @Sendable (String, Data) throws -> Void
     var delete: @Sendable (String) -> Void
 
     static let keychain = PushAuthKeyStore(
         load: { KeychainHelper.load(key: $0) },
         save: { try KeychainHelper.save(key: $0, data: $1) },
         delete: { KeychainHelper.delete(key: $0) }
     )
 }
 
 /// Enrolls this app installation with the push worker using App Attest, then
 /// signs each worker request with the attested key. The worker stores only the
 /// public key and a monotonically increasing assertion counter; Crossmate still
 /// has no server-side user accounts.
 actor PushRequestAuthenticator {
     private static let keyIDKey = "push.appAttest.keyID.v1"
     private static let pendingKeyIDKey = "push.appAttest.pendingKeyID.v1"
     private static let pendingEnrollmentKey = "push.appAttest.pendingEnrollment.v1"
     private static let maximumKeyIDCharacters = 256
     private static let maximumKeyIDBytes = 128
     private static let maximumBackoff: TimeInterval = 5 * 60
     private static let maximumRetryAfter: TimeInterval = 24 * 60 * 60
 
     private let baseURL: URL
     private let deviceID: String
     private let session: URLSession
     private let service: any AppAttestServicing
     private let keyStore: PushAuthKeyStore
     private let now: @Sendable () -> Date
     private let sleep: @Sendable (TimeInterval) async throws -> Void
     private let jitter: @Sendable () -> Double
 
     private var cachedKeyID: String?
     private var registeringTask: Task<String, Error>?
     private var consecutiveFailures = 0
     private var retryNotBefore: Date?
 
     init(
         baseURL: URL,
         deviceID: String,
         session: URLSession,
         service: any AppAttestServicing = SystemAppAttestService(),
         keyStore: PushAuthKeyStore = .keychain,
         now: @escaping @Sendable () -> Date = Date.init,
         sleep: @escaping @Sendable (TimeInterval) async throws -> Void = {
             try await Task.sleep(for: .seconds($0))
         },
         jitter: @escaping @Sendable () -> Double = { Double.random(in: 0.8...1.2) }
     ) {
         self.baseURL = baseURL
         self.deviceID = deviceID
         self.session = session
         self.service = service
         self.keyStore = keyStore
         self.now = now
         self.sleep = sleep
         self.jitter = jitter
     }
 
     func signedHeaders(
         method: String,
         path: String,
         body: Data
     ) async throws -> [String: String] {
         let keyID = try await registeredKeyID()
         return try await assertionHeaders(
             keyID: keyID,
             method: method,
             path: path,
             body: body
         )
     }
 
     func resetRegistration() {
         cachedKeyID = nil
         registeringTask?.cancel()
         registeringTask = nil
         consecutiveFailures = 0
         retryNotBefore = nil
         keyStore.delete(Self.keyIDKey)
         keyStore.delete(Self.pendingKeyIDKey)
         keyStore.delete(Self.pendingEnrollmentKey)
     }
 
     private func registeredKeyID() async throws -> String {
         if let cachedKeyID { return cachedKeyID }
         if let data = keyStore.load(Self.keyIDKey),
            let keyID = String(data: data, encoding: .utf8),
            !keyID.isEmpty {
             cachedKeyID = keyID
             return keyID
         }
         if let registeringTask {
             return try await registeringTask.value
         }
         let delay = max(0, retryNotBefore?.timeIntervalSince(now()) ?? 0)
         let task = Task {
             if delay > 0 { try await sleep(delay) }
             return try await registerFreshKey()
         }
         registeringTask = task
         do {
             let keyID = try await task.value
             registeringTask = nil
             cachedKeyID = keyID
             consecutiveFailures = 0
             retryNotBefore = nil
             return keyID
         } catch {
             registeringTask = nil
             recordRegistrationFailure(error)
             throw error
         }
     }
 
     private func registerFreshKey() async throws -> String {
         guard service.isSupported else {
             throw PushRequestAuthError.appAttestUnsupported
         }
         let keyID: String
         if let data = keyStore.load(Self.pendingKeyIDKey),
            let pending = String(data: data, encoding: .utf8),
            !pending.isEmpty {
             keyID = pending
         } else {
             keyID = try await service.generateKey()
             // Apple doesn't provide a way to recover this identifier later.
             // Persist it before the first network operation so a challenge or
             // attestation outage doesn't strand another Secure Enclave key.
             try keyStore.save(Self.pendingKeyIDKey, Data(keyID.utf8))
         }
         let networkKeyID = try Self.canonicalKeyID(keyID)
         var pending = loadPendingEnrollment(keyID: keyID, networkKeyID: networkKeyID)
         if pending == nil {
             let challenge = try await fetchChallenge(for: networkKeyID)
             pending = PendingEnrollment(
                 keyID: keyID,
                 networkKeyID: networkKeyID,
                 challenge: challenge,
                 attestation: nil
             )
             try savePendingEnrollment(pending!)
         }
         var enrollment = pending!
         if enrollment.attestation == nil {
             let clientDataHash = Self.clientDataHashForAttestation(
                 challenge: enrollment.challenge,
                 deviceID: deviceID,
                 keyID: networkKeyID
             )
             enrollment.attestation = try await service.attestKey(
                 keyID,
                 clientDataHash: clientDataHash
             )
             // If the Worker accepts the registration but its response is lost,
             // resend this exact attestation instead of asking Apple to attest
             // the key again with a different challenge.
             try savePendingEnrollment(enrollment)
         }
         do {
             try await submitAttestation(
                 keyID: networkKeyID,
                 challenge: enrollment.challenge,
                 attestation: enrollment.attestation!
             )
         } catch let error as PushRequestAuthError {
             // A definitive client/auth rejection means the server did not
             // accept this attestation. Apple's guidance is to discard that
             // identifier; transient server failures retain it for retry.
             if case let .attestationRejected(status) = error, (400..<500).contains(status) {
                 keyStore.delete(Self.pendingKeyIDKey)
                 keyStore.delete(Self.pendingEnrollmentKey)
             }
             throw error
         }
         try keyStore.save(Self.keyIDKey, Data(keyID.utf8))
         keyStore.delete(Self.pendingKeyIDKey)
         keyStore.delete(Self.pendingEnrollmentKey)
         return keyID
     }
 
     private func fetchChallenge(for keyID: String) async throws -> String {
         var request = URLRequest(
             url: baseURL.appendingPathComponent("attest").appendingPathComponent("challenge")
         )
         request.httpMethod = "POST"
         request.setValue("application/json", forHTTPHeaderField: "Content-Type")
         request.httpBody = try JSONEncoder().encode(
             ChallengeRequest(deviceID: deviceID, keyID: keyID)
         )
         let (data, response) = try await session.data(for: request)
         guard let http = response as? HTTPURLResponse else {
             throw PushRequestAuthError.invalidResponse
         }
         guard http.statusCode == 200 else {
             throw Self.challengeError(response: http, data: data, now: now())
         }
         let decoded = try JSONDecoder().decode(ChallengeResponse.self, from: data)
         guard !decoded.challenge.isEmpty else {
             throw PushRequestAuthError.missingChallenge
         }
         return decoded.challenge
     }
 
     private func submitAttestation(
         keyID: String,
         challenge: String,
         attestation: Data
     ) async throws {
         var request = URLRequest(
             url: baseURL.appendingPathComponent("attest").appendingPathComponent("register")
         )
         request.httpMethod = "POST"
         request.setValue("application/json", forHTTPHeaderField: "Content-Type")
         let body = AttestationRequest(
             deviceID: deviceID,
             keyID: keyID,
             challenge: challenge,
             attestationObject: attestation.base64URLEncodedString()
         )
         request.httpBody = try JSONEncoder().encode(body)
         let (_, response) = try await session.data(for: request)
         guard let http = response as? HTTPURLResponse else {
             throw PushRequestAuthError.invalidResponse
         }
         guard http.statusCode == 204 else {
             throw PushRequestAuthError.attestationRejected(status: http.statusCode)
         }
     }
 
     private func assertionHeaders(
         keyID: String,
         method: String,
         path: String,
         body: Data
     ) async throws -> [String: String] {
         let networkKeyID = try Self.canonicalKeyID(keyID)
         let timestamp = String(Int(Date().timeIntervalSince1970))
         let nonce = UUID().uuidString
         let bodyHash = Data(SHA256.hash(data: body)).base64URLEncodedString()
         let canonical = Self.canonicalRequest(
             method: method,
             path: path,
             bodyHash: bodyHash,
             timestamp: timestamp,
             nonce: nonce,
             deviceID: deviceID,
             keyID: networkKeyID
         )
         let clientDataHash = Data(SHA256.hash(data: Data(canonical.utf8)))
         let assertion = try await service.generateAssertion(keyID, clientDataHash: clientDataHash)
         return [
             "X-Crossmate-Auth-Version": "appattest-v1",
             "X-Crossmate-Device-ID": deviceID,
             "X-Crossmate-Key-ID": networkKeyID,
             "X-Crossmate-Timestamp": timestamp,
             "X-Crossmate-Nonce": nonce,
             "X-Crossmate-Body-SHA256": bodyHash,
             "X-Crossmate-Assertion": assertion.base64URLEncodedString()
         ]
     }
 
     private func recordRegistrationFailure(_ error: Error) {
         consecutiveFailures = min(consecutiveFailures + 1, 16)
         let exponential = min(
             Self.maximumBackoff,
             2 * pow(2, Double(consecutiveFailures - 1))
         )
         let retryAfter = min(
             (error as? PushRequestAuthError)?.retryAfter ?? 0,
             Self.maximumRetryAfter
         )
         let delay = max(retryAfter, exponential * min(max(jitter(), 0.5), 1.5))
         retryNotBefore = now().addingTimeInterval(delay)
     }
 
     private func loadPendingEnrollment(
         keyID: String,
         networkKeyID: String
     ) -> PendingEnrollment? {
         guard let data = keyStore.load(Self.pendingEnrollmentKey),
               let pending = try? JSONDecoder().decode(PendingEnrollment.self, from: data),
               pending.keyID == keyID,
               pending.networkKeyID == networkKeyID
         else {
             keyStore.delete(Self.pendingEnrollmentKey)
             return nil
         }
         return pending
     }
 
     private func savePendingEnrollment(_ pending: PendingEnrollment) throws {
         try keyStore.save(Self.pendingEnrollmentKey, JSONEncoder().encode(pending))
     }
 
     static func canonicalKeyID(_ keyID: String) throws -> String {
         guard !keyID.isEmpty, keyID.count <= maximumKeyIDCharacters else {
             throw PushRequestAuthError.malformedKeyID
         }
         let alphabet = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/_-=")
         guard keyID.unicodeScalars.allSatisfy(alphabet.contains) else {
             throw PushRequestAuthError.malformedKeyID
         }
         let usesStandardAlphabet = keyID.contains("+") || keyID.contains("/")
         let usesURLSafeAlphabet = keyID.contains("-") || keyID.contains("_")
         guard !(usesStandardAlphabet && usesURLSafeAlphabet) else {
             throw PushRequestAuthError.malformedKeyID
         }
         if let firstPaddingIndex = keyID.firstIndex(of: "=") {
             let firstPadding = keyID.distance(from: keyID.startIndex, to: firstPaddingIndex)
             guard keyID.dropFirst(firstPadding).allSatisfy({ $0 == "=" }) else {
                 throw PushRequestAuthError.malformedKeyID
             }
         }
         let unpadded = keyID.trimmingCharacters(in: CharacterSet(charactersIn: "="))
         guard keyID.count - unpadded.count <= 2 else {
             throw PushRequestAuthError.malformedKeyID
         }
         var standard = unpadded.replacingOccurrences(of: "-", with: "+")
             .replacingOccurrences(of: "_", with: "/")
         guard standard.count % 4 != 1 else { throw PushRequestAuthError.malformedKeyID }
         standard += String(repeating: "=", count: (4 - standard.count % 4) % 4)
         guard let bytes = Data(base64Encoded: standard),
               !bytes.isEmpty,
               bytes.count <= maximumKeyIDBytes
         else {
             throw PushRequestAuthError.malformedKeyID
         }
         let canonical = bytes.base64URLEncodedString()
         let suppliedCanonical = unpadded.replacingOccurrences(of: "+", with: "-")
             .replacingOccurrences(of: "/", with: "_")
         guard canonical == suppliedCanonical else {
             throw PushRequestAuthError.malformedKeyID
         }
         return canonical
     }
 
     static func challengeError(
         response: HTTPURLResponse,
         data: Data,
         now: Date
     ) -> PushRequestAuthError {
         switch response.statusCode {
         case 400:
             return .challengeBadRequest(reason: safeChallengeReason(data))
         case 404:
             return .challengeRouteMissing
         case 429:
             return .challengeRateLimited(retryAfter: retryAfter(response, now: now))
         case 500..<600:
             return .challengeServerError(status: response.statusCode)
         default:
             return .challengeRejected(status: response.statusCode)
         }
     }
 
     private static func safeChallengeReason(_ data: Data) -> String {
         let reason = String(data: data.prefix(160), encoding: .utf8)?
             .trimmingCharacters(in: .whitespacesAndNewlines)
         let knownReasons = [
             "Body too large",
             "Body must be JSON",
             "deviceID and keyID required",
             "Malformed deviceID or keyID",
             "Rate limit exceeded",
             "Not found"
         ]
         return knownReasons.contains(reason ?? "") ? reason! : "unrecognized response"
     }
 
     private static func retryAfter(_ response: HTTPURLResponse, now: Date) -> TimeInterval? {
         guard let value = response.value(forHTTPHeaderField: "Retry-After") else { return nil }
         if let seconds = TimeInterval(value), seconds >= 0 { return seconds }
         let formatter = DateFormatter()
         formatter.locale = Locale(identifier: "en_US_POSIX")
         formatter.timeZone = TimeZone(secondsFromGMT: 0)
         formatter.dateFormat = "EEE',' dd MMM yyyy HH':'mm':'ss z"
         guard let date = formatter.date(from: value) else { return nil }
         return max(0, date.timeIntervalSince(now))
     }
 
     private static func clientDataHashForAttestation(
         challenge: String,
         deviceID: String,
         keyID: String
     ) -> Data {
         let canonical = [
             "crossmate-appattest-v1",
             challenge,
             deviceID,
             keyID
         ].joined(separator: "\n")
         return Data(SHA256.hash(data: Data(canonical.utf8)))
     }
 
     static func canonicalRequest(
         method: String,
         path: String,
         bodyHash: String,
         timestamp: String,
         nonce: String,
         deviceID: String,
         keyID: String
     ) -> String {
         [
             "crossmate-push-request-v1",
             method.uppercased(),
             path,
             bodyHash,
             timestamp,
             nonce,
             deviceID,
             keyID
         ].joined(separator: "\n")
     }
 
     private struct ChallengeRequest: Encodable {
         var deviceID: String
         var keyID: String
     }
 
     private struct ChallengeResponse: Decodable {
         var challenge: String
     }
 
     private struct AttestationRequest: Encodable {
         var deviceID: String
         var keyID: String
         var challenge: String
         var attestationObject: String
     }
 
     private struct PendingEnrollment: Codable {
         var keyID: String
         var networkKeyID: String
         var challenge: String
         var attestation: Data?
     }
 }