AppIntegrityModuleApi

Returns a DeviceBindingApi that talks to the Unblu server over REST. Call once and reuse.

Pass the same UnbluClientConfiguration you will later hand to UnbluClient. Building the configuration does not initialize the SDK, so this can run first. The binding reads everything it needs from it — unbluBaseUrl, entryPath, preferencesStorage (so it reuses / persists the shared device id), customCookies (always sent), and authenticationChallengeDelegate (+ the PKCS#12 the host configured) for mutual TLS (mTLS) — which keeps it consistent with the initialized SDK.

The UserDefaults key under which the App Attest key ID is stored.

The shared instance.

Checks the App Store for an available update and compares it with the current app version.

Workflow:

1. Retrieves the current app version and bundle identifier from the app’s info dictionary.
2. Constructs the App Store lookup URL using the bundle identifier.
3. Makes a network request to fetch the app details from the App Store.
4. Parses the response to extract the latest available version and compare it with the current version.
5. Invokes the completion handler with the update status and relevant App Store details.

Opens the App Store page for the application to prompt the user to update.

Workflow:

1. Constructs the App Store URL using the provided app ID.
2. Attempts to open the URL in the App Store app.
3. Invokes the completion handler with the success status of opening the App Store.

Checks the security policies of the device, including passcode and biometric authentication.

• Determines if a passcode or biometric authentication is enabled on the device.

• Identifies the type of biometric authentication available (Face ID, Touch ID, or none).

Checks whether the app is running in an emulator (simulator) or under a debugger.

• Detects if the app is being traced (debugged).

• Detects if the app is running in an emulator.

Enables background mode overlay to obscure the app’s content when sent to the background.

• Disables the background mode overlay and removes observers to prevent memory leaks.

Asks Apple to attest to the validity of a generated cryptographic key.

• challenge: A Data object containing a nonce.
• completion: A closure invoked upon completion of the assertion generation.
• The first Data? is a statement from Apple about the validity of the key associated with keyId.
• The second Data? is the key ID as Data.

Generates an assertion to verify the legitimacy of an instance of your app running on a device.

This function should be called:

• After attestKey to obtain the keyId.

• After UnbluClient.getChallenge to obtain the nonce.

The result should be passed to UnbluClient.verifyAssertion for further validation.

Generates a token that identifies the current device.

The app you use to generate the token must be linked to your developer account. Otherwise, the token generation request will fail.

The result should be passed to UnbluClient.verifyDeviceToken for further validation.

Verify the device token generated by generateDeviceToken using the provided agent client.

Retrieves a cryptographic nonce (challenge) using the provided agent client.

Verifies an attestation object using the provided challenge and key identifier.

Verifies an assertion object using the provided challenge and key identifier.

Callbacks required for verifying device integrity with your backend.

Shared verifier used by handleDeviceIntegrityChecks(timeout:).

Runs the device integrity flow using the shared verifier and blocks until it completes or times out.

Runs the device integrity flow with the verifier provided and blocks until it completes or times out.

Runs the device integrity flow asynchronously and calls completion with the result.

Example:

let unbluAgent = Unblu.createAgentClient(withConfiguration: condig)
let api = AppIntegrityModuleApi.instance

let verifier = AppIntegrityModuleApi.DeviceIntegrityVerifier(
    verifyDeviceToken: { token, completion in
        api.verifyDeviceToken(unbluAgent: unbluAgent, token: token, completion: completion)
    },
    getChallenge: { completion in
        api.getChallenge(unbluAgent: unbluAgent, completion: completion)
    },
    verifyAttestation: { attestation, challenge, keyId, completion in
        api.verifyAttestation(
            unbluAgent: unbluAgent,
            attestationObject: attestation,
            challenge: challenge,
            keyId: keyId,
            completion: completion
        )
    },
    verifyAssertion: { assertion, challenge, keyId, completion in
        api.verifyAssertion(
            unbluAgent: unbluAgent,
            assertionObject: assertion,
            challenge: challenge,
            keyId: keyId,
            completion: completion
        )
    }
)

AppIntegrityModuleApi.handleDeviceIntegrityChecks(verifier: verifier) { isOk in
}

Runs the device integrity flow using an UnbluAgentClient.

Steps: 1) Generate a device token and verify it with the backend. 2) Fetch a challenge from the backend. 3) If a keyId exists, generate an assertion and verify it. 4) Otherwise, attest a new key, verify the attestation, then generate and verify the assertion.

Allows checking if the device identifier needs to be generated, as it may not be present in the secure store.

Retrieves the unique device identifier stored in the system. This identifier is generated and stored if it doesn’t already exist. Even if the app is reinstalled, this identifier will remain the same.

Generates a new RSA key pair if none exists in the Keychain.

Signs a given challenge string using the stored private key.

Deletes both private and public keys from the Keychain. After deleting, you can generate a new key pair to re-bind the app.

Returns the existing device-binding public key from the Keychain, encoded as base64 X.509 SubjectPublicKeyInfo. This is the key the device registers with the server during device binding.

The returned value matches the encoding produced by generateKeyPair(). Returns nil if no key pair is currently stored.

Overlays a secure text field on the main window to disable screen capture and recording.

Presents a full-screen SwiftUI QR scanner over the current key window’s topmost view controller. The scanner auto-dismisses on first decoded QR code or when the user taps Cancel.