App Attest iOS 27 Enhancements

 import SwiftUI
 import DeviceCheck
 import CryptoKit
 
−// Pre-iOS 27 App Attest integration
−// Limitations:
−//  - macOS was NOT supported at all
−//  - authenticator data had NO extensions (no launchValidationCategory, no bundleVersion)
−//  - isSupported returned false for Action/SSO extensions
+// MARK: - App Attest Manager
 
−actor LegacyAppAttestManager {
−    static let shared = LegacyAppAttestManager()
+actor AppAttestManager {
+    static let shared = AppAttestManager()
     private let service = DCAppAttestService.shared
−    private let keychainKey = "com.myapp.legacyAttestKeyID"
+    private let keychainKey = "com.myapp.attestKeyID"
 
−    var isSupported: Bool { service.isSupported }
+    // Step 1: Check support (new: also available on macOS 27, more extension types)
+    var isSupported: Bool {
+        service.isSupported
+    }
 
+    // Step 2: Generate or retrieve a key ID
     func getOrCreateKeyID() async throws -> String {
−        if let existing = loadKeyIDFromKeychain() { return existing }
+        if let existing = loadKeyIDFromKeychain() {
+            return existing
+        }
         let keyID = try await service.generateKey()
         saveKeyIDToKeychain(keyID)
         return keyID
     }
 
+    // Step 3: Attest the key using a server-vended challenge
     func attestKey(keyID: String, serverChallenge: Data) async throws -> Data {
+        // Hash the challenge as required by the App Attest API
         let challengeHash = Data(SHA256.hash(data: serverChallenge))
−        // Returns attestation WITHOUT extensions in authenticator data
−        // Server sees only: rpIdHash, flags, counter, AAGUID, credentialID
−        // No launchValidationCategory, no bundleVersion, no ACL Blob OID
−        return try await service.attestKey(keyID, clientDataHash: challengeHash)
+        let attestation = try await service.attestKey(keyID, clientDataHash: challengeHash)
+        return attestation
     }
 
+    // Step 4: Generate an assertion for a payload (local, no Apple server round-trip)
     func generateAssertion(keyID: String, payload: Data) async throws -> Data {
         let payloadHash = Data(SHA256.hash(data: payload))
         return try await service.generateAssertion(keyID, clientDataHash: payloadHash)
     }
 
+    // MARK: - Keychain helpers (simplified)
     private func saveKeyIDToKeychain(_ keyID: String) {
         let data = Data(keyID.utf8)
         let query: [CFString: Any] = [
             kSecClass: kSecClassGenericPassword,
             kSecAttrAccount: keychainKey,
             kSecValueData: data,
             kSecAttrAccessible: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
         ]
         SecItemDelete(query as CFDictionary)
         SecItemAdd(query as CFDictionary, nil)
     }
 
     private func loadKeyIDFromKeychain() -> String? {
         let query: [CFString: Any] = [
             kSecClass: kSecClassGenericPassword,
             kSecAttrAccount: keychainKey,
             kSecReturnData: true,
             kSecMatchLimit: kSecMatchLimitOne
         ]
         var result: AnyObject?
         guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
               let data = result as? Data else { return nil }
         return String(data: data, encoding: .utf8)
     }
 }
 
−struct LegacyAppAttestDemoView: View {
−    @State private var log: [String] = []
+// MARK: - SwiftUI Demo View
 
+struct AppAttestDemoView: View {
+    @State private var statusLog: [String] = []
+    @State private var isWorking = false
+
     var body: some View {
−        List(log, id: \.self) { Text($0).font(.caption) }
−            .navigationTitle("App Attest (pre-iOS 27)")
+        NavigationStack {
+            List(statusLog, id: \.self) { entry in
+                Text(entry)
+                    .font(.system(.caption, design: .monospaced))
+                    .foregroundStyle(entry.hasPrefix("✅") ? .green :
+                                     entry.hasPrefix("❌") ? .red : .primary)
+            }
+            .navigationTitle("App Attest iOS 27")
             .toolbar {
−                ToolbarItem {
−                    Button("Run") { Task { await run() } }
+                ToolbarItem(placement: .primaryAction) {
+                    Button(isWorking ? "Working…" : "Run Attestation") {
+                        Task { await runAttestation() }
+                    }
+                    .disabled(isWorking)
                 }
             }
+        }
     }
 
     @MainActor
−    private func run() async {
−        log.removeAll()
−        // macOS: would crash or return isSupported == false
−        // Extensions in authenticator data: not present — server gets no env info
−        let mgr = LegacyAppAttestManager.shared
+    private func runAttestation() async {
+        isWorking = true
+        statusLog.removeAll()
+
+        let mgr = AppAttestManager.shared
+
         guard await mgr.isSupported else {
−            log.append("Not supported"); return
+            statusLog.append("❌ App Attest not supported on this device/extension type")
+            isWorking = false
+            return
         }
+        statusLog.append("✅ App Attest is supported")
+
         do {
             let keyID = try await mgr.getOrCreateKeyID()
−            log.append("Key: " + keyID.prefix(16))
−            let attestation = try await mgr.attestKey(
−                keyID: keyID,
−                serverChallenge: Data(UUID().uuidString.utf8)
−            )
−            log.append("Attestation: \(attestation.count) bytes — NO env extensions")
+            statusLog.append("✅ Key ID: " + keyID.prefix(16) + "...")
+
+            // Simulate a server-vended challenge (in production, fetch from your server)
+            let fakeChallenge = Data(UUID().uuidString.utf8)
+            let attestation = try await mgr.attestKey(keyID: keyID,
+                                                      serverChallenge: fakeChallenge)
+            statusLog.append("✅ Attestation received (\(attestation.count) bytes)")
+            statusLog.append("ℹ️ Send to server to validate authenticator data extensions:")
+            statusLog.append("   • launchValidationCategory (NEW iOS 27)")
+            statusLog.append("   • bundleVersion            (NEW iOS 27)")
+            statusLog.append("   • ACL Blob OID             (NEW macOS 27)")
+
+            // Generate an assertion for a sample payload
+            let payload = Data("{ \"action\": \"submitScore\", \"score\": 9999 }".utf8)
+            let assertion = try await mgr.generateAssertion(keyID: keyID, payload: payload)
+            statusLog.append("✅ Assertion generated (\(assertion.count) bytes) — embed in server request")
         } catch {
−            log.append("Error: \(error)")
+            statusLog.append("❌ Error: \(error.localizedDescription)")
         }
+
+        isWorking = false
     }
 }
 
−#Preview { LegacyAppAttestDemoView() }
+#Preview {
+    AppAttestDemoView()
+}