#j%XdZddlmZddlZddlZddlZddlZddlmZm Z m Z m Z ddl m Z e ddGdd Ze ddGd d Ze ddGd d ZddlZGddeZGddZdS)z Apple App Attest & DeviceCheck Verification Service for FreeExile. Verifies hardware-backed cryptographic attestation statements from Apple Secure Enclave to guarantee client binary integrity, detect jailbreak/tampering, and prevent emulator bots. ) annotationsN)DictTupleOptionalList) dataclassT)slotsfrozencZeZdZUded<ded<ded<ded<ded<ded<d Zd ed <d S) AttestationTokenstr device_id bundle_idpublic_key_hash signatureintcounter timestamp_msN Optional[str]challenge_nonce)__name__ __module__ __qualname____annotations__r3C:\Projects\FreeExile\server\security\app_attest.pyr r s_NNNNNNNNNLLL%)O))))))rr c\eZdZUded<ded<dZded<dZded<dZded<dZded <d S) ClientEnvironmentInfor r binary_hashFbool is_jailbrokendebugger_attachedsuspicious_dylib_loadedemulation_artifactsN)rrrrr"r#r$r%rrrrrsnNNNM#####$))))) %%%%%%%rrc8eZdZUded<ded<ded<ded<d S) ClientIntegrityResultr! is_trustedfloat risk_scorez List[str]violation_flagsr detailsN)rrrrrrrr'r'%s=LLLLLrr'ceZdZdZdS)AppleAppAttestSecurityErrorzRRaised when insecure simulated attestation is attempted in strict production mode.N)rrr__doc__rrrr.r.0s\\Drr.c^eZdZdZ d%d&d Zd'd(dZd)dZ d*d+dZ d,d-dZd.d Z d/d$Z dS)0AppleAppAttestValidatorz Apple App Attest & Secure Enclave verification service. Implements cryptographic challenge-response handshakes, monotonic counter validation, and client runtime integrity enforcement against jailbreak and emulators. com.freeexile.game.iosSHA256:OFFICIAL_APPLE_CERT_2026Nexpected_bundle_idr expected_binary_hashrequire_production_pkiOptional[bool]returnNonec||_||_|||_nKtjdddv|_i|_i|_ d|_ dS)NFREEEXILE_PRODUCTION_ATTEST>1onyestrues+APPLE_APP_ATTEST_ROOT_CA_SIMULATED_KEY_2026) r4r5r6osenvirongetstriplowerdevice_assertion_countersactive_challenges_attest_root_secret)selfr4r5r6s r__init__z AppleAppAttestValidator.__init__<s #5$8! ! -*@D ' ' ?CCCrrrrr c |jrtdttjdz}t j|d|}|d|d|d|d| }|r|d|z }tj |j |tj}t|||||||S)zJGenerates an authentic mock App Attest token for testing and verification.zjCannot generate mock attestation tokens when require_production_pki/FREEEXILE_PRODUCTION_ATTEST is active.rO_:)rrrrrrr) r6r.rrRhashlibsha256encode hexdigestrXnewrHr ) rIrrrrr\ pub_key_hash sign_datars rgenerate_mock_attestationz1AppleAppAttestValidator.generate_mock_attestationcs  & -| TY[[4'((~&@&@Y&@&@&G&G&I&IJJTTVV  PP9PP|PPgPPPP  / ._.. .IHT5y7G7G7I7I7>ZZddff (+    rtokenrequired_challengeTuple[bool, str]c ^|jrdS|jdkrdS|F|jrtj|j|sdS||j|jsdSn7|j|jvr)|jr ||j|jsdS|j|j krdd |jd |j d fS|jd |jd |j d |jd |j }|jr |d |jz }tj |j |tj}tj|j|sd S|j|j}||j|krdd|jd|dfS|j|j|j<dS)z Validates hardware attestation statement from Apple Secure Enclave. Verifies bundle ID, challenge match, cryptographic signature, and counter monotonicity. )FzProduction hardware attestation failure: Simulated HMAC tokens rejected. Apple ASN.1 X.509 PKI certificate chain verification required.r)Fz4Invalid assertion counter. Counter must be positive.N)Fz6Challenge mismatch or expired. Replay attack rejected.)Fz>Challenge already consumed or expired. Replay attack rejected.)FzIPending challenge verification failed or missing. Replay attack rejected.FzInvalid bundle identifier 'z ', expected 'z'. Binary tampering detected.ra)FzQInvalid cryptographic attestation signature. Untrusted hardware or hook detected.zrs #"""""  ............!!!!!! d###*******$#* d###&&&&&&&$#& d###$#      ,   z z z z z z z z z z r