feat: support Google Play Integrity attestation#13
Conversation
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughThunderID Android SDK configuration now supports flow secrets and platform attestation. Flow requests can carry custom headers, the quickstart mints Play Integrity tokens, and Compose action matching accepts additional identifier combinations. ChangesAndroid SDK and quickstart updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant ThunderIDClient
participant PlayIntegrityTokenProvider
participant FlowExecutionClient
participant HttpClient
ThunderIDClient->>PlayIntegrityTokenProvider: requestToken()
PlayIntegrityTokenProvider-->>ThunderIDClient: integrity token
ThunderIDClient->>FlowExecutionClient: initiate with token
FlowExecutionClient->>HttpClient: POST /flow/execute with custom headers
HttpClient-->>FlowExecutionClient: flow response
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@samples/quickstart/README.md`:
- Around line 11-49: Specify the properties language on the fenced configuration
block in the quickstart README by changing its opening fence to use properties
syntax highlighting, while leaving the configuration contents unchanged.
In `@samples/quickstart/src/main/kotlin/dev/thunderid/quickstart/MainActivity.kt`:
- Around line 41-53: Remove the trailing comma from the final argument at
MainActivity.kt lines 41-53 after allowInsecureConnections = BuildConfig.DEBUG.
Also remove the trailing commas at PlayIntegrityTokenProvider.kt lines 46-52
after .build() and ThunderIDClientTest.kt lines 105-110 after
attestationTokenProvider = { "test-token" }; no other call-site formatting
changes are needed.
- Around line 37-50: Update the PlayIntegrityTokenProvider construction in
MainActivity to pass applicationContext instead of the Activity this reference,
while leaving the ThunderIDConfig wiring and token-provider callback unchanged.
In `@src/main/kotlin/dev/thunderid/android/auth/FlowExecutionClient.kt`:
- Around line 59-61: Wrap the `attestationTokenHeaders` function declaration and
expression across multiple lines so each line remains within the 120-character
limit, preserving its current nullable-token header mapping behavior.
In
`@src/main/kotlin/dev/thunderid/compose/components/presentation/auth/SignIn.kt`:
- Around line 143-147: Extract the repeated FlowAction-to-FlowComponent
predicate into a private FlowAction.matches helper in SignIn.kt. Update
src/main/kotlin/dev/thunderid/compose/components/presentation/auth/SignIn.kt
lines 143-147 in enrichActions and lines 332-336 in ActionComponentView to call
this helper, preserving the existing matching order and behavior at both sites.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4414eb7d-7448-4288-8b41-9bbd4fac329b
📒 Files selected for processing (12)
samples/quickstart/README.mdsamples/quickstart/build.gradle.ktssamples/quickstart/config.properties.examplesamples/quickstart/src/main/kotlin/dev/thunderid/quickstart/MainActivity.ktsamples/quickstart/src/main/kotlin/dev/thunderid/quickstart/PlayIntegrityTokenProvider.ktsrc/main/kotlin/dev/thunderid/android/ThunderIDClient.ktsrc/main/kotlin/dev/thunderid/android/ThunderIDConfig.ktsrc/main/kotlin/dev/thunderid/android/auth/FlowExecutionClient.ktsrc/main/kotlin/dev/thunderid/android/http/HttpClient.ktsrc/main/kotlin/dev/thunderid/compose/components/presentation/auth/SignIn.ktsrc/test/kotlin/dev/thunderid/android/ThunderIDClientTest.ktsrc/test/kotlin/dev/thunderid/compose/components/presentation/auth/SignInTest.kt
2e558c1 to
724c62f
Compare
Native sign-in/sign-up flows had no way to prove they originate from a genuine, unmodified app install. Add an attestationTokenProvider hook on ThunderIDConfig; when set, its token is attached to flow-initiate requests via an Attestation-Token header. The quickstart sample wires this to the Play Integrity Standard API.
724c62f to
2a6d9eb
Compare
2 participants
Purpose
Native (app-native, Flow Execution API) sign-in and sign-up requests have no way to prove they originate from a genuine, unmodified install of the app — anyone can call
/flow/executedirectly with a validapplicationId. This adds support for attaching a platform attestation token (e.g. Google Play Integrity) to flow-initiate requests.Approach
ThunderIDConfig.attestationTokenProvider: (suspend () -> String)?— an app-supplied hook, since obtaining a platform attestation token is app/platform-specific and shouldn't live in the core SDK.ThunderIDClient.signIn/signUpinvoke the provider (when set) and pass the resulting token toFlowExecutionClient.initiate, which attaches it as anAttestation-Tokenheader.PlayIntegrityTokenProvider, configured throughTHUNDERID_ATTESTATION_ENABLED/THUNDERID_CLOUD_PROJECT_NUMBERinconfig.properties.ThunderIDClientTestandSignInTest.mainand resolved a conflict inSignIn.kt's action/component matching logic (keptmain's existing implementation, just widenedenrichActionsvisibility tointernalfor the new test).Related Issues
Related PRs
Checklist
Security checks