feat: support platform attestation in SDK and sample

[Malith-19]

Purpose

Add platform attestation support to the iOS SDK and quickstart sample, matching the Android SDK (thunder-id/android-sdks#13).

Approach

• ThunderIDConfig gains attestationEnabled + an app-supplied attestationTokenProvider closure (token minting is platform-specific, so it stays out of the core SDK).
• When enabled, the SDK sends the provider's token as an Attestation-Token header on native flow-initiate requests (validated in ThunderIDClient).
• The quickstart sample wires an AppAttestTokenProvider (Apple App Attest), gated by THUNDERID_ATTESTATION_ENABLED.

Related Issues

• Support Android and IOS SDK and samples to support attestation feature. thunderid#4126

Related PRs

• Android: feat: support Google Play Integrity attestation android-sdks#13

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified. (pending on-device attestation test)
• Documentation provided. (sample README)
• Tests provided.
  • Unit Tests
  • Integration Tests
• Breaking changes.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• New Features
  • Added optional Apple App Attest support for sign-in and sign-up flow initiation.
  • Added configurable attestation settings and token provider support.
  • Included a Quickstart implementation that generates and persists App Attest tokens.
  • Added configuration guidance and end-to-end testing requirements.
• Bug Fixes
  • Added validation to prevent enabled attestation without a token provider.
• Tests
  • Added coverage for default, invalid, and valid attestation configurations.

[coderabbitai]

📝 Walkthrough

Walkthrough

The SDK adds optional Apple App Attest configuration, token generation, validation, and propagation through sign-in and sign-up flow initiation. The Quickstart sample documents and configures the feature, while tests cover default and validated configurations.

Changes

Platform attestation support

Layer / File(s)	Summary
Quickstart App Attest provider and wiring Samples/Quickstart/Sources/AppAttestTokenProvider.swift, Samples/Quickstart/Sources/App.swift, Samples/Quickstart/Sources/Config.plist.example, Samples/Quickstart/README.md	The sample generates persisted App Attest attestation or assertion envelopes, conditionally enables the provider from plist configuration, and documents testing requirements.
SDK attestation configuration and flow initiation Sources/ThunderID/ThunderIDConfig.swift, Sources/ThunderID/ThunderIDClient.swift, Tests/ThunderIDTests/ThunderIDClientTests.swift	The SDK adds attestation settings, validates required providers, resolves tokens during sign-in and sign-up initiation, and tests default, invalid, and valid configurations.
Attestation header transport Sources/ThunderID/auth/FlowExecutionClient.swift, Sources/ThunderID/http/HTTPClient.swift	Optional tokens are sent as Attestation-Token headers on flow execution requests, and HTTP POST supports caller-provided headers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• thunder-id/thunderid#4126 — Directly covers adding iOS SDK and Quickstart Apple App Attest support.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: adding platform attestation support to the SDK and sample.
Description check	✅ Passed	The description covers purpose, approach, related issue/PRs, checklist items, and security checks, matching the template well.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Malith-19]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Samples/Quickstart/Sources/AppAttestTokenProvider.swift`:
- Around line 105-108: Update makeChallenge() to check the OSStatus returned by
SecRandomCopyBytes instead of discarding it. If the call fails, populate the
32-byte challenge using Swift’s SystemRandomNumberGenerator; otherwise preserve
the existing securely generated bytes and return them as Data.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ce928db-74d2-4d1b-a76d-62e79f401c77

📥 Commits

Reviewing files that changed from the base of the PR and between 34890c7 and bc81190.

📒 Files selected for processing (9)

• Samples/Quickstart/README.md
• Samples/Quickstart/Sources/App.swift
• Samples/Quickstart/Sources/AppAttestTokenProvider.swift
• Samples/Quickstart/Sources/Config.plist.example
• Sources/ThunderID/ThunderIDClient.swift
• Sources/ThunderID/ThunderIDConfig.swift
• Sources/ThunderID/auth/FlowExecutionClient.swift
• Sources/ThunderID/http/HTTPClient.swift
• Tests/ThunderIDTests/ThunderIDClientTests.swift