Trusted Entitlements: add support for signing POST body

[NachoSoto]

Changes:

• HTTPClient has a new X-Post-Params-Hash request header
• Replaced HTTPRequest.Method.post's Encodable value with a more specific HTTPRequestBody (like HTTPResponseBody)
• HTTPRequestBody allows overriding contentForSignature (it defaults to []) which then Signing uses for the hash
• Fixed LogInOperation not passing the VerificationResult to the result CustomerInfo. This is captured in unit and integration tests now.
• Add support for signing POST requests in Path.logIn and Path.postReceiptData

Depends on https://github.com/RevenueCat/khepri/pull/6246

[NachoSoto]

Separating this sped up compilation from 4 seconds to less than 100ms (not sure exactly how long, but that was the threshold I set for the warning).

[NachoSoto]

These exposed the fact that LogInOperation wasn't forwarding the verification result.

[NachoSoto]

The diff here is horribly hard to read for no reason.
I simply moved 2 tests into a separate class, which is this:

class BackendPostReceiptWithSignatureVerificationTests: BaseBackendPostReceiptDataTests {

    override var verificationMode: Configuration.EntitlementVerificationMode { .informational }

    func testGetsEntitlementsWithVerifiedResponse() {
        self.httpClient.mock(
            requestPath: .postReceiptData,
            response: .init(statusCode: .success,
                            response: Self.validCustomerResponse,
                            verificationResult: .verified)
        )

        let result = waitUntilValue { completed in
            self.backend.post(receiptData: Self.receiptData,
                              productData: nil,
                              transactionData: .init(
                                 appUserID: Self.userID,
                                 presentedOfferingID: nil,
                                 unsyncedAttributes: nil,
                                 storefront: nil,
                                 source: .init(isRestore: false, initiationSource: .purchase)
                              ),
                              observerMode: false,
                              completion: { result in
                completed(result)
            })
        }

        expect(result).to(beSuccess())

        if #available(iOS 13.0, macOS 10.15, tvOS 13.0, watchOS 6.2, *) {
            expect(result?.value?.entitlements.verification) == .verified
        }
    }

    func testGetsEntitlementsWithFailedVerification() {
        self.httpClient.mock(
            requestPath: .postReceiptData,
            response: .init(statusCode: .success,
                            response: Self.validCustomerResponse,
                            verificationResult: .failed)
        )

        let result = waitUntilValue { completed in
            self.backend.post(receiptData: Self.receiptData2,
                              productData: nil,
                              transactionData: .init(
                                 appUserID: Self.userID,
                                 presentedOfferingID: nil,
                                 unsyncedAttributes: nil,
                                 storefront: nil,
                                 source: .init(isRestore: false, initiationSource: .purchase)
                              ),
                              observerMode: false,
                              completion: { result in
                completed(result)
            })
        }

        expect(result).to(beSuccess())

        if #available(iOS 13.0, macOS 10.15, tvOS 13.0, watchOS 6.2, *) {
            expect(result?.value?.entitlements.verification) == .failed
        }
    }

}

[aboedo]

thanks for the heads up!

[NachoSoto]

A test WITH the header is in SignatureVerificationHTTPClientTests below.

[NachoSoto]

⚠️ this was missing! And we had no unit/integration tests for it. We do now.

[NachoSoto]

I had to refactor these using #2769 because of the change to use HTTPRequestBody

[aboedo]

approving for now but let's remember to update the signatures of tests with the keys that don't have expiration set

[aboedo]

nitpick: reading this without knowing how we do signature verification, this seems like it'd be confusing and hard to understand why we'd need a specific header for post parameters. maybe something like postParametersHeaderForSigning(with body:? (also changed to "with" since the others use "with" too

[NachoSoto]

Done.

[aboedo]

thanks for the heads up!

[NachoSoto]

approving for now but let's remember to update the signatures of tests with the keys that don't have expiration set

Doing that in a separate PR 👍🏻

[codecov]

Codecov Report

Merging #2753 (99ed6be) into main (1e12136) will decrease coverage by 0.01%.
The diff coverage is 91.66%.

@@            Coverage Diff             @@
##             main    #2753      +/-   ##
==========================================
- Coverage   86.51%   86.50%   -0.01%     
==========================================
  Files         214      216       +2     
  Lines       15396    15482      +86     
==========================================
+ Hits        13320    13393      +73     
- Misses       2076     2089      +13     

Impacted Files	Coverage Δ
...ources/Networking/HTTPClient/HTTPRequestBody.swift	0.00% <0.00%> (ø)
...urces/Networking/HTTPClient/HTTPResponseBody.swift	100.00% <ø> (ø)
...king/Operations/GetIntroEligibilityOperation.swift	100.00% <ø> (ø)
...king/Operations/PostAdServicesTokenOperation.swift	90.90% <ø> (ø)
...king/Operations/PostAttributionDataOperation.swift	88.88% <ø> (ø)
...king/Operations/PostOfferForSigningOperation.swift	95.89% <ø> (ø)
...Operations/PostSubscriberAttributesOperation.swift	90.69% <ø> (ø)
Sources/Networking/HTTPClient/HTTPClient.swift	97.88% <82.35%> (-0.66%)	⬇️
Sources/Security/HTTPRequestBody+Signing.swift	91.89% <91.89%> (ø)
Sources/FoundationExtensions/Data+Extensions.swift	72.22% <100.00%> (+0.79%)	⬆️
... and 5 more

... and 5 files with indirect coverage changes

[NachoSoto]

Verified integration tests are working with the canary 🎉

[NachoSoto]

Ship it!