[App Check] Reset App Attest key state if attestKey fails

[andrewheard]

Resets the stored key ID if attestKey:clientDataHash:completionHandler: fails due to DCErrorInvalidKey. This should resolve App Check / App Attest failures after app reinstallation, device migration, or restoration of a device from a backup (see docs).

[paulb777]

Thanks!

[jostster]

Should the block attempt to retry the query after a reset instead of continuing with the error?

[paulb777]

@jostster My understanding is that the error is the Promises mechanic to trigger a reset.

[jostster]

@paulb777 Gotcha, so clients would still need to look for the specific error and display something to the user to try the action again? Or would there be a way in the sdk to have it auto retry the previous action when this trigger is hit and the key is reset?

[paulb777]

@andrewheard ^

[andrewheard]

My understanding is that the error is the Promises mechanic to trigger a reset.
-- @paulb777

This is accurate. The FIRAppAttestRejectionError isn't propagated to the user. Line 251 will return YES, resulting in the retry block (line 254) being invoked:

firebase-ios-sdk/FirebaseAppCheck/Sources/AppAttestProvider/FIRAppAttestProvider.m

Lines 245 to 255 in 6673e7c

	return [FBLPromise onQueue:self.queue
	attempts:1
	delay:0
	condition:^BOOL(NSInteger attemptCount, NSError *_Nonnull error) {
	// Reset keyID before retrying.
	keyIDForAttempt = nil;
	return [error isKindOfClass:[FIRAppAttestRejectionError class]];
	}
	retry:^FBLPromise<NSArray * /*[keyID, attestArtifact]*/> *_Nullable {
	return [self attestKeyGenerateIfNeededWithID:keyIDForAttempt];
	}]

The Promises documentation on retry might help clarify the mechanics.

@jostster There shouldn't be any need to trigger a reset yourself (handled by the SDK).

[jostster]

Thanks so much, we will undo our temp fix and implement this update. While it will be hard to replicate as we have already reset our key we will keep an eye on it for our end users and file a ticket should there be an edge case to this resolution. Thanks for the quick fix.