iOS 安全：Keychain、生物识别与传输安全

let url = documentsURL.appendingPathComponent("secrets.json")
try data.write(to: url, options: [.completeFileProtection])

import Security

enum Keychain {
    static func save(_ data: Data, service: String, account: String) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
        ]
        SecItemDelete(query as CFDictionary)          // 先删再加，避免 duplicate
        var attributes = query
        attributes[kSecValueData as String] = data
        let status = SecItemAdd(attributes as CFDictionary, nil)
        guard status == errSecSuccess else { throw KeychainError(status) }
    }

    static func read(service: String, account: String) throws -> Data {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne,
        ]
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        guard status == errSecSuccess, let data = result as? Data else {
            throw KeychainError(status)
        }
        return data
    }
}

var error: Unmanaged<CFError>?
guard let access = SecAccessControlCreateWithFlags(
    nil,
    kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
    [.biometryCurrentSet, .privateKeyUsage],   // 当前生物特征集合 + 私钥用途
    &error
) else { throw KeychainError.accessControl }

let attributes: [String: Any] = [
    kSecClass as String: kSecClassKey,
    kSecAttrApplicationTag as String: keyTag,
    kSecAttrAccessControl as String: access,
    kSecValueData as String: privateKeyData,
]
SecItemAdd(attributes as CFDictionary, nil)

let query: [String: Any] = [
    kSecClass as String: kSecClassKey,
    kSecAttrApplicationTag as String: keyTag,
    kSecReturnData as String: true,
    kSecUseOperationPrompt as String: "解锁以继续",   // 弹窗文案
]
var item: CFTypeRef?
let status = SecItemCopyMatching(query as CFDictionary, &item)
if status == errSecUserCanceled { /* 用户取消 */ }

import LocalAuthentication

func authenticate() async throws -> Bool {
    let context = LAContext()
    context.localizedCancelTitle = "使用密码"

    var error: NSError?
    guard context.canEvaluatePolicy(.deviceOwnerAuthentication, error: &error) else {
        throw AuthError.unavailable(error)
    }

    return try await context.evaluatePolicy(
        .deviceOwnerAuthentication,
        localizedReason: "验证身份以查看账户信息"
    )
}

// 正确姿势：生物识别保护密钥，而不是保护「判断」
func unlock() async throws -> Data {
    let context = LAContext()
    _ = try await context.evaluatePolicy(.deviceOwnerAuthentication,
                                         localizedReason: "解锁保险箱")
    // 取出的条目本身由 SecAccessControl 保护，绕过 evaluatePolicy 也拿不到
    return try Keychain.read(service: "vault", account: "masterKey",
                             context: context)
}

import CryptoKit

func makeSecureEnclaveKey(tag: String) throws -> SecureEnclave.P256.Signing.PrivateKey {
    var error: Unmanaged<CFError>?
    guard let access = SecAccessControlCreateWithFlags(
        nil, kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
        [.privateKeyUsage, .biometryCurrentSet], &error
    ) else { throw KeychainError.accessControl }

    return try SecureEnclave.P256.Signing.PrivateKey(
        accessControl: access,
        authenticationContext: LAContext()
    )
}

// 签名：私钥不出芯片
func sign(_ payload: Data, with key: SecureEnclave.P256.Signing.PrivateKey) throws -> Data {
    try key.signature(for: payload).derRepresentation
}

<!-- 不推荐：全局关闭 ATS -->
<key>NSAppTransportSecurity</key>
<dict><key>NSAllowsArbitraryLoads</key><true/></dict>

<!-- 推荐：只对特定域名例外 -->
<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>legacy.example.com</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key><true/>
      <key>NSIncludesSubdomains</key><true/>
    </dict>
  </dict>
</dict>

final class PinningDelegate: NSObject, URLSessionDelegate {
    private let pinnedHashes: Set<String>   // SPKI 的 SHA-256 base64

    func urlSession(_ session: URLSession,
                    didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition,
                                                  URLCredential?) -> Void) {
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
              let trust = challenge.protectionSpace.serverTrust else {
            completionHandler(.performDefaultHandling, nil); return
        }

        // 校验 SPKI 哈希，而不是整张证书
        guard let chain = SecTrustCopyCertificateChain(trust) as? [SecCertificate],
              let leaf = chain.first,
              pinnedHashes.contains(spkiHash(of: leaf)) else {
            completionHandler(.cancelAuthenticationChallenge, nil); return
        }
        completionHandler(.useCredential, URLCredential(trust: trust))
    }
}

func isJailbroken() -> Bool {
    // 1. 可疑文件路径
    let paths = ["/Applications/Cydia.app", "/Library/MobileSubstrate/MobileSubstrate.dylib",
                 "/bin/bash", "/usr/sbin/sshd", "/etc/apt"]
    if paths.contains(where: { FileManager.default.fileExists(atPath: $0) }) { return true }

    // 2. 能否写出沙箱外
    let testPath = "/private/jailbreak_test.txt"
    do {
        try "test".write(toFile: testPath, atomically: true, encoding: .utf8)
        try FileManager.default.removeItem(atPath: testPath)
        return true
    } catch { }

    // 3. 能否打开 cydia:// scheme
    if let url = URL(string: "cydia://package/com.example.package"),
       UIApplication.shared.canOpenURL(url) { return true }

    // 4. 检查 dyld 镜像里是否注入了可疑库
    let suspicious = ["MobileSubstrate", "SubstrateLoader", "FridaGadget", "cynject"]
    for i in 0..<_dyld_image_count() {
        if let name = String(validatingUTF8: _dyld_get_image_name(i)),
           suspicious.contains(where: { name.contains($0) }) { return true }
    }
    return false
}

let service = DCAppAttestService.shared
guard service.isSupported else { /* 走降级路径 */ }

service.generateKey { keyID, error in
    service.attestKey(keyID, clientDataHash: hash) { attestation, error in
        api.registerAttestation(attestation)   // 服务端验证并绑定 keyID
    }
}

// 后续请求用 assertion 签名
service.generateAssertion(keyID, clientDataHash: requestHash) { assertion, error in
    // 把 assertion 放进请求头，服务端验签
}