Native/Mobile Application Integration with Corbado Connect

import CorbadoConnect
import Foundation

class AppBackend {
    /// Get connect token from backend (which gets it from Corbado Backend API)
    static func getConnectToken(connectTokenType: ConnectTokenType, accessToken: String) async throws -> String {
        // 1. Set up request
        let urlString = "https://<your-backend>/auth/createConnectToken"
        guard let url = URL(string: urlString) else {
            throw URLError(.badURL)
        }

        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")

        let requestPayload = GetConnectTokenRequest(
            connectTokenType: connectTokenType.rawValue
        )
        
        do {
            let jsonData = try JSONEncoder().encode(requestPayload)
            request.httpBody = jsonData
        } catch {
            throw error
        }

        // 2. Perform request
        let (data, response) = try await URLSession.shared.data(for: request)

        // 3. Check response
        guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
            let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
            print("Error: HTTP Status Code \(statusCode)")
            
            // You might want to try decoding error details from 'data' here if your API
            // provides them or a custom error
            throw URLError(.badServerResponse)
        }

        // 4. Decode the JSON response
        do {
            let decodedResponse = try JSONDecoder().decode(GetConnectTokenResponse.self, from: data)
            return decodedResponse.connectToken
        } catch {
            print("Error decoding JSON response: \(error)")
            
            if let responseString = String(data: data, encoding: .utf8) {
                print("Raw response string: \(responseString)")
            }
            
            throw error
        }
    }

    /// Complete the login process by verifying signedPasskeyData with backend and obtaining an access token
    /// If you are using an external Identity Provider (IdP) such as Amazon Cognito or Firebase, 
    /// you can delegate the verification process to those systems by making a call to them.
    static func completeLogin(signedPasskeyData: String) async throws -> (Bool, String) {
        // 1. Set up request
        let urlString = "https://<your-backend>/auth/completeLogin"
        guard let url = URL(string: urlString) else {
            throw URLError(.badURL)
        }

        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")

        let requestPayload = CompleteLoginRequest(
            signedPasskeyData: signedPasskeyData
        )
        
        do {
            let jsonData = try JSONEncoder().encode(requestPayload)
            request.httpBody = jsonData
        } catch {
            throw error
        }

        // 2. Perform request
        let (data, response) = try await URLSession.shared.data(for: request)

        // 3. Check response
        guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
            let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
            print("Error: HTTP Status Code \(statusCode)")
            
            // You might want to try decoding error details from 'data' here if your API
            // provides them or a custom error
            throw URLError(.badServerResponse)
        }

        // 4. Decode the JSON response
        do {
            let decodedResponse = try JSONDecoder().decode(CompleteLoginResponse.self, from: data)
            return (decodedResponse.success, decodedResponse.accessToken)
        } catch {
            print("Error decoding JSON response: \(error)")
            
            if let responseString = String(data: data, encoding: .utf8) {
                print("Raw response string: \(responseString)")
            }
            
            throw error
        }
    }
}

struct GetConnectTokenRequest: Codable {
    let connectTokenType: String
}

struct GetConnectTokenResponse: Codable {
    let connectToken: String
}

struct CompleteLoginRequest: Codable {
    let signedPasskeyData: String
}

struct CompleteLoginResponse: Codable {
    let success: Bool
    let accessToken: String
}

import com.corbado.connect.core.ConnectTokenType
import kotlinx.serialization.Serializable
import kotlinx.serialization.json.Json
import java.io.BufferedReader
import java.io.InputStreamReader
import java.io.OutputStreamWriter
import java.net.HttpURLConnection
import java.net.URL

object AppBackend {
    // Get connect token from backend (which gets it from Corbado Backend API)
    suspend fun getConnectToken(
        connectTokenType: ConnectTokenType,
        accessToken: String
    ): Result<String> {
        return try {
            // 1. Set up request
            val request = GetConnectTokenRequest(connectTokenType)
            val jsonRequest = Json.encodeToString(GetConnectTokenRequest.serializer(), request)

            // 2. Perform request
            val urlString = "https://<your-backend>/auth/createConnectToken"
            val url = URL(urlString)
            val connection = url.openConnection() as HttpURLConnection
            connection.requestMethod = "POST"
            connection.setRequestProperty("Content-Type", "application/json")
            connection.setRequestProperty("Authorization", "Bearer $accessToken")
            connection.doOutput = true

            val writer = OutputStreamWriter(connection.outputStream)
            writer.write(jsonRequest)
            writer.flush()

            // 3. Check response
            val reader = BufferedReader(InputStreamReader(connection.inputStream))
            val response = reader.readText()

            // 4. Decode the JSON response
            val jsonResponse = Json.decodeFromString(GetConnectTokenResponse.serializer(), response)

            Result.success(jsonResponse.connectToken)
        } catch (e: Exception) {
            Result.failure(e)
        }
    }

    // Complete the login process by verifying signedPasskeyData with backend and obtaining an access token
    // If you are using an external Identity Provider (IdP) such as Amazon Cognito or Firebase,
    // you can delegate the verification process to those systems by making a call to them.
    suspend fun completeLogin(signedPasskeyData: String): Result<Pair<Boolean, String>> {
        return try {
            // 1. Set up request
            val request = CompleteLoginRequest(signedPasskeyData)
            val jsonRequest = Json.encodeToString(CompleteLoginRequest.serializer(), request)

            // 2. Perform request
            val urlString = "https://<your-backend>/auth/completeLogin"
            val url = URL(urlString)
            val connection = url.openConnection() as HttpURLConnection
            connection.requestMethod = "POST"
            connection.setRequestProperty("Content-Type", "application/json")
            connection.doOutput = true

            val writer = OutputStreamWriter(connection.outputStream)
            writer.write(jsonRequest)
            writer.flush()

            // 3. Check response
            val reader = BufferedReader(InputStreamReader(connection.inputStream))
            val response = reader.readText()

            // 4. Decode the JSON response
            val jsonResponse = Json.decodeFromString(CompleteLoginResponse.serializer(), response)

            Result.success(Pair(jsonResponse.success, jsonResponse.accessToken))
        } catch (e: Exception) {
            Result.failure(e)
        }
    }
}

@Serializable
data class GetConnectTokenRequest(
    val connectTokenType: ConnectTokenType,
)

@Serializable
data class GetConnectTokenResponse(
    val connectToken: String
)

@Serializable
data class CompleteLoginRequest(
    val signedPasskeyData: String
)

@Serializable
data class CompleteLoginResponse(
    val success: Boolean,
    val accessToken: String
)

// In your ViewModel or screen logic
let nextStep = await corbado.isAppendAllowed(connectTokenProvider: { _ in
    // Provide the access token of the currently logged-in user.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyAppend, accessToken: "access-token-of-user")
}, situation: .postLogin)

switch nextStep {
case .askUserForAppend(let autoAppend, _, let conditionalAppend, let customData):
    if autoAppend {
        // Passkey Intelligence determined the user is highly likely to convert.
        // You can immediately trigger the passkey creation ceremony or adjust the UI
        // to encourage immediate action. For now, we'll simply show the screen.
    }
    
    // Render the screen as shown above, allowing the user to initiate.
case .skip:
    // The user is not eligible for passkey append at this time.
    // You should skip this screen and navigate them to the main part of your app.
    break
}

// In your ViewModel or screen logic
val nextStep = corbado.isAppendAllowed(connectTokenProvider = { _ ->
    val result = AppBackend.getConnectToken(ConnectTokenType.PasskeyAppend, "access-token-of-user")
    if (result.isFailure) {
        throw ConnectTokenError("Could not get connect token")
    }

    result.getOrThrow()
}, situation = AppendSituationType.PostLogin)

when (nextStep) {
    is ConnectAppendStep.AskUserForAppend -> {
        if (nextStep.autoAppend) {
            // Passkey Intelligence determined the user is highly likely to convert.
            // You can immediately trigger the passkey creation ceremony or adjust the UI
            // to encourage immediate action. For now, we'll simply show the screen.
        }
        
        // Render the screen as shown above, allowing the user to initiate.
    }

    is ConnectAppendStep.Skip -> {
        // The user is not eligible for passkey append at this time.
        // You should skip this screen and navigate them to the main part of your app.
    }
}

// In your button's action handler
let response = await corbado.completeAppend()

switch response {
case .completed:
    // Success! The passkey was created and associated with the user's account.
    // Navigate to a success screen or the next part of your app.
    break

case .cancelled:
    // The user manually cancelled the native iOS prompt.
    // No action is typically needed; the user remains on the current screen.
    break

case .excludeCredentialsMatch:
    // A passkey from this device already exists for the user.
    // This is not an error. Inform the user gracefully.
    break

case .error:
    // An unexpected error occurred during the process.
    // You can either display an error message to the user or
    // choose to silently skip/ignore the error.
    break
}

// In your button's action handler
when(val result = corbado.completeAppend(activityContext)) {
    is ConnectAppendStatus.Completed -> {
        // Success! The passkey was created and associated with the user's account.
        // Navigate to a success screen or the next part of your app.
    }
    ConnectAppendStatus.Cancelled -> {
        // The user manually cancelled the native prompt.
        // No action is typically needed; the user remains on the current screen.
    }
    ConnectAppendStatus.ExcludeCredentialsMatch -> {
        // A passkey from this device already exists for the user.
        // This is not an error. Inform the user gracefully.
    }
    else -> {
        // An unexpected error occurred during the process.
        // You can either display an error message to the user or
        // choose to silently skip/ignore the error.
    }
}

let nextStep = await corbado.isLoginAllowed()
switch nextStep {
case .initTextField(let cuiChallenge, _):
    // If cuiChallenge is not nil, handle "Overlay Login",
    // otherwise handle "Textfield Login" (see below)
    break
    
case .initOneTap(let email):
    // Handle "One-Tap Login" (see below)
    break

case .initFallback(_, _):
    // Handle "Fallback Login" (see below)
    break
}

when (val nextStep = corbado.isLoginAllowed()) {
    is ConnectLoginStep.InitTextField -> {
        // If challenge is not null, handle "Overlay Login",
        // otherwise handle "Textfield Login" (see below)
    }

    is ConnectLoginStep.InitOneTap -> {
        // Handle "One-Tap Login" (see below)
    }

    is ConnectLoginStep.InitFallback -> {
        // Handle "Fallback Login" (see below)
    }
}

// Take cuiChallenge from .initTextField(), see above. Overlay Login needs a non-nil challenge.
guard let cuiChallenge else { return }
let nextStep = await corbado.loginWithoutIdentifier(cuiChallenge: cuiChallenge, conditionalUI: false) {
    // This closure is called when the Corbado iOS SDK is waiting for a user interaction.
    // You can use it to show a loading indicator.
}

switch nextStep {
case .done(let signedPasskeyData, let username):
    // The passkey ceremony was successful.
    do {
        let (success, accessToken) = try await AppBackend.completeLogin(signedPasskeyData: signedPasskeyData)
        if success {
            // Backend verification successful. You now have a valid access token.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an appropriate error message.
        }
    } catch (let error) {
        // Handle error
    }
    
case .ignore(_):
    // Passkey login was ignored. This is not an error.
    break
    
case .initSilentFallback(let email, _):
    // Passkey login failed silently, and a fallback is configured. The user
    // should now proceed with a different authentication method on your
    // fallback login screen.
    break
    
case .error(let error, let triggerFallback, _, let username):
    if triggerFallback {
        // A fallback has been triggered due to an error.
        // Redirect to your fallback login screen.
    }
        
    switch error {
    case .PasskeyDeletedOnServer(let message):
        // This passkey still exists on the device but was deleted 
        // from the server. Inform the user about this situation.
        break
    default:
        // A generic error occurred. Show a generic error message.
        break
    }
}

// Take challenge from .InitTextField, see above. Overlay Login needs a non-null challenge.
val cuiChallenge = challenge ?: return
val result = corbado.loginWithoutIdentifier(activityContext, cuiChallenge)
when (result) {
    is ConnectLoginWithoutIdentifierStatus.Done -> {
        // The passkey ceremony was successful.
        val (success, accessToken) = AppBackend.completeLogin(result.session).getOrThrow()
        if (success) {
            // Backend verification successful. You now have a valid access token.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an appropriate error message.
        }
    }

    is ConnectLoginWithoutIdentifierStatus.InitSilentFallback -> {
        // Passkey login failed silently, and a fallback is configured. The user
        // should now proceed with a different authentication method on your
        // fallback login screen.
    }

    is ConnectLoginWithoutIdentifierStatus.Error -> {
        if (result.triggerFallback) {
            // A fallback has been triggered due to an error.
            // Redirect to your fallback login screen.
        }

        // A generic error occurred. Show a generic error message.
    }

    is ConnectLoginWithoutIdentifierStatus.Ignore -> {
        // Passkey login was ignored. This is not an error.
    }
}

// Take email from textfield input
let nextStep = await corbado.loginWithTextField(identifier: email)

switch nextStep {
case .done(let signedPasskeyData, let username):
    // The passkey ceremony was successful.
    do {
        let (success, accessToken) = try await AppBackend.completeLogin(signedPasskeyData: signedPasskeyData)
        if success {
            // Backend verification successful. You now have a valid access token.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an error message.
        }
    } catch (let error) {
        // Handle error
    }
case .initSilentFallback(let email, _):
    // A fallback is configured. Route to your fallback login screen.
    break
    
case .error(let error, let triggerFallback, _, let username):
    if triggerFallback {
        // A fallback has been triggered. Route to your fallback login screen.
    }
    
    switch error {
    case .UserNotFound:
        // No user account matches the provided identifier.
        // Follow your account-enumeration policy when presenting a message.
        break
    default:
        // A generic error occurred.
        break
    }
    
case .initRetry:
    // The operation can be retried. You might want to show a retry button to the user.
    break
}

// Take email from textfield input
val result = corbado.loginWithTextField(activityContext, email)
when (result) {
    is ConnectLoginWithIdentifierStatus.Done -> {
        // The passkey ceremony was successful.
        val (success, accessToken) = AppBackend.completeLogin(result.session).getOrThrow()
        if (success) {
            // Backend verification successful. You now have a valid access token.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an appropriate error message.
        }
    }
    is ConnectLoginWithIdentifierStatus.InitSilentFallback -> {
        // A fallback is configured. Route to your fallback login screen.
    }
    is ConnectLoginWithIdentifierStatus.Error -> {
        if (result.triggerFallback) {
            // A fallback has been triggered. Route to your fallback login screen.
        }
        
        // A generic error occurred.
    }
    is ConnectLoginWithIdentifierStatus.InitRetry -> {
        // The operation can be retried. You might want to show a retry button to the user.
    }
}

let nextStep = await corbado.loginWithOneTap()

// Handle the 'nextStep' response just as you would for the 'Textfield Login'
// flow. The possible cases (.done, .error, etc.) are the same.

val result = corbado.loginWithOneTap(activityContext)

// Handle the 'result' response just as you would for the 'Textfield Login'
// flow. The possible cases (.Done, .Error, etc.) are the same.

// This single method both fetches the list of current passkeys and checks
// if the user is eligible to add a new one.
let nextStep = await corbado.isManageAppendAllowed(connectTokenProvider: { _ in
    // Provide a connect token of type 'PasskeyList' to authorize the list operation.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyList, accessToken: "access-token-of-user")
})

switch nextStep {
case .allowed(let passkeys):
    // Success. The user is allowed to add a new passkey.
    // Update your UI state with the `passkeys` array to display them.
    // Your UI should also show an "Add new passkey" button.
    break

case .notAllowed(let passkeys):
    // Success, but with a condition. The user is *not* allowed to add a new passkey.
    // Update your UI state with the `passkeys` array to display them.
    // The "Add new passkey" button should be hidden.
    break

case .error(let error):
    // An error occurred during the process.
    // Handle the error, for example by showing an alert to the user.
    break
}

// This single method both fetches the list of current passkeys and checks
// if the user is eligible to add a new one.
val manageStep = corbado.isManageAppendAllowed { _ ->
    // Provide a connect token of type 'PasskeyList' to authorize the list operation.
    val result = AppBackend.getConnectToken(ConnectTokenType.PasskeyList, "access-token-of-user")
    if (result.isFailure) {
        throw ConnectTokenError("Could not get connect token")
    }

    result.getOrThrow()
}

when (manageStep) {
    is ConnectManageStep.Allowed -> {
        // Success. The user is allowed to add a new passkey.
        // Update your UI state with the `passkeys` array to display them.
        // Your UI should also show an "Add new passkey" button.
    }

    is ConnectManageStep.NotAllowed -> {
        // Success, but with a condition. The user is *not* allowed to add a new passkey.
        // Update your UI state with the `passkeys` array to display them.
        // The "Add new passkey" button should be hidden.
    }

    is ConnectManageStep.Error -> {
        // An error occurred during the process.
        // Handle the error, for example by showing an alert to the user.
    }
}

// This assumes 'passkey' is the Passkey object selected by the user from your UI list.
let status = await corbado.deletePasskey(connectTokenProvider: { connectTokenType in
    // The SDK requests 'PasskeyDelete' for the deletion and 'PasskeyList' for the updated list.
    return try await AppBackend.getConnectToken(connectTokenType: connectTokenType, accessToken: "access-token-of-user")
}, passkeyId: passkey.id)

switch status {
case .done(let passkeys):
    // Deletion was successful.
    // The SDK conveniently returns the updated list of passkeys.
    // You should refresh your UI with this new list.
    break
    
case .error(let error):
    // An error occurred during the deletion process.
    // You should handle the specific error and show an appropriate message to the user.
    break
    
default:
    // A fallback for any other unhandled cases.
    // You could show a generic error message here.
    break
}

// This assumes 'passkeyId' is the ID of the passkey selected by the user from your UI list.
val deleteStatus = corbado.deletePasskey(connectTokenProvider = { connectTokenType ->
    // The SDK requests PasskeyDelete for the deletion and PasskeyList for the updated list.
    val result = AppBackend.getConnectToken(connectTokenType, "access-token-of-user")
    if (result.isFailure) {
        throw ConnectTokenError("Could not get connect token")
    }

    result.getOrThrow()
}, passkeyId = passkeyId)

when (deleteStatus) {
    is ConnectManageStatus.Done -> {
        // Deletion was successful.
        // The SDK conveniently returns the updated list of passkeys.
        // You should refresh your UI with this new list.
    }
    else -> {
        // An error occurred during the deletion process.
        // You should handle the specific error and show an appropriate message to the user.
    }
}

// This would be called when the user taps the "Add new passkey" button in your UI.
let status = await corbado.completePasskeyListAppend { connectTokenType in
    // The SDK requests 'PasskeyAppend' for the creation and 'PasskeyList' for the updated list.
    return try await AppBackend.getConnectToken(connectTokenType: connectTokenType, accessToken: "access-token-of-user")
}

switch status {
case .done(let passkeys):
    // Success! The new passkey was created.
    // The SDK returns the updated list of passkeys, including the new one.
    // You should refresh your UI with this new list.
    break
    
case .passkeyOperationCancelled:
    // The user manually cancelled the native iOS prompt.
    // No action is typically needed, but you could show a transient message.
    break
    
case .error(_):
    // An unexpected error occurred during the process.
    // Display a clear error message to the user.
    break
    
case .passkeyOperationExcludeCredentialsMatch:
    // A passkey from this device already exists for the user.
    // This is not an error. Inform the user gracefully.
    break
}

// This would be called when the user taps the "Add new passkey" button in your UI.
val appendStatus = corbado.completePasskeyListAppend(activityContext, { connectTokenType ->
    // The SDK requests PasskeyAppend for the creation and PasskeyList for the updated list.
    val result = AppBackend.getConnectToken(connectTokenType, "access-token-of-user")
    if (result.isFailure) {
        throw ConnectTokenError("Could not get connect token")
    }

    result.getOrThrow()
})

when (appendStatus) {
    is ConnectManageStatus.Done -> {
        // Success! The new passkey was created.
        // The SDK returns the updated list of passkeys, including the new one.
        // You should refresh your UI with this new list.
    }
    is ConnectManageStatus.PasskeyOperationCancelled -> {
        // The user manually cancelled the native prompt.
        // No action is typically needed, but you could show a transient message.
    }
    is ConnectManageStatus.Error -> {
        // An unexpected error occurred during the process.
        // Display a clear error message to the user.
    }
    is ConnectManageStatus.PasskeyOperationExcludeCredentialsMatch -> {
        // A passkey from this device already exists for the user.
        // This is not an error. Inform the user gracefully.
    }
}