Native/Mobile Application Integration with Corbado Connect

import CorbadoConnect
import Foundation

class AppBackend {
    /// Get connectToken from backend (which gets it from Corbado Backend API)
    static func getConnectToken(connectTokenType: ConnectTokenType, accessToken: String) async throws -> String {
        // 1. Set up request
        let urlString = "https://<your-backend>/auth/createConnectToken"
        guard let url = URL(string: urlString) else {
            throw URLError(.badURL)
        }

        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")

        let requestPayload = GetConnectTokenRequest(
            connectTokenType: connectTokenType.rawValue,
            accessToken: accessToken
        )
        
        do {
            let jsonData = try JSONEncoder().encode(requestPayload)
            request.httpBody = jsonData
        } catch {
            throw error
        }

        // 2. Perform request
        let (data, response) = try await URLSession.shared.data(for: request)

        // 3. Check response
        guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
            let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
            print("Error: HTTP Status Code \(statusCode)")
            
            // You might want to try decoding error details from 'data' here if your API
            // provides them or a custom error
            throw URLError(.badServerResponse)
        }

        // 4. Decode the JSON response
        do {
            let decodedResponse = try JSONDecoder().decode(GetConnectTokenResponse.self, from: data)
            return decodedResponse.token
        } catch {
            print("Error decoding JSON response: \(error)")
            
            if let responseString = String(data: data, encoding: .utf8) {
                print("Raw response string: \(responseString)")
            }
            
            throw error
        }
    }

    /// Verify signedPasskeyData with backend (which verifies with Corbado Backend API)
    /// If you are using an external Identity Provider (IdP) such as Amazon Cognito or Firebase, 
    /// you can delegate the verification process to those systems by making a call to them.
    static func verifySignedPasskeyData(signedPasskeyData: String) async throws -> (Bool, String) {
        // 1. Set up request
        let urlString = "https://<your-backend>/auth/verifySignedPasskeyData"
        guard let url = URL(string: urlString) else {
            throw URLError(.badURL)
        }

        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")

        let requestPayload = VerifySignedPasskeyDataRequest(
            signedPasskeyData: signedPasskeyData
        )
        
        do {
            let jsonData = try JSONEncoder().encode(requestPayload)
            request.httpBody = jsonData
        } catch {
            throw error
        }

        // 2. Perform request
        let (data, response) = try await URLSession.shared.data(for: request)

        // 3. Check response
        guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
            let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
            print("Error: HTTP Status Code \(statusCode)")
            
            // You might want to try decoding error details from 'data' here if your API
            // provides them or a custom error
            throw URLError(.badServerResponse)
        }

        // 4. Decode the JSON response
        do {
            let decodedResponse = try JSONDecoder().decode(VerifySignedPasskeyDataResponse.self, from: data)
            return (decodedResponse.success, decodedResponse.accessToken)
        } catch {
            print("Error decoding JSON response: \(error)")
            
            if let responseString = String(data: data, encoding: .utf8) {
                print("Raw response string: \(responseString)")
            }
            
            throw error
        }
    }
}

struct GetConnectTokenRequest: Codable {
    let connectTokenType: String
    let accessToken: String
}

struct GetConnectTokenResponse: Codable {
    let token: String
}

struct VerifySignedPasskeyDataRequest: Codable {
    let signedPasskeyData: String
}

struct VerifySignedPasskeyDataResponse: Codable {
    let success: Bool
    let accessToken: String
}

// In your ViewModel or screen logic
let nextStep = await corbado.isAppendAllowed { _ in
    // Provide the accessToken of the currently logged-in user.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyAppend, accessToken: "access-token-of-user")
}

switch nextStep {
case .askUserForAppend(let autoAppend, _):
    if autoAppend {
        // Passkey Intelligence determined the user is highly likely to convert.
        // You can immediately trigger the passkey creation ceremony or adjust the UI
        // to encourage immediate action. For now, we'll simply show the screen.
    }
    
    // Render the screen as shown above, allowing the user to initiate.
case .skip:
    // The user is not eligible for passkey append at this time.
    // You should skip this screen and navigate them to the main part of your app.
}

// In your button's action handler
let response = await corbado.completeAppend()

switch response {
case .completed:
    // Success! The passkey was created and associated with the user's account.
    // Navigate to a success screen or the next part of your app.

case .cancelled:
    // The user manually cancelled the native iOS prompt.
    // No action is typically needed; the user remains on the current screen.

case .excludeCredentialsMatch:
    // A passkey from this device already exists for the user.
    // This is not an error. Inform the user gracefully.

case .error:
    // An unexpected error occurred during the process.
    // You can either display an error message to the user or
    // choose to silently skip/ignore the error.
}

let nextStep = await corbado.isLoginAllowed()
switch nextStep {
case .initTextField(let cuiChallenge, _):
    // If cuiChallenge is not nil, handle "Overlay Login",
    // otherwise handle "Textfield Login" (see below)
    
case .initOneTap(let email):
    // Handle "One-Tap Login" (see below)

case .initFallback(_, _):
    // Handle "Fallback Login" (see below)
}

// Take cuiChallenge from .initTextField(), see above
let nextStep = await corbado.loginWithoutIdentifier(cuiChallenge: cuiChallenge, conditionalUI: false) {
    // This closure is called when the Corbado iOS SDK is waiting for a user interaction.
    // You can use it to show a loading indicator.
}

switch nextStep {
case .done(let signedPasskeyData, let username):
    // The passkey ceremony was successful.
    do {
        let (success, accessToken) = try await AppBackend.verifySignedPasskeyData(signedPasskeyData: signedPasskeyData)
        if success {
            // Backend verification successful. You now have a valid accessToken.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an appropriate error message.
        }
    } catch (let error) {
        // Handle error
    }
    
case .ignore(_):
    // Passkey login was ignored. This is not an error.
    
case .initSilentFallback(let email, _):
    // Passkey login failed silently, and a fallback is configured. The user
    // should now proceed with a different authentication method on your
    // fallback login screen.
    
case .error(let error, let triggerFallback, _, let username):
    if triggerFallback {
        // A fallback has been triggered due to an error.
        // Redirect to your fallback login screen.
    }
        
    switch error {
    case .PasskeyDeletedOnServer(let message):
        // This passkey still exists on the device but was deleted 
        // from the server. Inform the user about this situation.
    default:
        // A generic error occurred. Show a generic error message.
    }
}

// Take email from textfield input
let nextStep = await corbado.loginWithIdentifier(identifier: email)

switch nextStep {
case .done(let signedPasskeyData, let username):
    // The passkey ceremony was successful.
    do {
        let (success, accessToken) = try await AppBackend.verifySignedPasskeyData(signedPasskeyData: signedPasskeyData)
        if success {
            // Backend verification successful. You now have a valid accessToken.
            // Store the token and navigate the user to the logged-in area of your app.
        } else {
            // Backend verification failed. Show an error message.
        }
    } catch (let error) {
        // Handle error
    }
case .initSilentFallback(let email, _):
    // A fallback is configured. Route to your fallback login screen.
    
case .error(let error, let triggerFallback, _, let username):
    if triggerFallback {
        // A fallback has been triggered. Route to your fallback login screen.
    }
    
    switch error {
    case .UserNotFound:
        // No user account matches the provided identifier.
        // Show an error message like "There is no account registered to that email address."
    default:
        // A generic error occurred.
    }
    
case .initRetry:
    // The operation can be retried. You might want to show a retry button to the user.
}

let nextStep = await corbado.loginWithOneTap()

// Handle the 'nextStep' response just as you would for the 'Textfield Login'
// flow. The possible cases (.done, .error, etc.) are the same.

// This single method both fetches the list of current passkeys and checks
// if the user is eligible to add a new one.
let nextStep = await corbado.isManageAppendAllowed(connectTokenProvider: {
    // Provide a connectToken of type 'PasskeyList' to authorize the list operation.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyList, accessToken: "access-token-of-user")
})

switch nextStep {
case .allowed(let passkeys):
    // Success. The user is allowed to add a new passkey.
    // Update your UI state with the `passkeys` array to display them.
    // Your UI should also show an "Add new passkey" button.

case .notAllowed(let passkeys):
    // Success, but with a condition. The user is *not* allowed to add a new passkey.
    // Update your UI state with the `passkeys` array to display them.
    // The "Add new passkey" button should be hidden.

case .error(let error):
    // An error occurred during the process.
    // Handle the error, for example by showing an alert to the user.
}

// This assumes 'passkey' is the PasskeyInfo object selected by the user from your UI list.
let status = await corbado.deletePasskey(passkeyId: passkey.id) { _ in
    // Provide a connectToken of type 'PasskeyDelete' to authorize the deletion.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyDelete, accessToken: "access-token-of-user")
}

switch status {
case .done(let passkeys):
    // Deletion was successful.
    // The SDK conveniently returns the updated list of passkeys.
    // You should refresh your UI with this new list.
    
case .error(let error):
    // An error occurred during the deletion process.
    // You should handle the specific error and show an appropriate message to the user.
    
default:
    // A fallback for any other unhandled cases.
    // You could show a generic error message here.
}

// This would be called when the user taps the "Add new passkey" button in your UI.
let status = await corbado.completePasskeyListAppend { _ in
    // Provide a connectToken of type 'PasskeyAppend' to authorize the creation.
    return try await AppBackend.getConnectToken(connectTokenType: .PasskeyAppend, accessToken: "access-token-of-user")
}

switch status {
case .done(let passkeys):
    // Success! The new passkey was created.
    // The SDK returns the updated list of passkeys, including the new one.
    // You should refresh your UI with this new list.
    
case .passkeyOperationCancelled:
    // The user manually cancelled the native iOS prompt.
    // No action is typically needed, but you could show a transient message.
    
case .error(_):
    // An unexpected error occurred during the process.
    // Display a clear error message to the user.
    
case .passkeyOperationExcludeCredentialsMatch:
    // A passkey from this device already exists for the user.
    // This is not an error. Inform the user gracefully.
}