import "github.com/takimoto3/app-attest/certs"

var keyID = []byte(.....) // DCAppAttestService.generateKey returned value and base64.StdEncoding.DecodeString
var challenge = []byte(.....) // one-time challenge from the server
var clientDataHash = sha256.Sum256(challenge)
var attestation = []byte(.....) // DCAppAttestService.attestKey returned value

attestationObj := &attest.AttestationObject{}
err := attestationObj.Unmarshal(attestation)
if err != nil {
    // handle error...
}

pool, err := certs.LoadCertFiles("testdata/Apple_App_Attestation_Root_CA.pem") // Path to your root CA file
if err != nil {
    // handle error...
}
service := attest.NewAttestationService(
    pool, // cert pool
    "<TEAM ID>.<Bundle ID>",   // Your App ID
)

result, err := service.Verify(attestObject, clientDataHash[:], keyID)
if err != nil {
    // handle error...
}

// use result ....

var challenge = []byte(....) // one-time challenge from the server
var cliendData = []byte("{..., \"challenge\":\"<challenge data>\", .....}") // client request(JSON data case)
var assertion = []byte(....) // DCAppAttestService.generateAssertion returned value

assertionObj := &attest.AssertionObject{}
err := assertionObject.Unmarshal(assertion)
if err != nil {
    // handle error...
}

service := attest.AssertionService{
    AppID:     "<TEAM ID>.<Bundle ID>",
    Challenge: <stored_challenge>,
	Counter:   <stored_counter>,
	PublicKey: <stored_publickey>,
}
newCounter, err := service.Verify(assertionObject, challenge, cliendData)
if err != nil {
    // handle error...
}

import (
    "context"
    "crypto/x509"
    "errors"
    "fmt"
    "log"

    "github.com/takimoto3/app-attest/certs"
    "github.com/takimoto3/app-attest/fraud"
    "github.com/takimoto3/app-attest/fraud/receipt"
    "github.com/takimoto3/appleapi-core/token"
)

func main() {
    // The receipt from the initial attestation, which you should have stored.
    var initialReceipt []byte

    // ---" Prerequisites ---
    // You need a token.Provider for JWT authentication.
    // Load your private key from a .p8 file.
    privKey, err := token.LoadPKCS8File("<PATH_TO_YOUR_AUTHKEY.P8>") // e.g., "certs/AuthKey.p8"
    if err != nil {
        log.Fatalf("Failed to load private key: %v", err)
    }
    // Create a new token provider with your Key ID, Team ID, and private key.
    tokenProvider := token.NewProvider("<YOUR_KEY_ID>", "<YOUR_TEAM_ID>", privKey)
    
    // ---" 1. Create clients ---
    // Create a fraud client.
    fraudClient, err := fraud.NewClient(tokenProvider)
    if err != nil {
        log.Fatalf("Failed to create fraud client: %v", err)
    }

    // Create a receipt verifier with Apple's root CA.
    rootCAPool, err := certs.LoadCertFiles("testdata/Apple_App_Attestation_Root_CA.pem")
    if err != nil {
        log.Fatalf("Failed to load root CA: %v", err)
    }
    receiptVerifier := receipt.NewReceiptVerifier(rootCAPool)

    // ---" 2. Request a new receipt from Apple ---
    // The fraud.Client handles the HTTP POST to Apple's server.
    newReceiptBytes, err := fraudClient.Post(context.Background(), initialReceipt)
    if err != nil {
        // Handle specific cases like "Not Modified".
        if errors.Is(err, fraud.ErrNotModified) {
            log.Println("Receipt not modified. Risk metric not updated.")
            // This is not a fatal error. You can continue with the old receipt.
            return 
        }
        // Handle other potential errors (e.g., network issues, invalid token).
        log.Fatalf("Failed to get new receipt from Apple: %v", err)
    }

    // ---" 3. Parse and verify the new receipt ---
    // Use the receipt verifier to parse the returned PKCS#7 container.
    verifiedReceipt, err := receiptVerifier.ParseAndVerify(newReceiptBytes.Receipt)
    if err != nil {
        log.Fatalf("Failed to parse and verify new receipt: %v", err)
    }

    // ---" 4. Use the risk metric ---
    // Now you can access the risk metric.
    fmt.Printf("Successfully verified new receipt.\n")
    fmt.Printf("Risk Metric: %d\n", verifiedReceipt.RiskMetric)
    fmt.Printf("Receipt Type: %s\n", verifiedReceipt.Type)
    fmt.Printf("Creation Time: %v\n", verifiedReceipt.CreationTime)

    // You should now store the new receipt (`newReceiptBytes.Receipt`) 
    // to use it for the next refresh.
}