[FC] Updates lookup call to use mobile endpoint on verified flows

[carlosmuvi-stripe]

Summary

• Uses new mobile/lookup on verified flows.
  • Pass verification token and app_id, required for this endpoint
  • Also session_id and email_source, optional before, are now required.
• Non verified flows continue to use POST consumer_sessions (does some method renaming to match this)
• Modifies ErrorHandler to, on attestation failures, close the native AuthFlow and continue on web.

Motivation

https://docs.google.com/document/d/1joKz5UZHLVazmecfMHbq6gB6n4wj5u8To6AtqYgq_tc/edit?tab=t.0#heading=h.cz1xkpga7giy

Testing

• Added tests
• Modified tests
• Manually verified

[carlosmuvi-stripe]

• [FC] Adds attestation analytics events. #9831
• [FC] Add app verification to signup flows (Networking+ID) #9830
• [FC] Updates lookup call to use mobile endpoint on verified flows #9820 👈 (View in Graphite)
• [FC] Sends supports_app_verification to sync call when Integrity available #9819
• [FC] Prepares integrity on first sync call #9818
• [FC] Adds ActivityRetainedScope and broader singleton component #9821
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Diffuse output:

OLD: paymentsheet-example-release-master.apk (signature: V1, V2)
NEW: paymentsheet-example-release-pr.apk (signature: V1, V2)

          │            compressed            │          uncompressed           
          ├───────────┬───────────┬──────────┼──────────┬──────────┬───────────
 APK      │ old       │ new       │ diff     │ old      │ new      │ diff      
──────────┼───────────┼───────────┼──────────┼──────────┼──────────┼───────────
      dex │   3.9 MiB │     4 MiB │ +6.1 KiB │  8.6 MiB │  8.6 MiB │ +13.8 KiB 
     arsc │   2.3 MiB │   2.3 MiB │      0 B │  2.3 MiB │  2.3 MiB │       0 B 
 manifest │   5.1 KiB │   5.1 KiB │      0 B │ 25.2 KiB │ 25.2 KiB │       0 B 
      res │ 908.4 KiB │ 908.4 KiB │      0 B │  1.4 MiB │  1.4 MiB │       0 B 
   native │   2.6 MiB │   2.6 MiB │      0 B │    6 MiB │    6 MiB │       0 B 
    asset │   1.6 MiB │   1.6 MiB │    -38 B │  1.6 MiB │  1.6 MiB │     -38 B 
    other │   1.4 MiB │   1.4 MiB │      0 B │  1.6 MiB │  1.6 MiB │       0 B 
──────────┼───────────┼───────────┼──────────┼──────────┼──────────┼───────────
    total │  12.6 MiB │  12.6 MiB │ +6.1 KiB │ 21.6 MiB │ 21.6 MiB │ +13.7 KiB 

 DEX     │ old   │ new   │ diff               
─────────┼───────┼───────┼────────────────────
   files │     1 │     1 │    0               
 strings │ 40764 │ 40820 │  +56 (+98 -42)     
   types │ 14057 │ 14079 │  +22 (+60 -38)     
 classes │ 11728 │ 11749 │  +21 (+26 -5)      
 methods │ 59789 │ 59913 │ +124 (+3621 -3497) 
  fields │ 39961 │ 40027 │  +66 (+2599 -2533) 

 ARSC    │ old  │ new  │ diff 
─────────┼──────┼──────┼──────
 configs │  243 │  243 │  0   
 entries │ 6209 │ 6209 │  0

APK

     compressed      │     uncompressed      │                                
──────────┬──────────┼───────────┬───────────┤                                
 size     │ diff     │ size      │ diff      │ path                           
──────────┼──────────┼───────────┼───────────┼────────────────────────────────
    4 MiB │ +6.1 KiB │   8.6 MiB │ +13.8 KiB │ ∆ classes.dex                  
  7.8 KiB │    -39 B │   7.6 KiB │     -39 B │ ∆ assets/dexopt/baseline.prof  
 53.5 KiB │     +4 B │ 118.7 KiB │       0 B │ ∆ META-INF/CERT.SF             
  1.2 KiB │     -2 B │   1.2 KiB │       0 B │ ∆ META-INF/CERT.RSA            
 50.3 KiB │     -2 B │ 118.6 KiB │       0 B │ ∆ META-INF/MANIFEST.MF         
    990 B │     +1 B │     858 B │      +1 B │ ∆ assets/dexopt/baseline.profm 
──────────┼──────────┼───────────┼───────────┼────────────────────────────────
  4.1 MiB │ +6.1 KiB │   8.9 MiB │ +13.7 KiB │ (total)

DEX

STRINGS:

   old   │ new   │ diff          
  ───────┼───────┼───────────────
   40764 │ 40820 │ +56 (+98 -42) 
  
  + , appVerificationEnabled=
  + , eventTimestamp=
  + , prefilledEmail=
  + , sessionId=
  + , verdictOptOut=
  + , verifiedFlow=
  + CUSTOMER_OBJECT
  + EventRecord{eventType=
  + Integrity - Failed to request integrity token
  + Integrity token provider is not initialized. Call prepare() first.
  + IntegrityDialogWrapper
  + LA5/N0;
  + LA5/O0;
  + LP6/t3;
  + LR8/p;
  + LV3/m;
  + LV3/n;
  + LV3/o;
  + LV3/p;
  + LX3/A;
  + LX3/r;
  + LX3/s;
  + LX3/t;
  + LX3/u;
  + LX3/v;
  + LX3/w;
  + LX3/x;
  + LX3/y;
  + LX3/z;
  + Lf3/q;
  + Lf3/r;
  + Lf9/s0;
  + Lg0/c;
  + Lg9/f;
  + Lg9/g;
  + Lh6/N;
  + Lv5/H;
  + Null token
  + Null verdictOptOut
  + OnRequestIntegrityTokenCallback
  + StandardIntegrityTokenRequest{requestHash=
  + USER_ACTION
  + VIIZZZZLZZZZZZLLLLZZLLLLLLLLLLLLLLLLLLLLLLLLLLLL
  + VLLB
  + VLLLJL
  + VLLZLLZLL
  + VZZZZLZZZZZZLLLLZZLLLLLLLLLLLLLLLLLLLLLLLLLLLL
  + [LA5/U;
  + [LP6/B1;
  + [LP6/C0;
  + [LP6/G0;
  + [LP6/I2;
  + [LP6/M2;
  + [LP6/T0;
  + [LP6/Y0;
  + [LP6/Y2;
  + [LP6/Z1;
  + [LP6/d1;
  + [LP6/d2;
  + [LP6/d3;
  + [LP6/g2;
  + [LP6/h1;
  + [LP6/i3;
  + [LP6/r1;
  + [LP6/t3;
  + [LP6/v1;
  + [LP6/z0;
  + [LS/C3;
  + [LS/H1;
  + [LS/P0;
  + [LS/f1;
  + [LS/o2;
  + [Lf9/N;
  + [Lf9/d0;
  + [Lf9/g0;
  + [Lf9/q0;
  + [Lg1/o;
  + [Lg1/r;
  + [Lh6/J;
  + [Lh6/M;
  + [Lh6/s;
  + android_verification_token
  + app_verification_enabled
  + consumers/mobile/sessions/lookup
  + customer_object
  + email_source
  + hostedAuthUrl is required to switch to web flow!
  + integrityRequestManager
  + link_failed_to_attest_request
  + nonce
  + onRequestExpressIntegrityToken
  + request(...)
  + request.token.sid
  + request.verdict.opt.out
  + requestExpressIntegrityToken(%s)
  + requestExpressIntegrityToken(%s, %s, %s)
  + user_action
  + ~~R8{"backend":"dex","compilation-mode":"release","has-checksums":false,"min-api":21,"pg-map-id":"c766713","r8-mode":"full","version":"8.7.14"}
  
  - EventRecord{eventType=4, eventTimestamp=
  - LS/J3;
  - Lg1/t;
  - Lg1/u;
  - Lg1/v;
  - Lg1/w;
  - VIIZZZZLZZZZZLLLLZZLLLLLLLLLLLLLLLLLLLLLLLLLLLL
  - VZZZZLZZZZZLLLLZZLLLLLLLLLLLLLLLLLLLLLLLLLLLL
  - [LA5/S;
  - [LP6/B0;
  - [LP6/C1;
  - [LP6/D0;
  - [LP6/H0;
  - [LP6/J2;
  - [LP6/N2;
  - [LP6/U0;
  - [LP6/Z0;
  - [LP6/Z2;
  - [LP6/b2;
  - [LP6/e1;
  - [LP6/e2;
  - [LP6/e3;
  - [LP6/h2;
  - [LP6/i1;
  - [LP6/m3;
  - [LP6/s1;
  - [LP6/w1;
  - [LS/D3;
  - [LS/I1;
  - [LS/Q0;
  - [LS/g1;
  - [LS/p2;
  - [Lf9/M;
  - [Lf9/c0;
  - [Lf9/f0;
  - [Lf9/p0;
  - [Lg1/s;
  - [Lg1/v;
  - [Lh6/I;
  - [Lh6/L;
  - [Lh6/r;
  - ~~R8{"backend":"dex","compilation-mode":"release","has-checksums":false,"min-api":21,"pg-map-id":"05ed342","r8-mode":"full","version":"8.7.14"}
  

TYPES:

   old   │ new   │ diff          
  ───────┼───────┼───────────────
   14057 │ 14079 │ +22 (+60 -38) 
  
  + LA5/N0;
  + LA5/O0;
  + LP6/t3;
  + LR8/p;
  + LV3/m;
  + LV3/n;
  + LV3/o;
  + LV3/p;
  + LX3/A;
  + LX3/r;
  + LX3/s;
  + LX3/t;
  + LX3/u;
  + LX3/v;
  + LX3/w;
  + LX3/x;
  + LX3/y;
  + LX3/z;
  + Lf3/q;
  + Lf3/r;
  + Lf9/s0;
  + Lg0/c;
  + Lg9/f;
  + Lg9/g;
  + Lh6/N;
  + Lv5/H;
  + [LA5/U;
  + [LP6/B1;
  + [LP6/C0;
  + [LP6/G0;
  + [LP6/I2;
  + [LP6/M2;
  + [LP6/T0;
  + [LP6/Y0;
  + [LP6/Y2;
  + [LP6/Z1;
  + [LP6/d1;
  + [LP6/d2;
  + [LP6/d3;
  + [LP6/g2;
  + [LP6/h1;
  + [LP6/i3;
  + [LP6/r1;
  + [LP6/t3;
  + [LP6/v1;
  + [LP6/z0;
  + [LS/C3;
  + [LS/H1;
  + [LS/P0;
  + [LS/f1;
  + [LS/o2;
  + [Lf9/N;
  + [Lf9/d0;
  + [Lf9/g0;
  + [Lf9/q0;
  + [Lg1/o;
  + [Lg1/r;
  + [Lh6/J;
  + [Lh6/M;
  + [Lh6/s;
  
  - LS/J3;
  - Lg1/t;
  - Lg1/u;
  - Lg1/v;
  - Lg1/w;
  - [LA5/S;
  - [LP6/B0;
  - [LP6/C1;
  - [LP6/D0;
  - [LP6/H0;
  - [LP6/J2;
  - [LP6/N2;
  - [LP6/U0;
  - [LP6/Z0;
  - [LP6/Z2;
  - [LP6/b2;
  - [LP6/e1;
  - [LP6/e2;
  - [LP6/e3;
  - [LP6/h2;
  - [LP6/i1;
  - [LP6/m3;
  - [LP6/s1;
  - [LP6/w1;
  - [LS/D3;
  - [LS/I1;
  - [LS/Q0;
  - [LS/g1;
  - [LS/p2;
  - [Lf9/M;
  - [Lf9/c0;
  - [Lf9/f0;
  - [Lf9/p0;
  - [Lg1/s;
  - [Lg1/v;
  - [Lh6/I;
  - [Lh6/L;
  - [Lh6/r;
  

METHODS:

   old   │ new   │ diff               
  ───────┼───────┼────────────────────
   59789 │ 59913 │ +124 (+3621 -3497) 
  
  + A2.i <init>(boolean, a, p, t0, int)
  + A2.u <init>(i, a, String, o)
  + A5.A0 <init>(B0, c)
  + A5.B0 <init>(Y, H, a)
  + A5.B0 a(String, c) → Object
  + A5.B <init>(I)
  + A5.D0 <init>(G0, c)
  + A5.E0 <init>(G0, String, d)
  + A5.E0 
...✂

[tillh-stripe]

Works as expected. Two notes:

1. I’m wondering how process death during the bank auth would impact this. Let’s discuss this in Slack.
2. We should add a toggle to mock an integrity verdict failure, which would allow us to test this much better (think Maestro test).

[tillh-stripe]

Talked and decided to do the two mentioned things as follow-ups to this pull request.