Added new VerificationResult.verifiedOnDevice (#2379)

This will be used to represent data that has been created and verified
locally.

Author: NachoSoto

Sources/Security/VerificationResult.swift

@@ -54,6 +54,9 @@ internal enum VerificationResult: Int {
     /// Entitlements were verified with our server.
     case verified = 1
 
+    /// Entitlements were created and verified on device through `StoreKit 2`.
+    case verifiedOnDevice = 3
+
     /// Entitlement verification failed, possibly due to a MiTM attack.
     /// ### Related Symbols
     /// - ``ErrorCode/signatureVerificationFailed``
@@ -77,20 +80,23 @@ extension VerificationResult {
         switch (cachedResult, responseResult) {
         case (.notRequested, .notRequested),
             (.verified, .verified),
+            (.verifiedOnDevice, .verifiedOnDevice),
             (.failed, .failed):
             return cachedResult
 
-        case (.verified, .notRequested): return .notRequested
-        case (.verified, .failed): return .failed
+        case (.verified, .notRequested), (.verifiedOnDevice, .notRequested): return .notRequested
+        case (.verified, .failed), (.verifiedOnDevice, .failed): return .failed
 
-        case (.notRequested, .verified): return .verified
+        case (.notRequested, .verified), (.notRequested, .verifiedOnDevice): return responseResult
         case (.notRequested, .failed): return .failed
 
         case (.failed, .notRequested): return .notRequested
         // If the cache verification failed, the etag won't be used
         // so the response would only be a 200 and not 304.
         // Therefore the cache verification error can be ignored
-        case (.failed, .verified): return .verified
+        case (.failed, .verified), (.failed, .verifiedOnDevice): return responseResult
+
+        case (.verifiedOnDevice, .verified), (.verified, .verifiedOnDevice): return responseResult
         }
     }
 

Tests/APITesters/ObjCAPITester/ObjCAPITester/RCVerificationResultAPI.m

@@ -17,6 +17,7 @@ + (void)checkAPI {
     switch (result) {
         case RCVerificationResultNotRequested:
         case RCVerificationResultVerified:
+        case RCVerificationResultVerifiedOnDevice:
         case RCVerificationResultFailed:
             break;
     }

Tests/APITesters/SwiftAPITester/SwiftAPITester/VerificationResultAPI.swift

@@ -24,6 +24,7 @@ func checkVerificationResultAPI(_ mode: EntitlementVerificationMode = .disabled,
     switch result {
     case .notRequested,
             .verified,
+            .verifiedOnDevice,
             .failed:
         break
 

Tests/UnitTests/Security/SigningTests.swift

@@ -297,28 +297,37 @@ class SigningTests: TestCase {
     func testVerificationResultWithSameCachedAndResponseResult() {
         expect(VerificationResult.from(cache: .notRequested, response: .notRequested)) == .notRequested
         expect(VerificationResult.from(cache: .verified, response: .verified)) == .verified
+        expect(VerificationResult.from(cache: .verifiedOnDevice, response: .verifiedOnDevice)) == .verifiedOnDevice
         expect(VerificationResult.from(cache: .failed, response: .failed)) == .failed
     }
 
     func testVerificationNotRequestedCachedResult() {
         expect(VerificationResult.from(cache: .notRequested,
                                        response: .verified)) == .verified
+        expect(VerificationResult.from(cache: .notRequested,
+                                       response: .verifiedOnDevice)) == .verifiedOnDevice
         expect(VerificationResult.from(cache: .notRequested,
                                        response: .failed)) == .failed
     }
 
     func testVerifiedCachedResult() {
         expect(VerificationResult.from(cache: .verified,
                                        response: .notRequested)) == .notRequested
+        expect(VerificationResult.from(cache: .verifiedOnDevice,
+                                       response: .notRequested)) == .notRequested
         expect(VerificationResult.from(cache: .verified,
                                        response: .failed)) == .failed
+        expect(VerificationResult.from(cache: .verifiedOnDevice,
+                                       response: .failed)) == .failed
     }
 
     func testFailedVerificationCachedResult() {
         expect(VerificationResult.from(cache: .failed,
                                        response: .notRequested)) == .notRequested
         expect(VerificationResult.from(cache: .failed,
                                        response: .verified)) == .verified
+        expect(VerificationResult.from(cache: .failed,
+                                       response: .verifiedOnDevice)) == .verifiedOnDevice
     }
 
 }