RootHerald Unity Plugin

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="RootHerald.Native" version="0.2.0" />
</packages>

#if ENABLE_IL2CPP
using System;
using System.Runtime.InteropServices;

internal static class RootHeraldNative
{
    // Keyless ABI 3.0: Create takes no api_key and no endpoint.
    [DllImport("__Internal")]
    public static extern IntPtr RootHeraldClient_Create();

    [DllImport("__Internal")]
    public static extern void RootHeraldClient_Destroy(IntPtr client);

    // Collect a quote-over-nonce evidence blob. Returns a caller-owned char*
    // (marshal to string, then free). No verdict, no network to RootHerald.
    [DllImport("__Internal")]
    public static extern int RootHeraldClient_CollectEvidence(
        string nonceB64, out IntPtr outEvidenceJson);

    [DllImport("__Internal")]
    public static extern void RootHeraldClient_FreeEvidence(IntPtr evidenceJson);

    // ...EnrollBegin / EnrollComplete / GetDeviceInfo / CollectPosture likewise.
}
#endif

using System.Threading.Tasks;
using RootHerald;
using UnityEngine;
using UnityEngine.UI;

public class RootHeraldGate : MonoBehaviour
{
    public Text   StatusText;
    public Button VerifyButton;

    private void Awake() => VerifyButton.onClick.AddListener(OnVerify);

    private async void OnVerify()
    {
        StatusText.text = "Attesting…";
        bool trusted = await AttestAsync("signup");
        StatusText.text = trusted ? "TRUSTED" : "BLOCKED";
    }

    public async Task<bool> AttestAsync(string action)
    {
        // 1. Ask YOUR backend for a fresh challenge nonce (it called
        //    /api/v1/attestations/challenge with its rh_sk_ secret).
        string nonce = await MyBackend.GetChallengeNonceAsync(action);

        // 2. Collect a keyless quote-over-nonce evidence blob on-device.
        using var client = new RootHeraldClient();   // no key, no endpoint
        string evidenceJson = await client.CollectEvidenceAsync(nonce);

        // 3. Relay to your backend, which POSTs it to /attestations/verify
        //    and returns whether the device was trusted.
        return await MyBackend.VerifyAndAuthorizeAsync(action, evidenceJson);
    }
}