[mikepitre]

Why

Nothing in the SDK has called device attestation since #571 removed the startup flow and DeviceAssertionMiddleware. The helper, its API, and the Play Integrity dependency stayed behind. DeviceAttestationApi.getChallenge() is also a non-suspend void method that Retrofit rejects, so #997 had to exclude it from ServiceInterfaceValidationTest. This PR deletes the dead code and the exclusion.

Scope

• Delete DeviceAttestationHelper, DeviceAttestationHelperTest, and DeviceAttestationApi.
• Remove ClerkApi.deviceAttestation, the DeviceAttestationHelper.clearCache() call in Clerk.reset(), and ApiPaths.Client.DeviceAttestation.
• Remove the google-playIntegrity catalog entry and implementation(libs.google.playIntegrity).
• Remove the three detekt baseline entries for DeviceAttestationHelper and DeviceAssertionMiddleware.
• Remove the DeviceAttestationApi exclusion from ServiceInterfaceValidationTest.
• Deprecate Constants.Attestation instead of deleting it. Nothing reads it, but it is part of the public Constants object, and deleting it would break any app that references it. Delete it in the next major version.
• Reformat Clerk.kt in a separate commit. Spotless checks only files that differ from origin/main, and the Clerk.kt on main no longer matches the pinned ktfmt output. That commit changes formatting only.

Blast Radius

Apps that use the SDK no longer get com.google.android.play:integrity or its dependency com.google.android.play:core-common at runtime. The SDK declared Play Integrity as implementation, so apps never compiled against it through the SDK. An app breaks only if it loads Play Integrity classes at runtime without declaring the dependency itself.

Two open PRs touch the same code. #985 edits DeviceAttestationHelperTest.kt, which this PR deletes. Resolve that conflict by deleting the file. #910 adds ClerkProtect.reset() next to the removed clearCache() call. Resolve that conflict by keeping ClerkProtect.reset().

Verification

• ./gradlew :source:api:testDebugUnitTest :source:api:spotlessCheck :source:api:detekt on JDK 21 passes with 752 tests and 0 failures. ServiceInterfaceValidationTest now passes with no exclusion.
• A repo-wide search for DeviceAttestation, playIntegrity, DeviceAssertion, and Constants.Attestation finds no matches.
• :source:api:dependencies --configuration releaseRuntimeClasspath before and after this change differ by only com.google.android.play:integrity and com.google.android.play:core-common.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Changes
  • Removed device attestation support, including Play Integrity token preparation and verification.
  • Deprecated the attestation constants; they remain available but are no longer used by the SDK.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: clerk/clerk-android/.coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 771687a8-4a5b-4399-89ac-bd39da55e317

📥 Commits

Reviewing files that changed from the base of the PR and between 15dc8a1 and 7fff699.

📒 Files selected for processing (11)

• config/detekt/detekt-baseline.xml
• gradle/libs.versions.toml
• source/api/build.gradle.kts
• source/api/src/main/kotlin/com/clerk/api/Clerk.kt
• source/api/src/main/kotlin/com/clerk/api/Constants.kt
• source/api/src/main/kotlin/com/clerk/api/attestation/DeviceAttestationHelper.kt
• source/api/src/main/kotlin/com/clerk/api/network/ApiPaths.kt
• source/api/src/main/kotlin/com/clerk/api/network/ClerkApi.kt
• source/api/src/main/kotlin/com/clerk/api/network/api/DeviceAttestationApi.kt
• source/api/src/test/java/com/clerk/api/attestation/DeviceAttestationHelperTest.kt
• source/api/src/test/java/com/clerk/api/network/api/ServiceInterfaceValidationTest.kt

 _______________________________________________________________________________
< Fancy algorithms are slow when n is small, and n is usually small. - Rob Pike >
 -------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[swolfand]

The deletion is complete, and deprecating Constants.Attestation instead of deleting it keeps the API compatible. Two things to watch, neither blocking: (1) The base isn't main, so CI ran only detekt and semgrep here. Retarget to main after #997 merges and let the unit tests run. (2) config/bin/ktfmt bundles ktfmt 0.54 while spotless uses 0.64, so the pre-commit hook will undo the Clerk.kt reformat. Bumping the hook binary is worth a follow-up.

Withdrawing until this is retargeted to main and the unit-test jobs pass; CI has only run detekt/semgrep on this branch.