Deprecate Android SafetyNet support (#585)

* Deprecate Android SafetyNet support

The Android SafetyNet support is marked as deprecated starting from version 4.9.0 and will be completely removed in version 5.0.0. This includes key verification classes, configuration options, and dependencies. This decision arises from updates in the latest symfony and webauthn environments.

phpstan-baseline.neon

@@ -860,6 +860,14 @@ parameters:
 			count: 4
 			path: src/symfony/src/DependencyInjection/Configuration.php
 
+		-
+			message: """
+				#^Call to deprecated method addAndroidSafetynetConfig\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Configuration\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/Configuration.php
+
 		-
 			message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeParentInterface\\:\\:scalarNode\\(\\)\\.$#"
 			count: 1
@@ -1030,6 +1038,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/DependencyInjection/Factory/Security/WebauthnFactory.php
 
+		-
+			message: """
+				#^Call to deprecated method loadAndroidSafetyNet\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\WebauthnExtension\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/WebauthnExtension.php
+
 		-
 			message: "#^Cannot access offset 'failure_handler' on mixed\\.$#"
 			count: 4
@@ -1241,6 +1257,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Repository/PublicKeyCredentialSourceRepository.php
 
+		-
+			message: """
+				#^Fetching class constant class of deprecated class Webauthn\\\\AttestationStatement\\\\AndroidSafetyNetAttestationStatementSupport\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/Resources/config/android_safetynet.php
+
 		-
 			message: """
 				#^Fetching class constant class of deprecated class Webauthn\\\\PublicKeyCredentialLoader\\:
@@ -1768,6 +1792,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Service/PublicKeyCredentialRequestOptionsFactory.php
 
+		-
+			message: """
+				#^Instantiation of deprecated class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Compiler\\\\EnforcedSafetyNetApiKeyVerificationCompilerPass\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/WebauthnBundle.php
+
 		-
 			message: "#^Method Webauthn\\\\Bundle\\\\WebauthnBundle\\:\\:getContainerExtension\\(\\) never returns null so it can be removed from the return type\\.$#"
 			count: 1

src/symfony/src/DependencyInjection/Compiler/EnforcedSafetyNetApiKeyVerificationCompilerPass.php

@@ -9,6 +9,9 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Webauthn\AttestationStatement\AndroidSafetyNetAttestationStatementSupport;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class EnforcedSafetyNetApiKeyVerificationCompilerPass implements CompilerPassInterface
 {
     public function process(ContainerBuilder $container): void

src/symfony/src/DependencyInjection/Configuration.php

@@ -456,10 +456,14 @@ private function addMetadataConfig(ArrayNodeDefinition $rootNode): void
             ->end();
     }
 
+    /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+     */
     private function addAndroidSafetynetConfig(ArrayNodeDefinition $rootNode): void
     {
         $rootNode->children()
             ->arrayNode('android_safetynet')
+                ->setDeprecated('web-auth/webauthn-symfony-bundle', '4.9.0', 'Android SafetyNet is now deprecated.')
                 ->addDefaultsIfNotSet()
                 ->info('Additional configuration options for the Android SafetyNet attestation.')
                 ->children()

src/symfony/src/DependencyInjection/WebauthnExtension.php

@@ -357,6 +357,7 @@ private function loadRequestControllersSupport(ContainerBuilder $container, arra
     }
 
     /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
      * @param mixed[] $config
      */
     private function loadAndroidSafetyNet(ContainerBuilder $container, FileLoader $loader, array $config): void

src/symfony/src/Resources/config/android_safetynet.php

@@ -10,6 +10,7 @@
 use function Symfony\Component\DependencyInjection\Loader\Configurator\param;
 use function Symfony\Component\DependencyInjection\Loader\Configurator\service;
 
+//TODO >=5.0.0: Remove this file
 return static function (ContainerConfigurator $container): void {
     $container = $container->services()
         ->defaults()
@@ -19,6 +20,11 @@
     if (class_exists(JWKFactory::class) && class_exists(RS256::class)) {
         $container
             ->set(AndroidSafetyNetAttestationStatementSupport::class)
+            ->deprecate(
+                'web-auth/webauthn-symfony-bundle',
+                '4.9.0',
+                'The "%service_id%" service is deprecated and will be removed in version 5.0.0. Android SafetyNet is now deprecated.'
+            )
             ->args([service(ClockInterface::class)->nullOnInvalid()])
             ->call('setMaxAge', [param('webauthn.android_safetynet.max_age')])
             ->call('setLeeway', [param('webauthn.android_safetynet.leeway')]);

src/webauthn/composer.json

@@ -51,7 +51,6 @@
         "symfony/property-info": "As of 4.5.x, the symfony/serializer component will become mandatory for converting objects such as the Metadata Statement",
         "phpdocumentor/reflection-docblock": "As of 4.5.x, the phpdocumentor/reflection-docblock component will become mandatory for converting objects such as the Metadata Statement",
         "psr/log-implementation": "Recommended to receive logs from the library",
-        "web-token/jwt-library": "Mandatory for the AndroidSafetyNet Attestation Statement support",
         "symfony/event-dispatcher": "Recommended to use dispatched events"
     }
 }

src/webauthn/src/AttestationStatement/AndroidSafetyNetAttestationStatementSupport.php

@@ -43,6 +43,9 @@
 use function is_string;
 use const JSON_THROW_ON_ERROR;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class AndroidSafetyNetAttestationStatementSupport implements AttestationStatementSupport, CanDispatchEvents
 {
     private ?string $apiKey = null;