Part of a stack of PRs, builds on #7022.

Matches the trusted-entitlements RC Container signing behavior from RevenueCat/purchases-android#3601.

Changes

• Implements response signature verification for the remote config endpoint
• As described in the backend spec this only validates the first element in the response (the config blob)
• Extracted the ElementParser out of the main RCContainer parser in order to reuse it during the signature validation for extracting the checksum
  • This is done in order to keep the RCContainer.Parser clean of any business knowledge about the config endpoint (handling the 0st element as the config blob in order to pull out it's checksum)
• In order to keep the HTTPClient generic and not assume RCContainer == config endpoint, i've introduced the ResponseSignatureContextProvider, which can give instruct the HTTP client on how to create and validate the signatures.
  • For the current JSON endpoint this means using the request body for the request signature, using the full body for the response signature and not overriding any result based on http status code
  • For the remote config endpoint this means no request signature, using only the checksum from the config blob (the first element in RCContainer format) and overriding the 204 status code to return .verified regardless
  • This should support the remote config case while keeping the HTTP client clear of any domain logic.

This is only unit tested so far, as we don't have a live endpoint to test against yet. But since it's unused it should not be a big deal for now.

Architecture

flowchart TD
    A["HTTPClient"] --> B{"ResponseSignatureContextProvider"}

    B -->|"Default provider"| C["Current JSON endpoints"]
    C --> D["Use response body as signature payload"]
    D --> E["Verify signature"]
    E --> F["Existing JSON decoding"]

    B -->|"Remote config provider"| G["RC Container endpoint"]
    G --> H["Read config element for signing"]
    H --> I["Validate config checksum"]
    I --> J["Use checksum as signature payload"]
    J --> K["Verify signature"]

    K --> L["RemoteConfigAPI"]
    L --> M["Parse full RCContainer"]
    M --> N["Return container + verification result"]

    O["RCContainer.ElementParser"]
    O -. "used by signing path" .-> H
    O -. "used by full container parser" .-> M