SafetyNet Is Gone. Play Integrity Is Only as Strong as Your Server

class IntegrityClient(context: Context, private val cloudProjectNumber: Long) {
    private val manager = IntegrityManagerFactory.createStandard(context)
    private var provider: StandardIntegrityTokenProvider? = null

    // Warm up early: typically a few seconds, most under 10s.
    suspend fun warmUp() {
        provider = manager.prepareIntegrityToken(
            PrepareIntegrityTokenRequest.builder()
                .setCloudProjectNumber(cloudProjectNumber)
                .build()
        ).await()
    }

    // Bind the token to THIS action: hash what the server will act on.
    suspend fun tokenFor(action: TransferRequest): String {
        val requestHash = sha256("${action.fromAccount}|${action.toAccount}|${action.amountMinor}")
        val response = checkNotNull(provider) { "warmUp() first" }.request(
            StandardIntegrityTokenRequest.builder()
                .setRequestHash(requestHash)
                .build()
        ).await()
        return response.token() // opaque: send it to the server, never decode it here
    }
}

// Server side, after decoding the token through Google's decodeIntegrityToken endpoint.
fun decide(payload: IntegrityPayload, expected: ExpectedRequest, action: Action): Decision {
    val req = payload.requestDetails
    if (req.requestPackageName != expected.packageName) return Decision.Deny
    if (req.requestHash != expected.requestHash) return Decision.Deny          // replayed or swapped
    if (expected.now - req.timestampMillis > 60_000) return Decision.Deny      // stale token

    val genuineApp = payload.appIntegrity.appRecognitionVerdict == "PLAY_RECOGNIZED"
    val labels = payload.deviceIntegrity.deviceRecognitionVerdict.orEmpty()
    val screenWatched = payload.environmentDetails?.appAccessRiskVerdict
        ?.appsDetected.orEmpty().any { it.endsWith("_CAPTURING") }

    return when {
        !genuineApp -> Decision.Deny
        action.isHighValue && "MEETS_STRONG_INTEGRITY" !in labels -> Decision.StepUp   // re-auth, limits
        action.isHighValue && screenWatched -> Decision.StepUp
        "MEETS_DEVICE_INTEGRITY" in labels -> Decision.Allow
        "MEETS_BASIC_INTEGRITY" in labels -> Decision.AllowWithLimits
        else -> Decision.Challenge                                               // CAPTCHA, then limits
    }
}