Is it expected for App Check to default to Device Check rather than App Attest on iOS

[timdiacon]

I've configured App Check on my iOS project. When I log the token received I can see it always defaults to Device Check rather then App Attest.

I have created an AppCheckProviderFactory as workaround which I call from App Delegate which resolves the issue.

Is this a known bug or expected behavior?

import Foundation
import FirebaseCore
import FirebaseAppCheck
import DeviceCheck

/// Custom App Check provider factory that ensures App Attest is used on iOS 14+ devices
/// This fixes an issue where the Capacitor plugin defaults to DeviceCheck even when App Attest is available
public class CustomAppCheckProviderFactory: NSObject, AppCheckProviderFactory {
    public func createProvider(with app: FirebaseApp) -> AppCheckProvider? {
        if #available(iOS 14.0, *) {
            // Use App Attest on iOS 14+ devices with Secure Enclave
            if DCAppAttestService.shared.isSupported {
                return AppAttestProvider(app: app)
            } else {
                // Fallback to DeviceCheck if App Attest is not supported
                return DeviceCheckProvider(app: app)
            }
        } else {
            // Use DeviceCheck on iOS < 14
            return DeviceCheckProvider(app: app)
        }
    }
}

[robingenz]

The only known issue right now is this one: #453. Feel free to create a PR and i will take a look.