API Integration

{
  "app": {
    "id": "uuid",
    "name": "Truth or Dare",
    "bundleIds": ["com.psycatgames.truthordare"],
    "contentSchemaType": {
      "id": 1,
      "name": "Truth or Dare",
      "structure": {
        "parts": ["main"],
        "join": " "
      }
    }
  }
}

{
  "categories": [
    {
      "id": "uuid",
      "name": "party-classics",
      "isPaid": false,
      "isActive": true,
      "isExplicit": false,
      "hiddenOnIOS": false,
      "hiddenOnAndroid": false,
      "emoji": "🎉",
      "designerMetadata": {},
      "gameMetadata": {},
      "statements": ["stmt-id-1", "stmt-id-2", "stmt-id-3"],
      "localizedTexts": [
        {
          "title": "Party Classics",
          "description": "The best questions for your next party"
        }
      ]
    }
  ]
}

{
  "statements": [
    {
      "id": "abc123",
      "mode": "classic",
      "tags": ["party", "fun"],
      "isActive": true,
      "hiddenOnIOS": false,
      "hiddenOnAndroid": false,
      "gameMetadata": {},
      "contentMetadata": {},
      "designMetadata": {},
      "parts": [
        {
          "partName": "title",
          "text": "Would you rather"
        },
        {
          "partName": "text1",
          "text": "eat a spider"
        },
        {
          "partName": "text2",
          "text": "drink spoiled milk"
        }
      ]
    }
  ],
  "pagination": {
    "page": 1,
    "pageSize": 50,
    "totalItems": 150,
    "totalPages": 3,
    "hasNext": true,
    "hasPrevious": false
  },
  "category": {
    "id": "uuid",
    "name": "party-classics",
    "title": "Party Classics",
    "description": "The best questions for your next party"
  }
}

{
  "status": 401,
  "code": "INVALID_SIGNATURE",
  "message": "Request signature verification failed",
  "traceId": "req-uuid"
}

{
  "status": 400,
  "code": "VALIDATION_ERROR",
  "message": "Request validation failed",
  "traceId": "req-uuid",
  "details": [
    { "path": "categoryId", "message": "Required" }
  ]
}

import 'dart:convert';
import 'dart:typed_data';
import 'package:crypto/crypto.dart';
import 'package:encrypt/encrypt.dart' as encrypt;
import 'package:http/http.dart' as http;
import 'package:uuid/uuid.dart';

class ContentApiClient {
  static const _baseUrl = 'https://content-api.vanilla.nl';
  final String _hmacSecret;
  final String _bundleId;
  final String _appVersion;
  final String _appBuild;
  final String _platform; // 'ios' or 'android'

  ContentApiClient({
    required String hmacSecret,
    required String bundleId,
    required String appVersion,
    required String appBuild,
    required String platform,
  })  : _hmacSecret = hmacSecret,
        _bundleId = bundleId,
        _appVersion = appVersion,
        _appBuild = appBuild,
        _platform = platform;

  /// Build signed headers for a request
  Map<String, String> _buildHeaders(String method, String path,
      String query, String language) {
    final timestamp = (DateTime.now().millisecondsSinceEpoch ~/ 1000).toString();
    final nonce = const Uuid().v4();

    final headers = {
      'vanilla-timestamp': timestamp,
      'vanilla-nonce': nonce,
      'vanilla-app-version': _appVersion,
      'vanilla-app-build': _appBuild,
      'vanilla-app-os': _platform,
      'vanilla-app-language': language.toLowerCase(),
      'vanilla-app-bundle': _bundleId,
    };

    // Build canonical string
    final sortedHeaders = headers.entries.toList()
      ..sort((a, b) => a.key.compareTo(b.key));
    final headerLines =
        sortedHeaders.map((e) => '${e.key}:${e.value}').join('\n');
    final canonical = '$method\n$path\n$query\n$headerLines';

    // Sign
    final hmac = Hmac(sha256, utf8.encode(_hmacSecret));
    final signature = hmac.convert(utf8.encode(canonical)).toString();

    return {
      ...headers.map((k, v) =>
          MapEntry(k.split('-').map((s) =>
            '${s[0].toUpperCase()}${s.substring(1)}'
          ).join('-'), v)),
      'Vanilla-Signature': signature,
    };
  }

  /// Decrypt an AES-256-GCM response
  Map<String, dynamic> _decrypt(Uint8List body, String encNonce) {
    final keyBytes = utf8.encode(_hmacSecret);
    final key = Uint8List(32);
    key.setRange(0, keyBytes.length.clamp(0, 32), keyBytes);

    final iv = base64.decode(encNonce);
    final ciphertext = body.sublist(0, body.length - 16);
    final tag = body.sublist(body.length - 16);

    // Use platform AES-256-GCM decryption
    // (exact API depends on your crypto library)
    final encrypter = encrypt.Encrypter(
      encrypt.AES(encrypt.Key(key), mode: encrypt.AESMode.gcm),
    );
    final decrypted = encrypter.decryptBytes(
      encrypt.Encrypted(Uint8List.fromList([...ciphertext, ...tag])),
      iv: encrypt.IV(iv),
    );

    return json.decode(utf8.decode(decrypted));
  }

  /// Fetch categories (encrypted)
  Future<Map<String, dynamic>> getCategories(String language) async {
    final path = '/v1/categories';
    final headers = _buildHeaders('GET', path, '', language);
    final response = await http.get(
      Uri.parse('$_baseUrl$path'),
      headers: headers,
    );

    if (response.statusCode != 200) {
      throw Exception('API error ${response.statusCode}: ${response.body}');
    }

    return _decrypt(
      response.bodyBytes,
      response.headers['vanilla-enc-nonce']!,
    );
  }

  /// Fetch statements for a category (encrypted, paginated)
  Future<Map<String, dynamic>> getStatements(
      String categoryId, String language, {int page = 1}) async {
    final path = '/v1/statements';
    final query = 'categoryId=$categoryId&page=$page';
    final headers = _buildHeaders('GET', path, query, language);
    final response = await http.get(
      Uri.parse('$_baseUrl$path?$query'),
      headers: headers,
    );

    if (response.statusCode != 200) {
      throw Exception('API error ${response.statusCode}: ${response.body}');
    }

    return _decrypt(
      response.bodyBytes,
      response.headers['vanilla-enc-nonce']!,
    );
  }

  /// Fetch app info (unencrypted JSON)
  Future<Map<String, dynamic>> getAppInfo(String language) async {
    final path = '/v1/app';
    final headers = _buildHeaders('GET', path, '', language);
    final response = await http.get(
      Uri.parse('$_baseUrl$path'),
      headers: headers,
    );

    if (response.statusCode != 200) {
      throw Exception('API error ${response.statusCode}: ${response.body}');
    }

    return json.decode(response.body);
  }
}

final client = ContentApiClient(
  hmacSecret: 'your-shared-secret',
  bundleId: 'com.psycatgames.truthordare',
  appVersion: '1.2.0',
  appBuild: '42',
  platform: 'ios',
);

// Fetch app info + schema
final appInfo = await client.getAppInfo('en');

// Fetch all categories
final categoriesData = await client.getCategories('en');
final categories = categoriesData['categories'] as List;

// Fetch statements for the first category
final statementsData = await client.getStatements(
  categories[0]['id'],
  'en',
);
final statements = statementsData['statements'] as List;

// Reconstruct full text from parts using schema join string
final schema = appInfo['app']['contentSchemaType']['structure'];
final joinStr = schema['join'] as String;
for (final stmt in statements) {
  final parts = stmt['parts'] as List;
  final fullText = (schema['parts'] as List).map((partName) {
    if (partName.startsWith('{') && partName.endsWith('}')) {
      // Literal -- use translation from schema
      return schema['literals'][partName]['en'];
    }
    return parts.firstWhere((p) => p['partName'] == partName)['text'];
  }).join(joinStr);
  print(fullText);
}