Add anonymous OOBE gateway grants

Provide App Attest-bound, one-time onboarding AI access without creating accounts, with durable replay protection and production deployment safeguards.
2026-08-21 22:55:46 +08:00
parent edd0d9feca
commit 0d236f57fb
32 changed files with 2202 additions and 61 deletions
@@ -58,6 +58,8 @@ APPLE_TOKEN_URL=https://appleid.apple.com/auth/token
 APPLE_REVOKE_URL=https://appleid.apple.com/auth/revoke
 APPLE_INTEGRITY_ENVIRONMENT=development
 APP_ATTEST_CHALLENGE_TTL_SECONDS=300
+# Temporary production-device testing only; keep false for normal deployments.
+ALLOW_DEVELOPMENT_APP_ATTEST=false
 # DeviceCheck reuses the configured Apple Team ID, Key ID and ES256 private key.

 # Prefer the newer Volcengine API key. The legacy app ID/access token pair is optional.