Add anonymous OOBE gateway grants

Provide App Attest-bound, one-time onboarding AI access without creating accounts, with durable replay protection and production deployment safeguards.
2026-08-21 22:55:46 +08:00
parent edd0d9feca
commit 0d236f57fb
32 changed files with 2202 additions and 61 deletions
@@ -148,6 +148,10 @@ data class AppConfig(
                        if (production) "production" else "development",
                    ),
                ),
+                allowDevelopmentAppAttest = config.booleanOrDefault(
+                    "app.integrity.allowDevelopmentAppAttest",
+                    false,
+                ),
                challengeLifetimeSeconds = config.positiveLong(
                    "app.integrity.challengeLifetimeSeconds",
                    300,
@@ -449,6 +453,7 @@ data class IntegrityConfig(
    val deviceCheckPolicy: IntegrityPolicy,
    val appAttestPolicy: IntegrityPolicy,
    val appleEnvironment: AppleServiceEnvironment = AppleServiceEnvironment.DEVELOPMENT,
+    val allowDevelopmentAppAttest: Boolean = false,
    val challengeLifetimeSeconds: Long = 300,
    val appAttestTeamId: String = APP_ATTEST_TEAM_ID,
    val appAttestBundleId: String = APP_ATTEST_BUNDLE_ID,