Mobile companion API: attestation-required endpoints (Play Integrity, App Attest)

[thlpkee20-wq]

Description

High-value mobile endpoints (initiate wire, approve payout) should require a Play Integrity or App Attest assertion. Verify assertions server-side against provider public keys and reject on failure.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: mobile routes under src/routes/, src/security/
• Assertion nonce single-use

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/mobile-integrity-attestation
• Implement changes
  • Add attestation verifier per provider
  • Wire middleware on gated endpoints
  • Emit mobile.attestation.rejected counter
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Rooted-device signal blocks assertion
• Include test output and notes

Example commit message

feat: mobile integrity attestation on gated endpoints

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours