Move Apple App Attest root certificate to configuration

[Malith-19]

Purpose

The Apple "App Attestation Root CA" certificate was hardcoded as a Go constant (appleAppAttestRootPEM) in backend/internal/attestation/app_attest_constants.go, so the trust anchor could not be updated or overridden without a code change and rebuild.

This PR moves the certificate out of source into deployment configuration, keeping Apple's public root as the default value in default.json so the product still works out of the box.

Follow-up to the review comment on #4055: #4055 (comment)

Approach

• Added an engine-level attestation.apple.root_certificate config section to the config schema (config.go) and backend/cmd/server/config/default.json.
• The App Attest verifier now reads the root certificate from configuration instead of the embedded constant. newAppAttestVerifier takes the PEM as a parameter, and Initialize sources it from the server runtime config.
• Removed the appleAppAttestRootPEM constant.
• Server startup fails with a clear error if the configured certificate is missing or unparseable.
• Documented the new setting (purpose, default, override example) in the iOS App Attest section of the Application Settings guide.

The default certificate in default.json is byte-identical to the removed constant, so behavior is unchanged out of the box while deployments can now override the trust anchor.

Config resolution: deployment.yaml is merged over default.json at load time (LoadConfig → mergeStructs), and a non-empty user value overrides the default. Operators override the cert by adding an attestation.apple.root_certificate block to deployment.yaml; omitting it keeps the shipped Apple root.

Related Issues

• Fixes Move hardcoded Apple App Attest Root CA certificate to configuration #4080

Related PRs

• Follow-up to Add Apple App Attest attestation for mobile clients #4055

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • docs/content/guides/guides/applications/application-settings.mdx (iOS App Attest section)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• New Features
  • Added configurable Apple App Attestation root certificate support via server configuration.
• Bug Fixes
  • Improved startup validation by returning clear errors when the configured certificate is missing or invalid.
• Documentation
  • Updated iOS (Apple App Attest) guidance to explain the server-level trust anchor and how to override the shipped root certificate.
• Tests
  • Added coverage for parsing valid, missing, and invalid configured root certificate values.

[coderabbitai]

📝 Walkthrough

Walkthrough

Apple App Attestation now receives its root certificate through server configuration. The verifier parses and validates the configured PEM, initialization passes the runtime value, and tests cover valid, missing, and invalid roots.

Changes

Apple App Attestation configuration

Layer / File(s)	Summary
Attestation configuration contract backend/internal/system/config/config.go, backend/cmd/server/config/default.json, docs/content/guides/guides/applications/application-settings.mdx	Adds the attestation.apple.root_certificate schema and default value, and documents server-level configuration and overrides.
Configured root parsing and validation backend/internal/attestation/app_attest.go, backend/internal/attestation/app_attest_constants.go, backend/internal/attestation/app_attest_test.go	Builds the verifier certificate pool from configured PEM data, removes the embedded certificate, and tests valid, missing, and invalid roots.
Runtime verifier initialization backend/internal/attestation/init.go	Passes the configured Apple root certificate into App Attest verifier construction.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• thunder-id/thunderid#3951: Related platform-attestation provider initialization and verification flow.
• thunder-id/thunderid#4055: Related Apple App Attest verifier and root certificate handling changes.

Suggested reviewers: rajithacharith, thamindudilshan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy #4080 by adding config, updating the verifier, removing the embedded constant, and failing on invalid or missing certs.
Out of Scope Changes check	✅ Passed	The docs and tests are directly related to the configuration move and do not appear out of scope.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title clearly summarizes the main change: moving the Apple App Attest root certificate into configuration.
Description check	✅ Passed	The description follows the template and covers purpose, approach, issues, checklist, security, and relevant testing/docs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/internal/system/config/config.go`:
- Around line 200-202: Document the new engine-level setting represented by
AppleAttestationConfig.RootCertificate, using the configuration key
attestation.apple.root_certificate. Add it to the relevant deployment
configuration or server settings guide under docs/, including its purpose and
default value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b50d8608-b40d-4f1f-ba28-d606e995ca30

📥 Commits

Reviewing files that changed from the base of the PR and between a52b755 and 5462909.

📒 Files selected for processing (6)

• backend/cmd/server/config/default.json
• backend/internal/attestation/app_attest.go
• backend/internal/attestation/app_attest_constants.go
• backend/internal/attestation/app_attest_test.go
• backend/internal/attestation/init.go
• backend/internal/system/config/config.go

💤 Files with no reviewable changes (1)

• backend/internal/attestation/app_attest_constants.go

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ThaminduDilshan]

We may have to modify the docs around this. Proceeding with this for now.

cc: @himeshsiriwardana