Add dev mode flag for mobile app attestation

[Malith-19]

Purpose

Mobile type applications validate platform attestation by default, so sample apps and development clients that haven't configured attestation can't try out sign-in flows. This adds a per-application dev mode flag that skips attestation verification when enabled, so it can be turned on for testing without requiring a full attestation setup.

Approach

• Backend: added AttestationConfig.DevMode (devMode on the wire), and a new flowInitiationDevMode flow-initiation mode. A mobile app with dev mode enabled bypasses the attestation guard entirely, regardless of whether Android/Apple attestation is configured. Also fixed a bug where the Android-credential persist path silently dropped DevMode on update.
• Console UI: added a "Dev Mode" toggle to the attestation settings card, placed in the card header (right side), matching the enable-toggle placement used elsewhere (e.g. flow sections). A warning banner is shown in the card body while dev mode is enabled, advising it's for testing only.

UI Preview

Related Issues

• Closes Add dev mode flag for mobile applications to bypass attestation #4432

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

New Features

• Added Attestation Dev Mode for mobile applications, allowing authentication flows without platform attestation during development and testing.
• Added a Console toggle with warning messaging and confirmation before enabling Dev Mode.
• Added API configuration support with Dev Mode disabled by default.

Documentation

• Documented Dev Mode configuration, behavior, and production-use warnings.

Bug Fixes

• Preserved Dev Mode settings when saving and loading application attestation configuration.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This change adds mobile attestation DevMode. The flag persists through backend processing, appears in the Console and API schema, bypasses attestation for direct mobile flows, and includes tests and documentation.

Changes

Mobile attestation dev mode

Layer / File(s)	Summary
Attestation configuration and persistence api/application.yaml, backend/pkg/thunderidengine/providers/model.go, backend/internal/application/service.go, backend/**/*_test.go	The API schema adds an independent devMode flag. Backend sanitization and credential reconstruction preserve the flag.
Dev mode flow initiation bypass backend/internal/flow/flowexec/*, docs/content/guides/applications/application-settings.mdx, docs/content/key-concepts/authentication/integration-models.mdx	Mobile clients with DevMode use a dedicated initiation mode that accepts direct flows without flow-secret or attestation verification. Documentation describes the configuration and behavior.
Console dev mode configuration frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/*, frontend/packages/i18n/src/locales/en-US.ts	The Console adds a confirmed DevMode switch, warning state, localized text, emitted configuration, and component tests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Console
  participant ApplicationAPI
  participant flowexec
  participant MobileApp
  Console->>ApplicationAPI: save attestation.devMode
  ApplicationAPI-->>MobileApp: persist DevMode configuration
  MobileApp->>flowexec: initiate flow without attestation token
  flowexec->>MobileApp: resolve DevMode initiation mode
  flowexec-->>MobileApp: allow direct flow initiation

Loading

Possibly related PRs

• thunder-id/thunderid#3951: Extends the same attestation configuration and flow-initiation logic with DevMode.
• thunder-id/thunderid#4055: Overlaps with the attestation configuration and flow-initiation logic.

Suggested reviewers: brionmario, donomalvindula, jeradrutnam, thiva-k

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding a development mode flag for mobile app attestation.
Description check	✅ Passed	The description covers the purpose, implementation, UI changes, related issue, testing, security checks, and screenshots; unchecked optional items do not make it incomplete.
Linked Issues check	✅ Passed	The changes satisfy issue #4432 by adding per-application configuration, preserving the disabled default, and bypassing mobile attestation when DevMode is enabled.
Out of Scope Changes check	✅ Passed	The backend, API, Console, documentation, tests, and credential-preservation fix all directly support the mobile attestation DevMode objective.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/pkg/thunderidengine/providers/model.go`:
- Line 651: Update docs/content/apis.mdx to document AttestationConfig.devMode,
including its wire/configuration name, disabled-by-default behavior, mobile-only
scope, and update semantics. Update
docs/content/guides/mobile-app-attestation.mdx or the relevant existing guide to
explain that enabled dev mode bypasses flow-secret and platform-attestation
checks for mobile applications, with a clear testing-only warning.
- Line 651: Update the jsonschema description on the DevMode field in the model
definition to state that it bypasses flow-secret and platform-attestation checks
only during direct flow initiation, rather than broadly skipping attestation for
the application; preserve the existing default and testing/development guidance.

In `@frontend/apps/console/src/features/applications/models/oauth.ts`:
- Around line 511-526: Update the AttestationConfig type to use an exclusive
union for platform configuration: allow Android or Apple attestation, but not
both, while retaining devMode as a common field. Include an empty variant so
dev-only configurations remain valid, and preserve the existing
AndroidAttestationConfig and AppleAttestationConfig symbols.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2df864a7-e886-480f-aa12-dde1262e8fca

📥 Commits

Reviewing files that changed from the base of the PR and between 48689c2 and af04f9c.

📒 Files selected for processing (11)

• backend/internal/application/service.go
• backend/internal/application/service_test.go
• backend/internal/flow/flowexec/constants.go
• backend/internal/flow/flowexec/service.go
• backend/internal/flow/flowexec/service_test.go
• backend/pkg/thunderidengine/providers/model.go
• backend/pkg/thunderidengine/providers/model_test.go
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/AttestationSection.tsx
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/AttestationSection.test.tsx
• frontend/apps/console/src/features/applications/models/oauth.ts
• frontend/packages/i18n/src/locales/en-US.ts

[codecov]

Codecov Report

❌ Patch coverage is 96.82540% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...plication/advanced-settings/AttestationSection.tsx	94.28%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Malith-19]

We need to add a prompt when user enabling the dev mode and get the confirmation to enable it when doing.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/content/guides/applications/application-settings.mdx`:
- Around line 194-197: Update the Dev Mode description to explicitly state that
it bypasses both Flow Secret and attestation checks only when a Mobile
application initiates a flow directly. Keep the existing configuration
instructions and warning, but clarify this scope so it does not imply
verification is removed for all application operations.

In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/AttestationSection.tsx`:
- Around line 226-231: The emit flow in AttestationSection must persist Dev Mode
transitions even when Apple configuration is incomplete. Update the early-return
branch handling partially filled Apple fields to preserve the last valid
platform configuration while applying and emitting the current dev value, and
ensure both enabling and disabling transitions are covered by tests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fbcb2993-cc0f-4cd4-936f-8775a49152ec

📥 Commits

Reviewing files that changed from the base of the PR and between d38203b and b0c40e6.

📒 Files selected for processing (14)

• api/application.yaml
• backend/internal/application/service.go
• backend/internal/application/service_test.go
• backend/internal/flow/flowexec/constants.go
• backend/internal/flow/flowexec/service.go
• backend/internal/flow/flowexec/service_test.go
• backend/pkg/thunderidengine/providers/model.go
• backend/pkg/thunderidengine/providers/model_test.go
• docs/content/guides/applications/application-settings.mdx
• docs/content/key-concepts/authentication/integration-models.mdx
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/AttestationSection.tsx
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/DevModeConfirmDialog.tsx
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/AttestationSection.test.tsx
• frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/DevModeConfirmDialog.test.tsx

🚧 Files skipped from review as they are similar to previous changes (9)

• docs/content/key-concepts/authentication/integration-models.mdx
• backend/pkg/thunderidengine/providers/model.go
• backend/internal/application/service.go
• backend/internal/application/service_test.go
• backend/internal/flow/flowexec/service.go
• api/application.yaml
• backend/internal/flow/flowexec/constants.go
• backend/pkg/thunderidengine/providers/model_test.go
• backend/internal/flow/flowexec/service_test.go