App Attest step 4: the six device routes on the approval broker as body-authenticated POSTs; wire header rows deleted, vectors regenerated, Swift mirror (stacked on #11989)

apps/approve-ios/Approve/AppState.swift

@@ -91,11 +91,12 @@ final class AppState: ObservableObject {
             let attempt = PushAttempt(enrollmentId: e.enrollment_id, attestKeyId: e.attest_key_id, token: desired)
             do {
                 let client = try requireClient()
-                let body = WireEncode.pushUpdate(registration(client.config, desired))
+                let push = registration(client.config, desired)
+                let body = WireEncode.pushUpdate(push)
                 let requestedAt = Self.now()
                 let auth = try await assertion(e, requestedAt: requestedAt,
                                                clientData: devicePushUpdateClientData(enrollmentId: e.enrollment_id, requestedAt: requestedAt, pushBodyJson: body))
-                try await client.updatePush(bodyJson: body, auth)
+                try await client.updatePush(push, auth)
                 // Record success only if the token is STILL desired and the enrolment the update
                 // was made for is STILL the current one; otherwise loop and re-derive.
                 guard apnsToken == desired, case .enrolled(var now) = state, now.enrollment_id == e.enrollment_id,

apps/approve-ios/Approve/Wire.swift

@@ -181,6 +181,16 @@ enum WireEncode {
     }
     /// push_update_json
     static func pushUpdate(_ p: ApnsRegistration) -> String { push(p).serialized }
+    /// read_authentication_json_value
+    static func readAuthentication(_ a: ReadAuth) -> WireJson {
+        .object([("enrollment_id", .string(a.enrollmentId)), ("requested_at", .string(a.requestedAt)), ("assertion_b64", .string(a.assertionB64))])
+    }
+    /// read_authentication_json: the body of the three authenticated reads
+    static func readRequest(_ a: ReadAuth) -> String { readAuthentication(a).serialized }
+    /// push_update_request_json: { auth, push }
+    static func pushUpdateRequest(_ a: ReadAuth, _ p: ApnsRegistration) -> String {
+        WireJson.object([("auth", readAuthentication(a)), ("push", push(p))]).serialized
+    }
 }
 
 enum WireDecode {
@@ -393,14 +403,12 @@ enum OutcomeName {
     ]
 }
 
-// ── Headers, paths ───────────────────────────────────────────────────────────────────────────
-enum ReadHeader {
-    static let enrollment = "X-Approval-Enrollment"
-    static let requestedAt = "X-Approval-Requested-At"
-    static let assertion = "X-Approval-Assertion"
-}
-
-/// The credentials an authenticated GET or PUT carries; produced by the caller so this file signs nothing.
+// ── Paths ────────────────────────────────────────────────────────────────────────────────────
+/// EVERY DEVICE OPERATION IS A POST WHOSE BODY CARRIES ITS AUTHENTICATION (gunbc.auth.approval_device_wire
+/// ReadAuthentication): the server hands a route no request header but the tailnet login, so the
+/// enrolment id, the claimed time and the assertion travel in the JSON body. The assertion's client
+/// data (device_read_client_data) is unchanged by where the carrier rides.
+/// The credentials an authenticated read or push update carries; produced by the caller so this file signs nothing.
 struct ReadAuth {
     var enrollmentId: String
     var requestedAt: String
@@ -476,14 +484,9 @@ struct Client {
     let config: ServerConfig
     let session = URLSession(configuration: .ephemeral)
 
-    private func send(_ method: String, _ path: String, body: String? = nil, read: ReadAuth? = nil) async throws -> Data {
+    private func send(_ method: String, _ path: String, body: String? = nil) async throws -> Data {
         var req = URLRequest(url: try config.url(path))
         req.httpMethod = method
-        if let read {
-            req.setValue(read.enrollmentId, forHTTPHeaderField: ReadHeader.enrollment)
-            req.setValue(read.requestedAt, forHTTPHeaderField: ReadHeader.requestedAt)
-            req.setValue(read.assertionB64, forHTTPHeaderField: ReadHeader.assertion)
-        }
         if let body {
             req.httpBody = Data(body.utf8)
             req.setValue("application/json", forHTTPHeaderField: "Content-Type")
@@ -501,21 +504,24 @@ struct Client {
     func enrol(_ r: EnrolmentRequest) async throws -> EnrolmentGrant {
         try WireDecode.enrolmentGrant(await send("POST", Route.enrol, body: WireEncode.enrolmentRequest(r)))
     }
+    /// POST /approve/device/pending, body = read_authentication_json
     func pending(_ read: ReadAuth) async throws -> [PendingApproval] {
-        try WireDecode.pendingList(await send("GET", Route.pending, read: read))
+        try WireDecode.pendingList(await send("POST", Route.pending, body: WireEncode.readRequest(read)))
     }
+    /// POST /approve/device/requests/<id>, body = read_authentication_json
     func fetch(_ path: String, _ read: ReadAuth) async throws -> FetchedRequest {
-        try WireDecode.fetchedRequest(await send("GET", path, read: read))
+        try WireDecode.fetchedRequest(await send("POST", path, body: WireEncode.readRequest(read)))
     }
     func redeem(_ r: SignedRedemption) async throws -> RedemptionOutcome {
         try WireDecode.redemptionResponse(await send("POST", Route.redeem, body: WireEncode.signedRedemption(r)))
     }
-    /// GET /approve/device/enrollments/<enrollment_id>, read-assertion authenticated.
+    /// POST /approve/device/enrollments/<enrollment_id>, body = read_authentication_json.
     func readback(_ path: String, _ read: ReadAuth) async throws -> EnrolmentReadback {
-        try WireDecode.enrolmentReadback(await send("GET", path, read: read))
+        try WireDecode.enrolmentReadback(await send("POST", path, body: WireEncode.readRequest(read)))
     }
-    /// PUT /approve/device/push; the body is the exact JSON the assertion's client data framed.
-    func updatePush(bodyJson: String, _ read: ReadAuth) async throws {
-        _ = try await send("PUT", Route.push, body: bodyJson, read: read)
+    /// POST /approve/device/push, body = push_update_request_json { auth, push }; the assertion's
+    /// client data frames push_update_json(push) alone, exactly as the server re-renders it.
+    func updatePush(_ push: ApnsRegistration, _ read: ReadAuth) async throws {
+        _ = try await send("POST", Route.push, body: WireEncode.pushUpdateRequest(read, push))
     }
 }

apps/approve-ios/ApproveTests/ProtocolVectorTests.swift

@@ -73,7 +73,7 @@ struct Vectors: Decodable {
     var envelope: [Envelope]
     /// path_segment: input -> encoded, emitted by the .dag path_segment fold.
     var path_segment: [PathSegment]
-    /// surface: the header names and route paths, by name.
+    /// surface: the one method, and the route paths, by name.
     var surface: [Surface]
     /// stored_request: the store's own rendering, so the detail screen's reader is joined to it.
     /// Optional in the Codable so that a fixture predating the section (it is emitted by
@@ -178,6 +178,18 @@ final class ProtocolVectorTests: XCTestCase {
         XCTAssertEqual(WireEncode.pushUpdate(try WireDecode.pushUpdate(Data(body.utf8))), body)
     }
 
+    /// The read-authentication body and the push-update envelope { auth, push } are ENCODED only by
+    /// the app (the server decodes them), so they are checked against the fixture bytes directly
+    /// from the fixture's own field values.
+    func testReadAuthenticationEncodesToTheFixtureBytes() throws {
+        let body = try envelope("read_authentication")
+        let auth = ReadAuth(enrollmentId: "enr-482913", requestedAt: "2026-09-18T12:00:30Z", assertionB64: "omlzaWduYXR1cmU")
+        XCTAssertEqual(WireEncode.readRequest(auth), body)
+        let pushBody = try envelope("push_update")
+        let push = try WireDecode.pushUpdate(Data(pushBody.utf8))
+        XCTAssertEqual(WireEncode.pushUpdateRequest(auth, push), try envelope("push_update_request"))
+    }
+
     /// Every response body decodes strictly, with its declared members present and non-empty.
     func testResponsesDecode() throws {
         XCTAssertFalse(try WireDecode.enrolmentGrant(Data(try envelope("enrolment_grant").utf8)).enrollment_id.isEmpty)
@@ -250,14 +262,12 @@ final class ProtocolVectorTests: XCTestCase {
         XCTAssertEqual(got, Data(try envelope("push_update_client_data").utf8))
     }
 
-    /// Every header name and route the app spells is the fixture's; a missing surface row FAILS, so
+    /// The method and every route the app spells is the fixture's; a missing surface row FAILS, so
     /// a route the wire adds and the app does not spell is caught, not silently absent.
     func testSurfaceMatchesTheFixture() throws {
         let rows = Dictionary(uniqueKeysWithValues: try load().surface.map { ($0.name, $0.value) })
         func surface(_ name: String) throws -> String { try XCTUnwrap(rows[name], "surface row \(name) missing") }
-        XCTAssertEqual(ReadHeader.enrollment, try surface("header_enrollment"))
-        XCTAssertEqual(ReadHeader.requestedAt, try surface("header_requested_at"))
-        XCTAssertEqual(ReadHeader.assertion, try surface("header_assertion"))
+        XCTAssertEqual("POST", try surface("method_every_device_operation"))
         XCTAssertEqual(Route.enrol, try surface("route_enrol"))
         XCTAssertEqual(Route.pending, try surface("route_pending"))
         XCTAssertEqual(Route.requestPrefix, try surface("route_request_prefix"))

apps/approve-ios/project.yml

@@ -23,6 +23,8 @@ targets:
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: ai.gunb.approve
+        MARKETING_VERSION: "1"
+        CURRENT_PROJECT_VERSION: 1
         INFOPLIST_KEY_UILaunchScreen_Generation: YES
         INFOPLIST_KEY_NSFaceIDUsageDescription: "Approving a request signs it with a key that only unlocks with Face ID."
         INFOPLIST_KEY_CFBundleDisplayName: Approve

dag/extdeps/filesystem/filesystem_io.dag

@@ -411,6 +411,15 @@ type FilesystemDirectoryListing sole_constructor {
   entries: String
 }
 
+// THE ENTRY NAMES OF AN ADMITTED LISTING, decoded once beside the encoding they come from: `List`
+// joins names with newlines, so this is the split -- blank lines dropped, every other line one
+// name as the host spelled it. A consumer that split `entries` itself would be the second
+// decoder of one wire format (review 69704 of gunbc#12000 found one; extdeps.realization
+// artifact_store_fs carries an older one under filesystem_absence_establishment_adoption_standing).
+fn filesystem_listing_entry_names(listing: FilesystemDirectoryListing) -> List<String> {
+  filter(listing.entries.split(delimiter: "\n"), n => n != "")
+}
+
 type FilesystemEstablishedAbsence sole_constructor {
   directory: FilePath
   name: String

dag/gunbc/auth/approval_app_attest_config.dag

@@ -0,0 +1,53 @@
+module gunbc.auth.approval_app_attest_config
+
+import std.types { NonEmptyStr, Int, List }
+import extdeps.apple.app_attest { AppIdPrefix, AppAttestEnvironment, AppAttestDevelopment, app_attest_app_id }
+
+// THE FACTS THE APP ATTEST VERIFIER IS CONFIGURED WITH, and who owns each. The bundle identifier
+// is the app's (apps/approve-ios/project.yml PRODUCT_BUNDLE_IDENTIFIER). The App ID prefix is
+// read from the Identifier entry of the operator's Apple Developer account -- its own fact, not a
+// second name for the team id (extdeps.apple.app_attest AppIdPrefix). The environment is decided
+// by how the build reaches the phone: TestFlight and App Store builds attest in production. The
+// admitted launch categories are Apple's validation categories for those distributions (2 =
+// TestFlight, 4 = App Store; 3 = a development signing identity is admitted so the operator's
+// own Xcode build can enrol during bring-up), and the bundle version is the one the operator
+// distributed.
+//
+// THE OPERATOR SUPPLIED THE PREFIX (chat, 2026-09-22): the Team ID 72HGYAMBVQ shown under
+// Membership details, which Apple uses as the App ID prefix for an account's own identifiers. The
+// bring-up build reaches the phone from the operator's Xcode over a cable, so it attests in the
+// development environment with a development signing identity (category 3); TestFlight (2) and
+// App Store (4) stay admitted for the day the distribution changes, and the bundle version is the
+// MARKETING_VERSION apps/approve-ios/project.yml sets. A wrong prefix does not fabricate: every
+// attestation refuses AttestationAppIdMismatch by name. The row below is the one place that changes.
+type AppAttestVerifierConfig
+  = AppAttestVerifierConfigured {
+      app_id_prefix: AppIdPrefix
+      bundle_id: NonEmptyStr
+      environment: AppAttestEnvironment
+      admitted_validation_categories: List<Int>
+      expected_bundle_version: NonEmptyStr
+    }
+  | AppAttestVerifierAwaitingOperator { missing: NonEmptyStr }
+
+data approval_app_bundle_id: NonEmptyStr = "ai.gunb.approve"
+
+data approval_app_attest_verifier: AppAttestVerifierConfig = AppAttestVerifierConfigured {
+  app_id_prefix: "72HGYAMBVQ" as AppIdPrefix,
+  bundle_id: approval_app_bundle_id,
+  environment: AppAttestDevelopment,
+  admitted_validation_categories: [2, 3, 4],
+  expected_bundle_version: approval_app_bundle_version,
+}
+
+// CFBundleShortVersionString of the operator's build: the same literal apps/approve-ios/project.yml
+// sets as MARKETING_VERSION, which is hand-authored Swift/XcodeGen seed and cannot read this row.
+data approval_app_bundle_version: NonEmptyStr = "1"
+
+fn approval_app_attest_app_id(c: AppAttestVerifierConfig) -> NonEmptyStr? {
+  match c {
+    AppAttestVerifierAwaitingOperator { missing: _ } => none
+    AppAttestVerifierConfigured { app_id_prefix: p, bundle_id: b, environment: _, admitted_validation_categories: _, expected_bundle_version: _ } =>
+      Present { value: app_attest_app_id(prefix: p, bundle_id: b) }
+  }
+}