Add Apple App Attest Safely

App Attest can raise the cost of automated abuse, but it is not a substitute for user authentication, authorization, quotas, or server-side provider-key protection. Use a maintained verifier or Apple's current server-side guidance; do not implement certificate and CBOR verification from a partial code snippet.

Non-negotiable server contract

1. Generate a cryptographically random challenge on the server, bind it to the intended operation and request-body hash, set a short expiry, and store it server-side.
2. On registration, verify the attestation certificate chain to Apple's root, the app-identity hash, the challenge, and the returned public key before persisting the key.
3. On every asserted request, read the raw request body once, verify the assertion against the stored public key and the server-issued challenge, then atomically advance the counter.
4. Consume each challenge exactly once. A replay, stale challenge, mismatched body hash, or failed counter compare-and-swap must reject the request.
5. Apply normal user authentication and a server-side spend quota after the assertion. App Attest alone does not authorize a user.

Safe handler shape