From 18985a99748e4d46d663789d50c14ba8604ac3d1 Mon Sep 17 00:00:00 2001
From: Tom Brow <tomb@block.xyz>
Date: Fri, 21 Aug 2026 14:44:34 -0700
Subject: [PATCH] Log App Attest enrollment parsing stages

Signed-off-by: Tom Brow <tomb@block.xyz>
Co-authored-by: Codex <noreply@openai.com>
Ai-assisted: true
---
 crates/buzz-push-gateway/src/app_attest.rs | 38 +++++++++++++++++-----
 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/crates/buzz-push-gateway/src/app_attest.rs b/crates/buzz-push-gateway/src/app_attest.rs
index 216bc1d0e7..55908ee5ba 100644
--- a/crates/buzz-push-gateway/src/app_attest.rs
+++ b/crates/buzz-push-gateway/src/app_attest.rs
@@ -63,14 +63,29 @@ impl AppAttestVerifier {
         key_id_b64: &str,
         client_data: &[u8],
     ) -> Result<VerifiedAttestation, AppAttestError> {
-        let cbor = STANDARD
-            .decode(attestation_b64)
-            .map_err(|_| AppAttestError::Invalid)?;
+        let cbor = STANDARD.decode(attestation_b64).map_err(|_| {
+            tracing::warn!(
+                "App Attest enrollment rejected before verification: invalid attestation base64"
+            );
+            AppAttestError::Invalid
+        })?;
         if cbor.is_empty() || cbor.len() > MAX_ATTESTATION_BYTES {
+            tracing::warn!(
+                attestation_bytes = cbor.len(),
+                "App Attest enrollment rejected before verification: invalid attestation size"
+            );
             return Err(AppAttestError::Invalid);
         }
-        let challenge = std::str::from_utf8(client_data).map_err(|_| AppAttestError::Invalid)?;
-        let att = Attestation::from_cbor_bytes(&cbor).map_err(|_| AppAttestError::Invalid)?;
+        let challenge = std::str::from_utf8(client_data).map_err(|_| {
+            tracing::warn!(
+                "App Attest enrollment rejected before verification: non-UTF-8 transcript"
+            );
+            AppAttestError::Invalid
+        })?;
+        let att = Attestation::from_cbor_bytes(&cbor).map_err(|error| {
+            tracing::warn!(%error, "App Attest enrollment rejected before verification: invalid CBOR");
+            AppAttestError::Invalid
+        })?;
         let (public_key, _) = att
             .verify(
                 challenge,
@@ -82,10 +97,17 @@ impl AppAttestVerifier {
                 tracing::warn!(%error, "App Attest enrollment verification failed");
                 AppAttestError::Invalid
             })?;
-        let key_id = STANDARD
-            .decode(key_id_b64)
-            .map_err(|_| AppAttestError::Invalid)?;
+        let key_id = STANDARD.decode(key_id_b64).map_err(|_| {
+            tracing::warn!(
+                "App Attest enrollment rejected after verification: invalid key ID base64"
+            );
+            AppAttestError::Invalid
+        })?;
         if key_id.len() != 32 {
+            tracing::warn!(
+                key_id_bytes = key_id.len(),
+                "App Attest enrollment rejected after verification: invalid key ID size"
+            );
             return Err(AppAttestError::Invalid);
         }
         Ok(VerifiedAttestation {