refactor: replace passkey challenge structs with PasskeyCeremony - #362
Draft
livio-a wants to merge 8 commits into
Draft
refactor: replace passkey challenge structs with PasskeyCeremony#362livio-a wants to merge 8 commits into
livio-a wants to merge 8 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Resolve conflicts by combining main's DisplayName registration labels and CI tarball journey setup with the PasskeyCeremony refactor. Co-authored-by: Cursor <cursoragent@cursor.com>
Update merged tests to assert persisted session data instead of removed challenge username fields, and relax residentKey checks when go-webauthn omits the preferred default from JSON. Co-authored-by: Cursor <cursoragent@cursor.com>
livio-a
changed the title
Member
|
Is this still relevant? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refactors WebAuthn passkey ceremony handling to stop mirroring go-webauthn types in domain structs and rebuilding browser JSON by hand.
PasskeyCeremony: persistssession_data+rp_originsfor verify; keepsclientOptionsin-memory only (not written to DB) and exposes them viaClientOptions()at issue time.PasskeyChallenge,PasskeyRegistrationChallenge, andBuildPasskey*helpers withCreatePasskeyChallenge/VerifyPasskeyChallengeandCreatePasskeyRegistrationChallenge/VerifyPasskeyRegistrationChallenge.AuthChallengePasskeyandPasskeyRegistration.Challengeto*PasskeyCeremony; service and flow adapters return ceremony options verbatim to the client.ClientOptionsinto the API envelope (challengePayloadToAPI).attestation: none,residentKey: preferred,excludeCredentialsfor existing passkeys; threadsuserVerificationfrom service/flow intoCreatePasskeyRegistrationChallenge.att.*codes (ErrAuthAttemptInvalidState,ErrInternal, raw go-webauthn verify errors wrapped asErrAuthAttemptProofRejectedat the service layer).Motivation
The old model converted
webauthn.SessionDatafield-by-field, discarded go-webauthn client options at issue, then rebuilt them for the browser — duplicating the library and risking drift. This stores what go-webauthn needs for verify and returns what it produced for the browser at issue time.Out of scope (follow-ups)
mediation: "conditional"(ADR 013 future work)toFlowStepChallengealways emittingmethod: "passkey"— registration browser path still needs OpenAPI + API mapper fixuserVerification(requiredfor MFA vspreferredfor primary passkey) — flow still hardcodes"preferred"Test plan
go test ./internal/domain/... ./internal/service/... ./internal/api/...go test -tags postgres_integration ./internal/api/integration_test/... -run 'Passkey|Registration|Upsell'go test -tags postgres_integration ./internal/storage/database/repository/... -run Passkeycorepack pnpm run check -- --full(blocked by unrelatedcmd/serverTestEmbeddedPostgresOptionsUseDataDirfailure on this machine)