cleanup

backend/src/auth/passkeys.rs

@@ -118,13 +118,55 @@ impl PasskeyService {
         .execute(conn);
     }
 
+    fn begin_registration(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+        username: &str,
+        challenge_user_id: Option<Uuid>,
+        exclude: Option<Vec<CredentialID>>,
+    ) -> AppResult<RegistrationChallengeResponse> {
+        self.prune_expired(conn);
+
+        let (challenge, state) = self
+            .webauthn
+            .start_passkey_registration(user_id, username, username, exclude)
+            .map_err(|err| {
+                tracing::error!(error = %err, "failed to start passkey registration");
+                AppError::internal("failed to start passkey registration")
+            })?;
+
+        let challenge_id = Uuid::new_v4();
+        let expires_at = (Utc::now() + self.challenge_ttl).naive_utc();
+        let challenge_bytes: Vec<u8> = challenge.public_key.challenge.clone().into();
+        let state_bytes = serde_json::to_vec(&state)
+            .context("failed to encode passkey registration state")
+            .map_err(AppError::internal)?;
+
+        let record = NewWebauthnChallenge {
+            id: challenge_id,
+            user_id: challenge_user_id,
+            purpose: PURPOSE_REGISTRATION.to_string(),
+            challenge: challenge_bytes,
+            state: state_bytes,
+            expires_at,
+        };
+
+        diesel::insert_into(challenge_dsl::webauthn_challenges)
+            .values(&record)
+            .execute(conn)?;
+
+        Ok(RegistrationChallengeResponse {
+            challenge_id,
+            challenge,
+        })
+    }
+
     pub fn start_registration(
         &self,
         conn: &mut PgConnection,
         user: &User,
     ) -> AppResult<RegistrationChallengeResponse> {
-        self.prune_expired(conn);
-
         let existing: Vec<UserPasskey> = passkey_dsl::user_passkeys
             .filter(passkey_dsl::user_id.eq(user.id))
             .filter(passkey_dsl::revoked_at.is_null())
@@ -141,38 +183,7 @@ impl PasskeyService {
             )
         };
 
-        let (challenge, state) = self
-            .webauthn
-            .start_passkey_registration(user.id, &user.username, &user.username, exclude)
-            .map_err(|err| {
-                tracing::error!(error = %err, "failed to start passkey registration");
-                AppError::internal("failed to start passkey registration")
-            })?;
-
-        let challenge_id = Uuid::new_v4();
-        let expires_at = (Utc::now() + self.challenge_ttl).naive_utc();
-        let challenge_bytes: Vec<u8> = challenge.public_key.challenge.clone().into();
-        let state_bytes = serde_json::to_vec(&state)
-            .context("failed to encode passkey registration state")
-            .map_err(AppError::internal)?;
-
-        let record = NewWebauthnChallenge {
-            id: challenge_id,
-            user_id: Some(user.id),
-            purpose: PURPOSE_REGISTRATION.to_string(),
-            challenge: challenge_bytes,
-            state: state_bytes,
-            expires_at,
-        };
-
-        diesel::insert_into(challenge_dsl::webauthn_challenges)
-            .values(&record)
-            .execute(conn)?;
-
-        Ok(RegistrationChallengeResponse {
-            challenge_id,
-            challenge,
-        })
+        self.begin_registration(conn, user.id, &user.username, Some(user.id), exclude)
     }
 
     pub fn start_signup_registration(
@@ -181,50 +192,16 @@ impl PasskeyService {
         user_id: Uuid,
         username: &str,
     ) -> AppResult<RegistrationChallengeResponse> {
-        self.prune_expired(conn);
-
-        let (challenge, state) = self
-            .webauthn
-            .start_passkey_registration(user_id, username, username, None)
-            .map_err(|err| {
-                tracing::error!(error = %err, "failed to start passkey registration");
-                AppError::internal("failed to start passkey registration")
-            })?;
-
-        let challenge_id = Uuid::new_v4();
-        let expires_at = (Utc::now() + self.challenge_ttl).naive_utc();
-        let challenge_bytes: Vec<u8> = challenge.public_key.challenge.clone().into();
-        let state_bytes = serde_json::to_vec(&state)
-            .context("failed to encode passkey registration state")
-            .map_err(AppError::internal)?;
-
-        let record = NewWebauthnChallenge {
-            id: challenge_id,
-            user_id: None,
-            purpose: PURPOSE_REGISTRATION.to_string(),
-            challenge: challenge_bytes,
-            state: state_bytes,
-            expires_at,
-        };
-
-        diesel::insert_into(challenge_dsl::webauthn_challenges)
-            .values(&record)
-            .execute(conn)?;
-
-        Ok(RegistrationChallengeResponse {
-            challenge_id,
-            challenge,
-        })
+        self.begin_registration(conn, user_id, username, None, None)
     }
 
-    pub fn finish_registration(
+    fn complete_registration(
         &self,
         conn: &mut PgConnection,
-        user: &User,
         challenge_id: Uuid,
-        credential: RegisterPublicKeyCredential,
-        nickname: Option<String>,
-    ) -> AppResult<UserPasskey> {
+        credential: &RegisterPublicKeyCredential,
+        expected_user: Option<Uuid>,
+    ) -> AppResult<PreparedPasskey> {
         let record: WebauthnChallenge = challenge_dsl::webauthn_challenges
             .find(challenge_id)
             .first(conn)
@@ -240,8 +217,14 @@ impl PasskeyService {
             return Err(AppError::bad_request("challenge is not for registration"));
         }
 
-        if record.user_id != Some(user.id) {
-            return Err(AppError::unauthorized());
+        if let Some(expected) = expected_user {
+            if record.user_id != Some(expected) {
+                return Err(AppError::unauthorized());
+            }
+        } else if record.user_id.is_some() {
+            return Err(AppError::bad_request(
+                "unexpected user context for signup registration",
+            ));
         }
 
         if record.expires_at < Utc::now().naive_utc() {
@@ -255,7 +238,7 @@ impl PasskeyService {
 
         let passkey = self
             .webauthn
-            .finish_passkey_registration(&credential, &state)
+            .finish_passkey_registration(credential, &state)
             .map_err(|err| {
                 tracing::warn!(error = %err, "passkey registration validation failed");
                 AppError::bad_request("invalid passkey attestation")
@@ -296,24 +279,36 @@ impl PasskeyService {
             .context("failed to serialise passkey")
             .map_err(AppError::internal)?;
 
-        let new_passkey = NewUserPasskey {
+        diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+
+        Ok(PreparedPasskey {
             id: Uuid::new_v4(),
-            user_id: user.id,
             credential_id: credential_id_vec,
             public_key: public_key_bytes,
             credential: credential_json,
             sign_count: credential_struct.counter as i64,
             transports,
             aaguid,
-            nickname,
-        };
+        })
+    }
+
+    pub fn finish_registration(
+        &self,
+        conn: &mut PgConnection,
+        user: &User,
+        challenge_id: Uuid,
+        credential: RegisterPublicKeyCredential,
+        nickname: Option<String>,
+    ) -> AppResult<UserPasskey> {
+        let prepared =
+            self.complete_registration(conn, challenge_id, &credential, Some(user.id))?;
+
+        let new_passkey = prepared.into_new_user_passkey(user.id, nickname);
 
         diesel::insert_into(passkey_dsl::user_passkeys)
             .values(&new_passkey)
             .execute(conn)?;
 
-        diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
-
         let created: UserPasskey = passkey_dsl::user_passkeys
             .find(new_passkey.id)
             .select(UserPasskey::as_select())
@@ -410,84 +405,7 @@ impl PasskeyService {
         challenge_id: Uuid,
         credential: &RegisterPublicKeyCredential,
     ) -> AppResult<PreparedPasskey> {
-        let record: WebauthnChallenge = challenge_dsl::webauthn_challenges
-            .find(challenge_id)
-            .first(conn)
-            .map_err(|err| {
-                if matches!(err, diesel::result::Error::NotFound) {
-                    AppError::bad_request("challenge not found")
-                } else {
-                    AppError::from(err)
-                }
-            })?;
-
-        if record.purpose != PURPOSE_REGISTRATION {
-            return Err(AppError::bad_request("challenge is not for registration"));
-        }
-
-        if record.expires_at < Utc::now().naive_utc() {
-            diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
-            return Err(AppError::bad_request("challenge expired"));
-        }
-
-        let state: PasskeyRegistration = serde_json::from_slice(&record.state)
-            .context("failed to decode registration state")
-            .map_err(AppError::internal)?;
-
-        let passkey = self
-            .webauthn
-            .finish_passkey_registration(credential, &state)
-            .map_err(|err| {
-                tracing::warn!(error = %err, "passkey registration validation failed");
-                AppError::bad_request("invalid passkey attestation")
-            })?;
-
-        let credential_struct: Credential = passkey.clone().into();
-        let credential_id_vec: Vec<u8> = credential_struct.cred_id.clone().into();
-
-        let duplicate = passkey_dsl::user_passkeys
-            .filter(passkey_dsl::credential_id.eq(&credential_id_vec))
-            .first::<UserPasskey>(conn)
-            .optional()?;
-        if duplicate.is_some() {
-            diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
-            return Err(AppError::conflict("credential already registered"));
-        }
-
-        let public_key_bytes = serde_cbor_2::to_vec(&credential_struct.cred)
-            .context("failed to encode credential public key")
-            .map_err(AppError::internal)?;
-
-        let transports: Vec<Option<String>> = credential_struct
-            .transports
-            .clone()
-            .unwrap_or_default()
-            .into_iter()
-            .map(|transport| Some(transport.as_ref().to_string()))
-            .collect();
-
-        let aaguid = match credential_struct.attestation.metadata {
-            AttestationMetadata::Packed { aaguid } | AttestationMetadata::Tpm { aaguid, .. } => {
-                Some(aaguid)
-            }
-            _ => None,
-        };
-
-        let credential_json = serde_json::to_value(&passkey)
-            .context("failed to serialise passkey")
-            .map_err(AppError::internal)?;
-
-        diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
-
-        Ok(PreparedPasskey {
-            id: Uuid::new_v4(),
-            credential_id: credential_id_vec,
-            public_key: public_key_bytes,
-            credential: credential_json,
-            sign_count: credential_struct.counter as i64,
-            transports,
-            aaguid,
-        })
+        self.complete_registration(conn, challenge_id, credential, None)
     }
 
     pub fn revoke_passkey(