feat(auth): add WebAuthn passkey support with migrations, routes, and tests

2025-10-29 17:50:14 +01:00
parent ec6e7f04f2
commit ca30b20873
23 changed files with 1511 additions and 83 deletions
@@ -16,7 +16,13 @@ use sha2::{Digest, Sha256};
 use uuid::Uuid;

 use crate::{
-    auth::{password, AuthenticatedUser},
+    auth::{
+        passkeys::{
+            AuthenticationChallengeResponse, PasskeyLoginFinishPayload, PasskeyLoginStartPayload,
+            PasskeyRegistrationFinishPayload, PasskeySummary, RegistrationChallengeResponse,
+        },
+        password, AuthenticatedUser,
+    },
    error::{AppError, AppResult},
    models::{NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus, User, UserMembership},
    schema::{
@@ -141,54 +147,13 @@ pub async fn login(
        return Err(AppError::unauthorized());
    }

-    let memberships: Vec<(UserMembership, Tenant)> = memberships_dsl::user_memberships
-        .inner_join(tenant_dsl::tenants)
-        .filter(memberships_dsl::user_id.eq(user.id))
-        .load(&mut conn)?;
-
-    if memberships.is_empty() {
-        return Err(AppError::unauthorized());
-    }
-
    let preferred_slug = payload
        .preferred_tenant_slug
        .as_ref()
        .map(|slug| slug.trim().to_string())
        .filter(|slug| !slug.is_empty());

-    if let Some(tenant) = preferred_slug.as_ref().and_then(|slug| {
-        memberships
-            .iter()
-            .find(|(_, tenant)| tenant.slug.eq_ignore_ascii_case(slug))
-    }) {
-        return issue_session(&state, &mut conn, &user, tenant.1.id);
-    }
-
-    if memberships.len() == 1 {
-        let tenant_id = memberships[0].1.id;
-        return issue_session(&state, &mut conn, &user, tenant_id);
-    }
-
-    let selection_token = state
-        .jwt
-        .generate_tenant_selector_token(user.id)
-        .map_err(AppError::from)?;
-
-    let tenants = memberships
-        .into_iter()
-        .map(|(_, tenant)| TenantSnippet {
-            id: tenant.id,
-            slug: tenant.slug,
-        })
-        .collect();
-
-    let response = Json(TenantSelectionResponse {
-        access_token: selection_token,
-        tenants,
-    })
-    .into_response();
-
-    Ok(response)
+    complete_login(&state, &mut conn, &user, preferred_slug)
 }

 pub async fn refresh(
@@ -367,6 +332,142 @@ pub async fn list_tenants(
    Ok(Json(TenantListResponse { tenants }))
 }

+pub async fn passkey_register_start(
+    State(state): State<AppState>,
+    user: AuthenticatedUser,
+) -> AppResult<Json<RegistrationChallengeResponse>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let current_user: User = dsl::users.find(user.user_id).first(&mut conn)?;
+    let challenge = service.start_registration(&mut conn, &current_user)?;
+    Ok(Json(challenge))
+}
+
+pub async fn passkey_register_finish(
+    State(state): State<AppState>,
+    user: AuthenticatedUser,
+    Json(payload): Json<PasskeyRegistrationFinishPayload>,
+) -> AppResult<Json<PasskeySummary>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let current_user: User = dsl::users.find(user.user_id).first(&mut conn)?;
+
+    let PasskeyRegistrationFinishPayload {
+        challenge_id,
+        credential,
+        nickname,
+    } = payload;
+
+    let passkey = service.finish_registration(
+        &mut conn,
+        &current_user,
+        challenge_id,
+        credential,
+        nickname,
+    )?;
+
+    Ok(Json(PasskeySummary::from(passkey)))
+}
+
+pub async fn passkey_login_start(
+    State(state): State<AppState>,
+    Json(payload): Json<PasskeyLoginStartPayload>,
+) -> AppResult<Json<AuthenticationChallengeResponse>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let username = payload.username.trim();
+    if username.is_empty() {
+        return Err(AppError::bad_request("username must not be empty"));
+    }
+
+    let mut conn = state.db_unscoped()?;
+    let user: User = dsl::users
+        .filter(dsl::username.eq(username))
+        .first(&mut conn)?;
+
+    let challenge = service.start_authentication(&mut conn, &user)?;
+    Ok(Json(challenge))
+}
+
+pub async fn passkey_login_finish(
+    State(state): State<AppState>,
+    Json(payload): Json<PasskeyLoginFinishPayload>,
+) -> AppResult<Response> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let (user, _passkey, auth_result) =
+        service.finish_authentication(&mut conn, payload.challenge_id, payload.credential)?;
+
+    if !auth_result.user_verified() {
+        return Err(AppError::unauthorized());
+    }
+
+    complete_login(&state, &mut conn, &user, None)
+}
+
+fn complete_login(
+    state: &AppState,
+    conn: &mut PgConnection,
+    user: &User,
+    preferred_slug: Option<String>,
+) -> AppResult<Response> {
+    let memberships: Vec<(UserMembership, Tenant)> = memberships_dsl::user_memberships
+        .inner_join(tenant_dsl::tenants)
+        .filter(memberships_dsl::user_id.eq(user.id))
+        .load(conn)?;
+
+    if memberships.is_empty() {
+        return Err(AppError::unauthorized());
+    }
+
+    if let Some(ref slug) = preferred_slug {
+        if let Some((_, tenant)) = memberships
+            .iter()
+            .find(|(_, tenant)| tenant.slug.eq_ignore_ascii_case(slug))
+        {
+            return issue_session(state, conn, user, tenant.id);
+        }
+    }
+
+    if memberships.len() == 1 {
+        return issue_session(state, conn, user, memberships[0].1.id);
+    }
+
+    let selection_token = state
+        .jwt
+        .generate_tenant_selector_token(user.id)
+        .map_err(AppError::from)?;
+
+    let tenants = memberships
+        .into_iter()
+        .map(|(_, tenant)| TenantSnippet {
+            id: tenant.id,
+            slug: tenant.slug,
+        })
+        .collect();
+
+    Ok(Json(TenantSelectionResponse {
+        access_token: selection_token,
+        tenants,
+    })
+    .into_response())
+}
+
 fn issue_session(
    state: &AppState,
    conn: &mut PgConnection,
@@ -60,6 +60,16 @@ pub fn create_router(state: AppState) -> Router<()> {
        .route("/logout", post(auth::logout))
        .route("/select-tenant", post(auth::select_tenant))
        .route("/tenants", get(auth::list_tenants))
+        .route(
+            "/passkeys/register/start",
+            post(auth::passkey_register_start),
+        )
+        .route(
+            "/passkeys/register/finish",
+            post(auth::passkey_register_finish),
+        )
+        .route("/passkeys/login/start", post(auth::passkey_login_start))
+        .route("/passkeys/login/finish", post(auth::passkey_login_finish))
        .route("/me", get(auth::me));

    let documents_routes = Router::new()
@@ -137,7 +147,9 @@ pub fn create_router(state: AppState) -> Router<()> {
            "/webdav-tokens",
            get(profile::list_webdav_tokens).post(profile::create_webdav_token),
        )
-        .route("/webdav-tokens/:id", delete(profile::delete_webdav_token));
+        .route("/webdav-tokens/:id", delete(profile::delete_webdav_token))
+        .route("/passkeys", get(profile::list_passkeys))
+        .route("/passkeys/:id", delete(profile::delete_passkey));

    let protected_state = state.clone();
    let assets_routes = Router::new().route("/:asset_id", get(documents::get_document_asset));
@@ -1,9 +1,14 @@
-use axum::{extract::Path, http::StatusCode, Json};
+use axum::{
+    extract::{Path, Query, State},
+    http::StatusCode,
+    Json,
+};
 use chrono::{DateTime, NaiveDateTime};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;

 use crate::auth::{
+    passkeys::PasskeySummary,
    webdav_tokens::{
        create_webdav_token as issue_token, list_webdav_tokens as load_tokens,
        revoke_webdav_token as revoke_token,
@@ -12,6 +17,7 @@ use crate::auth::{
 };
 use crate::error::{AppError, AppResult};
 use crate::models::WebdavToken;
+use crate::state::AppState;
 use crate::utils::{db::no_content, time::to_iso};

 #[derive(Debug, Serialize)]
@@ -37,6 +43,27 @@ pub struct CreateWebdavTokenRequest {
    pub expires_at: Option<String>,
 }

+#[derive(Debug, Deserialize)]
+pub struct RevokePasskeyQuery {
+    #[serde(default)]
+    pub reason: Option<String>,
+}
+
+pub async fn list_passkeys(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+) -> AppResult<Json<Vec<PasskeySummary>>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let passkeys = service.list_for_user(&mut conn, user_id)?;
+    Ok(Json(passkeys))
+}
+
 pub async fn list_webdav_tokens(
    TenantScopedConn {
        mut conn,
@@ -90,6 +117,23 @@ pub async fn delete_webdav_token(
    no_content()
 }

+pub async fn delete_passkey(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+    Path(passkey_id): Path<Uuid>,
+    Query(query): Query<RevokePasskeyQuery>,
+) -> AppResult<StatusCode> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    service.revoke_passkey(&mut conn, user_id, passkey_id, query.reason)?;
+    no_content()
+}
+
 fn webdav_token_to_response(token: WebdavToken) -> WebdavTokenResponse {
    WebdavTokenResponse {
        id: token.id,