feat(auth): add WebAuthn passkey support with migrations, routes, and tests

2025-10-29 17:50:14 +01:00
parent ec6e7f04f2
commit ca30b20873
23 changed files with 1511 additions and 83 deletions
@@ -16,7 +16,13 @@ use sha2::{Digest, Sha256};
 use uuid::Uuid;

 use crate::{
-    auth::{password, AuthenticatedUser},
+    auth::{
+        passkeys::{
+            AuthenticationChallengeResponse, PasskeyLoginFinishPayload, PasskeyLoginStartPayload,
+            PasskeyRegistrationFinishPayload, PasskeySummary, RegistrationChallengeResponse,
+        },
+        password, AuthenticatedUser,
+    },
    error::{AppError, AppResult},
    models::{NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus, User, UserMembership},
    schema::{
@@ -141,54 +147,13 @@ pub async fn login(
        return Err(AppError::unauthorized());
    }

-    let memberships: Vec<(UserMembership, Tenant)> = memberships_dsl::user_memberships
-        .inner_join(tenant_dsl::tenants)
-        .filter(memberships_dsl::user_id.eq(user.id))
-        .load(&mut conn)?;
-
-    if memberships.is_empty() {
-        return Err(AppError::unauthorized());
-    }
-
    let preferred_slug = payload
        .preferred_tenant_slug
        .as_ref()
        .map(|slug| slug.trim().to_string())
        .filter(|slug| !slug.is_empty());

-    if let Some(tenant) = preferred_slug.as_ref().and_then(|slug| {
-        memberships
-            .iter()
-            .find(|(_, tenant)| tenant.slug.eq_ignore_ascii_case(slug))
-    }) {
-        return issue_session(&state, &mut conn, &user, tenant.1.id);
-    }
-
-    if memberships.len() == 1 {
-        let tenant_id = memberships[0].1.id;
-        return issue_session(&state, &mut conn, &user, tenant_id);
-    }
-
-    let selection_token = state
-        .jwt
-        .generate_tenant_selector_token(user.id)
-        .map_err(AppError::from)?;
-
-    let tenants = memberships
-        .into_iter()
-        .map(|(_, tenant)| TenantSnippet {
-            id: tenant.id,
-            slug: tenant.slug,
-        })
-        .collect();
-
-    let response = Json(TenantSelectionResponse {
-        access_token: selection_token,
-        tenants,
-    })
-    .into_response();
-
-    Ok(response)
+    complete_login(&state, &mut conn, &user, preferred_slug)
 }

 pub async fn refresh(
@@ -367,6 +332,142 @@ pub async fn list_tenants(
    Ok(Json(TenantListResponse { tenants }))
 }

+pub async fn passkey_register_start(
+    State(state): State<AppState>,
+    user: AuthenticatedUser,
+) -> AppResult<Json<RegistrationChallengeResponse>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let current_user: User = dsl::users.find(user.user_id).first(&mut conn)?;
+    let challenge = service.start_registration(&mut conn, &current_user)?;
+    Ok(Json(challenge))
+}
+
+pub async fn passkey_register_finish(
+    State(state): State<AppState>,
+    user: AuthenticatedUser,
+    Json(payload): Json<PasskeyRegistrationFinishPayload>,
+) -> AppResult<Json<PasskeySummary>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let current_user: User = dsl::users.find(user.user_id).first(&mut conn)?;
+
+    let PasskeyRegistrationFinishPayload {
+        challenge_id,
+        credential,
+        nickname,
+    } = payload;
+
+    let passkey = service.finish_registration(
+        &mut conn,
+        &current_user,
+        challenge_id,
+        credential,
+        nickname,
+    )?;
+
+    Ok(Json(PasskeySummary::from(passkey)))
+}
+
+pub async fn passkey_login_start(
+    State(state): State<AppState>,
+    Json(payload): Json<PasskeyLoginStartPayload>,
+) -> AppResult<Json<AuthenticationChallengeResponse>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let username = payload.username.trim();
+    if username.is_empty() {
+        return Err(AppError::bad_request("username must not be empty"));
+    }
+
+    let mut conn = state.db_unscoped()?;
+    let user: User = dsl::users
+        .filter(dsl::username.eq(username))
+        .first(&mut conn)?;
+
+    let challenge = service.start_authentication(&mut conn, &user)?;
+    Ok(Json(challenge))
+}
+
+pub async fn passkey_login_finish(
+    State(state): State<AppState>,
+    Json(payload): Json<PasskeyLoginFinishPayload>,
+) -> AppResult<Response> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let mut conn = state.db_unscoped()?;
+    let (user, _passkey, auth_result) =
+        service.finish_authentication(&mut conn, payload.challenge_id, payload.credential)?;
+
+    if !auth_result.user_verified() {
+        return Err(AppError::unauthorized());
+    }
+
+    complete_login(&state, &mut conn, &user, None)
+}
+
+fn complete_login(
+    state: &AppState,
+    conn: &mut PgConnection,
+    user: &User,
+    preferred_slug: Option<String>,
+) -> AppResult<Response> {
+    let memberships: Vec<(UserMembership, Tenant)> = memberships_dsl::user_memberships
+        .inner_join(tenant_dsl::tenants)
+        .filter(memberships_dsl::user_id.eq(user.id))
+        .load(conn)?;
+
+    if memberships.is_empty() {
+        return Err(AppError::unauthorized());
+    }
+
+    if let Some(ref slug) = preferred_slug {
+        if let Some((_, tenant)) = memberships
+            .iter()
+            .find(|(_, tenant)| tenant.slug.eq_ignore_ascii_case(slug))
+        {
+            return issue_session(state, conn, user, tenant.id);
+        }
+    }
+
+    if memberships.len() == 1 {
+        return issue_session(state, conn, user, memberships[0].1.id);
+    }
+
+    let selection_token = state
+        .jwt
+        .generate_tenant_selector_token(user.id)
+        .map_err(AppError::from)?;
+
+    let tenants = memberships
+        .into_iter()
+        .map(|(_, tenant)| TenantSnippet {
+            id: tenant.id,
+            slug: tenant.slug,
+        })
+        .collect();
+
+    Ok(Json(TenantSelectionResponse {
+        access_token: selection_token,
+        tenants,
+    })
+    .into_response())
+}
+
 fn issue_session(
    state: &AppState,
    conn: &mut PgConnection,