feat(auth): add WebAuthn passkey support with migrations, routes, and tests

2025-10-29 17:50:14 +01:00
parent ec6e7f04f2
commit ca30b20873
23 changed files with 1511 additions and 83 deletions
@@ -3,14 +3,23 @@ mod common;
 use anyhow::{anyhow, Context, Result};
 use axum::body::Body;
 use axum::http::{header::SET_COOKIE, StatusCode};
+use backend::auth::passkeys::{
+    PasskeyLoginFinishPayload, PasskeyLoginStartPayload, PasskeyRegistrationFinishPayload,
+    RegistrationChallengeResponse,
+};
 use backend::jobs::JOB_PROVISION_TENANT;
-use backend::models::{Job, NewUserMembership, TenantStatus};
+use backend::models::{Job, NewUserMembership, TenantStatus, UserPasskey};
+use backend::openapi::schemas::PasskeySummary;
 use backend::schema::{jobs, tenants, user_memberships, users};
 use common::{acquire_db_lock, body_to_vec, TestApp};
 use diesel::prelude::*;
 use serde::Deserialize;
 use serde_json::json;
 use uuid::Uuid;
+use webauthn_rs_core::proto::{
+    AuthenticatorAssertionResponseRaw, AuthenticatorAttestationResponseRaw, PublicKeyCredential,
+    RegisterPublicKeyCredential,
+};

 #[derive(Deserialize)]
 struct AuthenticatedUser {
@@ -101,7 +110,7 @@ async fn signup_creates_user_tenant_and_membership() -> Result<()> {
    let me = app.get("/api/auth/me", Some(&login.access_token)).await?;
    assert_eq!(me.status(), StatusCode::OK);

-    app.with_conn(|conn| {
+    app.with_conn(move |conn| {
        let user: backend::models::User = users::table
            .filter(users::username.eq("signup-user"))
            .first(conn)?;
@@ -153,6 +162,227 @@ async fn signup_creates_user_tenant_and_membership() -> Result<()> {
    Ok(())
 }

+#[tokio::test]
+async fn passkey_register_start_creates_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-user", password, "admin").await?;
+
+    let (login, _) = login_with_session(&app, "passkey-user", password).await?;
+
+    let response = app
+        .post_json(
+            "/api/auth/passkeys/register/start",
+            &json!({}),
+            Some(&login.access_token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    let challenge: RegistrationChallengeResponse = serde_json::from_slice(&body)?;
+    assert_ne!(challenge.challenge_id, Uuid::nil());
+    let challenge_id = challenge.challenge_id;
+
+    app.with_conn(move |conn| {
+        use backend::schema::webauthn_challenges::dsl;
+        use diesel::dsl::{exists, select};
+
+        let exists: bool = select(exists(
+            dsl::webauthn_challenges.filter(dsl::id.eq(challenge_id)),
+        ))
+        .get_result(conn)?;
+        assert!(exists, "challenge not persisted");
+        Ok(())
+    })
+    .await?;
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_register_finish_rejects_unknown_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-register", password, "admin")
+        .await?;
+    let (login, _) = login_with_session(&app, "passkey-register", password).await?;
+
+    let payload = PasskeyRegistrationFinishPayload {
+        challenge_id: Uuid::new_v4(),
+        credential: fake_register_credential(),
+        nickname: None,
+    };
+
+    let response = app
+        .post_json(
+            "/api/auth/passkeys/register/finish",
+            &payload,
+            Some(&login.access_token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_start_requires_passkey() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-login", password, "admin").await?;
+
+    let payload = PasskeyLoginStartPayload {
+        username: "passkey-login".to_string(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/start", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_start_unknown_user_returns_not_found() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = PasskeyLoginStartPayload {
+        username: "nobody".to_string(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/start", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_finish_rejects_invalid_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = PasskeyLoginFinishPayload {
+        challenge_id: Uuid::new_v4(),
+        credential: fake_authentication_credential(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/finish", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn list_passkeys_returns_entries() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    let user_id = app.insert_user("passkey-owner", password, "admin").await?;
+    app.insert_passkey(user_id, Some("Laptop")).await?;
+
+    let (session, _) = login_with_session(&app, "passkey-owner", password).await?;
+
+    let response = app
+        .get("/api/profile/passkeys", Some(&session.access_token))
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let body = body_to_vec(response.into_body()).await?;
+    let summaries: Vec<PasskeySummary> = serde_json::from_slice(&body)?;
+    assert_eq!(summaries.len(), 1);
+    assert_eq!(summaries[0].nickname.as_deref(), Some("Laptop"));
+    assert!(summaries[0].revoked_at.is_none());
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn delete_passkey_soft_revokes() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    let user_id = app.insert_user("passkey-delete", password, "admin").await?;
+    let passkey_id = app.insert_passkey(user_id, Some("Phone")).await?;
+    let (session, _) = login_with_session(&app, "passkey-delete", password).await?;
+
+    let response = app
+        .delete(
+            &format!("/api/profile/passkeys/{}?reason=lost", passkey_id),
+            Some(&session.access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+    app.with_conn(move |conn| {
+        use backend::schema::user_passkeys::dsl as passkey_dsl;
+
+        let record = passkey_dsl::user_passkeys
+            .find(passkey_id)
+            .first::<UserPasskey>(conn)?;
+        assert!(record.revoked_at.is_some());
+        assert_eq!(record.revoked_reason.as_deref(), Some("lost"));
+        Ok(())
+    })
+    .await?;
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+fn fake_register_credential() -> RegisterPublicKeyCredential {
+    RegisterPublicKeyCredential {
+        id: "fake-passkey".to_string(),
+        raw_id: vec![1, 2, 3, 4].into(),
+        response: AuthenticatorAttestationResponseRaw {
+            attestation_object: vec![5, 6, 7, 8].into(),
+            client_data_json: vec![9, 10, 11, 12].into(),
+            transports: None,
+        },
+        type_: "public-key".to_string(),
+        extensions: Default::default(),
+    }
+}
+
+fn fake_authentication_credential() -> PublicKeyCredential {
+    PublicKeyCredential {
+        id: "fake-auth".to_string(),
+        raw_id: vec![1, 2, 3].into(),
+        response: AuthenticatorAssertionResponseRaw {
+            authenticator_data: vec![4, 5, 6].into(),
+            client_data_json: vec![7, 8, 9].into(),
+            signature: vec![10, 11, 12].into(),
+            user_handle: None,
+        },
+        extensions: Default::default(),
+        type_: "public-key".to_string(),
+    }
+}
+
 #[tokio::test]
 async fn login_rejects_invalid_password() -> Result<()> {
    let _lock = acquire_db_lock().await;
@@ -278,7 +508,6 @@ async fn login_returns_tenant_selection_when_multiple_memberships() -> Result<()
            id: Uuid::new_v4(),
            user_id,
            tenant_id: secondary_id,
-            role: "admin".to_string(),
        };

        diesel::insert_into(user_memberships::table)