Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

feat: verify discoverable passkeys against their saved owners

Browse Source
This commit is contained in:
Hare
2026-10-16 19:01:43 +09:00
parent 3c18916118
commit 9c12fb4372
15 changed files with 819 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/server-api/src/lib.rs
+5 -4
View File
@@ -4088,10 +4088,11 @@ pub struct PasskeyRegistrationCompleteRequest {
pub credential: RegisterPublicKeyCredential,
}
/// Identified-account login. Missing handles are rejected, not resolved to an implicit user.
///
/// The nullable wire field permits an explicit authentication error for old callers; it does not
/// advertise a discoverable-login ceremony.
/// Normal discoverable login omits the handle: the authenticator selects a credential.
/// An explicit handle selects legacy identified-account login, for non-resident keys or
/// keys registered with an old random WebAuthn user handle. This never adds a key or
/// falls back to another identity. Authenticate first, then enroll an RK from Account.
/// Existing challenge states are short-lived and are not migrated to the new ceremony.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[serde(deny_unknown_fields)]