alibi_plugins/passkey/
registration.rs

1//! Trusted application policy for passkey-first registration.
2use alibi_core::{AuthConfig, AuthRequest, AuthResult, ContextExtensions, utils::json::JsValue};
3use async_trait::async_trait;
4use serde::{Deserialize, Serialize};
5use std::sync::Arc;
6
7#[derive(Debug, Clone, Serialize, Deserialize)]
8#[serde(rename_all = "camelCase")]
9pub struct PasskeyRegistrationUser {
10    pub id: String,
11    pub name: String,
12    #[serde(skip_serializing_if = "Option::is_none")]
13    pub display_name: Option<String>,
14}
15
16/// Immutable request and application settings; captures may hold typed services.
17/// A captured store is not automatically rebound to the registration transaction.
18pub struct PasskeyRegistrationContext<'a> {
19    /// Original physical request, when one was supplied.
20    pub request: Option<&'a AuthRequest>,
21    /// Genuine logical input for server API calls.
22    pub endpoint: Option<&'a alibi_core::endpoint::EndpointCall>,
23    pub auth_config: &'a AuthConfig,
24    pub extensions: &'a ContextExtensions,
25}
26
27impl std::fmt::Debug for PasskeyRegistrationContext<'_> {
28    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
29        f.debug_struct("PasskeyRegistrationContext")
30            .finish_non_exhaustive()
31    }
32}
33
34/// Resolve an authorized registration identity when no session is available.
35#[async_trait]
36pub trait PasskeyUserResolver: Send + Sync {
37    async fn resolve_user(
38        &self,
39        context: &PasskeyRegistrationContext<'_>,
40        requested_context: Option<&str>,
41    ) -> AuthResult<Option<PasskeyRegistrationUser>>;
42}
43
44/// Facts supplied after the requested registration protocol and attestation policy
45/// verifies. None attestation admits a credential without proving key possession.
46#[derive(Debug, Clone)]
47pub struct VerifiedPasskeyRegistration {
48    pub credential_id: String,
49    pub public_key: Vec<u8>,
50    pub counter: u64,
51    pub aaguid: Option<String>,
52    pub device_type: String,
53    pub backed_up: bool,
54}
55
56#[derive(Debug, Default)]
57pub struct PasskeyRegistrationOverride {
58    /// Empty values are absent, as with upstream's truthiness check.
59    pub user_id: Option<String>,
60    pub name: Option<String>,
61}
62
63#[async_trait]
64pub trait PasskeyRegistrationAfterVerification: Send + Sync {
65    async fn after_verification(
66        &self,
67        context: &PasskeyRegistrationContext<'_>,
68        verification: &VerifiedPasskeyRegistration,
69        user: &PasskeyRegistrationUser,
70        client_data: &JsValue,
71        stored_context: Option<&str>,
72    ) -> AuthResult<Option<PasskeyRegistrationOverride>>;
73}
74
75#[derive(Clone)]
76pub struct PasskeyRegistrationConfig {
77    pub extensions: Option<super::PasskeyExtensions>,
78    pub require_session: bool,
79    pub resolve_user: Option<Arc<dyn PasskeyUserResolver>>,
80    pub after_verification: Option<Arc<dyn PasskeyRegistrationAfterVerification>>,
81}
82impl Default for PasskeyRegistrationConfig {
83    fn default() -> Self {
84        Self {
85            extensions: None,
86            require_session: true,
87            resolve_user: None,
88            after_verification: None,
89        }
90    }
91}
92impl std::fmt::Debug for PasskeyRegistrationConfig {
93    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
94        f.debug_struct("PasskeyRegistrationConfig")
95            .field("extensions", &self.extensions)
96            .field("require_session", &self.require_session)
97            .field("resolve_user", &self.resolve_user.is_some())
98            .field("after_verification", &self.after_verification.is_some())
99            .finish()
100    }
101}
102
103pub(super) fn trim_name(value: &str) -> &str {
104    value.trim_matches(|character| {
105        matches!(character,
106        '\u{0009}'..='\u{000D}' | '\u{0020}' | '\u{00A0}' | '\u{1680}' |
107        '\u{2000}'..='\u{200A}' | '\u{2028}' | '\u{2029}' | '\u{202F}' |
108        '\u{205F}' | '\u{3000}' | '\u{FEFF}')
109    })
110}
111
112/// Domain client errors and explicit public API errors preserve their wire contract.
113pub(super) const fn is_application_error(error: &alibi_core::AuthError) -> bool {
114    matches!(
115        error,
116        alibi_core::AuthError::Upstream { .. } | alibi_core::AuthError::Api { .. }
117    ) || error.status_code() < 500
118}
alibi_plugins/passkey/registration.rs

alibi_plugins/passkey/
registration.rs
