Expand description
CLI default human-signature (WebAuthn) callback for destructive hosted RPCs.
When the server marks an RPC human-tier and rejects it with
x-weft-sig-required: human, heddle-client’s request-signing interceptor
invokes an app-registered callback to produce a WebAuthn assertion over the
action, then retries once (see heddle_client::HumanSignatureCallback).
§What the CLI supports vs defers
A full WebAuthn ceremony needs a platform/roaming authenticator (touch,
biometric, or security key) driven by an OS/browser WebAuthn stack. The
heddle CLI runs headless in a terminal and has no in-process WebAuthn
authenticator binding today, so it cannot mint a genuine assertion — and we
must never fake one (a forged assertion would either be rejected by the
server’s UV check or, worse, defeat the entire human-gesture control).
Therefore the CLI’s default callback surfaces a clear, typed user-verification-required error naming a surface that can complete the ceremony (the web UI / tapestry), rather than attempting a partial/fake ceremony. The consent surface (the action summary) is still shown to the user before the error so they understand what was blocked.
Deferred (tracked for a follow-up): binding a platform authenticator via a
native WebAuthn crate (e.g. webauthn-authenticator-rs) so the CLI can
prompt for a security-key touch inline. When that lands, this callback swaps
its error branch for the real ceremony; the interceptor contract is
unchanged.
Functions§
- cli_
human_ signature_ callback - The default human-signature callback for CLI-opened hosted sessions.