From ace7afa3ccd134a215ae11eb47c465fdb3124475 Mon Sep 17 00:00:00 2001
From: scanash00 <scan@scanash.com>
Date: Wed, 29 Jul 2026 17:52:11 +0000
Subject: [PATCH] more passkey fixes

---
 crates/tranquil-pds/src/auth/webauthn.rs | 25 ++++++++++++++++++++++++-
 1 file(s) changed, 24 insertion(s)(+), 1 deletion(s)(-)

diff --git a/crates/tranquil-pds/src/auth/webauthn.rs b/crates/tranquil-pds/src/auth/webauthn.rs
--- a/crates/tranquil-pds/src/auth/webauthn.rs
+++ b/crates/tranquil-pds/src/auth/webauthn.rs
@@ -20,6 +20,10 @@
     webauthn: Webauthn,
 }
 
+fn clear_authentication_hints(response: &mut RequestChallengeResponse) {
+    response.public_key.hints = None;
+}
+
 impl WebAuthnConfig {
     pub fn new(hostname: &str) -> Result<Self, WebauthnError> {
         let rp_id = hostname.split(':').next().unwrap_or(hostname).to_string();
@@ -89,6 +93,10 @@
     ) -> Result<(RequestChallengeResponse, SecurityKeyAuthentication), WebauthnError> {
         self.webauthn
             .start_securitykey_authentication(&credentials)
+            .map(|(mut rcr, state)| {
+                clear_authentication_hints(&mut rcr);
+                (rcr, state)
+            })
             .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string()))
     }
 
@@ -150,7 +158,8 @@
 
 #[cfg(test)]
 mod tests {
-    use super::WebAuthnConfig;
+    use super::{WebAuthnConfig, clear_authentication_hints};
+    use webauthn_rs::prelude::RequestChallengeResponse;
 
     #[test]
     fn registration_does_not_prefer_security_key_ui() {
@@ -160,6 +169,20 @@
             .unwrap();
         let challenge = serde_json::to_value(challenge).unwrap();
 
+        assert!(challenge.pointer("/publicKey/hints").is_none());
+    }
+
+    #[test]
+    fn authentication_does_not_prefer_security_key_ui() {
+        let config = WebAuthnConfig::new("pds.example.com").unwrap();
+        let (challenge, _) = config.start_discoverable_authentication().unwrap();
+        let mut challenge = serde_json::to_value(challenge).unwrap();
+        challenge["publicKey"]["hints"] = serde_json::json!(["security-key"]);
+        let mut challenge: RequestChallengeResponse = serde_json::from_value(challenge).unwrap();
+
+        clear_authentication_hints(&mut challenge);
+
+        let challenge = serde_json::to_value(challenge).unwrap();
         assert!(challenge.pointer("/publicKey/hints").is_none());
     }
 }

--
tangled.sh