From 9e78206cf411e4e556160d58f0cb89871f83a889 Mon Sep 17 00:00:00 2001 From: Johanna Larsson Date: Sat, 08 Aug 2026 12:22:59 +0000 Subject: [PATCH] Switch back to SecurityKey, remove hint --- crates/tranquil-api/src/server/passkey_account.rs | 8 ++++---- crates/tranquil-api/src/server/passkeys.rs | 9 +++++---- crates/tranquil-api/src/server/reauth.rs | 4 ++-- crates/tranquil-pds/src/auth/webauthn.rs | 27 +++++++++++++++++---------- crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs | 8 ++++---- 5 file(s) changed, 32 insertion(s)(+), 24 deletion(s)(-) diff --git a/crates/tranquil-api/src/server/passkey_account.rs b/crates/tranquil-api/src/server/passkey_account.rs --- a/crates/tranquil-api/src/server/passkey_account.rs +++ b/crates/tranquil-api/src/server/passkey_account.rs @@ -492,7 +492,7 @@ } }; - let passkey = match webauthn.finish_registration(&credential, ®_state) { + let security_key = match webauthn.finish_registration(&credential, ®_state) { Ok(sk) => sk, Err(e) => { warn!("Passkey registration failed: {:?}", e); @@ -500,11 +500,11 @@ } }; - let credential_id = passkey.cred_id().to_vec(); - let public_key = match serde_json::to_vec(&passkey) { + let credential_id = security_key.cred_id().to_vec(); + let public_key = match serde_json::to_vec(&security_key) { Ok(pk) => pk, Err(e) => { - error!("Error serializing passkey: {:?}", e); + error!("Error serializing security key: {:?}", e); return Err(ApiError::InternalError(None)); } }; diff --git a/crates/tranquil-api/src/server/passkeys.rs b/crates/tranquil-api/src/server/passkeys.rs --- a/crates/tranquil-api/src/server/passkeys.rs +++ b/crates/tranquil-api/src/server/passkeys.rs @@ -104,10 +104,11 @@ .log_db_err("loading registration state")? .ok_or(ApiError::NoRegistrationInProgress)?; - let reg_state: PasskeyRegistration = serde_json::from_str(®_state_json).map_err(|e| { - error!("Failed to deserialize registration state: {:?}", e); - ApiError::InternalError(None) - })?; + let reg_state: SecurityKeyRegistration = + serde_json::from_str(®_state_json).map_err(|e| { + error!("Failed to deserialize registration state: {:?}", e); + ApiError::InternalError(None) + })?; let credential: RegisterPublicKeyCredential = serde_json::from_value(input.credential) .map_err(|e| { diff --git a/crates/tranquil-api/src/server/reauth.rs b/crates/tranquil-api/src/server/reauth.rs --- a/crates/tranquil-api/src/server/reauth.rs +++ b/crates/tranquil-api/src/server/reauth.rs @@ -159,7 +159,7 @@ return Err(ApiError::NoPasskeys); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -216,7 +216,7 @@ .log_db_err("loading authentication state")? .ok_or(ApiError::NoChallengeInProgress)?; - let auth_state: webauthn_rs::prelude::PasskeyAuthentication = + let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = serde_json::from_str(&auth_state_json).map_err(|e| { error!("Failed to deserialize authentication state: {:?}", e); ApiError::InternalError(None) diff --git a/crates/tranquil-pds/src/auth/webauthn.rs b/crates/tranquil-pds/src/auth/webauthn.rs --- a/crates/tranquil-pds/src/auth/webauthn.rs +++ b/crates/tranquil-pds/src/auth/webauthn.rs @@ -43,11 +43,11 @@ username: &str, display_name: &str, exclude_credentials: Vec, - ) -> Result<(CreationChallengeResponse, PasskeyRegistration), WebauthnError> { + ) -> Result<(CreationChallengeResponse, SecurityKeyRegistration), WebauthnError> { let user_unique_id = Uuid::new_v5(&Uuid::NAMESPACE_OID, user_id.as_bytes()); self.webauthn - .start_passkey_registration( + .start_securitykey_registration( user_unique_id, username, display_name, @@ -56,6 +56,8 @@ } else { Some(exclude_credentials) }, + None, + None, ) .map(|(mut ccr, state)| { let sel = ccr @@ -64,6 +66,7 @@ .get_or_insert_with(AuthenticatorSelectionCriteria::default); sel.resident_key = Some(ResidentKeyRequirement::Required); sel.require_resident_key = true; + ccr.public_key.hints = None; (ccr, state) }) .map_err(|e| WebauthnError::RegistrationFailed(e.to_string())) @@ -72,29 +75,33 @@ pub fn finish_registration( &self, reg: &RegisterPublicKeyCredential, - state: &PasskeyRegistration, - ) -> Result { + state: &SecurityKeyRegistration, + ) -> Result { self.webauthn - .finish_passkey_registration(reg, state) + .finish_securitykey_registration(reg, state) .map_err(|e| WebauthnError::RegistrationFailed(e.to_string())) } pub fn start_authentication( &self, - credentials: Vec, - ) -> Result<(RequestChallengeResponse, PasskeyAuthentication), WebauthnError> { + credentials: Vec, + ) -> Result<(RequestChallengeResponse, SecurityKeyAuthentication), WebauthnError> { self.webauthn - .start_passkey_authentication(&credentials) + .start_securitykey_authentication(&credentials) + .map(|(mut rcr, state)| { + rcr.public_key.hints = None; + (rcr, state) + }) .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string())) } pub fn finish_authentication( &self, auth: &PublicKeyCredential, - state: &PasskeyAuthentication, + state: &SecurityKeyAuthentication, ) -> Result { self.webauthn - .finish_passkey_authentication(auth, state) + .finish_securitykey_authentication(auth, state) .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string())) } diff --git a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs --- a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs +++ b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs @@ -327,7 +327,7 @@ .into_response(); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -714,7 +714,7 @@ ).into_response() })?; - let auth_state: webauthn_rs::prelude::PasskeyAuthentication = + let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = serde_json::from_str(&auth_state_json).map_err(|e| { tracing::error!(error = %e, "Failed to deserialize authentication state"); ( @@ -972,7 +972,7 @@ .into_response(); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -1146,7 +1146,7 @@ } }; - let auth_state: webauthn_rs::prelude::PasskeyAuthentication = match serde_json::from_str( + let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = match serde_json::from_str( &auth_state_json, ) { Ok(s) => s, -- tangled.sh