tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): add allowCredentials to login challenge options when username provided

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 15:36:54 -07:00
parent cf42a32800
commit 324ad24d05
2 changed files with 22 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server/main.test.ts
View File

@ -385,11 +385,7 @@ Deno.test("WebAuthn - /api/login/challenge handles username for PRF", async () =
if (query.includes("SELECT id FROM users WHERE username =")) {
return Promise.resolve([{ id: "mock-user-id" }]);
}
if (
query.includes(
"SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id =",
)
) {
if (query.includes("FROM passkeys WHERE user_id =")) {
return Promise.resolve([{
credential_id: "mock-cred",
prf_enabled: true,

18
server/main.ts
View File

@ -658,8 +658,8 @@ app.post("/api/login/challenge", async (c) => {
body = {};
}
const username = body.username;
let extensions: any = undefined;
let allowCredentials: any[] | undefined = undefined;
if (username) {
const user = await sqlWrapper
@ -668,13 +668,23 @@ app.post("/api/login/challenge", async (c) => {
);
if (user) {
const passkeys = await sqlWrapper
.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id} AND prf_enabled = true AND prf_salt IS NOT NULL`;
.sql`SELECT credential_id, transports, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
if (passkeys.length > 0) {
allowCredentials = passkeys.map((pk: any) => ({
id: pk.credential_id,
type: "public-key",
transports: pk.transports || undefined,
}));
const prfPasskeys = passkeys.filter((pk: any) =>
pk.prf_enabled && pk.prf_salt
);
if (prfPasskeys.length > 0) {
extensions = {
["prf" as string]: { evalByCredential: {} },
};
for (const pk of passkeys) {
for (const pk of prfPasskeys) {
const saltBytes = decodeBase64Url(pk.prf_salt);
extensions["prf"]["evalByCredential"][pk.credential_id] = {
first: saltBytes,
@ -683,11 +693,13 @@ app.post("/api/login/challenge", async (c) => {
}
}
}
}
const options = await generateAuthenticationOptions({
rpID,
userVerification: "preferred",
timeout: 60000,
allowCredentials,
extensions,
});