feat(webauthn): parse hints & merge into a transport preference

libwebauthn-tests/tests/basic_ctap2.rs

@@ -38,6 +38,8 @@ async fn test_webauthn_basic_ctap2() {
 
     // Make Credentials ceremony
     let make_credentials_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         challenge: Vec::from(challenge),
         origin: "example.org".to_owned(),
         top_origin: None,
@@ -64,6 +66,7 @@ async fn test_webauthn_basic_ctap2() {
     let credential: Ctap2PublicKeyCredentialDescriptor =
         (&response.authenticator_data).try_into().unwrap();
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         origin: "example.org".to_string(),

libwebauthn-tests/tests/large_blob.rs

@@ -46,6 +46,8 @@ async fn test_webauthn_large_blob_read_returns_planted_blob() {
     let challenge: [u8; 32] = thread_rng().gen();
 
     let make = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: RP.into(),
         challenge: challenge.to_vec(),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new(RP, RP),
@@ -91,6 +93,7 @@ async fn test_webauthn_large_blob_read_returns_planted_blob() {
     plant_large_blob_array(&mut channel, serialized).await;
 
     let ga = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: RP.into(),
         origin: RP.into(),
         challenge: challenge.to_vec(),
@@ -127,6 +130,7 @@ async fn capture_large_blob_key(
     challenge: &[u8; 32],
 ) -> [u8; 32] {
     let ga_for_key = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: RP.into(),
         origin: RP.into(),
         challenge: challenge.to_vec(),
@@ -239,6 +243,8 @@ async fn register_with_large_blob(
 ) -> Ctap2PublicKeyCredentialDescriptor {
     let user_id: [u8; 32] = thread_rng().gen();
     let make = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: RP.into(),
         challenge: challenge.to_vec(),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new(RP, RP),
@@ -281,6 +287,7 @@ fn ga_request(
     ext: GetAssertionLargeBlobExtension,
 ) -> GetAssertionRequest {
     GetAssertionRequest {
+        hints: vec![],
         relying_party_id: RP.into(),
         origin: RP.into(),
         challenge: challenge.to_vec(),

libwebauthn-tests/tests/preflight.rs

@@ -49,6 +49,8 @@ async fn make_credential_call_with_rp(
 ) -> Result<(Ctap2PublicKeyCredentialDescriptor, [u8; 32]), WebAuthnError<HidError>> {
     let challenge: [u8; 32] = thread_rng().gen();
     let make_credentials_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: rp_id.to_owned(),
         challenge: Vec::from(challenge),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new(rp_id, rp_id),
@@ -75,6 +77,7 @@ async fn get_assertion_call(
 ) -> Result<GetAssertionResponse, WebAuthnError<HidError>> {
     let challenge: [u8; 32] = thread_rng().gen();
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         origin: "example.org".to_owned(),
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),

libwebauthn-tests/tests/prf.rs

@@ -99,6 +99,8 @@ async fn test_webauthn_prf_eval_at_create_degrades_when_unsupported() {
         ..Default::default()
     };
     let req = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new("example.org", "example.org"),
@@ -174,6 +176,8 @@ async fn run_test_battery(channel: &mut HidChannel<'_>, using_pin: bool) {
 
     // Make Credentials ceremony
     let make_credentials_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new("example.org", "example.org"),
@@ -242,6 +246,7 @@ async fn run_test_battery(channel: &mut HidChannel<'_>, using_pin: bool) {
     let credential: Ctap2PublicKeyCredentialDescriptor =
         (&response.authenticator_data).try_into().unwrap();
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
@@ -558,6 +563,7 @@ async fn run_success_test(
     printoutput: &str,
 ) {
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
@@ -625,6 +631,7 @@ async fn run_failed_test(
     expected_error: PlatformError,
 ) {
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
@@ -671,6 +678,8 @@ async fn test_webauthn_prf_variable_length_input() {
     let challenge: [u8; 32] = thread_rng().gen();
 
     let make_credentials_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new("example.org", "example.org"),
@@ -716,6 +725,7 @@ async fn test_webauthn_prf_variable_length_input() {
         label: &str,
     ) -> [u8; 32] {
         let get_assertion = GetAssertionRequest {
+            hints: vec![],
             relying_party_id: "example.org".to_owned(),
             origin: "example.org".to_owned(),
             challenge: Vec::from(challenge.as_slice()),
@@ -797,6 +807,8 @@ fn basic_make_credential_request(
     extensions: Option<MakeCredentialsRequestExtensions>,
 ) -> MakeCredentialRequest {
     MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge.as_slice()),
         relying_party: Ctap2PublicKeyCredentialRpEntity::new("example.org", "example.org"),
@@ -933,6 +945,7 @@ async fn test_webauthn_prf_upgrades_uv_at_assertion() {
         eval_by_credential: HashMap::new(),
     };
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         origin: "example.org".to_owned(),
         challenge: Vec::from(challenge),

libwebauthn-tests/tests/signature_roundtrip.rs

@@ -67,6 +67,8 @@ async fn test_ctap2_signature_roundtrip() {
     let challenge: [u8; 32] = thread_rng().gen();
 
     let make_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         challenge: Vec::from(challenge),
         origin: "example.org".to_owned(),
         top_origin: None,
@@ -171,6 +173,7 @@ async fn test_ctap2_signature_roundtrip() {
     let credential: Ctap2PublicKeyCredentialDescriptor =
         (&registration.authenticator_data).try_into().unwrap();
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         origin: "example.org".to_owned(),

libwebauthn/examples/features/prf_replay.rs

@@ -84,6 +84,7 @@ async fn run_success_test(
     printoutput: &str,
 ) {
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "demo.yubico.com".to_owned(),
         challenge: Vec::from(challenge),
         origin: "demo.yubico.com".to_string(),

libwebauthn/examples/features/webauthn_extensions_hid.rs

@@ -55,6 +55,8 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         tokio::spawn(common::handle_uv_updates(state_recv));
 
         let make_credentials_request = MakeCredentialRequest {
+            hints: vec![],
+            authenticator_attachment: None,
             challenge: Vec::from(challenge),
             origin: "example.org".to_owned(),
             top_origin: None,
@@ -80,6 +82,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         let credential: Ctap2PublicKeyCredentialDescriptor =
             (&response.authenticator_data).try_into().unwrap();
         let get_assertion = GetAssertionRequest {
+            hints: vec![],
             relying_party_id: "example.org".to_owned(),
             challenge: Vec::from(challenge),
             origin: "example.org".to_string(),

libwebauthn/examples/features/webauthn_preflight_hid.rs

@@ -110,6 +110,8 @@ async fn make_credential_call<C: Channel>(
 ) -> Result<Ctap2PublicKeyCredentialDescriptor, WebAuthnError<C::TransportError>> {
     let challenge: [u8; 32] = thread_rng().gen();
     let make_credentials_request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         challenge: Vec::from(challenge),
         origin: "example.org".to_owned(),
         top_origin: None,
@@ -134,6 +136,7 @@ async fn get_assertion_call<C: Channel>(
 ) -> Result<GetAssertionResponse, WebAuthnError<C::TransportError>> {
     let challenge: [u8; 32] = thread_rng().gen();
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         origin: "example.org".to_string(),

libwebauthn/examples/features/webauthn_prf_cable.rs

@@ -108,6 +108,8 @@ async fn create() -> Result<(), Box<dyn Error>> {
     };
 
     let request = MakeCredentialRequest {
+        hints: vec![],
+        authenticator_attachment: None,
         challenge: vec![0x11; 32],
         origin: ORIGIN.to_owned(),
         top_origin: None,
@@ -169,6 +171,7 @@ async fn get(credential_id: Option<&str>) -> Result<(), Box<dyn Error>> {
     };
 
     let request = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: RP_ID.to_owned(),
         challenge: vec![0x22; 32],
         origin: ORIGIN.to_owned(),

libwebauthn/examples/features/webauthn_prf_hid.rs

@@ -48,6 +48,8 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         tokio::spawn(common::handle_uv_updates(state_recv));
 
         let make_credentials_request = MakeCredentialRequest {
+            hints: vec![],
+            authenticator_attachment: None,
             challenge: Vec::from(challenge),
             origin: "example.org".to_owned(),
             top_origin: None,
@@ -333,6 +335,7 @@ async fn run_success_test(
     printoutput: &str,
 ) {
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         origin: "example.org".to_string(),
@@ -364,6 +367,7 @@ async fn run_failed_test(
     expected_error: PlatformError,
 ) {
     let get_assertion = GetAssertionRequest {
+        hints: vec![],
         relying_party_id: "example.org".to_owned(),
         challenge: Vec::from(challenge),
         origin: "example.org".to_string(),

libwebauthn/src/ops/u2f.rs

@@ -228,6 +228,7 @@ impl UpgradableResponse<GetAssertionResponse, SignRequest> for SignResponse {
         // This isn't great, but we have no access to the original request, and need to construct
         // something like that here. In reality, we only need `extensions: None` currently.
         let orig_request = GetAssertionRequest {
+            hints: vec![],
             relying_party_id: String::new(), // We don't have access to that info here, but we don't need it either
             challenge: Vec::new(), // U2F path doesn't use client_data for response serialization
             origin: String::new(),