Get into Fizzy
<%= form_with url: session_path, class: "flex flex-column gap-half txt-medium" do |form| %>
<% if Account.accepting_signups? %>
-
New here? <%= link_to "Sign up", new_signup_path %> to create an account. Already have an account? Enter your email and we’ll get you signed in.
+
New here? <%= link_to "Sign up", new_signup_path %> to create an account. Already have an account? Enter your email and we'll get you signed in.
<% else %>
-
Enter your email and we’ll get you signed in.
+
Enter your email and we'll get you signed in.
<% end %>
<% end %>
+
<% content_for :footer do %>
diff --git a/app/views/users/credentials/_credential.html.erb b/app/views/users/credentials/_credential.html.erb
index f532552c3..a240fc46f 100644
--- a/app/views/users/credentials/_credential.html.erb
+++ b/app/views/users/credentials/_credential.html.erb
@@ -1,8 +1,7 @@
| <%= credential.name.presence || "Passkey" %> |
- <%= local_datetime_tag credential.created_at, style: :datetime %> |
- <%= button_to user_credential_path(@user, credential), method: :delete,
+ <%= button_to user_credential_path(Current.user, credential), method: :delete,
class: "btn btn--circle txt-negative txt-xx-small borderless",
data: { turbo_confirm: "Are you sure you want to remove this passkey?" } do %>
<%= icon_tag "trash" %>
diff --git a/app/views/users/credentials/index.html.erb b/app/views/users/credentials/index.html.erb
index 28febe77f..3b54e1e9f 100644
--- a/app/views/users/credentials/index.html.erb
+++ b/app/views/users/credentials/index.html.erb
@@ -2,7 +2,7 @@
<% content_for :header do %>
@@ -16,7 +16,6 @@
| Passkey |
- Created |
|
@@ -26,7 +25,7 @@
<% end %>
- <%= link_to new_user_credential_path(@user), class: "btn btn--link" do %>
+ <%= link_to new_user_credential_path(Current.user), class: "btn btn--link" do %>
<%= icon_tag "add" %>
Add a passkey
<% end %>
diff --git a/app/views/users/credentials/new.html.erb b/app/views/users/credentials/new.html.erb
index 722a6f612..15ad75378 100644
--- a/app/views/users/credentials/new.html.erb
+++ b/app/views/users/credentials/new.html.erb
@@ -2,14 +2,14 @@
<% content_for :header do %>
<% end %>
- <%= form_with url: user_credentials_path(@user),
+ <%= form_with url: user_credentials_path(Current.user),
data: { controller: "credential", credential_public_key_value: @creation_options.as_json },
html: { class: "flex flex-column gap" } do |form| %>
@@ -18,8 +18,8 @@
-
-
+
+
<% end %>
- <%= link_to "Cancel and go back", user_credentials_path(@user), hidden: true %>
+ <%= link_to "Cancel and go back", user_credentials_path(Current.user), hidden: true %>
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 24e742601..ad4ba3a59 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -6,7 +6,7 @@
<% if Current.user == @user %>
<%= link_to user_credentials_path(@user), class: "user-edit-link btn", style: "inset: 0 auto auto 0", data: { controller: "tooltip" } do %>
- 🔑
+ <%= icon_tag "key" %>
Manage passkeys
<% end %>
diff --git a/config/routes.rb b/config/routes.rb
index 4e0106d82..d1ca55416 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -157,6 +157,7 @@ Rails.application.routes.draw do
resources :transfers
resource :magic_link
resource :menu
+ resource :passkey, only: :create
end
end
diff --git a/lib/action_pack/web_authn/public_key_credential/creation_options.rb b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
index 0497a2bad..46510ad62 100644
--- a/lib/action_pack/web_authn/public_key_credential/creation_options.rb
+++ b/lib/action_pack/web_authn/public_key_credential/creation_options.rb
@@ -95,6 +95,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptions < ActionPack::W
],
authenticatorSelection: {
residentKey: @resident_key.to_s,
+ requireResidentKey: @resident_key == :required,
userVerification: user_verification.to_s
}
}
diff --git a/test/controllers/sessions/passkeys_controller_test.rb b/test/controllers/sessions/passkeys_controller_test.rb
new file mode 100644
index 000000000..88512f2df
--- /dev/null
+++ b/test/controllers/sessions/passkeys_controller_test.rb
@@ -0,0 +1,144 @@
+require "test_helper"
+
+class Sessions::PasskeysControllerTest < ActionDispatch::IntegrationTest
+ setup do
+ @identity = identities(:kevin)
+ @private_key = OpenSSL::PKey::EC.generate("prime256v1")
+
+ @credential = @identity.credentials.create!(
+ name: "Test Passkey",
+ credential_id: Base64.urlsafe_encode64(SecureRandom.random_bytes(32), padding: false),
+ public_key: @private_key.public_to_der,
+ sign_count: 0,
+ transports: [ "internal" ]
+ )
+ end
+
+ test "successful authentication" do
+ untenanted do
+ get new_session_url
+ challenge = session[:webauthn_challenge]
+
+ post session_passkey_url, params: assertion_params(challenge: challenge)
+
+ assert_response :redirect
+ assert cookies[:session_token].present?
+ assert_redirected_to landing_path
+ end
+ end
+
+ test "updates sign count" do
+ untenanted do
+ get new_session_url
+ challenge = session[:webauthn_challenge]
+
+ post session_passkey_url, params: assertion_params(challenge: challenge, sign_count: 1)
+
+ assert_equal 1, @credential.reload.sign_count
+ end
+ end
+
+ test "rejects invalid signature" do
+ untenanted do
+ get new_session_url
+ challenge = session[:webauthn_challenge]
+
+ params = assertion_params(challenge: challenge)
+ params[:response][:signature] = Base64.urlsafe_encode64("invalid", padding: false)
+
+ post session_passkey_url, params: params
+
+ assert_redirected_to new_session_path
+ assert_not cookies[:session_token].present?
+ assert_equal "That passkey didn't work. Try again.", flash[:alert]
+ end
+ end
+
+ test "rejects unknown credential" do
+ untenanted do
+ get new_session_url
+
+ post session_passkey_url, params: {
+ credential_id: "nonexistent",
+ response: {
+ client_data_json: Base64.urlsafe_encode64("{}", padding: false),
+ authenticator_data: Base64.urlsafe_encode64("x", padding: false),
+ signature: Base64.urlsafe_encode64("x", padding: false)
+ }
+ }
+
+ assert_redirected_to new_session_path
+ assert_not cookies[:session_token].present?
+ end
+ end
+
+ test "successful authentication via JSON" do
+ untenanted do
+ get new_session_url
+ challenge = session[:webauthn_challenge]
+
+ post session_passkey_url(format: :json), params: assertion_params(challenge: challenge)
+
+ assert_response :success
+ assert @response.parsed_body["session_token"].present?
+ end
+ end
+
+ test "failed authentication via JSON" do
+ untenanted do
+ get new_session_url
+
+ post session_passkey_url(format: :json), params: {
+ credential_id: "nonexistent",
+ response: {
+ client_data_json: Base64.urlsafe_encode64("{}", padding: false),
+ authenticator_data: Base64.urlsafe_encode64("x", padding: false),
+ signature: Base64.urlsafe_encode64("x", padding: false)
+ }
+ }
+
+ assert_response :unauthorized
+ assert_equal "That passkey didn't work. Try again.", @response.parsed_body["message"]
+ end
+ end
+
+ private
+ def assertion_params(challenge:, sign_count: 1)
+ origin = "http://www.example.com"
+
+ client_data_json = {
+ challenge: challenge,
+ origin: origin,
+ type: "webauthn.get"
+ }.to_json
+
+ authenticator_data = build_authenticator_data(sign_count: sign_count)
+ signature = sign(authenticator_data, client_data_json)
+
+ {
+ credential_id: @credential.credential_id,
+ response: {
+ client_data_json: client_data_json,
+ authenticator_data: Base64.urlsafe_encode64(authenticator_data, padding: false),
+ signature: Base64.urlsafe_encode64(signature, padding: false)
+ }
+ }
+ end
+
+ def build_authenticator_data(sign_count:)
+ rp_id_hash = Digest::SHA256.digest("www.example.com")
+ flags = 0x01 | 0x04 # user present + user verified
+
+ bytes = []
+ bytes.concat(rp_id_hash.bytes)
+ bytes << flags
+ bytes.concat([ sign_count ].pack("N").bytes)
+ bytes.pack("C*")
+ end
+
+ def sign(authenticator_data, client_data_json)
+ client_data_hash = Digest::SHA256.digest(client_data_json)
+ signed_data = authenticator_data + client_data_hash
+ @private_key.sign("SHA256", signed_data)
+ end
+end
diff --git a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
index 010dd5464..2fc1acfbc 100644
--- a/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
+++ b/test/lib/action_pack/web_authn/public_key_credential/creation_options_test.rb
@@ -43,6 +43,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
], @options.as_json[:pubKeyCredParams]
assert_equal "preferred", @options.as_json[:authenticatorSelection][:residentKey]
+ assert_equal false, @options.as_json[:authenticatorSelection][:requireResidentKey]
assert_equal "preferred", @options.as_json[:authenticatorSelection][:userVerification]
end
@@ -56,6 +57,7 @@ class ActionPack::WebAuthn::PublicKeyCredential::CreationOptionsTest < ActiveSup
)
assert_equal "required", options.as_json[:authenticatorSelection][:residentKey]
+ assert_equal true, options.as_json[:authenticatorSelection][:requireResidentKey]
end
test "as_json excludes excludeCredentials when empty" do
|