Method challengeWebAuthnFactor

internal/api/mfa.go:461–538

(w http.ResponseWriter, r *http.Request)

}

func (a *API) challengeWebAuthnFactor(w http.ResponseWriter, r *http.Request) error {
	ctx := r.Context()
	db := a.db.WithContext(ctx)
	config := a.config

	user := getUser(ctx)
	factor := getFactor(ctx)
	ipAddress := utilities.GetIPAddress(r)

	params := &ChallengeFactorParams{}
	if err := retrieveRequestParams(r, params); err != nil {
		return err
	}
	webAuthn, err := a.getWebAuthnMFA()
	if err != nil {
		return err
	}
	var response *ChallengeFactorResponse
	var ws *models.WebAuthnSessionData
	var challenge *models.Challenge
	if factor.IsUnverified() {
		// Get existing WebAuthn credentials to exclude duplicates
		excludeList := []wbnprotocol.CredentialDescriptor{}
		existingCredentials := user.WebAuthnCredentials()
		for _, cred := range existingCredentials {
			excludeList = append(excludeList, wbnprotocol.CredentialDescriptor{
				Type:         wbnprotocol.PublicKeyCredentialType,
				CredentialID: cred.ID,
				Transport:    []wbnprotocol.AuthenticatorTransport{"usb", "nfc"},
			})
		}

		options, session, err := webAuthn.BeginRegistration(user, webauthn.WithExclusions(excludeList))
		if err != nil {
			return apierrors.NewInternalServerError("Failed to generate WebAuthn registration data").WithInternalError(err)
		}
		ws = &models.WebAuthnSessionData{
			SessionData: session,
		}
		challenge = ws.ToChallenge(factor.ID, ipAddress)

		response = &ChallengeFactorResponse{
			Type: factor.FactorType,
			ID:   challenge.ID,
			WebAuthn: &WebAuthnChallengeData{
				Type:              "create",
				CredentialOptions: options,
			},
		}

	} else if factor.IsVerified() {
		options, session, err := webAuthn.BeginLogin(user)
		if err != nil {
			return err
		}
		ws = &models.WebAuthnSessionData{
			SessionData: session,
		}