Method PasskeyAuthenticationOptions

internal/api/passkey_authentication.go:33–65

PasskeyAuthenticationOptions handles POST /passkeys/authentication/options. Generates WebAuthn authentication options for discoverable credential login.

(w http.ResponseWriter, r *http.Request)

// PasskeyAuthenticationOptions handles POST /passkeys/authentication/options.
// Generates WebAuthn authentication options for discoverable credential login.
func (a *API) PasskeyAuthenticationOptions(w http.ResponseWriter, r *http.Request) error {
	config := a.config
	db := a.db.WithContext(r.Context())

	webAuthn, err := a.getPasskeyWebAuthn()
	if err != nil {
		return apierrors.NewInternalServerError("Failed to initialize WebAuthn").WithInternalError(err)
	}

	// Discoverable flow: empty allowCredentials, no user binding
	options, session, err := webAuthn.BeginDiscoverableLogin()
	if err != nil {
		return apierrors.NewInternalServerError("Failed to generate WebAuthn authentication options").WithInternalError(err)
	}

	expiresAt := time.Now().Add(config.WebAuthn.ChallengeExpiryDuration)
	challenge := models.NewWebAuthnChallenge(
		nil, // no user_id for discoverable flow
		models.WebAuthnChallengeTypeAuthentication,
		&models.WebAuthnSessionData{SessionData: session},
		expiresAt,
	)

	if err := db.Create(challenge); err != nil {
		return apierrors.NewInternalServerError("Database error storing challenge").WithInternalError(err)
	}

	return sendJSON(w, http.StatusOK, &PasskeyAuthenticationOptionsResponse{
		ChallengeID: challenge.ID.String(),
		Options:     &options.Response,
		ExpiresAt:   expiresAt.Unix(),
	})
}

// PasskeyAuthenticationVerify handles POST /passkeys/authentication/verify.
// Validates the WebAuthn assertion and issues tokens for discoverable credential login.