Method PasskeyAuthenticationVerify

internal/api/passkey_authentication.go:69–206

PasskeyAuthenticationVerify handles POST /passkeys/authentication/verify. Validates the WebAuthn assertion and issues tokens for discoverable credential login.

(w http.ResponseWriter, r *http.Request)

// PasskeyAuthenticationVerify handles POST /passkeys/authentication/verify.
// Validates the WebAuthn assertion and issues tokens for discoverable credential login.
func (a *API) PasskeyAuthenticationVerify(w http.ResponseWriter, r *http.Request) error {
	ctx := r.Context()
	config := a.config
	db := a.db.WithContext(ctx)

	params := &PasskeyAuthenticationVerifyParams{}
	body, err := utilities.GetBodyBytes(r)
	if err != nil {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeBadJSON, "Could not read request body")
	}
	if err := json.Unmarshal(body, params); err != nil {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeBadJSON, "Could not parse request body as JSON: %v", err)
	}

	if params.ChallengeID == "" {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "challenge_id is required")
	}
	if params.Credential == nil {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "credential is required")
	}

	challengeID, err := uuid.FromString(params.ChallengeID)
	if err != nil {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "challenge_id must be a valid UUID")
	}

	challenge, err := models.ConsumeWebAuthnChallengeByID(db, challengeID, models.WebAuthnChallengeTypeAuthentication, nil)
	if err != nil {
		if models.IsNotFoundError(err) {
			return apierrors.NewBadRequestError(apierrors.ErrorCodeWebAuthnChallengeNotFound, "Challenge not found or already used")
		}

		return apierrors.NewInternalServerError("Database error consuming challenge").WithInternalError(err)
	}

	if challenge.IsExpired() {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeWebAuthnChallengeExpired, "Challenge has expired")
	}

	parsedResponse, err := parseCredentialAssertionResponse(params.Credential)
	if err != nil {
		return apierrors.NewBadRequestError(apierrors.ErrorCodeWebAuthnVerificationFailed, "Invalid credential response").WithInternalError(err)
	}

	webAuthn, err := a.getPasskeyWebAuthn()
	if err != nil {
		return apierrors.NewInternalServerError("Failed to initialize WebAuthn").WithInternalError(err)
	}

	sessionData := *challenge.SessionData.SessionData

	// Discoverable login: resolve user from userHandle in the assertion
	handler := func(rawID, userHandle []byte) (webauthn.User, error) {
		userID, uerr := uuid.FromString(string(userHandle))
		if uerr != nil {
			return nil, uerr
		}