From 779dc1b98522d24aa5f82efe20acaab2d4e03215 Mon Sep 17 00:00:00 2001 From: Johanna Larsson Date: Sat, 8 Aug 2026 08:48:20 +0100 Subject: [PATCH] Replace SecurityKey with Passkey --- .../src/server/passkey_account.rs | 8 +++--- crates/tranquil-api/src/server/passkeys.rs | 9 +++---- crates/tranquil-api/src/server/reauth.rs | 4 +-- .../src/endpoints/authorize/passkey.rs | 8 +++--- crates/tranquil-pds/src/auth/webauthn.rs | 25 ++++++++----------- 5 files changed, 25 insertions(+), 29 deletions(-) diff --git a/crates/tranquil-api/src/server/passkey_account.rs b/crates/tranquil-api/src/server/passkey_account.rs index 33d96b9..2780da6 100644 --- a/crates/tranquil-api/src/server/passkey_account.rs +++ b/crates/tranquil-api/src/server/passkey_account.rs @@ -492,7 +492,7 @@ pub async fn complete_passkey_setup( } }; - let security_key = match webauthn.finish_registration(&credential, ®_state) { + let passkey = match webauthn.finish_registration(&credential, ®_state) { Ok(sk) => sk, Err(e) => { warn!("Passkey registration failed: {:?}", e); @@ -500,11 +500,11 @@ pub async fn complete_passkey_setup( } }; - let credential_id = security_key.cred_id().to_vec(); - let public_key = match serde_json::to_vec(&security_key) { + let credential_id = passkey.cred_id().to_vec(); + let public_key = match serde_json::to_vec(&passkey) { Ok(pk) => pk, Err(e) => { - error!("Error serializing security key: {:?}", e); + error!("Error serializing passkey: {:?}", e); return Err(ApiError::InternalError(None)); } }; diff --git a/crates/tranquil-api/src/server/passkeys.rs b/crates/tranquil-api/src/server/passkeys.rs index b683a9f..d79611c 100644 --- a/crates/tranquil-api/src/server/passkeys.rs +++ b/crates/tranquil-api/src/server/passkeys.rs @@ -104,11 +104,10 @@ pub async fn finish_passkey_registration( .log_db_err("loading registration state")? .ok_or(ApiError::NoRegistrationInProgress)?; - let reg_state: SecurityKeyRegistration = - serde_json::from_str(®_state_json).map_err(|e| { - error!("Failed to deserialize registration state: {:?}", e); - ApiError::InternalError(None) - })?; + let reg_state: PasskeyRegistration = serde_json::from_str(®_state_json).map_err(|e| { + error!("Failed to deserialize registration state: {:?}", e); + ApiError::InternalError(None) + })?; let credential: RegisterPublicKeyCredential = serde_json::from_value(input.credential) .map_err(|e| { diff --git a/crates/tranquil-api/src/server/reauth.rs b/crates/tranquil-api/src/server/reauth.rs index 154f958..b4ae82f 100644 --- a/crates/tranquil-api/src/server/reauth.rs +++ b/crates/tranquil-api/src/server/reauth.rs @@ -159,7 +159,7 @@ pub async fn reauth_passkey_start( return Err(ApiError::NoPasskeys); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -216,7 +216,7 @@ pub async fn reauth_passkey_finish( .log_db_err("loading authentication state")? .ok_or(ApiError::NoChallengeInProgress)?; - let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = + let auth_state: webauthn_rs::prelude::PasskeyAuthentication = serde_json::from_str(&auth_state_json).map_err(|e| { error!("Failed to deserialize authentication state: {:?}", e); ApiError::InternalError(None) diff --git a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs index d114c20..ad1aab3 100644 --- a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs +++ b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs @@ -327,7 +327,7 @@ async fn passkey_start_named( .into_response(); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -714,7 +714,7 @@ async fn passkey_finish_named( ).into_response() })?; - let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = + let auth_state: webauthn_rs::prelude::PasskeyAuthentication = serde_json::from_str(&auth_state_json).map_err(|e| { tracing::error!(error = %e, "Failed to deserialize authentication state"); ( @@ -972,7 +972,7 @@ pub async fn authorize_passkey_start( .into_response(); } - let passkeys: Vec = stored_passkeys + let passkeys: Vec = stored_passkeys .iter() .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok()) .collect(); @@ -1146,7 +1146,7 @@ pub async fn authorize_passkey_finish( } }; - let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = match serde_json::from_str( + let auth_state: webauthn_rs::prelude::PasskeyAuthentication = match serde_json::from_str( &auth_state_json, ) { Ok(s) => s, diff --git a/crates/tranquil-pds/src/auth/webauthn.rs b/crates/tranquil-pds/src/auth/webauthn.rs index e255f25..3c25dc7 100644 --- a/crates/tranquil-pds/src/auth/webauthn.rs +++ b/crates/tranquil-pds/src/auth/webauthn.rs @@ -28,8 +28,7 @@ impl WebAuthnConfig { let builder = WebauthnBuilder::new(&rp_id, &rp_origin) .map_err(|e| WebauthnError::BuilderFailed(e.to_string()))? - .rp_name("Tranquil PDS") - .danger_set_user_presence_only_security_keys(true); + .rp_name("Tranquil PDS"); let webauthn = builder .build() @@ -44,11 +43,11 @@ impl WebAuthnConfig { username: &str, display_name: &str, exclude_credentials: Vec, - ) -> Result<(CreationChallengeResponse, SecurityKeyRegistration), WebauthnError> { + ) -> Result<(CreationChallengeResponse, PasskeyRegistration), WebauthnError> { let user_unique_id = Uuid::new_v5(&Uuid::NAMESPACE_OID, user_id.as_bytes()); self.webauthn - .start_securitykey_registration( + .start_passkey_registration( user_unique_id, username, display_name, @@ -57,8 +56,6 @@ impl WebAuthnConfig { } else { Some(exclude_credentials) }, - None, - None, ) .map(|(mut ccr, state)| { let sel = ccr @@ -75,29 +72,29 @@ impl WebAuthnConfig { pub fn finish_registration( &self, reg: &RegisterPublicKeyCredential, - state: &SecurityKeyRegistration, - ) -> Result { + state: &PasskeyRegistration, + ) -> Result { self.webauthn - .finish_securitykey_registration(reg, state) + .finish_passkey_registration(reg, state) .map_err(|e| WebauthnError::RegistrationFailed(e.to_string())) } pub fn start_authentication( &self, - credentials: Vec, - ) -> Result<(RequestChallengeResponse, SecurityKeyAuthentication), WebauthnError> { + credentials: Vec, + ) -> Result<(RequestChallengeResponse, PasskeyAuthentication), WebauthnError> { self.webauthn - .start_securitykey_authentication(&credentials) + .start_passkey_authentication(&credentials) .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string())) } pub fn finish_authentication( &self, auth: &PublicKeyCredential, - state: &SecurityKeyAuthentication, + state: &PasskeyAuthentication, ) -> Result { self.webauthn - .finish_securitykey_authentication(auth, state) + .finish_passkey_authentication(auth, state) .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string())) }