PasskeyRegistrationTest.kt

1package com.peachpasswords.passkeys23import kotlinx.serialization.json.Json4import kotlinx.serialization.json.contentOrNull5import kotlinx.serialization.json.int6import kotlinx.serialization.json.jsonArray7import kotlinx.serialization.json.jsonObject8import kotlinx.serialization.json.jsonPrimitive9import org.junit.Assert.assertEquals10import org.junit.Assert.assertNotNull11import org.junit.Assert.assertTrue12import org.junit.Test13import java.util.Base641415class PasskeyRegistrationTest {16    @Test fun builds_es256_registration_response_and_entry() {17        val result = PasskeyRegistration.build(18            requestJson = """19                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}20            """.trimIndent(),21            origin = "https://login.example.com",22            now = 123,23        )2425        assertNotNull(result)26        result!!27        val passkey = result.entryDraft.passkey!!28        assertEquals("example.com", passkey.rpId)29        assertEquals("june", passkey.userName)30        assertEquals(-7, passkey.algorithm)31        assertEquals(123, passkey.createdAt)32        assertTrue(passkey.privateKeyJwk!!.contains("\"d\""))33        assertTrue(b64Decode(passkey.credentialId).size == 32)34        assertTrue(b64Decode(passkey.publicKeyCose).isNotEmpty())3536        val response = Json.parseToJsonElement(result.responseJson).jsonObject37        assertEquals(passkey.credentialId, response["id"]?.jsonPrimitive?.contentOrNull)38        val payload = response["response"]!!.jsonObject39        assertEquals(-7, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)40        assertEquals("internal", payload["transports"]?.jsonArray?.single()?.jsonPrimitive?.contentOrNull)41        val clientData = Json.parseToJsonElement(String(b64Decode(payload["clientDataJSON"]!!.jsonPrimitive.content), Charsets.UTF_8)).jsonObject42        assertEquals("webauthn.create", clientData["type"]?.jsonPrimitive?.contentOrNull)43        assertEquals("https://login.example.com", clientData["origin"]?.jsonPrimitive?.contentOrNull)44        assertTrue(b64Decode(payload["attestationObject"]!!.jsonPrimitive.content).isNotEmpty())45    }4647    @Test fun prefers_eddsa_registration_when_offered() {48        val result = PasskeyRegistration.build(49            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-8},{"alg":-7}]}""",50            "https://example.com",51        )5253        assertNotNull(result)54        result!!55        assertEquals(-8, result.entryDraft.passkey?.algorithm)56        val jwk = Json.parseToJsonElement(result.entryDraft.passkey!!.privateKeyJwk!!).jsonObject57        assertEquals("OKP", jwk["kty"]?.jsonPrimitive?.contentOrNull)58        assertEquals("Ed25519", jwk["crv"]?.jsonPrimitive?.contentOrNull)59        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject60        assertEquals(-8, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)61    }6263    @Test fun rejects_requests_without_supported_algorithms() {64        val result = PasskeyRegistration.build(65            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-257}]}""",66            "https://example.com",67        )68        assertEquals(null, result)69    }7071    @Test fun registration_writes_backup_eligible_true_and_correct_flag_byte() {72        val result = PasskeyRegistration.build(73            requestJson = """74                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}75            """.trimIndent(),76            origin = "https://example.com",77        )7879        assertNotNull(result)80        result!!81        val passkey = result.entryDraft.passkey!!82        // Persisted backup state must match the flag byte that's put on the83        // wire — the audit finding was that these contradicted each other.84        assertEquals(true, passkey.backupEligible)85        assertEquals(false, passkey.backupState)8687        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject88        val authData = b64Decode(payload["authenticatorData"]!!.jsonPrimitive.content)89        // UP(0x01) | UV(0x04) | BE(0x08) | AT(0x40) = 0x4d. BS (0x10) is NOT90        // set because backupState is false at registration time.91        assertEquals(0x4d, authData[32].toInt() and 0xff)92    }9394    private fun b64Decode(value: String): ByteArray =95        Base64.getUrlDecoder().decode(value.padEnd(((value.length + 3) / 4) * 4, '='))96}