PasskeyRegistrationTest.kt

1package com.peachpasswords.passkeys23import kotlinx.serialization.json.Json4import kotlinx.serialization.json.contentOrNull5import kotlinx.serialization.json.int6import kotlinx.serialization.json.jsonArray7import kotlinx.serialization.json.jsonObject8import kotlinx.serialization.json.jsonPrimitive9import org.junit.Assert.assertEquals10import org.junit.Assert.assertNotNull11import org.junit.Assert.assertTrue12import org.junit.Test13import java.util.Base641415class PasskeyRegistrationTest {16    @Test fun builds_es256_registration_response_and_entry() {17        val result = PasskeyRegistration.build(18            requestJson = """19                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}20            """.trimIndent(),21            origin = "https://login.example.com",22            now = 123,23        )2425        assertNotNull(result)26        result!!27        val passkey = result.entryDraft.passkey!!28        assertEquals("example.com", passkey.rpId)29        assertEquals("june", passkey.userName)30        assertEquals(-7, passkey.algorithm)31        assertEquals(123, passkey.createdAt)32        assertTrue(passkey.privateKeyJwk!!.contains("\"d\""))33        assertTrue(b64Decode(passkey.credentialId).size == 32)34        assertTrue(b64Decode(passkey.publicKeyCose).isNotEmpty())3536        val response = Json.parseToJsonElement(result.responseJson).jsonObject37        assertEquals(passkey.credentialId, response["id"]?.jsonPrimitive?.contentOrNull)38        val payload = response["response"]!!.jsonObject39        assertEquals(-7, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)40        assertEquals("internal", payload["transports"]?.jsonArray?.single()?.jsonPrimitive?.contentOrNull)41        val clientData = Json.parseToJsonElement(String(b64Decode(payload["clientDataJSON"]!!.jsonPrimitive.content), Charsets.UTF_8)).jsonObject42        assertEquals("webauthn.create", clientData["type"]?.jsonPrimitive?.contentOrNull)43        assertEquals("https://login.example.com", clientData["origin"]?.jsonPrimitive?.contentOrNull)44        assertTrue(b64Decode(payload["attestationObject"]!!.jsonPrimitive.content).isNotEmpty())45    }4647    @Test fun prefers_eddsa_registration_when_offered() {48        val result = PasskeyRegistration.build(49            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-8},{"alg":-7}]}""",50            "https://example.com",51        )5253        assertNotNull(result)54        result!!55        assertEquals(-8, result.entryDraft.passkey?.algorithm)56        val jwk = Json.parseToJsonElement(result.entryDraft.passkey!!.privateKeyJwk!!).jsonObject57        assertEquals("OKP", jwk["kty"]?.jsonPrimitive?.contentOrNull)58        assertEquals("Ed25519", jwk["crv"]?.jsonPrimitive?.contentOrNull)59        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject60        assertEquals(-8, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)61    }6263    @Test fun rejects_requests_without_supported_algorithms() {64        val result = PasskeyRegistration.build(65            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-257}]}""",66            "https://example.com",67        )68        assertEquals(null, result)69    }7071    @Test fun registration_sets_uv_bit_when_user_verified() {72        val result = PasskeyRegistration.build(73            requestJson = """74                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}75            """.trimIndent(),76            origin = "https://example.com",77            userVerified = true,78        )7980        assertNotNull(result)81        result!!82        val passkey = result.entryDraft.passkey!!83        // Persisted backup state must match the flag bits on the wire —84        // the prior audit finding was that these contradicted each other.85        assertEquals(true, passkey.backupEligible)86        assertEquals(false, passkey.backupState)8788        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject89        val authData = b64Decode(payload["authenticatorData"]!!.jsonPrimitive.content)90        // H-07: UV=1 is warranted only when the ceremony actually ran.91        // UP(0x01) | UV(0x04) | BE(0x08) | AT(0x40) = 0x4d.92        assertEquals(0x4d, authData[32].toInt() and 0xff)93    }9495    @Test fun registration_clears_uv_bit_when_user_not_verified() {96        val result = PasskeyRegistration.build(97            requestJson = """98                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}99            """.trimIndent(),100            origin = "https://example.com",101            userVerified = false,102        )103104        assertNotNull(result)105        result!!106        val passkey = result.entryDraft.passkey!!107        // Backup semantics are unchanged by UV: BE stays true, BS stays108        // false at registration time regardless of the ceremony outcome.109        assertEquals(true, passkey.backupEligible)110        assertEquals(false, passkey.backupState)111112        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject113        val authData = b64Decode(payload["authenticatorData"]!!.jsonPrimitive.content)114        // H-07: no ceremony, no UV claim. UP(0x01) | BE(0x08) | AT(0x40) = 0x49;115        // UV (0x04) must be CLEAR, BS (0x10) must be CLEAR.116        assertEquals(0x49, authData[32].toInt() and 0xff)117    }118119    private fun b64Decode(value: String): ByteArray =120        Base64.getUrlDecoder().decode(value.padEnd(((value.length + 3) / 4) * 4, '='))121}