PasskeyRegistrationTest.kt

1package com.peachpasswords.passkeys23import kotlinx.serialization.json.Json4import kotlinx.serialization.json.contentOrNull5import kotlinx.serialization.json.int6import kotlinx.serialization.json.jsonArray7import kotlinx.serialization.json.jsonObject8import kotlinx.serialization.json.jsonPrimitive9import org.junit.Assert.assertEquals10import org.junit.Assert.assertNotNull11import org.junit.Assert.assertTrue12import org.junit.Test13import java.util.Base641415class PasskeyRegistrationTest {16    @Test fun builds_es256_registration_response_and_entry() {17        val result = PasskeyRegistration.build(18            requestJson = """19                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}20            """.trimIndent(),21            origin = "https://login.example.com",22            now = 123,23        )2425        assertNotNull(result)26        result!!27        val passkey = result.entryDraft.passkey!!28        assertEquals("example.com", passkey.rpId)29        assertEquals("june", passkey.userName)30        assertEquals(-7, passkey.algorithm)31        assertEquals(123, passkey.createdAt)32        assertTrue(passkey.privateKeyJwk!!.contains("\"d\""))33        assertTrue(b64Decode(passkey.credentialId).size == 32)34        assertTrue(b64Decode(passkey.publicKeyCose).isNotEmpty())3536        val response = Json.parseToJsonElement(result.responseJson).jsonObject37        assertEquals(passkey.credentialId, response["id"]?.jsonPrimitive?.contentOrNull)38        val payload = response["response"]!!.jsonObject39        assertEquals(-7, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)40        assertEquals("internal", payload["transports"]?.jsonArray?.single()?.jsonPrimitive?.contentOrNull)41        val clientData = Json.parseToJsonElement(String(b64Decode(payload["clientDataJSON"]!!.jsonPrimitive.content), Charsets.UTF_8)).jsonObject42        assertEquals("webauthn.create", clientData["type"]?.jsonPrimitive?.contentOrNull)43        assertEquals("https://login.example.com", clientData["origin"]?.jsonPrimitive?.contentOrNull)44        assertTrue(b64Decode(payload["attestationObject"]!!.jsonPrimitive.content).isNotEmpty())45    }4647    @Test fun prefers_eddsa_registration_when_offered() {48        val result = PasskeyRegistration.build(49            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-8},{"alg":-7}]}""",50            "https://example.com",51        )5253        assertNotNull(result)54        result!!55        assertEquals(-8, result.entryDraft.passkey?.algorithm)56        val jwk = Json.parseToJsonElement(result.entryDraft.passkey!!.privateKeyJwk!!).jsonObject57        assertEquals("OKP", jwk["kty"]?.jsonPrimitive?.contentOrNull)58        assertEquals("Ed25519", jwk["crv"]?.jsonPrimitive?.contentOrNull)59        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject60        assertEquals(-8, payload["publicKeyAlgorithm"]?.jsonPrimitive?.int)61    }6263    @Test fun rejects_requests_without_supported_algorithms() {64        val result = PasskeyRegistration.build(65            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-257}]}""",66            "https://example.com",67        )68        assertEquals(null, result)69    }7071    @Test fun rejects_missing_or_blank_origin() {72        val request = """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-7}]}"""73        assertEquals(null, PasskeyRegistration.build(request, null))74        assertEquals(null, PasskeyRegistration.build(request, "  "))75    }7677    @Test fun rejects_web_origin_outside_rp_id_domain() {78        val request = """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-7}]}"""79        assertEquals(null, PasskeyRegistration.build(request, "https://evil.com"))80        assertEquals(null, PasskeyRegistration.build(request, "https://evilexample.com"))81    }8283    @Test fun stores_verified_caller_origin_on_the_credential() {84        val web = PasskeyRegistration.build(85            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-7}]}""",86            "https://login.example.com",87        )88        assertEquals("https://login.example.com", web?.entryDraft?.passkey?.callerOrigin)8990        // Native-app origins carry no domain, so no rpId domain check applies;91        // the binding itself is the protection on get.92        val native = PasskeyRegistration.build(93            """{"challenge":"c","rp":{"id":"example.com"},"user":{"id":"u","name":"june"},"pubKeyCredParams":[{"alg":-7}]}""",94            "android:apk-key-hash:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",95        )96        assertEquals(97            "android:apk-key-hash:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",98            native?.entryDraft?.passkey?.callerOrigin,99        )100    }101102    @Test fun registration_sets_uv_bit_when_user_verified() {103        val result = PasskeyRegistration.build(104            requestJson = """105                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}106            """.trimIndent(),107            origin = "https://example.com",108            userVerified = true,109        )110111        assertNotNull(result)112        result!!113        val passkey = result.entryDraft.passkey!!114        // Persisted backup state must match the flag bits on the wire —115        // the prior audit finding was that these contradicted each other.116        assertEquals(true, passkey.backupEligible)117        assertEquals(false, passkey.backupState)118119        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject120        val authData = b64Decode(payload["authenticatorData"]!!.jsonPrimitive.content)121        // H-07: UV=1 is warranted only when the ceremony actually ran.122        // UP(0x01) | UV(0x04) | BE(0x08) | AT(0x40) = 0x4d.123        assertEquals(0x4d, authData[32].toInt() and 0xff)124    }125126    @Test fun registration_clears_uv_bit_when_user_not_verified() {127        val result = PasskeyRegistration.build(128            requestJson = """129                {"challenge":"Y2hhbGxlbmdl","rp":{"id":"example.com","name":"Example"},"user":{"id":"dXNlcg","name":"june","displayName":"June"},"pubKeyCredParams":[{"type":"public-key","alg":-7}]}130            """.trimIndent(),131            origin = "https://example.com",132            userVerified = false,133        )134135        assertNotNull(result)136        result!!137        val passkey = result.entryDraft.passkey!!138        // Backup semantics are unchanged by UV: BE stays true, BS stays139        // false at registration time regardless of the ceremony outcome.140        assertEquals(true, passkey.backupEligible)141        assertEquals(false, passkey.backupState)142143        val payload = Json.parseToJsonElement(result.responseJson).jsonObject["response"]!!.jsonObject144        val authData = b64Decode(payload["authenticatorData"]!!.jsonPrimitive.content)145        // H-07: no ceremony, no UV claim. UP(0x01) | BE(0x08) | AT(0x40) = 0x49;146        // UV (0x04) must be CLEAR, BS (0x10) must be CLEAR.147        assertEquals(0x49, authData[32].toInt() and 0xff)148    }149150    private fun b64Decode(value: String): ByteArray =151        Base64.getUrlDecoder().decode(value.padEnd(((value.length + 3) / 4) * 4, '='))152}