Repository navigation
Server check clients use only hardware keys for fido2 factor - #3878
filipslezaklab wants to merge 10 commits into
Conversation
| fn deserialize_passkeys(bin_keys: &[Vec<u8>]) -> Vec<Passkey> { | ||
| bin_keys | ||
| .iter() | ||
| .map(|bin| serde_cbor::from_slice(bin).expect("Can't deserialize Passkey")) |
| /// Every root is scoped to its own AAGUIDs, never blanket allowed. | ||
| #[must_use] | ||
| pub fn trusted_attestation_cas() -> AttestationCaList { | ||
| trusted_cas().into_owned() |
There was a problem hiding this comment.
Not sure this call warrants a dedicated function
| ..Default::default() | ||
| }; | ||
| if verify_registered_fido2_assertion( | ||
| let verified = verify_client_fido2_assertion( |
There was a problem hiding this comment.
Not sure what's gained by adding this variable
| // Changes the process-wide cwd, so under plain `cargo test` it must not run alongside other | ||
| // tests that use relative paths. | ||
| #[test] | ||
| fn rotated_log_symlink_resolves_for_relative_path() { |
There was a problem hiding this comment.
| fn rotated_log_symlink_resolves_for_relative_path() { | |
| fn test_rotated_log_symlink_resolves_for_relative_path() { |
| use super::*; | ||
|
|
||
| #[test] | ||
| fn bundled_list_parses() { |
There was a problem hiding this comment.
| fn bundled_list_parses() { | |
| fn test_bundled_list_parses() { |
| use tonic::Status; | ||
|
|
||
| /// How enabling a factor treats the user's recovery codes. | ||
| pub(super) enum RecoveryCodes { |
There was a problem hiding this comment.
RecoveryCodesHandling or RecoveryCodesPolicy?
This does not actually contain any codes :)
| } | ||
|
|
||
| /// Fetch the user's passkeys that passed hardware attestation at registration. | ||
| pub async fn hardware_passkeys_for_user( |
There was a problem hiding this comment.
This is almost the same query as passkeys_for_user, so they could use a shared method with an optional kind argument.
| } | ||
|
|
||
| /// Check whether a user has at least one security key that passed hardware attestation. | ||
| pub async fn hardware_exists_for_user<'e, E>(executor: E, user_id: Id) -> sqlx::Result<bool> |
There was a problem hiding this comment.
Same situation as above with the duplicate query
| } | ||
|
|
||
| let appender = RollingFileAppender::builder() | ||
| .rotation(Rotation::DAILY) |
There was a problem hiding this comment.
If we are doing this then let's make rotation configurable and allow for setting limited retention: https://docs.rs/tracing-appender/latest/tracing_appender/rolling/struct.Builder.html#method.max_log_files
| fs::remove_file(path) | ||
| .with_context(|| format!("Failed to remove log file symlink {path}"))?; | ||
| } | ||
| let file = OpenOptions::new() |
There was a problem hiding this comment.
Verify the default permissions set by this are safe (preferrably 0600)
This branch has not been deployed
2 participants
Related: #2131
Related: #3773