Kyle Isom
25417b24f4
Phase 14: Full WebAuthn support for passwordless passkey login and hardware security key 2FA. - go-webauthn/webauthn v0.16.1 dependency - WebAuthnConfig with RPID/RPOrigin/DisplayName validation - Migration 000009: webauthn_credentials table - DB CRUD with ownership checks and admin operations - internal/webauthn adapter: encrypt/decrypt at rest with AES-256-GCM - REST: register begin/finish, login begin/finish, list, delete - Web UI: profile enrollment, login passkey button, admin management - gRPC: ListWebAuthnCredentials, RemoveWebAuthnCredential RPCs - mciasdb: webauthn list/delete/reset subcommands - OpenAPI: 6 new endpoints, WebAuthnCredentialInfo schema - Policy: self-service enrollment rule, admin remove via wildcard - Tests: DB CRUD, adapter round-trip, interface compliance - Docs: ARCHITECTURE.md §22, PROJECT_PLAN.md Phase 14 Security: Credential IDs and public keys encrypted at rest with AES-256-GCM via vault master key. Challenge ceremonies use 128-bit nonces with 120s TTL in sync.Map. Sign counter validated on each assertion to detect cloned authenticators. Password re-auth required for registration (SEC-01 pattern). No credential material in API responses or logs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
29 lines
843 B
Go
29 lines
843 B
Go
// Package webauthn provides the adapter between the go-webauthn library and
|
|
// MCIAS internal types. It handles WebAuthn instance configuration and
|
|
// encryption/decryption of credential material stored in the database.
|
|
package webauthn
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
|
|
"git.wntrmute.dev/kyle/mcias/internal/config"
|
|
)
|
|
|
|
// NewWebAuthn creates a configured go-webauthn instance from MCIAS config.
|
|
func NewWebAuthn(cfg *config.WebAuthnConfig) (*webauthn.WebAuthn, error) {
|
|
if cfg.RPID == "" || cfg.RPOrigin == "" {
|
|
return nil, fmt.Errorf("webauthn: RPID and RPOrigin are required")
|
|
}
|
|
displayName := cfg.DisplayName
|
|
if displayName == "" {
|
|
displayName = "MCIAS"
|
|
}
|
|
return webauthn.New(&webauthn.Config{
|
|
RPID: cfg.RPID,
|
|
RPDisplayName: displayName,
|
|
RPOrigins: []string{cfg.RPOrigin},
|
|
})
|
|
}
|