AshAuthentication.Strategy.WebAuthn.Actions (ash_authentication v5.0.0-rc.6)

Core action implementations for the WebAuthn strategy.

Wraps the wax_ library for FIDO2 ceremony handling and coordinates with Ash to persist users and credentials.

Summary

Functions

add_credential(strategy, params, opts \\ [])

Add a new WebAuthn credential to an existing user.

authentication_challenge(strategy, allow_credentials, tenant)

Generate an authentication challenge.

delete_credential(strategy, user, credential_id, opts)

Delete a credential, refusing to delete the last one.

list_credentials(strategy, user, opts)

List all credentials for a user.

register(strategy, params, opts \\ [])

Register a new user with a WebAuthn credential.

registration_challenge(strategy, tenant)

Generate a registration challenge.

sign_in(strategy, params, opts \\ [])

Sign in a user with a WebAuthn credential.

update_credential_label(strategy, credential_id, new_label, opts)

Update the label of a credential.

Functions

add_credential(strategy, params, opts \\ [])

@spec add_credential(AshAuthentication.Strategy.WebAuthn.t(), map(), keyword()) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Add a new WebAuthn credential to an existing user.

This is used when a user wants to register an additional security key or passkey. Unlike register/3, this does NOT create a new user - it attaches a credential to an existing one.

Params should include:

"attestation_object" - Base64url-encoded attestation object from the browser
"client_data_json" - Base64url-encoded client data JSON from the browser
"label" - Optional human-readable label for the credential

Options must include:

challenge: - The Wax.Challenge used for this ceremony
user: - The existing user to attach the credential to

authentication_challenge(strategy, allow_credentials, tenant)

@spec authentication_challenge(AshAuthentication.Strategy.WebAuthn.t(), list(), any()) ::
  {:ok, Wax.Challenge.t()}

Generate an authentication challenge.

delete_credential(strategy, user, credential_id, opts)

@spec delete_credential(
  AshAuthentication.Strategy.WebAuthn.t(),
  Ash.Resource.record(),
  any(),
  keyword()
) :: :ok | {:error, any()}

Delete a credential, refusing to delete the last one.

list_credentials(strategy, user, opts)

@spec list_credentials(
  AshAuthentication.Strategy.WebAuthn.t(),
  Ash.Resource.record(),
  keyword()
) ::
  {:ok, [Ash.Resource.record()]} | {:error, any()}

List all credentials for a user.

register(strategy, params, opts \\ [])

@spec register(AshAuthentication.Strategy.WebAuthn.t(), map(), keyword()) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Register a new user with a WebAuthn credential.

registration_challenge(strategy, tenant)

@spec registration_challenge(AshAuthentication.Strategy.WebAuthn.t(), any()) ::
  {:ok, Wax.Challenge.t()}

Generate a registration challenge.

sign_in(strategy, params, opts \\ [])

@spec sign_in(AshAuthentication.Strategy.WebAuthn.t(), map(), keyword()) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Sign in a user with a WebAuthn credential.

update_credential_label(strategy, credential_id, new_label, opts)

@spec update_credential_label(
  AshAuthentication.Strategy.WebAuthn.t(),
  any(),
  String.t(),
  keyword()
) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Update the label of a credential.