Ithibati.Web.Router (Ithibati v0.1.0)

The five routes the ceremonies need, wired in one call.

pipeline :ceremony do
  plug :accepts, ["json"]
  plug :fetch_session
  plug :protect_from_forgery
end

scope "/auth" do
  pipe_through :ceremony
  ithibati_routes handler: MyAppWeb.Auth, rp_name: "MyApp"
end

The suffixes belong to Ithibati rather than to each application, so that there is no way to wire half of a ceremony: a mount chooses the prefix and nothing else. They are API from the first release, and changing one costs a major version.

Four of the routes are the passkey ceremonies. The fifth, /recovery, takes a recovery code and ends in Ithibati.Web.Handler.recovered/3. That is the same place a verified assertion ends, reached the other way.

Summary

Functions

ithibati_routes(opts)

Generates the ceremony routes, dispatching to handler.

Functions

ithibati_routes(opts)

(macro)

Generates the ceremony routes, dispatching to handler.

:handler implements Ithibati.Web.Handler, and :rp_name is the name a passkey dialog shows. Both are required. :user_verification and :seconds are the two WebAuthn choices that belong to the application rather than to Ithibati: whether the authenticator must confirm who is holding it, and how long a challenge stays acceptable. They default to "preferred" and sixty seconds.

The macro records all of this on the routes rather than reading it from application configuration, so that two mounts (an administrative one and a public one, say) can answer to different rules.