Documentation
¶
Overview ¶
Package passkeytest provides a backend-agnostic conformance suite for the passkey.Store interface. Every backend (memory, sqlite, postgres, mongo) is expected to pass the same contract, so behavioral drift between them is caught here rather than in production.
Passkeys are a sharper test than most stores: credential ids, public keys and AAGUIDs are raw binary, and the sign count is a uint32 that the SQL backends have to hold in a signed column.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Authenticator ¶ added in v1.9.1
type Authenticator struct {
// Origin is the page origin the browser would report, such as
// http://localhost:3000. Its host must be the RP ID or under it.
Origin string
// RPID is the relying party ID the credential is scoped to.
RPID string
// NoUserVerification signs assertions with user presence only, the
// way a security key with no PIN does.
NoUserVerification bool
// contains filtered or unexported fields
}
Authenticator is a software passkey for tests: it answers the options /v1/passkeys/register/begin and /v1/passkeys/login/begin return with the JSON a browser would post to the matching finish route. It holds one P-256 credential, signs with "none" attestation and reports user presence and verification on every ceremony.
It does what a platform authenticator does and nothing more careful, so use it to drive ceremonies end to end, never as a model of a real device.
func NewAuthenticator ¶ added in v1.9.1
func NewAuthenticator(origin, rpID string) *Authenticator
NewAuthenticator returns an authenticator with no credential yet.
func (*Authenticator) Create ¶ added in v1.9.1
func (a *Authenticator) Create(options json.RawMessage) ([]byte, error)
Create makes a new credential for the creation options and returns the attestation body for /v1/passkeys/register/finish. It replaces any credential the authenticator held.
func (*Authenticator) CredentialID ¶ added in v1.9.1
func (a *Authenticator) CredentialID() string
CredentialID is the ID of the credential Create made, base64url encoded the way authsome lists it.
func (*Authenticator) Get ¶ added in v1.9.1
func (a *Authenticator) Get(options json.RawMessage) ([]byte, error)
Get signs the request options' challenge with the credential Create made and returns the assertion body for /v1/passkeys/login/finish, user handle included, as a discoverable credential answers.
func (*Authenticator) UserHandle ¶ added in v1.9.1
func (a *Authenticator) UserHandle() []byte
UserHandle is the user handle the last Create stored, which a discoverable sign-in returns.
type Fixture ¶
type Fixture struct {
Store passkey.Store
AppID id.AppID
UserID id.UserID
// OtherUserID is a second user under the same app, used to prove that
// credential listing is scoped to one user.
OtherUserID id.UserID
}
Fixture is one backend ready to test, plus the tenant rows its foreign keys point at.
Source Files