Repository navigation
feat(config): let a deployment refuse synced passkeys and restrict models - #49
Merged
Merged
Conversation
…dels AuthenticatorPolicySchema gains syncedPasskeys, defaulting to block, plus aaguidAllowList and aaguidDenyList. A multi-device credential is synced by a platform password manager, so its private key exists somewhere outside the authenticator that created it. That is what a consumer wants and what an organisation issuing its own authenticators does not. Blocking is the default, matching the stated design position, and a deployment that wants platform passkeys opts in. Judged on backup eligibility rather than current backup state, because a credential that can leave the device is the exposure whether or not it already has. The AAGUID lists need attestation direct to mean anything, since an authenticator never asked to identify itself reports no usable AAGUID. The whole-object default for authenticator_policy is now derived from the field defaults rather than restated, so the two cannot drift. Refs fells-code/seamless-auth-api#170
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks fells-code/seamless-auth-api#170, the last of that repository's attestation and metadata session.
What
AuthenticatorPolicySchemagainssyncedPasskeys(allow|block, default block),aaguidAllowListandaaguidDenyList.The default is a deliberate behaviour change
A multi-device credential is synced by a platform password manager, so its private key exists somewhere outside the authenticator that created it. Every iCloud Keychain and Google Password Manager passkey is one.
Defaulting to
blockmatches the design position stated in the API repository's public sector documentation, which recorded "blocked by default, agency may enable" as the intent and which that repository's own README confirmed was not implemented. This closes that gap in the direction the position states rather than by rewriting the position.The cost is real and should not be understated: a deployment relying on platform passkeys stops enrolling them on upgrade until it sets
syncedPasskeys: 'allow'. The consuming release needs to say so loudly.Eligibility, not current state
The judgement is on backup eligibility rather than backup state. A credential that can leave the device is the exposure, whether or not it has yet. Judging on current state would let a credential register while unsynced and sync afterwards.
The AAGUID lists depend on attestation
They only mean something under
attestation: 'direct'. An authenticator that was never asked to identify itself reports an all-zero AAGUID, so an allow list would reject everything and a deny list would catch nothing. Documented on the fields.One tidy-up
The whole-object default for
authenticator_policywas restated next to the field defaults, which is two places to keep in step. It is now derived from the field defaults, with a test asserting the two agree.Verification
16 test files, 208 tests, 8 new.
typecheck,lint,format:checkclean.