feat: choose preferred WebAuthN platform for passwordless registration (#2469)

* feat: request preferred platform type for passwordless registration when using link

* add text in console

internal/ui/login/handler/passwordless_prompt_handler.go

@@ -23,7 +23,7 @@ func (l *Login) handlePasswordlessPrompt(w http.ResponseWriter, r *http.Request)
 		l.renderError(w, r, authReq, err)
 		return
 	}
-	l.renderPasswordlessRegistration(w, r, authReq, "", "", "", "", nil)
+	l.renderPasswordlessRegistration(w, r, authReq, "", "", "", "", 0, nil)
 }
 
 func (l *Login) renderPasswordlessPrompt(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) {

internal/ui/login/handler/passwordless_registration_handler.go

@@ -4,46 +4,78 @@ import (
 	"encoding/base64"
 	"net/http"
 
+	"github.com/caos/logging"
+
 	http_mw "github.com/caos/zitadel/internal/api/http/middleware"
 	"github.com/caos/zitadel/internal/domain"
 )
 
 const (
-	tmplPasswordlessRegistration        = "passwordlessregistration"
-	tmplPasswordlessRegistrationDone    = "passwordlessregistrationdone"
-	queryPasswordlessRegistrationCode   = "code"
-	queryPasswordlessRegistrationCodeID = "codeID"
-	queryPasswordlessRegistrationUserID = "userID"
-	queryPasswordlessRegistrationOrgID  = "orgID"
+	tmplPasswordlessRegistration     = "passwordlessregistration"
+	tmplPasswordlessRegistrationDone = "passwordlessregistrationdone"
 )
 
 type passwordlessRegistrationData struct {
 	webAuthNData
-	Code     string
-	CodeID   string
-	UserID   string
-	OrgID    string
-	Disabled bool
+	Code                string
+	CodeID              string
+	UserID              string
+	OrgID               string
+	RequestPlatformType authPlatform
+	Disabled            bool
+}
+
+type passwordlessRegistrationDoneDate struct {
+	userData
+	HideNextButton bool
 }
 
 type passwordlessRegistrationFormData struct {
 	webAuthNFormData
-	Code      string `schema:"code"`
-	CodeID    string `schema:"codeID"`
-	UserID    string `schema:"userID"`
-	OrgID     string `schema:"orgID"`
+	passwordlessRegistrationQueries
 	TokenName string `schema:"name"`
 }
 
-func (l *Login) handlePasswordlessRegistration(w http.ResponseWriter, r *http.Request) {
-	userID := r.FormValue(queryPasswordlessRegistrationUserID)
-	orgID := r.FormValue(queryPasswordlessRegistrationOrgID)
-	codeID := r.FormValue(queryPasswordlessRegistrationCodeID)
-	code := r.FormValue(queryPasswordlessRegistrationCode)
-	l.renderPasswordlessRegistration(w, r, nil, userID, orgID, codeID, code, nil)
+type passwordlessRegistrationQueries struct {
+	Code                string       `schema:"code"`
+	CodeID              string       `schema:"codeID"`
+	UserID              string       `schema:"userID"`
+	OrgID               string       `schema:"orgID"`
+	RequestPlatformType authPlatform `schema:"requestPlatformType"`
 }
 
-func (l *Login) renderPasswordlessRegistration(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, userID, orgID, codeID, code string, err error) {
+type authPlatform domain.AuthenticatorAttachment
+
+func (a authPlatform) MarshalText() (text []byte, err error) {
+	switch domain.AuthenticatorAttachment(a) {
+	case domain.AuthenticatorAttachmentPlattform:
+		return []byte("platform"), nil
+	case domain.AuthenticatorAttachmentCrossPlattform:
+		return []byte("crossPlatform"), nil
+	default:
+		return []byte("unspecified"), nil
+	}
+}
+
+func (a *authPlatform) UnmarshalText(text []byte) (err error) {
+	switch string(text) {
+	case "platform",
+		"1":
+		*a = authPlatform(domain.AuthenticatorAttachmentPlattform)
+	case "crossPlatform",
+		"2":
+		*a = authPlatform(domain.AuthenticatorAttachmentCrossPlattform)
+	}
+	return nil
+}
+
+func (l *Login) handlePasswordlessRegistration(w http.ResponseWriter, r *http.Request) {
+	queries := new(passwordlessRegistrationQueries)
+	err := l.parser.Parse(r, queries)
+	l.renderPasswordlessRegistration(w, r, nil, queries.UserID, queries.OrgID, queries.CodeID, queries.Code, queries.RequestPlatformType, err)
+}
+
+func (l *Login) renderPasswordlessRegistration(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, userID, orgID, codeID, code string, requestedPlatformType authPlatform, err error) {
 	var errID, errMessage, credentialData string
 	var disabled bool
 	if authReq != nil {
@@ -53,9 +85,9 @@ func (l *Login) renderPasswordlessRegistration(w http.ResponseWriter, r *http.Re
 	var webAuthNToken *domain.WebAuthNToken
 	if err == nil {
 		if authReq != nil {
-			webAuthNToken, err = l.authRepo.BeginPasswordlessSetup(setContext(r.Context(), authReq.UserOrgID), userID, authReq.UserOrgID)
+			webAuthNToken, err = l.authRepo.BeginPasswordlessSetup(setContext(r.Context(), authReq.UserOrgID), userID, authReq.UserOrgID, domain.AuthenticatorAttachment(requestedPlatformType))
 		} else {
-			webAuthNToken, err = l.authRepo.BeginPasswordlessInitCodeSetup(setContext(r.Context(), orgID), userID, orgID, codeID, code)
+			webAuthNToken, err = l.authRepo.BeginPasswordlessInitCodeSetup(setContext(r.Context(), orgID), userID, orgID, codeID, code, domain.AuthenticatorAttachment(requestedPlatformType))
 		}
 	}
 	if err != nil {
@@ -74,21 +106,21 @@ func (l *Login) renderPasswordlessRegistration(w http.ResponseWriter, r *http.Re
 		codeID,
 		userID,
 		orgID,
+		requestedPlatformType,
 		disabled,
 	}
 	translator := l.getTranslator(authReq)
 	if authReq == nil {
 		policy, err := l.authRepo.GetLabelPolicy(r.Context(), orgID)
-		if err != nil {
-
-		}
+		logging.Log("LOGIN-afgr2").OnError(err).Warn("could not get label policy")
 		data.LabelPolicy = policy
-		texts, err := l.authRepo.GetLoginText(r.Context(), orgID)
-		if err != nil {
 
+		translator, err = l.renderer.NewTranslator()
+		if err == nil {
+			texts, err := l.authRepo.GetLoginText(r.Context(), orgID)
+			logging.Log("LOGIN-HJK4t").OnError(err).Warn("could not get custom texts")
+			l.addLoginTranslations(translator, texts)
 		}
-		translator, _ = l.renderer.NewTranslator()
-		l.addLoginTranslations(translator, texts)
 	}
 	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplPasswordlessRegistration], data, nil)
 }
@@ -100,13 +132,13 @@ func (l *Login) handlePasswordlessRegistrationCheck(w http.ResponseWriter, r *ht
 		l.renderError(w, r, authReq, err)
 		return
 	}
-	l.checkPasswordlessRegistration(w, r, authReq, formData, nil)
+	l.checkPasswordlessRegistration(w, r, authReq, formData)
 }
 
-func (l *Login) checkPasswordlessRegistration(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, formData *passwordlessRegistrationFormData, err error) {
+func (l *Login) checkPasswordlessRegistration(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, formData *passwordlessRegistrationFormData) {
 	credData, err := base64.URLEncoding.DecodeString(formData.CredentialData)
 	if err != nil {
-		l.renderPasswordlessRegistration(w, r, authReq, formData.UserID, formData.OrgID, formData.CodeID, formData.Code, err)
+		l.renderPasswordlessRegistration(w, r, authReq, formData.UserID, formData.OrgID, formData.CodeID, formData.Code, formData.RequestPlatformType, err)
 		return
 	}
 	userAgentID, _ := http_mw.UserAgentIDFromCtx(r.Context())
@@ -116,7 +148,7 @@ func (l *Login) checkPasswordlessRegistration(w http.ResponseWriter, r *http.Req
 		err = l.authRepo.VerifyPasswordlessInitCodeSetup(setContext(r.Context(), formData.OrgID), formData.UserID, formData.OrgID, userAgentID, formData.TokenName, formData.CodeID, formData.Code, credData)
 	}
 	if err != nil {
-		l.renderPasswordlessRegistration(w, r, authReq, formData.UserID, formData.OrgID, formData.CodeID, formData.Code, err)
+		l.renderPasswordlessRegistration(w, r, authReq, formData.UserID, formData.OrgID, formData.CodeID, formData.Code, formData.RequestPlatformType, err)
 		return
 	}
 	l.renderPasswordlessRegistrationDone(w, r, authReq, nil)
@@ -127,6 +159,9 @@ func (l *Login) renderPasswordlessRegistrationDone(w http.ResponseWriter, r *htt
 	if err != nil {
 		errID, errMessage = l.getErrorMessage(r, err)
 	}
-	data := l.getUserData(r, authReq, "Passwordless Registration Done", errID, errMessage)
+	data := passwordlessRegistrationDoneDate{
+		userData:       l.getUserData(r, authReq, "Passwordless Registration Done", errID, errMessage),
+		HideNextButton: authReq == nil,
+	}
 	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplPasswordlessRegistrationDone], data, nil)
 }

internal/ui/login/static/i18n/de.yaml

@@ -153,6 +153,7 @@ PasswordlessRegistration:
 PasswordlessRegistrationDone:
   Title: Passwortloser Login erstellt
   Description: Token für passwortlosen Login erfolgreich hinzugefügt.
+  DescriptionClose: Du kannst das Fenster nun schliessen.
   NextButtonText: weiter
   CancelButtonText: abbrechen
 

internal/ui/login/static/i18n/en.yaml

@@ -153,6 +153,7 @@ PasswordlessRegistration:
 PasswordlessRegistrationDone:
   Title: Passwordless set up
   Description: Token for passwordless successfully added.
+  DescriptionClose: You can now close this window.
   NextButtonText: next
   CancelButtonText: cancel
 

internal/ui/login/static/resources/themes/scss/styles/error/error.scss

@@ -6,4 +6,8 @@
         margin-right: .5rem;
         font-size: 1.5rem;
     }
-}
+}
+
+#wa-error {
+    flex-direction: column;
+}

internal/ui/login/static/resources/themes/zitadel/css/zitadel.css

@@ -537,6 +537,10 @@ a.block {
   font-size: 1.5rem;
 }
 
+#wa-error {
+  flex-direction: column;
+}
+
 .lgn-qrcode {
   display: block;
   margin: auto;
@@ -1426,6 +1430,10 @@ a.block {
   font-size: 1.5rem;
 }
 
+#wa-error {
+  flex-direction: column;
+}
+
 .lgn-qrcode {
   display: block;
   margin: auto;

internal/ui/login/static/templates/passwordless_registration.html

@@ -17,6 +17,7 @@
     <input type="hidden" name="orgID" value="{{ .OrgID }}" />
     <input type="hidden" name="codeID" value="{{ .CodeID }}" />
     <input type="hidden" name="code" value="{{ .Code }}" />
+    <input type="hidden" name="requestPlatformType" value="{{ .RequestPlatformType }}" />
     <input type="hidden" name="credentialCreationData" value="{{ .CredentialCreationData }}" />
     <input type="hidden" name="credentialData" />
 

internal/ui/login/static/templates/passwordless_registration_done.html

@@ -6,6 +6,9 @@
     {{ template "user-profile" . }}
 
     <p>{{t "PasswordlessRegistrationDone.Description"}}</p>
+    {{if .HideNextButton }}
+    <p>{{t "PasswordlessRegistrationDone.DescriptionClose"}}</p>
+    {{end}}
 </div>
 
 <form action="{{ loginUrl }}" method="POST">
@@ -15,13 +18,11 @@
     <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
 
     <div class="lgn-actions">
-        <a class="lgn-stroked-button lgn-primary" href="{{ loginUrl }}">
-            {{t "PasswordlessRegistrationDone.CancelButtonText"}}
-        </a>
-        <span class="fill-space"></span>
+        {{if not .HideNextButton }}
         <button class="lgn-raised-button lgn-primary" type="submit">{{t "PasswordlessRegistrationDone.NextButtonText"}}</button>
+        {{end}}
     </div>
 </form>
 
 
-{{template "main-bottom" .}}
+{{template "main-bottom" .}}