Add Atomic API based Passkey Registration and Authentication Support #987

KaveeshaPiumini · 2025-12-20T08:43:14Z

This pull request introduces foundational support for WebAuthn-based authentication and registration in the backend. The changes include database schema updates, new handler methods for WebAuthn flows, updates to authentication constants, and enhancements to the test mocks. Additionally, several dependencies are updated or added, including the core WebAuthn library.

WebAuthn Feature Implementation

Added new handler methods in authenticationHandler to support starting and finishing WebAuthn registration and authentication, enabling the backend to process WebAuthn flows.
Introduced the AuthenticatorWebAuthn constant to the list of supported authenticators.
Registered the new WebAuthn package in the authentication module initialization.

Database Schema Changes

Added a new WEBAUTHN_SESSION table and supporting indexes to both Postgres and SQLite schema files for storing WebAuthn session data. [1] [2]

Testing and Mocking Enhancements

Extended the AuthenticationServiceInterfaceMock with methods for starting and finishing WebAuthn authentication and registration, supporting improved test coverage for the new flows. [1] [2]

Dependency Updates

Added github.com/go-webauthn/webauthn and related packages, and updated several existing dependencies to newer versions in go.mod to support WebAuthn and related functionalities.

Copilot

Pull request overview

This pull request introduces foundational support for WebAuthn/Passkey authentication in the backend, including credential registration and authentication flows. The implementation refactors the user credentials storage model from an array to a map-based structure to support multiple credential types (password, pin, secret, passkey) and adds comprehensive WebAuthn service layer with session management.

Key Changes:

Refactored user credential storage from []Credential to Credentials (map[string][]Credential) to support multiple credential types
Implemented complete WebAuthn service with registration/authentication flows
Added database schema for WebAuthn session storage with proper deployment isolation
Created new API endpoints for WebAuthn operations

Reviewed changes

Copilot reviewed 43 out of 44 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`backend/dbscripts/runtimedb/*.sql`	Added WEBAUTHN_SESSION table with deployment isolation support
`backend/internal/user/model.go`	Refactored Credential structure and added Credentials map type
`backend/internal/user/constants.go`	Added credential type constants and validation methods
`backend/internal/user/service.go`	Updated credential handling to use map-based structure
`backend/internal/user/handler.go`	Enhanced handler to hash credentials before service calls
`backend/internal/authn/webauthn/*.go`	New WebAuthn service implementation with session management
`backend/internal/authn/handler.go`	Added WebAuthn API handlers
`backend/internal/authn/init.go`	Registered WebAuthn routes and service
`backend/go.mod`	Added WebAuthn library dependencies
Various test files	Updated mocks and added unit tests

codecov · 2025-12-20T08:48:42Z

Codecov Report

❌ Patch coverage is 84.25358% with 154 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.07%. Comparing base (22250ce) to head (4e383a7).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
backend/internal/authn/passkey/service.go	68.27%	114 Missing and 11 partials ⚠️
backend/internal/authn/passkey/utils.go	95.02%	6 Missing and 4 partials ⚠️
backend/internal/authn/passkey/session.go	77.14%	5 Missing and 3 partials ⚠️
backend/internal/authn/passkey/webauthn_service.go	68.42%	5 Missing and 1 partial ⚠️
backend/internal/authn/passkey/store.go	98.20%	2 Missing and 1 partial ⚠️
backend/internal/authn/service.go	96.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #987      +/-   ##
==========================================
- Coverage   87.14%   87.07%   -0.07%     
==========================================
  Files         526      533       +7     
  Lines       35024    36002     +978     
  Branches     1611     1611              
==========================================
+ Hits        30522    31350     +828     
- Misses       2882     3013     +131     
- Partials     1620     1639      +19

Flag	Coverage Δ
backend-integration-postgres	`54.91% <37.73%> (-0.55%)`	⬇️
backend-integration-sqlite	`54.88% <37.73%> (-0.54%)`	⬇️
backend-unit	`78.69% <81.08%> (+0.08%)`	⬆️
frontend-apps-develop-unit	`80.87% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated no new comments.

backend/internal/authn/webauthn/REFACTORING_NOTES.md

backend/internal/authn/webauthn/service.go

ThaminduDilshan · 2026-01-06T07:28:05Z

backend/internal/authn/common/constants.go

 	AuthenticatorGithub      = "GithubOAuthAuthenticator"
 	AuthenticatorOAuth       = "OAuthAuthenticator"
 	AuthenticatorOIDC        = "OIDCAuthenticator"
+	AuthenticatorWebAuthn    = "WebAuthnAuthenticator"


Need to think again whether to go ahead with the webauthn term or passkeys. Webauthn is okay for the internal implementations as it is the core technology that we're using. But passkeys is more user friendly and should be used for user facing interfaces such as develop app UI, token assurance, authenticator list, etc.

Since this is a new implementation, we should think whether to mixup both terms or stick to one. Another related question is whether we're going to support any other webauthn authentication options except for FIDO2 in future. My answer is no. Hence we can stick to passkeys.

@darshanasbg WDYT?

On a side note, passkeys is not webauthn or fido. Passkeys is the modern term for FIDO2 + Webauthn. So in technical terms it should be either FIDO2 or WebAuthn.

Renamed to passkey as discussed offline

backend/internal/authn/webauthn/adapter.go

backend/internal/authn/passkey/webauthn_user.go

backend/internal/authn/webauthn/adapter.go

backend/internal/authn/passkey/webauthn_user.go

backend/internal/authn/webauthn/adapter_test.go

backend/internal/authn/webauthn/errorconstants.go

ThaminduDilshan · 2026-01-06T08:08:35Z

backend/internal/system/config/config.go


+// WebAuthnConfig holds the WebAuthn configuration details.
+type WebAuthnConfig struct {
+	AllowedOrigins []string `yaml:"allowed_origins" json:"allowed_origins"`


Shall we also add default configs corresponding to the cors allowed origins to the deployment.yaml file?

backend/internal/user/store_test.go

install/helm/conf/deployment.yaml

Copilot

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 40 out of 41 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 41 out of 42 changed files in this pull request and generated no new comments.

ThaminduDilshan · 2026-01-13T11:06:02Z

api/WIP/authentication.yaml

      port:
        default: "8090"

 paths:


Let's move this to api/authentication.yaml and remove this file as the API is implemented

backend/internal/authn/passkey/service.go

backend/internal/authn/passkey/webauthn_service_wrapper.go

ThaminduDilshan · 2026-01-13T17:51:20Z

backend/internal/authn/passkey/webauthn_service.go

+
+// webauthnUserInterface defines the interface for WebAuthn user operations.
+// This interface abstracts the passkey.User interface to reduce direct dependencies.
+type webauthnUserInterface interface {


Shall we move this to models.go?

backend/internal/authn/passkey/webauthn_library_adapter.go

backend/internal/authn/passkey/webauthn_user.go

backend/internal/authn/passkey/utils.go

ThaminduDilshan · 2026-01-13T18:27:20Z

backend/internal/authn/passkey/store_constants.go

+	jsonKeyExpires            = "expires"
+	jsonKeyUserVerification   = "user_verification"
+	jsonKeyExtensions         = "extensions"
+	jsonKeyCredParams         = "cred_params" // nolint:gosec // This is a JSON key, not a credential


Let's verify this lint disable comment is needed. If not shall we remove it?

I had to add this since it gave a gosec warning

backend/internal/authn/passkey/error_constants.go

ThaminduDilshan · 2026-01-13T18:40:27Z

backend/cmd/server/repository/conf/deployment.yaml

  allowed_origins:
    - "https://localhost:3000"
+
+passkey:


If cors origins are also there, let's add this to default.json as well.

cors origins are not in the default.json

ThaminduDilshan · 2026-01-13T18:42:02Z

backend/cmd/server/repository/conf/deployment.yaml

+
+passkey:
+  allowed_origins:
+    - "https://localhost:8090"


We can only keep "https://localhost:8090". Let's remove other too from the list

backend/internal/authn/passkey/model.go

backend/internal/authn/passkey/webauthn_service_wrapper.go

backend/internal/authn/passkey/service.go

ThaminduDilshan · 2026-01-14T03:35:03Z

backend/internal/authn/passkey/service.go

+
+	logger.Debug("Passkey credential creation options generated successfully",
+		log.String("userID", log.MaskString(req.UserID)),
+		log.Int("excludeCredentialsCount", len(credentials)))


Is this log field correct? excludeCredentialsCount

ThaminduDilshan · 2026-01-14T03:38:15Z

backend/internal/authn/passkey/service.go

+	}
+
+	// Retrieve user's existing passkey credentials from database
+	credentials, err := w.getPasskeyCredentialsFromDB(req.UserID)


Note: We need to verify whether WebAuthn user needs to have credentials for initialization phase. I feel like it's not a good solution to retrieve credentials prior and return in response or set in memory unless absolutely necessary.

Let's proceed with current implementation and revisit this later

backend/internal/authn/passkey/service.go

ThaminduDilshan · 2026-01-14T04:00:25Z

backend/internal/authn/passkey/service.go

+
+	// Verify the credential creation response using WebAuthn library service
+	logger.Debug("Calling FinishRegistration with session data",
+		log.String("sessionChallenge", sessionData.Challenge),


Let's avoid logging unnecessary details even in debug logs. Also shall we merge the two debug logs?
I feel like second log is unnecessary

ThaminduDilshan · 2026-01-14T04:04:54Z

backend/internal/authn/passkey/service.go

+	credential, err := webAuthnLibService.FinishRegistration(webAuthnUserAdapter, *sessionData, parsedCredential)
+	if err != nil {
+		logger.Error("Failed to verify and create credential", log.String("error", err.Error()))
+		return nil, &ErrorInvalidAttestationResponse


Is this the correct error? If so let's avoid logging client errors

ThaminduDilshan · 2026-01-14T04:06:06Z

backend/internal/authn/passkey/service.go

+
+	logger.Debug("Passkey credential verified and created",
+		log.String("credentialID", credentialID),
+		log.String("aaguid", base64.StdEncoding.EncodeToString(credential.Authenticator.AAGUID)))


Let's avoid logging unnecessary details even in debug logs. Some of these fields maybe sensitive data. We shouldn't log sensitive stuff/ PIIs even in debug logs

ThaminduDilshan · 2026-01-14T05:11:46Z

backend/internal/authn/passkey/service.go

+	// Retrieve user by userID to verify user exists
+	userInfo, svcErr := w.userService.GetUser(userID)
+	if svcErr != nil {
+		if svcErr.Type == serviceerror.ClientErrorType {


Shall we check for user not found error specifically? This could be any other client error as well

backend/internal/authn/passkey/service.go

ThaminduDilshan · 2026-01-14T05:15:24Z

backend/internal/authn/passkey/service.go

+
+	logger.Debug("Passkey authentication options generated successfully",
+		log.String("userID", log.MaskString(userID)),
+		log.Int("allowedCredentialsCount", len(credentials)))


Is this log field correct? allowedCredentialsCount

backend/internal/authn/passkey/service.go

ThaminduDilshan · 2026-01-14T06:03:18Z

backend/internal/authn/passkey/service.go

+	parsedResponse, err := parseAssertionResponse(credentialID, credentialType,
+		clientDataJSON, authenticatorData, signature, userHandle)
+	if err != nil {
+		logger.Error("Failed to parse assertion response", log.String("error", err.Error()))


Shall we avoid logging client errors? You can have deb ug logs.

Check other places as well

backend/internal/authn/passkey/service.go

ThaminduDilshan · 2026-01-14T06:08:26Z

backend/internal/authn/passkey/service_test.go

+)
+
+// sessionStoreInterfaceMock is a mock implementation of sessionStoreInterface.
+type sessionStoreInterfaceMock struct {


Shall we use mockery generated mocks instead of custom ones?

KaveeshaPiumini requested a review from Lakshan-Banneheke as a code owner December 20, 2025 08:43

Copilot AI review requested due to automatic review settings December 20, 2025 08:43

KaveeshaPiumini requested review from ThaminduDilshan and darshanasbg as code owners December 20, 2025 08:43

Copilot started reviewing on behalf of KaveeshaPiumini December 20, 2025 08:43 View session

KaveeshaPiumini added the Type/New Feature label Dec 20, 2025

Copilot AI reviewed Dec 20, 2025

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch from 7628df1 to 0a7670e Compare December 20, 2025 13:08

Copilot AI review requested due to automatic review settings December 22, 2025 03:49

KaveeshaPiumini force-pushed the passkey branch from 0a7670e to dc015bc Compare December 22, 2025 03:49

Copilot started reviewing on behalf of KaveeshaPiumini December 22, 2025 03:49 View session

Copilot AI reviewed Dec 22, 2025

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch 2 times, most recently from 45e65a5 to fa27491 Compare December 22, 2025 04:46

Copilot AI review requested due to automatic review settings December 22, 2025 04:46

Copilot started reviewing on behalf of KaveeshaPiumini December 22, 2025 04:47 View session

Copilot AI reviewed Dec 22, 2025

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch from fa27491 to f60e349 Compare December 22, 2025 05:18

Copilot AI review requested due to automatic review settings December 22, 2025 06:00

KaveeshaPiumini force-pushed the passkey branch from f60e349 to 1ed49a2 Compare December 22, 2025 06:00

Copilot started reviewing on behalf of KaveeshaPiumini December 22, 2025 06:00 View session

Copilot AI reviewed Dec 22, 2025

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch 2 times, most recently from 5ad8c38 to f5c5c6f Compare December 22, 2025 08:52

Copilot AI review requested due to automatic review settings December 22, 2025 08:52

Copilot started reviewing on behalf of KaveeshaPiumini December 22, 2025 08:52 View session

Copilot AI reviewed Dec 22, 2025

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch 2 times, most recently from 2971d35 to acb9d60 Compare December 22, 2025 11:47

ThaminduDilshan reviewed Jan 6, 2026

View reviewed changes

backend/internal/authn/webauthn/REFACTORING_NOTES.md Outdated Show resolved Hide resolved

ThaminduDilshan reviewed Jan 6, 2026

View reviewed changes

backend/internal/authn/webauthn/service.go Outdated Show resolved Hide resolved

ThaminduDilshan reviewed Jan 6, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings January 13, 2026 05:47

KaveeshaPiumini force-pushed the passkey branch from 6ecc7a8 to 4d86a12 Compare January 13, 2026 05:47

KaveeshaPiumini requested a review from senthalan as a code owner January 13, 2026 05:47

Copilot started reviewing on behalf of KaveeshaPiumini January 13, 2026 05:48 View session

KaveeshaPiumini force-pushed the passkey branch from 4d86a12 to 3bde4e1 Compare January 13, 2026 05:53

Copilot AI reviewed Jan 13, 2026

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch from 3bde4e1 to 31bcde0 Compare January 13, 2026 06:02

Copilot AI review requested due to automatic review settings January 13, 2026 06:12

KaveeshaPiumini force-pushed the passkey branch from 31bcde0 to 3a4265f Compare January 13, 2026 06:12

Copilot started reviewing on behalf of KaveeshaPiumini January 13, 2026 06:13 View session

KaveeshaPiumini requested a review from ThaminduDilshan January 13, 2026 06:19

Copilot AI reviewed Jan 13, 2026

View reviewed changes

KaveeshaPiumini force-pushed the passkey branch 2 times, most recently from 8558aa9 to 4ba3d6b Compare January 13, 2026 08:07

Copilot AI review requested due to automatic review settings January 13, 2026 08:07

Copilot started reviewing on behalf of KaveeshaPiumini January 13, 2026 08:08 View session

Copilot AI reviewed Jan 13, 2026

View reviewed changes

ThaminduDilshan reviewed Jan 13, 2026

View reviewed changes

ThaminduDilshan reviewed Jan 14, 2026

View reviewed changes

Add atomic api based passkey support

4e383a7

KaveeshaPiumini force-pushed the passkey branch from 4ba3d6b to 4e383a7 Compare January 14, 2026 11:56

Add Atomic API based Passkey Registration and Authentication Support #987

Are you sure you want to change the base?

Add Atomic API based Passkey Registration and Authentication Support #987

Uh oh!

Conversation

KaveeshaPiumini commented Dec 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

codecov bot commented Dec 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

ThaminduDilshan Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ThaminduDilshan Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

codecov bot commented Dec 20, 2025 •

edited

Loading

ThaminduDilshan Jan 6, 2026 •

edited

Loading

ThaminduDilshan Jan 6, 2026 •

edited

Loading

ThaminduDilshan Jan 14, 2026 •

edited

Loading