feat: add MFA for WebAuthn #1775

J0 · 2024-09-18T20:45:48Z

What kind of change does this PR introduce?

Adds MFA for WebAuthn and supporting migrations

What is the current behavior?

MFA for Phone and MFA for TOTP is supported

What is the new behavior?

Developers can use MFA For WebAuthn to sign in

example.env

migrations/20240912193726_add_web_authn.up.sql

internal/api/mfa.go

J0 · 2024-09-28T20:23:43Z

Not quite ready yet, please check back after 12pm CEST tomorrow..

internal/models/user.go

coveralls · 2024-09-30T08:42:15Z

Pull Request Test Coverage Report for Build 11293653315

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

141 of 360 (39.17%) changed or added relevant lines in 5 files are covered.
76 unchanged lines in 4 files lost coverage.
Overall coverage decreased (-0.4%) to 57.577%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/models/user.go	9	18	50.0%
internal/models/challenge.go	16	37	43.24%
internal/models/factor.go	10	46	21.74%
internal/api/mfa.go	105	258	40.7%

Files with Coverage Reduction	New Missed Lines	%
internal/api/mfa.go	2	57.97%
cmd/serve_cmd.go	10	0.0%
internal/api/api.go	19	84.21%
internal/api/middleware.go	45	80.37%

Totals
Change from base Build 11256757764:	-0.4%
Covered Lines:	9499
Relevant Lines:	16498

💛 - Coveralls

internal/models/amr.go

hf

Very good, very close! Thanks!

internal/api/mfa_test.go

internal/models/amr.go

internal/models/factor.go

migrations/20240930203726_add_web_authn.up.sql

internal/api/mfa.go

hf

Pretty solid. Approving but please consider the points especially about scanning.

internal/api/mfa.go

internal/models/challenge.go

internal/models/factor.go

Co-authored-by: Stojan Dimitrovski <[email protected]>

internal/api/mfa.go

Co-authored-by: Stojan Dimitrovski <[email protected]>

internal/models/factor.go

J0 · 2024-10-11T14:04:22Z

Merging first but let's not release until we do a full test with the updated frontend bindings. I will follow up on that front.

None of the code below should be active since it's flagged behind MFA_WEB_AUTHN_*_ENABLED

🤖 I have created a release *beep* *boop* --- ## [2.163.0](v2.162.2...v2.163.0) (2024-10-15) ### Features * add mail header support via `GOTRUE_SMTP_HEADERS` with `$messageType` ([#1804](#1804)) ([99d6a13](99d6a13)) * add MFA for WebAuthn ([#1775](#1775)) ([8cc2f0e](8cc2f0e)) * configurable email and sms rate limiting ([#1800](#1800)) ([5e94047](5e94047)) * mailer logging ([#1805](#1805)) ([9354b83](9354b83)) * preserve rate limiters in memory across configuration reloads ([#1792](#1792)) ([0a3968b](0a3968b)) ### Bug Fixes * add twilio verify support on mfa ([#1714](#1714)) ([aeb5d8f](aeb5d8f)) * email header setting no longer misleading ([#1802](#1802)) ([3af03be](3af03be)) * enforce authorized address checks on send email only ([#1806](#1806)) ([c0c5b23](c0c5b23)) * fix `getExcludedColumns` slice allocation ([#1788](#1788)) ([7f006b6](7f006b6)) * Fix reqPath for bypass check for verify EP ([#1789](#1789)) ([646dc66](646dc66)) * inline mailme package for easy development ([#1803](#1803)) ([fa6f729](fa6f729)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Adds MFA for WebAuthn and supporting migrations ## What is the current behavior? MFA for Phone and MFA for TOTP is supported ## What is the new behavior? Developers can use MFA For WebAuthn to sign in --------- Co-authored-by: Stojan Dimitrovski <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [2.163.0](v2.162.2...v2.163.0) (2024-10-15) ### Features * add mail header support via `GOTRUE_SMTP_HEADERS` with `$messageType` ([#1804](#1804)) ([99d6a13](99d6a13)) * add MFA for WebAuthn ([#1775](#1775)) ([8cc2f0e](8cc2f0e)) * configurable email and sms rate limiting ([#1800](#1800)) ([5e94047](5e94047)) * mailer logging ([#1805](#1805)) ([9354b83](9354b83)) * preserve rate limiters in memory across configuration reloads ([#1792](#1792)) ([0a3968b](0a3968b)) ### Bug Fixes * add twilio verify support on mfa ([#1714](#1714)) ([aeb5d8f](aeb5d8f)) * email header setting no longer misleading ([#1802](#1802)) ([3af03be](3af03be)) * enforce authorized address checks on send email only ([#1806](#1806)) ([c0c5b23](c0c5b23)) * fix `getExcludedColumns` slice allocation ([#1788](#1788)) ([7f006b6](7f006b6)) * Fix reqPath for bypass check for verify EP ([#1789](#1789)) ([646dc66](646dc66)) * inline mailme package for easy development ([#1803](#1803)) ([fa6f729](fa6f729)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Adds MFA for WebAuthn and supporting migrations ## What is the current behavior? MFA for Phone and MFA for TOTP is supported ## What is the new behavior? Developers can use MFA For WebAuthn to sign in --------- Co-authored-by: Stojan Dimitrovski <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [2.163.0](supabase/auth@v2.162.2...v2.163.0) (2024-10-15) ### Features * add mail header support via `GOTRUE_SMTP_HEADERS` with `$messageType` ([supabase#1804](supabase#1804)) ([99d6a13](supabase@99d6a13)) * add MFA for WebAuthn ([supabase#1775](supabase#1775)) ([8cc2f0e](supabase@8cc2f0e)) * configurable email and sms rate limiting ([supabase#1800](supabase#1800)) ([5e94047](supabase@5e94047)) * mailer logging ([supabase#1805](supabase#1805)) ([9354b83](supabase@9354b83)) * preserve rate limiters in memory across configuration reloads ([supabase#1792](supabase#1792)) ([0a3968b](supabase@0a3968b)) ### Bug Fixes * add twilio verify support on mfa ([supabase#1714](supabase#1714)) ([aeb5d8f](supabase@aeb5d8f)) * email header setting no longer misleading ([supabase#1802](supabase#1802)) ([3af03be](supabase@3af03be)) * enforce authorized address checks on send email only ([supabase#1806](supabase#1806)) ([c0c5b23](supabase@c0c5b23)) * fix `getExcludedColumns` slice allocation ([supabase#1788](supabase#1788)) ([7f006b6](supabase@7f006b6)) * Fix reqPath for bypass check for verify EP ([supabase#1789](supabase#1789)) ([646dc66](supabase@646dc66)) * inline mailme package for easy development ([supabase#1803](supabase#1803)) ([fa6f729](supabase@fa6f729)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## What kind of change does this PR introduce? Adds MFA for WebAuthn and supporting migrations ## What is the current behavior? MFA for Phone and MFA for TOTP is supported ## What is the new behavior? Developers can use MFA For WebAuthn to sign in --------- Co-authored-by: Stojan Dimitrovski <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [2.163.0](v2.162.2...v2.163.0) (2024-10-15) ### Features * add mail header support via `GOTRUE_SMTP_HEADERS` with `$messageType` ([#1804](#1804)) ([99d6a13](99d6a13)) * add MFA for WebAuthn ([#1775](#1775)) ([8cc2f0e](8cc2f0e)) * configurable email and sms rate limiting ([#1800](#1800)) ([5e94047](5e94047)) * mailer logging ([#1805](#1805)) ([9354b83](9354b83)) * preserve rate limiters in memory across configuration reloads ([#1792](#1792)) ([0a3968b](0a3968b)) ### Bug Fixes * add twilio verify support on mfa ([#1714](#1714)) ([aeb5d8f](aeb5d8f)) * email header setting no longer misleading ([#1802](#1802)) ([3af03be](3af03be)) * enforce authorized address checks on send email only ([#1806](#1806)) ([c0c5b23](c0c5b23)) * fix `getExcludedColumns` slice allocation ([#1788](#1788)) ([7f006b6](7f006b6)) * Fix reqPath for bypass check for verify EP ([#1789](#1789)) ([646dc66](646dc66)) * inline mailme package for easy development ([#1803](#1803)) ([fa6f729](fa6f729)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

J0 commented Sep 27, 2024

View reviewed changes

example.env Show resolved Hide resolved

J0 force-pushed the j0/add_webauthn branch 2 times, most recently from 4bafb15 to cb1ac2a Compare September 28, 2024 09:34

J0 commented Sep 28, 2024

View reviewed changes

migrations/20240912193726_add_web_authn.up.sql Show resolved Hide resolved

J0 commented Sep 28, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

hf reviewed Sep 30, 2024

View reviewed changes

internal/models/user.go Outdated Show resolved Hide resolved

internal/models/user.go Outdated Show resolved Hide resolved

internal/models/user.go Outdated Show resolved Hide resolved

J0 commented Oct 1, 2024

View reviewed changes

internal/models/amr.go Show resolved Hide resolved

J0 marked this pull request as ready for review October 2, 2024 14:57

J0 requested a review from a team as a code owner October 2, 2024 14:57

J0 force-pushed the j0/add_webauthn branch from a78abe0 to cc7aab0 Compare October 3, 2024 15:49

hf reviewed Oct 3, 2024

View reviewed changes

J0 force-pushed the j0/add_webauthn branch 2 times, most recently from c9b18e3 to cc764cc Compare October 10, 2024 14:16

feat: add MFA for WebAuthn

e92aeac

J0 force-pushed the j0/add_webauthn branch from cc764cc to e92aeac Compare October 10, 2024 14:22

hf reviewed Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

hf reviewed Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

hf approved these changes Oct 10, 2024

View reviewed changes

fix: apply suggestions from code review

65dd494

Co-authored-by: Stojan Dimitrovski <[email protected]>

J0 commented Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

J0 commented Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

J0 commented Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

J0 commented Oct 10, 2024

View reviewed changes

internal/api/mfa.go Outdated Show resolved Hide resolved

J0 and others added 2 commits October 10, 2024 22:12

fix: use JSON field name instead

db392d9

Co-authored-by: Stojan Dimitrovski <[email protected]>

fix: update scan and value

a23b37d

J0 commented Oct 11, 2024

View reviewed changes

internal/models/factor.go Outdated Show resolved Hide resolved

J0 added 2 commits October 11, 2024 11:06

fix: correct db naming of aaguid

c077687

fix: update openapi spec

c753275

J0 merged commit 8cc2f0e into master Oct 11, 2024
2 checks passed

J0 deleted the j0/add_webauthn branch October 11, 2024 14:04

github-actions bot mentioned this pull request Oct 11, 2024

chore(master): release 2.163.0 #1794

Merged

feat: add MFA for WebAuthn #1775

feat: add MFA for WebAuthn #1775

Uh oh!

Conversation

J0 commented Sep 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

J0 commented Sep 28, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Sep 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 11293653315

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

J0 commented Oct 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

J0 commented Sep 18, 2024 •

edited

Loading

coveralls commented Sep 30, 2024 •

edited

Loading

J0 commented Oct 11, 2024 •

edited

Loading