ASP.NET Core パスキー認証を実装する③ ログインAPIを作る

using System.ComponentModel.DataAnnotations;
using System.Security.Claims;
using Fido2NetLib;
using Fido2NetLib.Objects;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

public sealed record LoginFinishRequest(
    [property: Required] string FlowId,
    [property: Required] AuthenticatorAssertionRawResponse Credential);

public partial class PasskeysController
{
    [AllowAnonymous]
    [HttpPost("login/options")]
    public async Task<IActionResult> LoginOptions(CancellationToken ct)
    {
        var options = fido2.GetAssertionOptions(new GetAssertionOptionsParams
        {
            AllowedCredentials = Array.Empty<PublicKeyCredentialDescriptor>(),
            UserVerification = UserVerificationRequirement.Required,
        });
        return await SaveOptionsAsync("login", null, options.ToJson(), ct);
    }

    [AllowAnonymous]
    [HttpPost("login/finish")]
    public async Task<IActionResult> LoginFinish(
        LoginFinishRequest request, CancellationToken ct)
    {
        var challenge = await TakeAsync(request.FlowId, "login", ct);
        if (challenge is null) return VerificationFailed();

        var raw = request.Credential;
        if (raw.RawId is not { Length: > 0 } ||
            raw.Response?.UserHandle is not { Length: > 0 } handle)
            return VerificationFailed();
        var key = await store.FindCredentialAsync(raw.RawId, ct);
        if (key is null) return VerificationFailed();
        var user = await store.FindUserAsync(key.UserId, ct);
        if (user is null || !user.IsActive ||
            !handle.AsSpan().SequenceEqual(user.UserHandle))
            return VerificationFailed();

        try
        {
            var result = await fido2.MakeAssertionAsync(new MakeAssertionParams
            {
                AssertionResponse = raw,
                OriginalOptions = AssertionOptions.FromJson(challenge.OptionsJson),
                StoredPublicKey = key.PublicKey,
                StoredSignatureCounter = key.SignCount,
                IsUserHandleOwnerOfCredentialIdCallback = (args, token) =>
                    Task.FromResult(
                        args.CredentialId.AsSpan().SequenceEqual(key.CredentialId) &&
                        args.UserHandle is not null &&
                        args.UserHandle.AsSpan().SequenceEqual(user.UserHandle)),
            }, ct);

            if (!await store.TryUpdateCounterAsync(
                key.CredentialId, key.Version, result.SignCount, ct))
                return VerificationFailed();

            var identity = new ClaimsIdentity(new[]
            {
                new Claim(ClaimTypes.NameIdentifier, user.Id),
                new Claim(ClaimTypes.Name, user.DisplayName),
            }, CookieAuthenticationDefaults.AuthenticationScheme);
            await HttpContext.SignInAsync(
                CookieAuthenticationDefaults.AuthenticationScheme,
                new ClaimsPrincipal(identity),
                new AuthenticationProperties { IsPersistent = false });
            Response.Cookies.Delete(FlowCookie, new CookieOptions
            {
                Secure = true, HttpOnly = true, Path = "/",
            });
            return NoContent();
        }
        catch (Fido2VerificationException)
        {
            return VerificationFailed();
        }
    }
}

ブラウザーから返ったCredential ID
    ↓
サーバーに保存したパスキー
    ↓
パスキーの所有者である利用者

UPDATE passkey AS p
SET sign_count = @sign_count,
    version = p.version + 1
WHERE p.credential_id = @credential_id
  AND p.version = @expected_version
  AND EXISTS (
      SELECT 1 FROM app_user AS u
      WHERE u.id = p.user_id AND u.is_active = true
  )
RETURNING p.credential_id;