ASP.NET Core パスキー認証を実装する② 登録APIを作る

using System.Security.Claims;
using System.Security.Cryptography;
using System.Text.Json;
using Fido2NetLib;
using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.WebUtilities;

[ApiController]
[Route("api/passkeys")]
[AutoValidateAntiforgeryToken]
[ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
public partial class PasskeysController : ControllerBase
{
    private const string FlowCookie = "__Host-passkey-flow";
    private readonly Fido2 fido2;
    private readonly IPasskeyStore store;

    public PasskeysController(Fido2 fido2, IPasskeyStore store)
    {
        this.fido2 = fido2;
        this.store = store;
    }

    private static string NewId() =>
        WebEncoders.Base64UrlEncode(RandomNumberGenerator.GetBytes(32));

    [AllowAnonymous]
    [HttpGet("csrf")]
    public IActionResult Csrf([FromServices] IAntiforgery antiforgery)
    {
        if (!Request.Cookies.ContainsKey(FlowCookie))
        {
            Response.Cookies.Append(FlowCookie, NewId(), new CookieOptions
            {
                HttpOnly = true,
                Secure = true,
                SameSite = SameSiteMode.Strict,
                Path = "/",
            });
        }
        return Ok(new { token = antiforgery.GetAndStoreTokens(HttpContext).RequestToken });
    }

    private string? BrowserId => Request.Cookies[FlowCookie];
    private string? CurrentUserId => User.FindFirstValue(ClaimTypes.NameIdentifier);

    private async Task<IActionResult> SaveOptionsAsync(
        string purpose, string? userId, string optionsJson, CancellationToken ct)
    {
        if (BrowserId is not { Length: > 0 } browserId)
            return BadRequest(new { message = "画面を更新してください。" });

        var id = NewId();
        await store.SaveChallengeAsync(new PasskeyChallenge(
            id, browserId, purpose, userId, optionsJson,
            DateTimeOffset.UtcNow.AddMinutes(5)), ct);
        using var document = JsonDocument.Parse(optionsJson);
        return Ok(new { flowId = id, publicKey = document.RootElement.Clone() });
    }

    private Task<PasskeyChallenge?> TakeAsync(
        string flowId, string purpose, CancellationToken ct) =>
        store.TakeChallengeAsync(flowId, BrowserId ?? "", purpose, ct);

    private IActionResult VerificationFailed() =>
        BadRequest(new { message = "認証を完了できませんでした。もう一度お試しください。" });
}

using System.ComponentModel.DataAnnotations;
using Fido2NetLib;
using Fido2NetLib.Objects;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

public sealed record RegisterFinishRequest(
    [property: Required] string FlowId,
    [property: Required] AuthenticatorAttestationRawResponse Credential);

public partial class PasskeysController
{
    [Authorize]
    [HttpPost("register/options")]
    public async Task<IActionResult> RegisterOptions(CancellationToken ct)
    {
        if (CurrentUserId is not { } userId) return Unauthorized();
        var user = await store.FindUserAsync(userId, ct);
        if (user is null || !user.IsActive) return Unauthorized();
        var saved = await store.ListAsync(user.Id, ct);
        var options = fido2.RequestNewCredential(new RequestNewCredentialParams
        {
            User = new Fido2User
            {
                Id = user.UserHandle,
                Name = user.DisplayName,
                DisplayName = user.DisplayName,
            },
            ExcludeCredentials = saved.Select(key =>
                new PublicKeyCredentialDescriptor(key.CredentialId)).ToArray(),
            AuthenticatorSelection = new AuthenticatorSelection
            {
                ResidentKey = ResidentKeyRequirement.Required,
                UserVerification = UserVerificationRequirement.Required,
            },
            AttestationPreference = AttestationConveyancePreference.None,
        });
        return await SaveOptionsAsync("register", user.Id, options.ToJson(), ct);
    }

    [Authorize]
    [HttpPost("register/finish")]
    public async Task<IActionResult> RegisterFinish(
        RegisterFinishRequest request, CancellationToken ct)
    {
        var challenge = await TakeAsync(request.FlowId, "register", ct);
        if (challenge is null || challenge.UserId != CurrentUserId)
            return VerificationFailed();
        var user = await store.FindUserAsync(challenge.UserId!, ct);
        if (user is null || !user.IsActive) return VerificationFailed();

        try
        {
            var result = await fido2.MakeNewCredentialAsync(new MakeNewCredentialParams
            {
                AttestationResponse = request.Credential,
                OriginalOptions = CredentialCreateOptions.FromJson(challenge.OptionsJson),
                IsCredentialIdUniqueToUserCallback = async (args, token) =>
                    await store.FindCredentialAsync(args.CredentialId, token) is null,
            }, ct);

            var added = await store.TryAddAsync(new SavedPasskey(
                result.Id, user.Id, result.PublicKey, result.SignCount,
                result.Transports, 0), ct);
            return added ? NoContent() : VerificationFailed();
        }
        catch (Fido2VerificationException)
        {
            return VerificationFailed();
        }
    }
}

INSERT INTO passkey
    (credential_id, user_id, public_key, sign_count, transports, version)
SELECT
    @credential_id, u.id, @public_key, @sign_count,
    CAST(@transports AS jsonb), 0
FROM app_user AS u
WHERE u.id = @user_id AND u.is_active = true
ON CONFLICT (credential_id) DO NOTHING
RETURNING credential_id;