glasslock

Server-side WebAuthn/FIDO2 credential verification for Gleam.

Types

Credential

A verified WebAuthn credential returned after successful registration or authentication.

Persist every field after registration. After authentication, replace the stored sign_count with the value returned by authentication.verify. Pass id and transports to registration.exclude_credential or authentication.allow_credential when starting another ceremony.

pub type Credential {
  Credential(
    id: BitArray,
    public_key: PublicKey,
    sign_count: Int,
    transports: List(Transport),
  )
}

Constructors

```
Credential(
  id: BitArray,
  public_key: PublicKey,
  sign_count: Int,
  transports: List(Transport),
)
```
Arguments

id

Authenticator-generated identifier.

public_key

COSE public key used to verify assertions.

sign_count

Latest authenticator signature counter.

transports

Browser transport hints reported at registration.

CredentialDescriptor

</>

A reference to a stored credential, used in allow_credentials and exclude_credentials lists. Carrying transports is optional but lets the browser route the ceremony to the right authenticator faster.

pub type CredentialDescriptor {
  CredentialDescriptor(id: BitArray, transports: List(Transport))
}

Constructors

CredentialDescriptor(id: BitArray, transports: List(Transport))

PublicKey

opaque </>

A COSE-encoded public key.

Round-trip through storage with parse_public_key and encode_public_key.

pub opaque type PublicKey

PublicKeyError

</>

Errors returned by parse_public_key when stored bytes cannot be interpreted as a supported COSE public key.

pub type PublicKeyError {
  InvalidPublicKey(reason: String)
  UnsupportedPublicKey(reason: String)
}

Constructors

```
InvalidPublicKey(reason: String)
```
The bytes are not a valid COSE-encoded public key.
```
UnsupportedPublicKey(reason: String)
```
The key uses an algorithm or curve glasslock does not support.

Transport

</>

Transport hints reported by an authenticator during registration.

Echoed back to the browser in allow_credentials/exclude_credentials so it can route the request to the right authenticator. Optional for correctness; helpful for UX, especially with hybrid (cross-device) transports.

pub type Transport {
  TransportUsb
  TransportNfc
  TransportBle
  TransportSmartCard
  TransportHybrid
  TransportInternal
}

Constructors

```
TransportUsb
```
Removable USB authenticator.
```
TransportNfc
```
Near-field communication authenticator.
```
TransportBle
```
Bluetooth Low Energy authenticator.
```
TransportSmartCard
```
ISO/IEC 7816 smart card with contacts.
```
TransportHybrid
```
Cross-device authenticator (e.g. phone acting as a roaming key).
```
TransportInternal
```
Built-in platform authenticator (Touch ID, Windows Hello, etc.).

Verification

</>

User-verification policy for a ceremony.

pub type Verification {
  VerificationRequired
  VerificationPreferred
  VerificationDiscouraged
}

Constructors

```
VerificationRequired
```
Reject unless the authenticator verifies the user with a biometric or PIN.
```
VerificationPreferred
```
Request verification, but accept a response without it.
```
VerificationDiscouraged
```
Ask the authenticator to skip verification when possible.

VerificationField

</>

Identifies which field failed verification in a VerificationMismatch error.

pub type VerificationField {
  TypeField
  ChallengeField
  OriginField
  RelyingPartyIdField
  CrossOriginField
  TopOriginField
  CredentialIdField
  CredentialTypeField
  UserHandleField
}

Constructors

```
TypeField
```
The type field in clientDataJSON (expected "webauthn.create" or "webauthn.get").
```
ChallengeField
```
The challenge field in clientDataJSON did not match the expected challenge bytes.
```
OriginField
```
The origin field in clientDataJSON did not match the expected origin.
```
RelyingPartyIdField
```
The SHA-256 hash of the Relying Party ID did not match authenticator data.
```
CrossOriginField
```
The crossOrigin field was true but cross-origin requests are not allowed.
```
TopOriginField
```
The topOrigin field was either set without crossOrigin: true, or did not match any allowed top-level origin.
```
CredentialIdField
```
The rawId in the response did not match the credential ID in authenticator data.
```
CredentialTypeField
```
The top-level credential type field was not "public-key".
```
UserHandleField
```
The assertion userHandle was missing or did not match the account.

Values

encode_public_key

</>

pub fn encode_public_key(public_key: PublicKey) -> BitArray

Serialize a PublicKey to canonical public-only COSE bytes.

The returned bytes round-trip through parse_public_key. Use when persisting a credential to storage.

parse_public_key

</>

pub fn parse_public_key(
  bytes: BitArray,
) -> Result(PublicKey, PublicKeyError)

Parse stored COSE bytes into a PublicKey.

Validates the encoding, key type, curve, and signature algorithm. Use when loading a credential from storage before passing to authentication.verify.

Constructors

Arguments

Constructors

Constructors

Constructors

Constructors

Constructors