KeychainMDIP / kc / 35111006541

96%

push

github

Enforce challenge ownership in verifyResponse (#1282)

* fix(keymaster): enforce challenge ownership

Require the challenge's current controller to match the active verifier
regardless of the publish option. Previously, only receipt generation
checked ownership, so publish: false accepted foreign-owned challenges.

Use one resolved document for ownership and credential requirements.
Preserve valid empty challenges and add regression coverage. Exact
login-challenge matching remains a separate application concern.

* test(python): verify as the challenge owner

6997 of 7398 branches covered (94.58%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

8680 of 8978 relevant lines covered (96.68%)

1676.32 hits per line