google / OpenSK / 39431419979

97%

2.1: 97%

push

github

Fixes UP in MakeCredential exclude_list (#813)

In `CtapState::process_make_credential`, matching a credential in
`exclude_list` unconditionally called `let _ = check_user_presence()`.
This caused two issues:

- If user presence was already satisfied via `pinUvAuthToken` or
  built-in UV, the authenticator still waited for another touch.
- Ignoring the return value of `check_user_presence` caused
  `CTAPHID_CANCEL` to return `CTAP2_ERR_CREDENTIAL_EXCLUDED` instead
  of `CTAP2_ERR_KEEPALIVE_CANCEL`.

We now only wait for user presence when `!self.has_valid_up(...)` and
propagate non-timeout errors:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#sctn-makeCred-authnr-alg

53 of 53 new or added lines in 1 file covered. (100.0%)

14220 of 14611 relevant lines covered (97.32%)

4099.43 hits per line