google / OpenSK / 39571022014

97%

2.1: 97%

push

github

Enforces allows_pin_protocol_v1 everywhere (#817)

* Enforces allows_pin_protocol_v1 everywhere

When `Customization::allows_pin_protocol_v1()` is `false`, PIN
protocol v1 was omitted from `authenticatorGetInfo` and rejected in
`authenticatorClientPin`, but was still accepted in other commands.

We now also check `allows_pin_protocol_v1()` in
`verify_pin_uv_auth_token`, `process_hmac_secret`, and
`pin_uv_auth_precheck` so `PinUvAuthProtocol::V1` is rejected with
`CTAP1_ERR_INVALID_PARAMETER` across all commands:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#op-makecred-step-preconditions

* Reuses check_pin_uv_auth_protocol in mod.rs

64 of 64 new or added lines in 6 files covered. (100.0%)

14429 of 14815 relevant lines covered (97.39%)

4043.31 hits per line