google / OpenSK / 39582045796

97%

2.1: 97%

push

github

Fixes built-in UV precondition checks (#818)

Before, built-in user verification did not check all preconditions
required by the CTAP specification:

- `MakeCredential` and `GetAssertion` with `uv` set did not verify
  that at least one fingerprint is enrolled before starting UV.
- `perform_built_in_uv` was still allowed when the PIN was blocked
  (`pin_retries == 0`).
- `getPinUvAuthTokenUsingUvWithPermissions` did not reject requests
  early when `uv_retries == 0` or when no fingerprints are enrolled.

We now check these preconditions and return the expected status codes:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authnrClientPin-puaprot-util-builtinuv

28 of 29 new or added lines in 3 files covered. (96.55%)

14457 of 14843 relevant lines covered (97.4%)

4035.82 hits per line