rp_id: The WebAuthn Relying Party ID (domain), e.g. 'openacs.org' or 'login.example.com'; Must be a registrable domain / host that matches the site origin rules. after_successful_login_url: Where to redirect after login if no return_url exists in state. login_failure_url: Where to send users on failure if you don’t want to show debug output.

Testcases:

No testcase defined.

• ::webauthn::passkey origin
• ::webauthn::passkey return_err ?-status /value/? /error/ /detail/
• ::webauthn::passkey login_url ?-return_url /value/?
• ::webauthn::passkey reg ...
• ::webauthn::passkey name
• ::webauthn::passkey auth ...
• ::webauthn::passkey logout
• ::webauthn::passkey new_challenge ?nbytes?
• ::webauthn::passkey store
• ::webauthn::passkey pp ?-list? ?-prefix /value/? /dict/

Testcases:

No testcase defined.

Compatibility function with other external_registry objects

Switches:

-return_url (optional, defaults to "/")

Testcases:

No testcase defined.

Compatibility function with other external_registry objects

Testcases:

No testcase defined.

compatibility with xo::Authorize

Testcases:

No testcase defined.

Generate a new cryptographically strong random challenge. The challenge is generated using ns_crypto::randombytes and returned as a base64url-encoded string suitable for use in WebAuthn request/creation options.

Parameters:

nbytes (optional, defaults to "32")

Number of random bytes to generate before encoding (default: 32).

Testcases:

No testcase defined.

Returns the "origin" field provided to the attestation.

Testcases:

No testcase defined.

Return a JSON error response on the current connection.

Switches:

-status (optional, defaults to "400")

HTTP status code to use for the response (default: 400).

Parameters:

error (required)

Short, stable error code (machine-readable).

detail (required)

Human-readable error message suitable for display/logging.

Testcases:

No testcase defined.

Return the backing store used for pending WebAuthn state.

Testcases:

No testcase defined.

Verify a WebAuthn authentication response (assertion) against stored state. This method validates the incoming assertion from navigator.credentials.get(). It checks required fields, maps the presented credential ID to a stored credential (user_id + public key), and verifies the assertion using the pending authentication state (challenge, rpId, origin, etc.). If the credential is unknown, an error is raised. When the state contains a user_id (identifier-first flow), the error message is phrased as "no passkey for this account"; otherwise it is treated as an unknown credential in discovery mode.

Switches:

-st (optional)

Authentication state dict as created by /webauthn/auth/options or auth issue_options (challenge, rpId, origin, return_url, ...).

-req (optional)

Parsed client response dict containing the assertion fields, including id, clientDataJSON, authenticatorData, and signature.

Testcases:

No testcase defined.

Issue WebAuthn assertion options for starting a passkey login ceremony. Generates a fresh state nonce and challenge, stores the pending authentication ceremony state in the configured store (keyed by state), and returns a dict containing: - state: the nonce to be echoed back to /webauthn/auth/verify - options: PublicKeyCredentialRequestOptions for navigator.credentials.get()

Switches:

-return_url (optional, defaults to "/")

Local URL to redirect to after successful login (default: "/").

Testcases:

No testcase defined.

Verify a WebAuthn registration response (attestation) against stored state. This method validates the incoming credential creation response from navigator.credentials.create() for the current registration ceremony. It checks required fields, verifies the clientDataJSON (type, challenge, origin), decodes and parses the attestationObject (CBOR), and extracts credential data (credential ID and public key) for subsequent storage.

Switches:

-st (optional)

Registration state dict as created by /webauthn/reg/options (challenge, origin, return_url, user_id, ...).

-req (optional)

Parsed client response dict containing "response" fields, including clientDataJSON and attestationObject.

Testcases:

No testcase defined.

Helper for JSON endpoints with page-contract-like parameter validation. This procedure validates and normalizes request parameters according to 'query_specs#, using OpenACS page-contract filters via 'ad_page_contract_filter_invoke'. Parsed values are exported into the caller’s scope (via 'uplevel') so the endpoint can use them as normal Tcl variables. On validation failure, this procedure does not generate HTML complaint output. Instead, it returns a JSON error (HTTP 400) using [$auth_obj return_err], taking the first complaint message from 'ad_complaints_get_list', and aborts the script via 'ad_script_abort'.

Parameters:

docstring (required)

Human-readable endpoint documentation (currently unused by this helper; included to mirror 'ad_page_contract' call style and for future diagnostics/logging).

query_specs (required)

List of parameter specifications, like in 'ad_page_contract'

Returns:

The configured WebAuthn auth object (currently '::webauthn::passkey')

Partial Call Graph (max 5 caller/called nodes):

Testcases:

No testcase defined.