Changeset 271221 in webkit


Ignore:
Timestamp:
Jan 6, 2021 5:50:34 PM (3 years ago)
Author:
jiewen_tan@apple.com
Message:

[WebAuthn] Adopt new UI for the Client PIN and dismiss flow
​https://bugs.webkit.org/show_bug.cgi?id=219712
<rdar://problem/72154935>

Reviewed by Brent Fulgham.

Covered by manual tests.

This patch does the following few things:

  1. It tweaks the WebAuthn process as a UI view service to be able to run NearField in the background.
  2. It adopts new SPI for security keys' client pin support.
  3. It adopts new SPI to dismiss the UI when necessary.
  • Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:

(NS_ERROR_ENUM):
Adds new SPI.

  • Scripts/process-entitlements.sh:

Tweaks WebAuthn process for NFC.

  • UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.h:
  • UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.mm:

Paperwork.

  • UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h:
  • UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm:

(WebKit::AuthenticatorPresenterCoordinator::~AuthenticatorPresenterCoordinator):
(WebKit::AuthenticatorPresenterCoordinator::updatePresenter):
(WebKit::AuthenticatorPresenterCoordinator::requestPin):
(WebKit::AuthenticatorPresenterCoordinator::dimissPresenter):
(WebKit::AuthenticatorPresenterCoordinator::setPin):
Adopts new SPIs.

  • UIProcess/WebAuthentication/Cocoa/NfcService.mm:

(WebKit::NfcService::platformStartDiscovery):
Tweaks NFC.

  • UIProcess/WebAuthentication/Cocoa/WKASCAuthorizationPresenterDelegate.mm:

(-[WKASCAuthorizationPresenterDelegate authorizationPresenter:credentialRequestedForLoginChoice:authenticatedContext:completionHandler:]):
(-[WKASCAuthorizationPresenterDelegate authorizationPresenter:validateUserEnteredPIN:completionHandler:]):
Adopts new SPIs.

Location:
trunk/Source/WebKit
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r271219 r271221  
     12021-01-06  Jiewen Tan  <jiewen_tan@apple.com>
     2
     3        [WebAuthn] Adopt new UI for the Client PIN and dismiss flow
     4        https://bugs.webkit.org/show_bug.cgi?id=219712
     5        <rdar://problem/72154935>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Covered by manual tests.
     10
     11        This patch does the following few things:
     12        1. It tweaks the WebAuthn process as a UI view service to be able to run NearField in the background.
     13        2. It adopts new SPI for security keys' client pin support.
     14        3. It adopts new SPI to dismiss the UI when necessary.
     15
     16        * Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:
     17        (NS_ERROR_ENUM):
     18        Adds new SPI.
     19
     20        * Scripts/process-entitlements.sh:
     21        Tweaks WebAuthn process for NFC.
     22
     23        * UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.h:
     24        * UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.mm:
     25        Paperwork.
     26
     27        * UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h:
     28        * UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm:
     29        (WebKit::AuthenticatorPresenterCoordinator::~AuthenticatorPresenterCoordinator):
     30        (WebKit::AuthenticatorPresenterCoordinator::updatePresenter):
     31        (WebKit::AuthenticatorPresenterCoordinator::requestPin):
     32        (WebKit::AuthenticatorPresenterCoordinator::dimissPresenter):
     33        (WebKit::AuthenticatorPresenterCoordinator::setPin):
     34        Adopts new SPIs.
     35
     36        * UIProcess/WebAuthentication/Cocoa/NfcService.mm:
     37        (WebKit::NfcService::platformStartDiscovery):
     38        Tweaks NFC.
     39
     40        * UIProcess/WebAuthentication/Cocoa/WKASCAuthorizationPresenterDelegate.mm:
     41        (-[WKASCAuthorizationPresenterDelegate authorizationPresenter:credentialRequestedForLoginChoice:authenticatedContext:completionHandler:]):
     42        (-[WKASCAuthorizationPresenterDelegate authorizationPresenter:validateUserEnteredPIN:completionHandler:]):
     43        Adopts new SPIs.
     44
    1452021-01-06  Jer Noble  <jer.noble@apple.com>
    246

  • trunk/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h

    r270917 r271221  
    7272- (void)presentAuthorizationWithContext:(ASCAuthorizationPresentationContext *)context completionHandler:(void (^)(id<ASCCredentialProtocol> _Nullable, NSError * _Nullable))completionHandler;
    7373- (void)updateInterfaceWithLoginChoices:(NSArray<id <ASCLoginChoiceProtocol>> *)loginChoices;
     74- (void)presentPINEntryInterface;
     75- (void)dismissWithError:(nullable NSError *)error;
    7476
    7577@property (nonatomic, weak) id <ASCAuthorizationPresenterDelegate> delegate;
    … …  
    159161@end
    160162
     163extern NSErrorDomain const ASCAuthorizationErrorDomain;
     164
     165typedef NS_ERROR_ENUM(ASCAuthorizationErrorDomain, ASCAuthorizationError) {
     166    ASCAuthorizationErrorUnknown,
     167    ASCAuthorizationErrorFailed,
     168    ASCAuthorizationErrorUserCanceled,
     169    ASCAuthorizationErrorPINRequired,
     170};
     171
     172extern NSString * const ASCPINValidationResultKey;
     173
     174typedef NS_ENUM(NSInteger, ASCPINValidationResult) {
     175    ASCPINValidationResultPINBlocked,
     176    ASCPINValidationResultPINAuthBlocked,
     177    ASCPINValidationResultPINInvalid,
     178};
     179
    161180NS_ASSUME_NONNULL_END
    162181

  • trunk/Source/WebKit/Platform/spi/Cocoa/NearFieldSPI.h

    r260366 r271221  
    105105
    106106@interface NFHardwareManager : NSObject
    107 + (instancetype)sharedHardwareManager;
     107+ (instancetype)sharedHardwareManagerWithNoUI;
    108108- (NSObject<NFSession> *)startReaderSession:(void(^)(NFReaderSession *session, NSError *error))theStartCallback;
    109109- (BOOL)areFeaturesSupported:(NFFeature)featureMask outError:(NSError**)outError;

  • trunk/Source/WebKit/Scripts/process-entitlements.sh

    r270688 r271221  
    244244    plistbuddy Add :com.apple.nfcd.hwmanager bool YES
    245245    plistbuddy Add :com.apple.nfcd.session.reader.internal bool YES
     246    # FIXME(rdar://problem/72646664): Find a better way to invoke NearField in the background.
     247    plistbuddy Add :com.apple.internal.nfc.allow.backgrounded.session bool YES
     248    plistbuddy Add :com.apple.UIKit.vends-view-services bool YES
    246249
    247250    plistbuddy Add :keychain-access-groups array

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.h

    r270694 r271221  
    3939SOFT_LINK_CLASS_FOR_HEADER(WebKit, ASCAppleIDCredential);
    4040
     41SOFT_LINK_CONSTANT_FOR_HEADER(WebKit, AuthenticationServicesCore, ASCAuthorizationErrorDomain, NSErrorDomain);
     42#define ASCAuthorizationErrorDomain WebKit::get_AuthenticationServicesCore_ASCAuthorizationErrorDomain()
     43
     44SOFT_LINK_CONSTANT_FOR_HEADER(WebKit, AuthenticationServicesCore, ASCPINValidationResultKey, NSString*);
     45#define ASCPINValidationResultKey WebKit::get_AuthenticationServicesCore_ASCPINValidationResultKey()
     46
    4147#endif // HAVE(ASC_AUTH_UI)

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticationServicesCoreSoftLink.mm

    r270694 r271221  
    3939SOFT_LINK_CLASS_FOR_SOURCE(WebKit, AuthenticationServicesCore, ASCAppleIDCredential);
    4040
     41SOFT_LINK_CONSTANT_FOR_SOURCE(WebKit, AuthenticationServicesCore, ASCAuthorizationErrorDomain, NSErrorDomain);
     42SOFT_LINK_CONSTANT_FOR_SOURCE(WebKit, AuthenticationServicesCore, ASCPINValidationResultKey, NSString*);
     43
    4144#endif // HAVE(ASC_AUTH_UI)

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h

    r270730 r271221  
    3636#include <wtf/WeakPtr.h>
    3737
     38OBJC_CLASS ASCAppleIDCredential;
    3839OBJC_CLASS ASCAuthorizationPresentationContext;
    3940OBJC_CLASS ASCAuthorizationPresenter;
    4041OBJC_CLASS ASCLoginChoiceProtocol;
    4142OBJC_CLASS LAContext;
     43OBJC_CLASS NSError;
    4244OBJC_CLASS WKASCAuthorizationPresenterDelegate;
    4345
    … …  
    5153public:
    5254    using TransportSet = HashSet<WebCore::AuthenticatorTransport, WTF::IntHash<WebCore::AuthenticatorTransport>, WTF::StrongEnumHashTraits<WebCore::AuthenticatorTransport>>;
    53     using CredentialRequestHandler = Function<void()>;
     55    using CredentialRequestHandler = Function<void(ASCAppleIDCredential *, NSError *)>;
    5456
    5557    AuthenticatorPresenterCoordinator(const AuthenticatorManager&, const String& rpId, const TransportSet&, WebCore::ClientDataType);
    … …  
    6466    void setCredentialRequestHandler(CredentialRequestHandler&& handler) { m_credentialRequestHandler = WTFMove(handler); }
    6567    void setLAContext(LAContext *);
    66 
    6768    void didSelectAssertionResponse(ASCLoginChoiceProtocol *, LAContext *);
     69    void setPin(const String&);
    6870
    6971private:
    … …  
    8082    CompletionHandler<void(WebCore::AuthenticatorAssertionResponse*)> m_responseHandler;
    8183    HashMap<ASCLoginChoiceProtocol *, RefPtr<WebCore::AuthenticatorAssertionResponse>> m_credentials;
     84
     85    CompletionHandler<void(const String&)> m_pinHandler;
    8286};
    8387

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm

    r270730 r271221  
    8787    if (m_responseHandler)
    8888        m_responseHandler(nullptr);
    89 }
    90 
    91 void AuthenticatorPresenterCoordinator::updatePresenter(WebAuthenticationStatus)
    92 {
    93     // FIXME(219713): Adopt new UI for the update flow.
    94 }
    95 
    96 void AuthenticatorPresenterCoordinator::requestPin(uint64_t, CompletionHandler<void(const String&)>&&)
    97 {
    98     // FIXME(219712): Adopt new UI for the Client PIN flow.
     89    if (m_pinHandler)
     90        m_pinHandler(String());
     91}
     92
     93void AuthenticatorPresenterCoordinator::updatePresenter(WebAuthenticationStatus status)
     94{
     95#if HAVE(ASC_AUTH_UI)
     96    switch (status) {
     97    case WebAuthenticationStatus::PinBlocked: {
     98        auto error = adoptNS([[NSError alloc] initWithDomain:ASCAuthorizationErrorDomain code:ASCAuthorizationErrorPINRequired userInfo:@{ ASCPINValidationResultKey: @(ASCPINValidationResultPINBlocked) }]);
     99        m_credentialRequestHandler(nil, error.get());
     100        break;
     101    }
     102    case WebAuthenticationStatus::PinAuthBlocked: {
     103        auto error = adoptNS([[NSError alloc] initWithDomain:ASCAuthorizationErrorDomain code:ASCAuthorizationErrorPINRequired userInfo:@{ ASCPINValidationResultKey: @(ASCPINValidationResultPINAuthBlocked) }]);
     104        m_credentialRequestHandler(nil, error.get());
     105        break;
     106    }
     107    case WebAuthenticationStatus::PinInvalid: {
     108        auto error = adoptNS([[NSError alloc] initWithDomain:ASCAuthorizationErrorDomain code:ASCAuthorizationErrorPINRequired userInfo:@{ ASCPINValidationResultKey: @(ASCPINValidationResultPINInvalid) }]);
     109        m_credentialRequestHandler(nil, error.get());
     110        break;
     111    }
     112    default:
     113        // FIXME(219713): Adopt new UI for the update flow.
     114        break;
     115    }
     116#endif // HAVE(ASC_AUTH_UI)
     117}
     118
     119void AuthenticatorPresenterCoordinator::requestPin(uint64_t, CompletionHandler<void(const String&)>&& completionHandler)
     120{
     121#if HAVE(ASC_AUTH_UI)
     122    m_pinHandler = WTFMove(completionHandler);
     123    [m_presenter presentPINEntryInterface];
     124#endif // HAVE(ASC_AUTH_UI)
    99125}
    100126
    … …  
    157183void AuthenticatorPresenterCoordinator::dimissPresenter(WebAuthenticationResult result)
    158184{
     185#if HAVE(ASC_AUTH_UI)
    159186    if (result == WebAuthenticationResult::Succeeded && m_credentialRequestHandler) {
    160         m_credentialRequestHandler();
    161         return;
    162     }
    163     // FIXME(219716): Adopt new UI for the dismiss flow.
     187        // FIXME(219767): Replace the ASCAppleIDCredential with the upcoming WebAuthn credentials one.
     188        // This is just a place holder to tell the UI that the ceremony succeeds.
     189        m_credentialRequestHandler(adoptNS([WebKit::allocASCAppleIDCredentialInstance() initWithUser:@"" identityToken:adoptNS([[NSData alloc] init]).get()]).get(), nil);
     190        return;
     191    }
     192
     193    [m_presenter dismissWithError:nil];
     194#endif // HAVE(ASC_AUTH_UI)
    164195}
    165196
    … …  
    186217}
    187218
     219void AuthenticatorPresenterCoordinator::setPin(const String& pin)
     220{
     221    m_pinHandler(pin);
     222}
     223
    188224} // namespace WebKit
    189225

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/NfcService.mm

    r251762 r271221  
    5353{
    5454#if HAVE(NEAR_FIELD)
    55     return [[getNFHardwareManagerClass() sharedHardwareManager] areFeaturesSupported:NFFeatureReaderMode outError:nil];
     55    return [[getNFHardwareManagerClass() sharedHardwareManagerWithNoUI] areFeaturesSupported:NFFeatureReaderMode outError:nil];
    5656#else
    5757    return false;
    … …  
    119119        });
    120120    });
    121     [[getNFHardwareManagerClass() sharedHardwareManager] startReaderSession:callback.get()];
     121    [[getNFHardwareManagerClass() sharedHardwareManagerWithNoUI] startReaderSession:callback.get()];
    122122#endif // HAVE(NEAR_FIELD)
    123123}

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WKASCAuthorizationPresenterDelegate.mm

    r270730 r271221  
    4848- (void)authorizationPresenter:(ASCAuthorizationPresenter *)presenter credentialRequestedForLoginChoice:(id <ASCLoginChoiceProtocol>)loginChoice authenticatedContext:(nullable LAContext *)context completionHandler:(void (^)(id <ASCCredentialProtocol> _Nullable credential, NSError * _Nullable error))completionHandler
    4949{
    50     auto requestHandler = [completionHandler = makeBlockPtr(completionHandler)] {
    51         // FIXME(219767): Replace the ASCAppleIDCredential with the upcoming WebAuthn credentials one.
    52         // This is just a place holder to tell the UI that the ceremony succeeds.
    53         completionHandler(adoptNS([WebKit::allocASCAppleIDCredentialInstance() initWithUser:@"" identityToken:adoptNS([[NSData alloc] init]).get()]).get(), nil);
     50    auto requestHandler = [completionHandler = makeBlockPtr(completionHandler)] (ASCAppleIDCredential *credential, NSError *error) {
     51        completionHandler(credential, error);
    5452    };
    5553    [self dispatchCoordinatorCallback:[requestHandler = WTFMove(requestHandler)] (WebKit::AuthenticatorPresenterCoordinator& coordinator) mutable {
    … …  
    8886- (void)authorizationPresenter:(ASCAuthorizationPresenter *)presenter validateUserEnteredPIN:(NSString *)pin completionHandler:(void (^)(id <ASCCredentialProtocol> credential, NSError *error))completionHandler
    8987{
    90     // FIXME(219712): Adopt new UI for the Client PIN flow.
     88    auto requestHandler = [completionHandler = makeBlockPtr(completionHandler)] (ASCAppleIDCredential *credential, NSError *error) {
     89        completionHandler(credential, error);
     90    };
     91    [self dispatchCoordinatorCallback:[requestHandler = WTFMove(requestHandler)] (WebKit::AuthenticatorPresenterCoordinator& coordinator) mutable {
     92        coordinator.setCredentialRequestHandler(WTFMove(requestHandler));
     93    }];
     94
     95    String pinString = pin;
     96    [self dispatchCoordinatorCallback:[pinString = WTFMove(pinString)] (WebKit::AuthenticatorPresenterCoordinator& coordinator) mutable {
     97        coordinator.setPin(pinString);
     98    }];
    9199}
    92100
Note: See TracChangeset for help on using the changeset viewer.