Repository: google/OpenSK
File: src/ctap/mod.rs (Rust)

Code before:
                Some(protocol) => {
                    if protocol != CtapState::<R, CheckUserPresence>::PIN_PROTOCOL_VERSION {
                        return Err(Ctap2StatusCode::CTAP2_ERR_PIN_AUTH_INVALID);
                    }
                }
                None => return Err(Ctap2StatusCode::CTAP2_ERR_MISSING_PARAMETER),
            }
        }

        let has_es_256 = pub_key_cred_params
            .iter()
            .any(|(credential_type, algorithm)| {
                // Even though there is only one type now, checking seems safer in
                // case of extension so you can't forget to update here.
                *credential_type == PublicKeyCredentialType::PublicKey
                    && *algorithm == SignatureAlgorithm::ES256 as i64
            });
        if !has_es_256 {
            return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_ALGORITHM);
        }

        let use_hmac_extension = if let Some(extensions) = extensions {
            extensions.has_make_credential_hmac_secret()?
        } else {
            false
        };
        if use_hmac_extension && !options.rk {
            // The extension is actually supported, but we need resident keys.
            return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION);
        }
        let cred_random = if use_hmac_extension {
            Some(self.rng.gen_uniform_u8x32().to_vec())
        } else {
            None
        };
        let ed_flag = if use_hmac_extension { ED_FLAG } else { 0 };

        let rp_id = rp.rp_id;
        if let Some(exclude_list) = exclude_list {
            for cred_desc in exclude_list {
                if self
                    .persistent_store
                    .find_credential(&rp_id, &cred_desc.key_id)
                    .is_some()
                {
                    // Perform this check, so bad actors can't brute force exclude_list
                    // without user interaction. Discard the user presence check's outcome.
                    let _ = (self.check_user_presence)(cid);
                    return Err(Ctap2StatusCode::CTAP2_ERR_CREDENTIAL_EXCLUDED);
                }
            }

Review comment (suggestion):
`extensions.map_or(false, |extensions| { ... })` would be more idiomatic. Alternatively:

```rust
match extensions {
  Some(...) => { ... }
  None => false
}
```

Code after:
                }
            }

            match pin_uv_auth_protocol {
                Some(protocol) => {
                    if protocol != CtapState::<R, CheckUserPresence>::PIN_PROTOCOL_VERSION {
                        return Err(Ctap2StatusCode::CTAP2_ERR_PIN_AUTH_INVALID);
                    }
                }
                None => return Err(Ctap2StatusCode::CTAP2_ERR_MISSING_PARAMETER),
            }
        }

        let has_es_256 = pub_key_cred_params
            .iter()
            .any(|(credential_type, algorithm)| {
                // Even though there is only one type now, checking seems safer in
                // case of extension so you can't forget to update here.
                *credential_type == PublicKeyCredentialType::PublicKey
                    && *algorithm == SignatureAlgorithm::ES256 as i64
            });
        if !has_es_256 {
            return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_ALGORITHM);
        }

        let use_hmac_extension =
            extensions.map_or(Ok(false), |e| e.has_make_credential_hmac_secret())?;
        if use_hmac_extension && !options.rk {
            // The extension is actually supported, but we need resident keys.
            return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION);
        }
        let cred_random = if use_hmac_extension {
            Some(self.rng.gen_uniform_u8x32().to_vec())
        } else {
            None
        };
        let ed_flag = if use_hmac_extension { ED_FLAG } else { 0 };

        let rp_id = rp.rp_id;
        if let Some(exclude_list) = exclude_list {
            for cred_desc in exclude_list {
                if self
                    .persistent_store
                    .find_credential(&rp_id, &cred_desc.key_id)
                    .is_some()
                {
                    // Perform this check, so bad actors can't brute force exclude_list
                    // without user interaction. Discard the user presence check's outcome.
                    let _ = (self.check_user_presence)(cid);
                    return Err(Ctap2StatusCode::CTAP2_ERR_CREDENTIAL_EXCLUDED);
                }