fix: invalid challenge causes a query exception (#473)

asbiin · Feb 26, 2024 · 7199d4e · 7199d4e
1 parent d598f0f
commit 7199d4e
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 0 deletions.
diff --git a/src/Auth/EloquentWebAuthnProvider.php b/src/Auth/EloquentWebAuthnProvider.php
@@ -50,6 +50,7 @@ public function retrieveByCredentials(array $credentials): ?User
                 return $this->retrieveById($webauthnKey->user_id);
             } catch (ModelNotFoundException $e) {
                 // No result
+                return null;
             }
         }
 

diff --git a/tests/Unit/Auth/EloquentWebAuthnProviderTest.php b/tests/Unit/Auth/EloquentWebAuthnProviderTest.php
@@ -142,4 +142,29 @@ public function it_retrieve_user_new_format()
         $this->assertNotNull($result);
         $this->assertEquals($user->id, $result->id);
     }
+
+    /**
+     * @test
+     */
+    public function it_does_not_fail_when_retrieving_user()
+    {
+        Webauthn::shouldReceive('validateAssertion')->andReturn(true);
+        Webauthn::shouldReceive('model')->andReturn(WebauthnKey::class);
+
+        $provider = new EloquentWebAuthnProvider(
+            app('config'),
+            app(CredentialAssertionValidator::class),
+            app(Hasher::class),
+            User::class,
+        );
+
+        $result = $provider->retrieveByCredentials([
+            'id' => Base64UrlSafe::encode('id'),
+            'rawId' => 'rawId',
+            'type' => 'public-key',
+            'response' => 'response',
+        ]);
+
+        $this->assertNull($result);
+    }
 }