feat: webauthn: support discoverable credentials

go/api/openapi.yaml

@@ -1043,18 +1043,6 @@ components:
           example: [email protected]
           format: email
           type: string
-        userHandle:
-          description: User identifier for webauthn
-          example: 2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24
-          pattern: \b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b
-          type: string
-          x-go-type-import:
-            name: uuid
-            path: "github.com/google/uuid"
-          x-go-type: uuid.UUID
-      oneOf:
-        - required: [email]
-        - required: [userHandle]
 
     SignUpWebauthnRequest:
       type: object

go/controller/post_signin_webauthn.go

@@ -38,6 +38,17 @@ func webauthnCredentials(
 	return creds, nil
 }
 
+func (ctrl *Controller) postSigninWebauthnDiscoverableLogin( //nolint:ireturn
+	logger *slog.Logger,
+) (api.PostSigninWebauthnResponseObject, error) {
+	creation, apiErr := ctrl.Webauthn.BeginDiscoverableLogin(logger)
+	if apiErr != nil {
+		return ctrl.sendError(apiErr), nil
+	}
+
+	return api.PostSigninWebauthn200JSONResponse(creation.Response), nil
+}
+
 func (ctrl *Controller) PostSigninWebauthn( //nolint:ireturn
 	ctx context.Context,
 	request api.PostSigninWebauthnRequestObject,
@@ -49,16 +60,11 @@ func (ctrl *Controller) PostSigninWebauthn( //nolint:ireturn
 		return ctrl.sendError(ErrDisabledEndpoint), nil
 	}
 
-	var user sql.AuthUser
-	var apiErr *APIError
-	switch {
-	case request.Body.UserHandle != nil:
-		user, apiErr = ctrl.wf.GetUser(ctx, *request.Body.UserHandle, logger)
-	case request.Body.Email != nil:
-		user, apiErr = ctrl.wf.GetUserByEmail(ctx, string(*request.Body.Email), logger)
-	default:
-		return ctrl.sendError(ErrInvalidRequest), nil
+	if request.Body.Email == nil {
+		return ctrl.postSigninWebauthnDiscoverableLogin(logger)
 	}
+
+	user, apiErr := ctrl.wf.GetUserByEmail(ctx, string(*request.Body.Email), logger)
 	if apiErr != nil {
 		return ctrl.sendError(apiErr), nil
 	}
@@ -74,10 +80,11 @@ func (ctrl *Controller) PostSigninWebauthn( //nolint:ireturn
 	}
 
 	waUser := WebauthnUser{
-		ID:          user.ID,
-		Name:        user.DisplayName,
-		Email:       user.Email.String,
-		Credentials: creds,
+		ID:           user.ID,
+		Name:         user.DisplayName,
+		Email:        user.Email.String,
+		Credentials:  creds,
+		Discoverable: false,
 	}
 
 	creation, apiErr := ctrl.Webauthn.BeginLogin(waUser, logger)