From 19b4835bea200099bae15bc02edd5e4cafa2c46c Mon Sep 17 00:00:00 2001
From: Joe Carstairs <jcarstairs@scottlogic.com>
Date: Mon, 22 Jan 2024 14:59:51 +0000
Subject: verifyRegistrationResponse is single-responsibility!

---
 api/auth/_verifyRegistrationResponse.ts | 15 +++++----------
 api/auth/registration.ts                | 14 ++++++++++++--
 2 files changed, 17 insertions(+), 12 deletions(-)

(limited to 'api/auth')

diff --git a/api/auth/_verifyRegistrationResponse.ts b/api/auth/_verifyRegistrationResponse.ts
index 66af079..350bf0b 100644
--- a/api/auth/_verifyRegistrationResponse.ts
+++ b/api/auth/_verifyRegistrationResponse.ts
@@ -4,8 +4,6 @@ import { type RegistrationResponseJSON } from '@simplewebauthn/server/script/dep
 
 import { verifyRegistrationResponse as innerVerifyRegistrationResponse } from '@simplewebauthn/server';
 import RELYING_PARTY from './_relyingParty';
-import addAuthenticator from '../db/_addAuthenticator';
-import addUser from '../db/_addUser';
 import env from '../_env';
 
 /**
@@ -14,14 +12,14 @@ import env from '../_env';
  * matches the expected challenge, which should be the most recent challenge
  * to be associated with the given user.
  *
- * If verification is successful, saves the new user and their new
- * authenticator to the database.
+ * If verification is successful, returns the authenticator object. Otherwise,
+ * returns null.
  */
 export default async function verifyRegistrationResponse(
   newUser: User,
   expectedChallenge: string,
   registrationResponse: RegistrationResponseJSON,
-): Promise<boolean> {
+): Promise<Authenticator | null> {
   const verification = await innerVerifyRegistrationResponse({
     response: registrationResponse,
     expectedChallenge,
@@ -34,7 +32,7 @@ export default async function verifyRegistrationResponse(
   });
 
   if (!verification.verified || !verification.registrationInfo) {
-    return false;
+    return null;
   }
 
   const authenticator: Authenticator = {
@@ -55,8 +53,5 @@ export default async function verifyRegistrationResponse(
     transports: verification.registrationInfo['transports'] ?? [],
   };
 
-  await addUser(newUser);
-  await addAuthenticator(authenticator);
-
-  return true;
+  return authenticator;
 }
diff --git a/api/auth/registration.ts b/api/auth/registration.ts
index d318d83..9f1c377 100644
--- a/api/auth/registration.ts
+++ b/api/auth/registration.ts
@@ -6,6 +6,9 @@ import verifyRegistrationResponse from './_verifyRegistrationResponse';
 import getUser from '../db/_getUser';
 import getCurrentChallenge from '../db/_getCurrentChallenge';
 import setCurrentChallenge from '../db/_setCurrentChallenge';
+import { getFirstQueryParam } from '../_getFirstQueryParam';
+import addUser from 'db/_addUser';
+import addAuthenticator from 'db/_addAuthenticator';
 
 /**
  * # registration
@@ -152,8 +155,15 @@ async function handlePost(request: VercelRequest): Promise<(r: VercelResponse) =
     );
   }
 
-  const isValid = await verifyRegistrationResponse(newUser, expectedChallenge, registrationResponse);
+  const authenticator = await verifyRegistrationResponse(newUser, expectedChallenge, registrationResponse);
+  const isVerified = !!authenticator;
+
+  if (isVerified) {
+    await addUser(newUser);
+    await addAuthenticator(authenticator);
+  }
+
   return (response) => void (
-    response.status(200).send(isValid ? 'true' : 'false')
+    response.status(200).send(isVerified ? 'true' : 'false')
   );
 }
-- 
cgit v1.2.3