Fix parsing SupportedCtapOptions from empty JSON object

This commit was constructed through a series of steps:

Step 1: Add the new test "SupportedCtapOptions can be parsed from an empty JSON
object". It initially fails with:

```
true was not false
ScalaTestFailureLocation: com.yubico.fido.metadata.MetadataBlobSpec at (MetadataBlobSpec.scala:68)
org.scalatest.exceptions.TestFailedException: true was not false
	at org.scalatest.matchers.MatchersHelper$.indicateFailure(MatchersHelper.scala:392)
	at org.scalatest.matchers.should.Matchers$ShouldMethodHelperClass.shouldMatcher(Matchers.scala:7304)
	at org.scalatest.matchers.should.Matchers$AnyShouldWrapper.should(Matchers.scala:7347)
	at com.yubico.fido.metadata.MetadataBlobSpec.$anonfun$new$5(MetadataBlobSpec.scala:68)
```

At the line:

```
options.isUv should be(false)
```

This is because `SupportedCtapOptions` is still annotated with `@Jacksonized`,
so Jackson uses the builder to construct the object, and the class has

```
@Builder.Default boolean uv = false;
```

so the builder initializes the builder field to the primitive `false` value,
which causes the constructor argument to be `Boolean.FALSE`, which is not null,
and therefore the constructor sets `this.uv` to `true`.

Step 2: Remove `@Jacksonized` from `SupportedCtapOptions`. This causes Jackson
to invoke the constructor directly instead of going through the builder, which
bypasses the builder field defaults.

The test "SupportedCtapOptions can be parsed from an empty JSON object" now
fails with a different cause:

```
Cannot construct instance of `com.yubico.fido.metadata.SupportedCtapOptions`, problem: `java.lang.NullPointerException`
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 2]
com.fasterxml.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `com.yubico.fido.metadata.SupportedCtapOptions`, problem: `java.lang.NullPointerException`
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 2]
	at com.fasterxml.jackson.databind.exc.ValueInstantiationException.from(ValueInstantiationException.java:46)
        [...]
Caused by: java.lang.NullPointerException
	at com.yubico.fido.metadata.SupportedCtapOptions.<init>(SupportedCtapOptions.java:180)
        [...]
```

which is the line:

```
this.plat = plat;
```

The test "FIDO Metadata Service 3 blob payloads are structurally identical after
multiple (de)serialization round-trips." also begins failing now.

Step 3: Use `Boolean.TRUE.equals(...)` to fix `NullPointerException`s while
setting `plat`, `rk` and `up` in `SupportedCtapOptions` constructor.

The test "SupportedCtapOptions can be parsed from an empty JSON object" now
passes. Instead the test "FIDO Metadata Service 3 blob payloads are structurally
identical after multiple (de)serialization round-trips" now fails. This is why
we added the test in the previous commit, to get a more focused view of this
failure. This failure is:

```
TestFailedException was thrown during property evaluation.
  Message: SupportedCtapOptions(plat=false, rk=true, clientPin=true, up=true, uv=true, pinUvAuthToken=false, noMcGaPermissionsWithClientPin=false, largeBlobs=false, ep=true, bioEnroll=true, userVerificationMgmtPreview=true, uvBioEnroll=false, authnrCfg=false, uvAcfg=false, credMgmt=false, credentialMgmtPreview=false, setMinPINLength=false, makeCredUvNotRqd=false, alwaysUv=true) did not equal SupportedCtapOptions(plat=false, rk=true, clientPin=true, up=true, uv=true, pinUvAuthToken=false, noMcGaPermissionsWithClientPin=false, largeBlobs=false, ep=false, bioEnroll=false, userVerificationMgmtPreview=false, uvBioEnroll=false, authnrCfg=false, uvAcfg=false, credMgmt=false, credentialMgmtPreview=false, setMinPINLength=false, makeCredUvNotRqd=false, alwaysUv=false)
  Location: (MetadataBlobSpec.scala:108)
  Occurred when passed generated values (
    arg0 = SupportedCtapOptions(plat=false, rk=true, clientPin=true, up=true, uv=true, pinUvAuthToken=false, noMcGaPermissionsWithClientPin=false, largeBlobs=false, ep=false, bioEnroll=false, userVerificationMgmtPreview=false, uvBioEnroll=false, authnrCfg=false, uvAcfg=false, credMgmt=false, credentialMgmtPreview=false, setMinPINLength=false, makeCredUvNotRqd=false, alwaysUv=false)
  )
```

This is because the constructor sets some of the the tri-state inputs to `true`
when non-null, including when `false`. This means that when the input is
absent (null), it is set to `false` and then emitted as `false` when serialized
back to JSON, which is then interpreted as non-null and converted to `true` when
deserializing again.

Step 4: Add `@JsonInclude` directives to omit the tri-state fields that are
true-when-non-null when their value is false.

All tests now pass!

Author: emlun

webauthn-server-attestation/src/main/java/com/yubico/fido/metadata/SupportedCtapOptions.java

@@ -2,10 +2,10 @@
 
 import com.fasterxml.jackson.annotation.JsonAlias;
 import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import lombok.Builder;
 import lombok.Value;
-import lombok.extern.jackson.Jacksonized;
 
 /**
  * A fixed-keys map of CTAP2 option names to Boolean values representing whether an authenticator
@@ -17,7 +17,6 @@
  */
 @Value
 @Builder
-@Jacksonized
 public class SupportedCtapOptions {
 
   /**
@@ -39,7 +38,9 @@ public class SupportedCtapOptions {
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean clientPin = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean clientPin = false;
 
   /**
    * @see <a
@@ -53,7 +54,9 @@ public class SupportedCtapOptions {
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean uv = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean uv = false;
 
   /**
    * @see <a
@@ -83,21 +86,27 @@ public class SupportedCtapOptions {
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean ep = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean ep = false;
 
   /**
    * @see <a
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean bioEnroll = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean bioEnroll = false;
 
   /**
    * @see <a
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean userVerificationMgmtPreview = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean userVerificationMgmtPreview = false;
 
   /**
    * @see <a
@@ -134,7 +143,9 @@ public class SupportedCtapOptions {
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean credentialMgmtPreview = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean credentialMgmtPreview = false;
 
   /**
    * @see <a
@@ -155,7 +166,9 @@ public class SupportedCtapOptions {
    *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
    *     to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
    */
-  @Builder.Default boolean alwaysUv = false;
+  @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+  @Builder.Default
+  boolean alwaysUv = false;
 
   @JsonCreator
   private SupportedCtapOptions(
@@ -178,10 +191,10 @@ private SupportedCtapOptions(
       @JsonProperty("setMinPINLength") Boolean setMinPINLength,
       @JsonProperty("makeCredUvNotRqd") Boolean makeCredUvNotRqd,
       @JsonProperty("alwaysUv") Boolean alwaysUv) {
-    this.plat = plat;
-    this.rk = rk;
+    this.plat = Boolean.TRUE.equals(plat);
+    this.rk = Boolean.TRUE.equals(rk);
     this.clientPin = clientPin != null;
-    this.up = up;
+    this.up = Boolean.TRUE.equals(up);
     this.uv = uv != null;
     this.pinUvAuthToken = Boolean.TRUE.equals(pinUvAuthToken);
     this.noMcGaPermissionsWithClientPin = Boolean.TRUE.equals(noMcGaPermissionsWithClientPin);

webauthn-server-attestation/src/test/scala/com/yubico/fido/metadata/MetadataBlobSpec.scala

@@ -57,6 +57,31 @@ class MetadataBlobSpec
   }
 
   describe("SupportedCtapOptions") {
+    it("can be parsed from an empty JSON object.") {
+      val options = JacksonCodecs
+        .json()
+        .readValue("{}", classOf[SupportedCtapOptions])
+      options should not be null
+      options.isPlat should be(false)
+      options.isRk should be(false)
+      options.isUp should be(false)
+      options.isUv should be(false)
+      options.isPinUvAuthToken should be(false)
+      options.isNoMcGaPermissionsWithClientPin should be(false)
+      options.isLargeBlobs should be(false)
+      options.isEp should be(false)
+      options.isBioEnroll should be(false)
+      options.isUserVerificationMgmtPreview should be(false)
+      options.isUvBioEnroll should be(false)
+      options.isAuthnrCfg should be(false)
+      options.isUvAcfg should be(false)
+      options.isCredMgmt should be(false)
+      options.isCredentialMgmtPreview should be(false)
+      options.isSetMinPINLength should be(false)
+      options.isMakeCredUvNotRqd should be(false)
+      options.isAlwaysUv should be(false)
+    }
+
     it(
       "are structurally identical after multiple (de)serialization round-trips."
     ) {