Emphasize that appid extensions do not usually need to be set explicitly

Author: emlun

webauthn-server-core/src/main/java/com/yubico/webauthn/data/AssertionExtensionInputs.java

@@ -93,6 +93,10 @@ public static class AssertionExtensionInputsBuilder {
     /**
      * The input to the FIDO AppID Extension (<code>appid</code>).
      *
+     * <p>You usually do not need to call this method explicitly; if {@link RelyingParty#getAppId()}
+     * is present, then {@link RelyingParty#startAssertion(StartAssertionOptions)} will enable this
+     * extension automatically.
+     *
      * <p>This extension allows WebAuthn Relying Parties that have previously registered a
      * credential using the legacy FIDO JavaScript APIs to request an assertion. The FIDO APIs use
      * an alternative identifier for Relying Parties called an <a
@@ -103,10 +107,6 @@ public static class AssertionExtensionInputsBuilder {
      * <p>This extension does not allow FIDO-compatible credentials to be created. Thus, credentials
      * created with WebAuthn are not backwards compatible with the FIDO JavaScript APIs.
      *
-     * <p>{@link RelyingParty#startAssertion(StartAssertionOptions)} sets this extension input
-     * automatically if the {@link RelyingParty.RelyingPartyBuilder#appId(Optional)} parameter is
-     * given when constructing the {@link RelyingParty} instance.
-     *
      * @see <a
      *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
      *     FIDO AppID Extension (appid)</a>
@@ -118,6 +118,10 @@ public AssertionExtensionInputsBuilder appid(@NonNull Optional<AppId> appid) {
     /**
      * The input to the FIDO AppID Extension (<code>appid</code>).
      *
+     * <p>You usually do not need to call this method explicitly; if {@link RelyingParty#getAppId()}
+     * is present, then {@link RelyingParty#startAssertion(StartAssertionOptions)} will enable this
+     * extension automatically.
+     *
      * <p>This extension allows WebAuthn Relying Parties that have previously registered a
      * credential using the legacy FIDO JavaScript APIs to request an assertion. The FIDO APIs use
      * an alternative identifier for Relying Parties called an <a
@@ -128,10 +132,6 @@ public AssertionExtensionInputsBuilder appid(@NonNull Optional<AppId> appid) {
      * <p>This extension does not allow FIDO-compatible credentials to be created. Thus, credentials
      * created with WebAuthn are not backwards compatible with the FIDO JavaScript APIs.
      *
-     * <p>{@link RelyingParty#startAssertion(StartAssertionOptions)} sets this extension input
-     * automatically if the {@link RelyingParty.RelyingPartyBuilder#appId(Optional)} parameter is
-     * given when constructing the {@link RelyingParty} instance.
-     *
      * @see <a
      *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
      *     FIDO AppID Extension (appid)</a>
@@ -191,10 +191,6 @@ private AssertionExtensionInputsBuilder uvm(Boolean uvm) {
    * <p>This extension does not allow FIDO-compatible credentials to be created. Thus, credentials
    * created with WebAuthn are not backwards compatible with the FIDO JavaScript APIs.
    *
-   * <p>{@link RelyingParty#startAssertion(StartAssertionOptions)} sets this extension input
-   * automatically if the {@link RelyingParty.RelyingPartyBuilder#appId(Optional)} parameter is
-   * given when constructing the {@link RelyingParty} instance.
-   *
    * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
    *     FIDO AppID Extension (appid)</a>
    */

webauthn-server-core/src/main/java/com/yubico/webauthn/data/RegistrationExtensionInputs.java

@@ -27,6 +27,8 @@
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.yubico.webauthn.RelyingParty;
+import com.yubico.webauthn.StartRegistrationOptions;
 import com.yubico.webauthn.extension.appid.AppId;
 import java.util.Collections;
 import java.util.HashSet;
@@ -158,6 +160,10 @@ public static class RegistrationExtensionInputsBuilder {
     /**
      * Enable or disable the FIDO AppID Exclusion Extension (<code>appidExclude</code>).
      *
+     * <p>You usually do not need to call this method explicitly; if {@link RelyingParty#getAppId()}
+     * is present, then {@link RelyingParty#startRegistration(StartRegistrationOptions)} will enable
+     * this extension automatically.
+     *
      * @see <a
      *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-exclude-extension">§10.2.
      *     FIDO AppID Exclusion Extension (appidExclude)</a>
@@ -170,6 +176,10 @@ public RegistrationExtensionInputsBuilder appidExclude(Optional<AppId> appidExcl
     /**
      * Enable the FIDO AppID Exclusion Extension (<code>appidExclude</code>).
      *
+     * <p>You usually do not need to call this method explicitly; if {@link RelyingParty#getAppId()}
+     * is present, then {@link RelyingParty#startRegistration(StartRegistrationOptions)} will enable
+     * this extension automatically.
+     *
      * @see <a
      *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-exclude-extension">§10.2.
      *     FIDO AppID Exclusion Extension (appidExclude)</a>