[Browser MFA] Split validation out of Finish function

[danielashare]

This PR extracts the validation logic out of the WebAuthn finish function. This allows the Browser MFA flow to validate a WebAuthn response it gets from the browser before sending it to tsh to be consumed. The RFD for this addition can be found here.

Manual tests:

• Login with Passkey
• Login with TouchID
• Login with YubiKey
• Passwordless with Passkey
• Passwordless with TouchID
• Passwordless with YubiKey

[codingllama]

I appreciate the small, focused PR. Thanks!

This doesn't need to depend on danielashare/browser-mfa-proto - if you drop those commits it can land on its own.

[codingllama]

Suggested change

	// validateOnly validates an MFA response without consuming it
	func (f *loginFlow) validateOnly(ctx context.Context, user string, resp *wantypes.CredentialAssertionResponse, requiredExtensions *mfav1.ChallengeExtensions) error {
	func (f *loginFlow) validate(ctx context.Context, user string, resp *wantypes.CredentialAssertionResponse, requiredExtensions *mfav1.ChallengeExtensions) error {

So it matches the public method? A godoc becomes less pressing in the private method when there is parity too, IMO.

Or, better yet, remove it completely - see #63978 (comment).

[codingllama]

I'm not convinced all of validateMFAResponseInternal/finish/validateOnly need to exist at a private API level, nor about mfaValidationResult existing and holding so much "private" state of the finish logic.

We could add a "validateOnly bool" to the private finish func and just use that accordingly via public APIs.

// finish implements both LoginFlow.Finish and LoginFlow.Validate.
// If validateOnly is set then updates to the device and session data are
// skipped.
func (f *loginFlow) finish(
	ctx context.Context,
	user string,
	resp *wantypes.CredentialAssertionResponse,
	requiredExtensions *mfav1.ChallengeExtensions,
	validateOnly bool,
) (*LoginData, error) {
 // (...)
}

[codingllama]

This is the same as TestLoginFlow_BeginFinish, correct? Could we reuse the setup somehow?

A way we could do it is to incorporate Validate into TestLoginFlow_BeginFinish itself, for example by having t.Run variations that call/don't call Validate in the flow.

Eg:

func TestLoginFlow_BeginFinish(t *testing.T) {
	// (...)
	for _, test := range tests {
		runTest := func(t *testing.T, validate bool) {
			t.Parallel()

			identity := test.identity.clone()
			// (continue until Finish)

			if validate {
				// Test for validate here, or pass on to a "testLoginFlowValidate" function.
				// Avoid Fatal-ing the test in simple assertions so it continues to Finish.
			}

			// (continue onto Finish)
		}

		t.Run(test.name+"/Finish", func(t *testing.T) { runTest(t, false) })
		t.Run(test.name+"/ValidateThenFinish", func(t *testing.T) { runTest(t, false) })
	}
}

[codingllama]

Similarly, should we piggy back this onto TestLoginFlow_Finish_errors? That's even simpler with "createResp" being a func.

[codingllama]

Suggestion: loop:

	for range 2 {
		// Validate won't consume the session.
		err = webLogin.Validate(ctx, user, assertionResp, &mfav1.ChallengeExtensions{
			Scope:      mfav1.ChallengeScope_CHALLENGE_SCOPE_ADMIN_ACTION,
			AllowReuse: mfav1.ChallengeAllowReuse_CHALLENGE_ALLOW_REUSE_YES,
		})
		require.NoError(t, err)
	}
	// Session data still exists.
	require.NotEmpty(t, webIdentity.SessionData, "Session should not be consumed by Validate")

Same for Finish.

[codingllama]

Is this test covering a meaningful scenario?

Is a reusable session any different from a "normal" one? Do we expect multiple Validate calls for a reusable session?