Skip to content

Implement first step of cancellation: Stop all handler when one completes/fails #204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
msirringhaus wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Implement first step of cancellation: Stop all handler when one completes/fails #204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ba0cb37
Implement first step of cancellation: Stop all handler when one compl…
msirringhaus Aug 13, 2026
eb2a665
Make device selection cancellable
msirringhaus Aug 19, 2026
0226595
Make handle_events cancellable
msirringhaus Aug 19, 2026
a651ad9
Address feedback [1/2]: Remove pointless tests, use run_until_cancell…
msirringhaus Aug 24, 2026
38cc9e5
Address feedback [2/2]: Make test API deterministic
msirringhaus Aug 24, 2026
ca6847c
Add changelog entry
msirringhaus Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ run xdg-desktop-portal while we work on upstreaming the changes.
- daemon: Add support for CTAP2 hybrid over BLE behind a feature flag.
- daemon: Deduplicate USB state events emitted over D-Bus.
- daemon: Don't use hybrid when not available
- daemon: Cancel other transports, if one succeeded/failed
- ui: Add Georgian translations. (Thank you, @EkaterinePopova!)
- ui: Add a portal backend API to credentialsd-ui.
- ui: Allow setting client PIN during the flow when required.
Expand Down
6 changes: 3 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions credentialsd/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ ring = "=0.17.14"
serde_json = "=1.0.151"
tokio = { version = "=1.53.1", features = ["rt-multi-thread"] }
tokio-stream = "=0.1.19"
tokio-util = "=0.7.13"

[dev-dependencies]
gio = "=0.22.8"
Expand Down
118 changes: 62 additions & 56 deletions credentialsd/src/credential_service/hybrid.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,18 @@ use tokio::sync::{
broadcast,
mpsc::{self, Sender},
};
use tokio_util::sync::CancellationToken;
use tracing::{debug, error};

use libwebauthn::transport::cable::channel::{CableUpdate, CableUxUpdate};
use libwebauthn::transport::cable::qr_code_device::{
CableQrCodeDevice, CableTransports, QrCodeOperationHint,
};
use libwebauthn::transport::{Channel, ChannelSettings, Device};
use libwebauthn::webauthn::{WebAuthn, error::WebAuthnError};
use libwebauthn::{
proto::CtapError,
transport::cable::channel::{CableUpdate, CableUxUpdate},
};

use credentialsd_common::{
memfd::write_secret,
Expand All @@ -29,6 +33,7 @@ pub(crate) trait HybridHandler {
fn start(
&self,
request: &CredentialRequest,
cancellation: CancellationToken,
) -> impl Stream<Item = HybridEvent> + Unpin + Send + Sized + 'static;
}

Expand All @@ -44,6 +49,7 @@ impl HybridHandler for InternalHybridHandler {
fn start(
&self,
request: &CredentialRequest,
cancellation: CancellationToken,
) -> impl Stream<Item = HybridEvent> + Unpin + Send + Sized + 'static {
tracing::debug!("Starting hybrid operation");
let request = request.clone();
Expand Down Expand Up @@ -93,65 +99,65 @@ impl HybridHandler for InternalHybridHandler {
debug!("Reached end of Hybrid updates stream.");
});

tracing::debug!("Polling hybrid channel for updates.");
let response: Result<AuthenticatorResponse, Error> = loop {
match &request {
CredentialRequest::CreatePublicKeyCredentialRequest(make_request) => {
match channel.webauthn_make_credential(make_request).await {
Ok(response) => break Ok(response.into()),
Err(WebAuthnError::Ctap(ctap_error)) => {
if ctap_error.is_retryable_user_error() {
tracing::debug!(
"Retrying credential creation operation because of CTAP error: {:?}",
ctap_error
);
continue;
} else {
tracing::error!(
"Received CTAP unrecoverable CTAP error: {:?}",
ctap_error
);
break Err(Error::AuthenticatorError);
}
}
Err(err) => {
tracing::error!(
"Received unrecoverable error from authenticator: {:?}",
err
);
break Err(Error::AuthenticatorError);
}
};
let wait_for_response_fut = async {
loop {
let response: Result<AuthenticatorResponse, _> = match &request {
CredentialRequest::CreatePublicKeyCredentialRequest(make_request) => {
channel
.webauthn_make_credential(make_request)
.await
.map(|response| response.into())
}
CredentialRequest::GetPublicKeyCredentialRequest(get_request) => {
channel
.webauthn_get_assertion(get_request)
.await
.map(|response| response.into())
}
};
match response {
Ok(response) => {
tracing::debug!("Received credential from hybrid authenticator");
break Ok(response);
}
Err(WebAuthnError::Ctap(ctap_error))
if ctap_error.is_retryable_user_error() =>
{
tracing::debug!(%ctap_error, "Retrying WebAuthn operation");
continue;
}
Err(err) => {
tracing::error!(%err,
"Failed to make/get credential with hybrid authenticator"
);
break Err(err);
}
}
}
.map_err(|err| match err {
WebAuthnError::Ctap(CtapError::PINAuthBlocked) => {
Error::PinAttemptsExhausted
}
CredentialRequest::GetPublicKeyCredentialRequest(get_request) => {
match channel.webauthn_get_assertion(get_request).await {
Ok(response) => break Ok(response.into()),
Err(WebAuthnError::Ctap(ctap_error)) => {
if ctap_error.is_retryable_user_error() {
tracing::debug!(
"Retrying assertion operation because of CTAP error: {:?}",
ctap_error
);
continue;
} else {
tracing::error!(
"Received CTAP unrecoverable CTAP error: {:?}",
ctap_error
);
break Err(Error::AuthenticatorError);
}
}
Err(err) => {
tracing::error!(
"Received unrecoverable error from authenticator: {:?}",
err
);
break Err(Error::AuthenticatorError);
}
};
WebAuthnError::Ctap(CtapError::NoCredentials) => Error::NoCredentials,
WebAuthnError::Ctap(CtapError::CredentialExcluded) => {
Error::CredentialExcluded
}
_ => Error::AuthenticatorError,
})
};

tracing::debug!("Polling hybrid channel for updates.");
let response = match cancellation
.run_until_cancelled(wait_for_response_fut)
.await
{
Some(resp) => resp,
None => {
tracing::debug!("Hybrid handler cancelled, stopping processing");
Err(Error::Internal("Request cancelled".to_string()))
}
};

let terminal_state = match response {
Ok(auth_response) => HybridStateInternal::Completed(Box::new(auth_response)),
Err(_) => HybridStateInternal::Failed,
Expand Down
Loading