fix: activation WebAuthn impossible BUG-070 (rp_id/origines derives requete, challenges multiples)

backend/auth/router.py

@@ -576,18 +576,25 @@ class WebauthnRemoveRequest(BaseModel):
 
 
 @router.post("/mfa/webauthn/register/options")
-async def mfa_webauthn_register_options(current_user=Depends(require_auth)):
+async def mfa_webauthn_register_options(request: Request,
+                                        current_user=Depends(require_auth)):
     """Start WebAuthn key enrolment — returns publicKey creation options for the browser."""
-    from .webauthn_mfa import begin_registration
+    from .webauthn_mfa import begin_registration, resolve_relying_party
 
+    # BUG-070: rp_id/origins derive from the request (exact host incl. port)
+    # unless explicitly configured — the old localhost defaults rejected
+    # every real access URL ("Unexpected client data origin").
+    rp, _ = resolve_relying_party(request)
     options = begin_registration(current_user["username"],
-                                 current_user.get("display_name", ""))
+                                 current_user.get("display_name", ""),
+                                 rp_id_override=rp)
     return {"options": options}
 
 
 @router.post("/mfa/webauthn/register")
 async def mfa_webauthn_register(
     req: WebauthnRegisterRequest,
+    request: Request,
     current_user=Depends(require_auth),
 ):
     """Verify the created credential, store it, and enable MFA if not already on.
@@ -597,14 +604,17 @@ async def mfa_webauthn_register(
     from datetime import datetime, timezone
 
     from .user_store import get_user, update_user
-    from .webauthn_mfa import complete_registration
+    from .webauthn_mfa import complete_registration, resolve_relying_party
 
     user = get_user(current_user["username"])
     if user is None:
         raise HTTPException(404, "Utilisateur introuvable")
+    rp, origins = resolve_relying_party(request)
     try:
         record = complete_registration(current_user["username"], req.credential,
-                                       label=req.label)
+                                       label=req.label,
+                                       rp_id_override=rp,
+                                       origins_override=origins)
     except ValueError as e:
         raise HTTPException(400, str(e))
     except Exception as e:
@@ -683,7 +693,7 @@ async def mfa_webauthn_remove(
 
 
 @router.post("/mfa/webauthn/options")
-async def mfa_webauthn_login_options(body: dict = Body(...)):
+async def mfa_webauthn_login_options(request: Request, body: dict = Body(...)):
     """Unauthenticated: begin the login assertion for a user with registered keys.
 
     Enumeration-safe: always 200 — returns null options (caller falls back to
@@ -695,8 +705,9 @@ async def mfa_webauthn_login_options(body: dict = Body(...)):
     if not user or not user.get("mfa_enabled") or not creds:
         return {"mfa_method": "totp", "options": None}
 
-    from .webauthn_mfa import begin_authentication
-    options = begin_authentication(username, creds)
+    from .webauthn_mfa import begin_authentication, resolve_relying_party
+    rp, _ = resolve_relying_party(request)
+    options = begin_authentication(username, creds, rp_id_override=rp)
     if options is None:
         return {"mfa_method": "totp", "options": None}
     return {"mfa_method": "webauthn", "options": options}
@@ -710,7 +721,7 @@ async def mfa_webauthn_verify(
 ):
     """Unauthenticated: verify the WebAuthn assertion and issue JWT tokens."""
     from .user_store import get_user, update_user
-    from .webauthn_mfa import complete_authentication
+    from .webauthn_mfa import complete_authentication, resolve_relying_party
 
     client_ip = _enforce_mfa_rate_limit(request, body.username)
 
@@ -721,13 +732,16 @@ async def mfa_webauthn_verify(
     if not user.get("mfa_enabled"):
         raise HTTPException(400, "MFA non activé pour cet utilisateur")
 
+    rp, origins = resolve_relying_party(request)
     creds = user.get("webauthn_credentials", [])
     try:
         credential_id = body.credential.get("id", "")
         stored = next((c for c in creds if c.get("credential_id") == credential_id), None)
         if stored is None:
             raise ValueError("Credential non enregistré")
-        new_count = complete_authentication(body.username, body.credential, stored)
+        new_count = complete_authentication(body.username, body.credential, stored,
+                                            rp_id_override=rp,
+                                            origins_override=origins)
     except ValueError as e:
         _record_mfa_failure(client_ip, body.username)
         raise HTTPException(401, str(e))

backend/auth/webauthn_mfa.py

@@ -38,8 +38,16 @@ logger = logging.getLogger("obsigate.auth.webauthn")
 # Challenge lifetime: clients have 3 minutes to complete the ceremony.
 CHALLENGE_TTL_SECONDS = 180
 
-# In-memory pending challenges: key -> (challenge_bytes, expires_at)
-_pending: dict[str, tuple[bytes, float]] = {}
+# How many outstanding challenges to keep per key. BUG-070: a single slot made
+# the flow fragile — a double-click on "add key" (or any retry) overwrote the
+# pending challenge and the in-flight ceremony failed with
+# "Client data challenge was not expected challenge". The verifier now accepts
+# any recent challenge for the key.
+MAX_PENDING_PER_KEY = 5
+
+# In-memory pending challenges: key -> [(challenge_bytes, expires_at), ...]
+# (newest last)
+_pending: dict[str, list[tuple[bytes, float]]] = {}
 
 
 def rp_id() -> str:
@@ -55,24 +63,100 @@ def expected_origins() -> list[str]:
     return [o.strip() for o in raw.split(",") if o.strip()]
 
 
+def resolve_relying_party(request: Any = None) -> tuple[str, list[str]]:
+    """Resolve the WebAuthn (rp_id, expected_origins) for a ceremony.
+
+    BUG-070: the previous defaults (rp_id ``localhost``, origins
+    ``http://localhost``) rejected every real-world access URL — any port
+    (``http://localhost:2020``), ``127.0.0.1``, a LAN host or a public domain
+    failed verification with "Unexpected client data origin".
+
+    Explicit configuration still wins: when ``OBSIGATE_WEBAUTHN_RP_ID`` /
+    ``OBSIGATE_WEBAUTHN_ORIGINS`` are set they are used unchanged.  Otherwise
+    the values are derived from the incoming request (exact ``Host``, port
+    included, since the browser origin carries non-default ports).
+
+    Behind a reverse proxy the external host/proto come from
+    ``X-Forwarded-Host`` / ``X-Forwarded-Proto``, honored only when
+    ``OBSIGATE_TRUST_PROXY=true`` (same rule as ``get_client_ip``).
+    """
+    env_rp = os.environ.get("OBSIGATE_WEBAUTHN_RP_ID")
+    env_raw = os.environ.get("OBSIGATE_WEBAUTHN_ORIGINS")
+    if request is None:
+        return (env_rp or "localhost",
+                [o.strip() for o in env_raw.split(",") if o.strip()]
+                if env_raw else ["http://localhost"])
+
+    from backend.services.net import is_trusted_proxy
+
+    if is_trusted_proxy():
+        fwd_host = request.headers.get("x-forwarded-host", "")
+        host = fwd_host.split(",")[0].strip() or request.headers.get("host", "")
+        fwd_proto = request.headers.get("x-forwarded-proto", "")
+        scheme = fwd_proto.split(",")[0].strip() or request.url.scheme
+    else:
+        host = request.headers.get("host", "")
+        scheme = request.url.scheme
+    if not host:
+        url = request.url
+        host = url.netloc or url.hostname or ""
+        scheme = scheme or url.scheme or "http"
+    rp = env_rp or _hostname_only(host) or "localhost"
+    if env_raw:
+        origins = [o.strip() for o in env_raw.split(",") if o.strip()]
+    else:
+        origins = [f"{scheme or 'http'}://{host}"] if host else ["http://localhost"]
+    return rp, origins
+
+
+def _hostname_only(host: str) -> str:
+    """Strip the port (and IPv6 brackets) from a Host header value."""
+    host = host.strip()
+    if host.startswith("["):  # [::1]:8080 or [::1]
+        end = host.find("]")
+        return host[1:end] if end > 0 else host
+    if host.count(":") == 1:
+        name, _, port = host.partition(":")
+        return name if port.isdigit() else host
+    return host
+
+
 def _prune_expired() -> None:
     now = time.time()
-    for key in [k for k, (_, exp) in _pending.items() if exp < now]:
-        _pending.pop(key, None)
+    for key in list(_pending):
+        remaining = [(c, exp) for c, exp in _pending[key] if exp >= now]
+        if remaining:
+            _pending[key] = remaining
+        else:
+            _pending.pop(key, None)
 
 
 def _store_challenge(key: str) -> bytes:
     _prune_expired()
     challenge = secrets.token_bytes(32)
-    _pending[key] = (challenge, time.time() + CHALLENGE_TTL_SECONDS)
+    slot = _pending.setdefault(key, [])
+    slot.append((challenge, time.time() + CHALLENGE_TTL_SECONDS))
+    del slot[:-MAX_PENDING_PER_KEY]  # keep only the most recent ones
     return challenge
 
 
 def _take_challenge(key: str) -> bytes | None:
-    """Pop a challenge (single-use). Returns None if missing/expired."""
+    """Pop the newest challenge (single-use). Returns None if missing/expired."""
     _prune_expired()
-    entry = _pending.pop(key, None)
-    return entry[0] if entry else None
+    slot = _pending.get(key)
+    if not slot:
+        return None
+    challenge, _ = slot.pop()
+    if not slot:
+        _pending.pop(key, None)
+    return challenge
+
+
+def _take_all_challenges(key: str) -> list[bytes]:
+    """Pop every outstanding challenge for *key* (newest last)."""
+    _prune_expired()
+    slot = _pending.pop(key, None)
+    return [c for c, _ in slot] if slot else []
 
 
 def clear_pending(username: str) -> None:
@@ -83,9 +167,12 @@ def clear_pending(username: str) -> None:
 
 # ── Registration (enrol a key in settings) ─────────────────────────────
 
-def begin_registration(username: str, display_name: str) -> dict:
+def begin_registration(username: str, display_name: str,
+                       rp_id_override: str | None = None,
+                       origins_override: list[str] | None = None) -> dict:
+    _ = origins_override  # origins only matter at verification time
     options = generate_registration_options(
-        rp_id=rp_id(),
+        rp_id=rp_id_override or rp_id(),
         rp_name=rp_name(),
         user_name=username,
         user_display_name=display_name or username,
@@ -98,19 +185,44 @@ def begin_registration(username: str, display_name: str) -> dict:
     return _finalize_options(options)
 
 
-def complete_registration(username: str, credential_json: dict[str, Any],
-                          label: str = "") -> dict:
-    challenge = _take_challenge(f"{username}:register")
-    if challenge is None:
-        raise ValueError("Session d'enregistrement expirée — recommencez")
+def _verify_with_any_challenge(key: str, verify_one: Any, empty_message: str) -> Any:
+    """Run *verify_one(challenge)* against every outstanding challenge.
 
+    Returns the first success; re-raises the last error when all fail.
+    BUG-070: lets an in-flight ceremony survive a re-requested options call
+    (double-click / retry) that stored a newer challenge afterwards.
+    """
+    challenges = _take_all_challenges(key)
+    if not challenges:
+        raise ValueError(empty_message)
+    last_error: Exception | None = None
+    for challenge in challenges:
+        try:
+            return verify_one(challenge)
+        except Exception as e:  # try the next candidate challenge
+            last_error = e
+    assert last_error is not None
+    raise last_error
+
+
+def complete_registration(username: str, credential_json: dict[str, Any],
+                          label: str = "", rp_id_override: str | None = None,
+                          origins_override: list[str] | None = None) -> dict:
     credential = parse_registration_credential_json(credential_json)
-    verification = verify_registration_response(
-        credential=credential,
-        expected_challenge=challenge,
-        expected_rp_id=rp_id(),
-        expected_origin=expected_origins(),
-    )
+    effective_rp = rp_id_override or rp_id()
+    effective_origins = origins_override or expected_origins()
+
+    def _verify(challenge: bytes) -> Any:
+        return verify_registration_response(
+            credential=credential,
+            expected_challenge=challenge,
+            expected_rp_id=effective_rp,
+            expected_origin=effective_origins,
+        )
+
+    verification = _verify_with_any_challenge(
+        f"{username}:register", _verify,
+        "Session d'enregistrement expirée — recommencez")
 
     transports = credential.response.transports or []
     label = (label or str(credential_json.get("label") or "")).strip() or "Security key"
@@ -126,9 +238,12 @@ def complete_registration(username: str, credential_json: dict[str, Any],
 
 # ── Authentication (assertion at login) ────────────────────────────────
 
-def begin_authentication(username: str, credentials: list[dict]) -> dict | None:
+def begin_authentication(username: str, credentials: list[dict],
+                       rp_id_override: str | None = None,
+                       origins_override: list[str] | None = None) -> dict | None:
     if not credentials:
         return None
+    _ = origins_override  # origins only matter at verification time
     from webauthn.helpers.structs import PublicKeyCredentialDescriptor
 
     allow = [
@@ -136,7 +251,7 @@ def begin_authentication(username: str, credentials: list[dict]) -> dict | None:
         for c in credentials
     ]
     options = generate_authentication_options(
-        rp_id=rp_id(),
+        rp_id=rp_id_override or rp_id(),
         challenge=_store_challenge(f"{username}:login"),
         allow_credentials=allow,
     )
@@ -147,21 +262,27 @@ def complete_authentication(
     username: str,
     credential_json: dict[str, Any],
     stored: dict,
+    rp_id_override: str | None = None,
+    origins_override: list[str] | None = None,
 ) -> int:
-    """Verify an assertion. Returns the new sign_count. Raises ValueError on failure."""
-    challenge = _take_challenge(f"{username}:login")
-    if challenge is None:
-        raise ValueError("Session expirée — rechargez la page")
-
+    """Verify an assertion. Returns the new sign_count. Raises on failure."""
     credential = parse_authentication_credential_json(credential_json)
-    verification = verify_authentication_response(
-        credential=credential,
-        expected_challenge=challenge,
-        expected_rp_id=rp_id(),
-        expected_origin=expected_origins(),
-        credential_public_key=base64url_to_bytes(stored["public_key"]),
-        credential_current_sign_count=int(stored.get("sign_count", 0)),
-    )
+    effective_rp = rp_id_override or rp_id()
+    effective_origins = origins_override or expected_origins()
+
+    def _verify(challenge: bytes) -> Any:
+        return verify_authentication_response(
+            credential=credential,
+            expected_challenge=challenge,
+            expected_rp_id=effective_rp,
+            expected_origin=effective_origins,
+            credential_public_key=base64url_to_bytes(stored["public_key"]),
+            credential_current_sign_count=int(stored.get("sign_count", 0)),
+        )
+
+    verification = _verify_with_any_challenge(
+        f"{username}:login", _verify,
+        "Session expirée — rechargez la page")
     return int(verification.new_sign_count)