O postProcess(
+ O filter) {
+ filter.setAuthenticationSuccessHandler(new WebAuthnAuthenticationSuccessHandler(userDetailsService));
+ return filter;
+ }
+ }));
+ }
+
// Commenting this out to try adding /error to the unprotected URIs list instead
// @Bean
// public WebSecurityCustomizer webSecurityCustomizer() {
diff --git a/src/main/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementService.java b/src/main/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementService.java
new file mode 100644
index 0000000..893beca
--- /dev/null
+++ b/src/main/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementService.java
@@ -0,0 +1,142 @@
+package com.digitalsanctuary.spring.user.service;
+
+import java.util.List;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import com.digitalsanctuary.spring.user.dto.WebAuthnCredentialInfo;
+import com.digitalsanctuary.spring.user.exceptions.WebAuthnException;
+import com.digitalsanctuary.spring.user.persistence.model.User;
+import com.digitalsanctuary.spring.user.persistence.repository.WebAuthnCredentialQueryRepository;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Service for managing WebAuthn credentials.
+ *
+ *
+ * Handles credential listing, renaming, and deletion. It includes important safety features like last-credential
+ * protection to prevent users from being locked out of their accounts.
+ *
+ *
+ *
+ * Last-Credential Protection: The service prevents deletion of the last passkey if the user has no password,
+ * ensuring users always have a way to authenticate.
+ *
+ *
+ * @see WebAuthnCredentialQueryRepository
+ * @see WebAuthnException
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class WebAuthnCredentialManagementService {
+
+ private final WebAuthnCredentialQueryRepository credentialQueryRepository;
+
+ /**
+ * Get all credentials for a user.
+ *
+ * @param user the user to get credentials for
+ * @return list of credential information.
+ */
+ public List getUserCredentials(User user) {
+ return credentialQueryRepository.findCredentialsByUserId(user.getId());
+ }
+
+ /**
+ * Check if user has any passkeys.
+ *
+ * @param user the user to check
+ * @return true if user has at least one enabled passkey, false otherwise
+ */
+ public boolean hasCredentials(User user) {
+ return credentialQueryRepository.hasCredentials(user.getId());
+ }
+
+ /**
+ * Rename a credential label.
+ *
+ *
+ * Help users identify their passkeys (e.g., "My iPhone", "Work Laptop"). The label must be non-empty and no more than 255 characters.
+ *
+ *
+ * @param credentialId the credential ID to rename
+ * @param newLabel the new label
+ * @param user the user performing the operation
+ * @throws WebAuthnException if the credential is not found, access is denied, or the label is invalid
+ */
+ @Transactional
+ public void renameCredential(String credentialId, String newLabel, User user) throws WebAuthnException {
+ validateLabel(newLabel);
+
+ int updated = credentialQueryRepository.renameCredential(credentialId, newLabel, user.getId());
+
+ if (updated == 0) {
+ throw new WebAuthnException("Credential not found or access denied");
+ }
+
+ log.info("User {} renamed credential {}", user.getEmail(), credentialId);
+ }
+
+ /**
+ * Delete a credential with last-credential protection.
+ *
+ *
+ * Deletes a credential. This operation includes important safety logic:
+ *
+ *
+ * - If this is the user's last passkey AND the user has no password, deletion is blocked
+ * - This prevents users from being locked out of their accounts
+ * - Users must either add a password or register another passkey before deleting their last one
+ *
+ *
+ *
+ * Security: This method verifies that the credential belongs to the specified user before allowing deletion.
+ *
+ *
+ * @param credentialId the credential ID to delete
+ * @param user the user performing the operation
+ * @throws WebAuthnException if the credential is not found, access is denied, or deletion would lock out the user
+ */
+ @Transactional
+ public void deleteCredential(String credentialId, User user) throws WebAuthnException {
+ // Check if this is the last credential and user has no password
+ long enabledCount = credentialQueryRepository.countCredentials(user.getId());
+
+ if (enabledCount == 1 && (user.getPassword() == null || user.getPassword().isEmpty())) {
+ throw new WebAuthnException(
+ "Cannot delete last passkey. User would be locked out. " + "Please add a password or another passkey first.");
+ }
+
+ int updated = credentialQueryRepository.deleteCredential(credentialId, user.getId());
+
+ if (updated == 0) {
+ throw new WebAuthnException("Credential not found or access denied");
+ }
+
+ log.info("User {} deleted credential {}", user.getEmail(), credentialId);
+ }
+
+ /**
+ * Validate credential label.
+ *
+ *
+ * Ensures the label meets the following requirements:
+ *
+ *
+ * - Not null or empty (after trimming)
+ * - No more than 255 characters
+ *
+ *
+ * @param label the label to validate
+ * @throws WebAuthnException if the label is invalid
+ */
+ private void validateLabel(String label) throws WebAuthnException {
+ if (label == null || label.trim().isEmpty()) {
+ throw new WebAuthnException("Credential label cannot be empty");
+ }
+ if (label.length() > 255) {
+ throw new WebAuthnException("Credential label too long (max 255 characters)");
+ }
+ }
+}
diff --git a/src/test/java/com/digitalsanctuary/spring/user/api/WebAuthnManagementAPITest.java b/src/test/java/com/digitalsanctuary/spring/user/api/WebAuthnManagementAPITest.java
new file mode 100644
index 0000000..d3f6d34
--- /dev/null
+++ b/src/test/java/com/digitalsanctuary/spring/user/api/WebAuthnManagementAPITest.java
@@ -0,0 +1,222 @@
+package com.digitalsanctuary.spring.user.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.userdetails.UserDetails;
+import com.digitalsanctuary.spring.user.dto.WebAuthnCredentialInfo;
+import com.digitalsanctuary.spring.user.exceptions.WebAuthnException;
+import com.digitalsanctuary.spring.user.persistence.model.User;
+import com.digitalsanctuary.spring.user.service.UserService;
+import com.digitalsanctuary.spring.user.service.WebAuthnCredentialManagementService;
+import com.digitalsanctuary.spring.user.test.annotations.ServiceTest;
+import com.digitalsanctuary.spring.user.test.fixtures.TestFixtures;
+import com.digitalsanctuary.spring.user.util.GenericResponse;
+
+@ServiceTest
+@DisplayName("WebAuthnManagementAPI Tests")
+class WebAuthnManagementAPITest {
+
+ @Mock
+ private WebAuthnCredentialManagementService credentialManagementService;
+
+ @Mock
+ private UserService userService;
+
+ @Mock
+ private UserDetails userDetails;
+
+ @InjectMocks
+ private WebAuthnManagementAPI api;
+
+ private User testUser;
+
+ @BeforeEach
+ void setUp() {
+ testUser = TestFixtures.Users.standardUser();
+ when(userDetails.getUsername()).thenReturn(testUser.getEmail());
+ when(userService.findUserByEmail(testUser.getEmail())).thenReturn(testUser);
+ }
+
+ @Nested
+ @DisplayName("GET /user/webauthn/credentials")
+ class GetCredentialsTests {
+
+ @Test
+ @DisplayName("should return credentials for authenticated user")
+ void shouldReturnCredentials() {
+ // Given
+ WebAuthnCredentialInfo cred = WebAuthnCredentialInfo.builder().id("cred-1").label("My iPhone").created(Instant.now())
+ .build();
+
+ when(credentialManagementService.getUserCredentials(testUser)).thenReturn(List.of(cred));
+
+ // When
+ ResponseEntity> response = api.getCredentials(userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody()).hasSize(1);
+ assertThat(response.getBody().get(0).getLabel()).isEqualTo("My iPhone");
+ }
+
+ @Test
+ @DisplayName("should return empty list when no credentials")
+ void shouldReturnEmptyList() {
+ // Given
+ when(credentialManagementService.getUserCredentials(testUser)).thenReturn(Collections.emptyList());
+
+ // When
+ ResponseEntity> response = api.getCredentials(userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody()).isEmpty();
+ }
+
+ @Test
+ @DisplayName("should throw when user not found")
+ void shouldThrowWhenUserNotFound() {
+ // Given
+ when(userService.findUserByEmail(testUser.getEmail())).thenReturn(null);
+
+ // When/Then
+ try {
+ api.getCredentials(userDetails);
+ } catch (RuntimeException e) {
+ assertThat(e.getMessage()).isEqualTo("User not found");
+ }
+ }
+ }
+
+ @Nested
+ @DisplayName("GET /user/webauthn/has-credentials")
+ class HasCredentialsTests {
+
+ @Test
+ @DisplayName("should return true when user has credentials")
+ void shouldReturnTrue() {
+ // Given
+ when(credentialManagementService.hasCredentials(testUser)).thenReturn(true);
+
+ // When
+ ResponseEntity response = api.hasCredentials(userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody()).isTrue();
+ }
+
+ @Test
+ @DisplayName("should return false when user has no credentials")
+ void shouldReturnFalse() {
+ // Given
+ when(credentialManagementService.hasCredentials(testUser)).thenReturn(false);
+
+ // When
+ ResponseEntity response = api.hasCredentials(userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody()).isFalse();
+ }
+ }
+
+ @Nested
+ @DisplayName("PUT /user/webauthn/credentials/{id}/label")
+ class RenameCredentialTests {
+
+ @Test
+ @DisplayName("should rename credential successfully")
+ void shouldRenameSuccessfully() throws WebAuthnException {
+ // Given
+ WebAuthnManagementAPI.RenameCredentialRequest request = new WebAuthnManagementAPI.RenameCredentialRequest("Work Laptop");
+
+ // When
+ ResponseEntity response = api.renameCredential("cred-1", request, userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody().getMessage()).contains("renamed successfully");
+ verify(credentialManagementService).renameCredential("cred-1", "Work Laptop", testUser);
+ }
+
+ @Test
+ @DisplayName("should return bad request when rename fails")
+ void shouldReturnBadRequestOnFailure() throws WebAuthnException {
+ // Given
+ WebAuthnManagementAPI.RenameCredentialRequest request = new WebAuthnManagementAPI.RenameCredentialRequest("New Name");
+ doThrow(new WebAuthnException("Credential not found or access denied")).when(credentialManagementService)
+ .renameCredential(eq("cred-999"), eq("New Name"), any(User.class));
+
+ // When
+ ResponseEntity response = api.renameCredential("cred-999", request, userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
+ assertThat(response.getBody().getMessage()).contains("not found");
+ }
+ }
+
+ @Nested
+ @DisplayName("DELETE /user/webauthn/credentials/{id}")
+ class DeleteCredentialTests {
+
+ @Test
+ @DisplayName("should delete credential successfully")
+ void shouldDeleteSuccessfully() throws WebAuthnException {
+ // When
+ ResponseEntity response = api.deleteCredential("cred-1", userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+ assertThat(response.getBody().getMessage()).contains("deleted successfully");
+ verify(credentialManagementService).deleteCredential("cred-1", testUser);
+ }
+
+ @Test
+ @DisplayName("should return bad request when delete fails")
+ void shouldReturnBadRequestOnFailure() throws WebAuthnException {
+ // Given
+ doThrow(new WebAuthnException("Cannot delete last passkey")).when(credentialManagementService).deleteCredential(eq("cred-1"),
+ any(User.class));
+
+ // When
+ ResponseEntity response = api.deleteCredential("cred-1", userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
+ assertThat(response.getBody().getMessage()).contains("Cannot delete last passkey");
+ }
+
+ @Test
+ @DisplayName("should return bad request when user not found")
+ void shouldReturnBadRequestWhenUserNotFound() throws WebAuthnException {
+ // Given
+ when(userService.findUserByEmail(testUser.getEmail())).thenReturn(null);
+
+ // When
+ ResponseEntity response = api.deleteCredential("cred-1", userDetails);
+
+ // Then
+ assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
+ assertThat(response.getBody().getMessage()).contains("User not found");
+ verify(credentialManagementService, never()).deleteCredential(any(), any());
+ }
+ }
+}
diff --git a/src/test/java/com/digitalsanctuary/spring/user/persistence/repository/WebAuthnUserEntityBridgeTest.java b/src/test/java/com/digitalsanctuary/spring/user/persistence/repository/WebAuthnUserEntityBridgeTest.java
new file mode 100644
index 0000000..a4ac68f
--- /dev/null
+++ b/src/test/java/com/digitalsanctuary/spring/user/persistence/repository/WebAuthnUserEntityBridgeTest.java
@@ -0,0 +1,108 @@
+package com.digitalsanctuary.spring.user.persistence.repository;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.util.Optional;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.security.web.webauthn.api.PublicKeyCredentialUserEntity;
+import com.digitalsanctuary.spring.user.persistence.model.User;
+import com.digitalsanctuary.spring.user.test.annotations.ServiceTest;
+import com.digitalsanctuary.spring.user.test.fixtures.TestFixtures;
+
+@ServiceTest
+@DisplayName("WebAuthnUserEntityBridge Tests")
+class WebAuthnUserEntityBridgeTest {
+
+ @Mock
+ private JdbcTemplate jdbcTemplate;
+
+ @Mock
+ private UserRepository userRepository;
+
+ @Mock
+ private PublicKeyCredentialUserEntity existingEntity;
+
+ private WebAuthnUserEntityBridge bridge;
+
+ private User testUser;
+
+ @BeforeEach
+ void setUp() {
+ testUser = TestFixtures.Users.standardUser();
+ bridge = new WebAuthnUserEntityBridge(jdbcTemplate, userRepository);
+ }
+
+ @Nested
+ @DisplayName("Find By Username")
+ class FindByUsernameTests {
+
+ @Test
+ @DisplayName("should return null for null username")
+ void shouldReturnNullForNull() {
+ // When
+ PublicKeyCredentialUserEntity result = bridge.findByUsername(null);
+
+ // Then
+ assertThat(result).isNull();
+ }
+
+ @Test
+ @DisplayName("should return null for empty username")
+ void shouldReturnNullForEmpty() {
+ // When
+ PublicKeyCredentialUserEntity result = bridge.findByUsername("");
+
+ // Then
+ assertThat(result).isNull();
+ }
+
+ @Test
+ @DisplayName("should return null for anonymousUser")
+ void shouldReturnNullForAnonymousUser() {
+ // When
+ PublicKeyCredentialUserEntity result = bridge.findByUsername("anonymousUser");
+
+ // Then
+ assertThat(result).isNull();
+ }
+
+ @Test
+ @DisplayName("should return empty when no application user found")
+ void shouldReturnEmptyWhenNoUser() {
+ // Given
+ when(userRepository.findByEmail("unknown@test.com")).thenReturn(null);
+
+ // When
+ Optional result = bridge.findOptionalByUsername("unknown@test.com");
+
+ // Then
+ assertThat(result).isEmpty();
+ }
+ }
+
+ @Nested
+ @DisplayName("Create User Entity")
+ class CreateUserEntityTests {
+
+ @Test
+ @DisplayName("should create entity with correct name and display name")
+ void shouldCreateEntityWithCorrectFields() {
+ // When
+ PublicKeyCredentialUserEntity entity = bridge.createUserEntity(testUser);
+
+ // Then
+ assertThat(entity.getName()).isEqualTo(testUser.getEmail());
+ assertThat(entity.getDisplayName()).isEqualTo(testUser.getFullName());
+ assertThat(entity.getId()).isNotNull();
+ }
+ }
+}
diff --git a/src/test/java/com/digitalsanctuary/spring/user/security/WebAuthnAuthenticationSuccessHandlerTest.java b/src/test/java/com/digitalsanctuary/spring/user/security/WebAuthnAuthenticationSuccessHandlerTest.java
new file mode 100644
index 0000000..e25ad6b
--- /dev/null
+++ b/src/test/java/com/digitalsanctuary/spring/user/security/WebAuthnAuthenticationSuccessHandlerTest.java
@@ -0,0 +1,158 @@
+package com.digitalsanctuary.spring.user.security;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.util.Collection;
+import java.util.Set;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.webauthn.api.Bytes;
+import org.springframework.security.web.webauthn.api.ImmutablePublicKeyCredentialUserEntity;
+import org.springframework.security.web.webauthn.api.PublicKeyCredentialUserEntity;
+import org.springframework.security.web.webauthn.authentication.WebAuthnAuthentication;
+import com.digitalsanctuary.spring.user.persistence.model.User;
+import com.digitalsanctuary.spring.user.service.DSUserDetails;
+import com.digitalsanctuary.spring.user.test.annotations.ServiceTest;
+import com.digitalsanctuary.spring.user.test.fixtures.TestFixtures;
+
+@ServiceTest
+@DisplayName("WebAuthnAuthenticationSuccessHandler Tests")
+class WebAuthnAuthenticationSuccessHandlerTest {
+
+ @Mock
+ private UserDetailsService userDetailsService;
+
+ @Mock
+ private AuthenticationSuccessHandler delegate;
+
+ private WebAuthnAuthenticationSuccessHandler handler;
+
+ private MockHttpServletRequest request;
+ private MockHttpServletResponse response;
+ private User testUser;
+
+ @BeforeEach
+ void setUp() {
+ testUser = TestFixtures.Users.standardUser();
+ handler = new WebAuthnAuthenticationSuccessHandler(userDetailsService, delegate);
+ request = new MockHttpServletRequest();
+ response = new MockHttpServletResponse();
+ SecurityContextHolder.clearContext();
+ }
+
+ @Nested
+ @DisplayName("WebAuthn Authentication Conversion")
+ class WebAuthnConversionTests {
+
+ @Test
+ @DisplayName("should convert WebAuthn principal to DSUserDetails")
+ void shouldConvertWebAuthnPrincipalToDSUserDetails() throws Exception {
+ // Given
+ Collection authorities = Set.of(new SimpleGrantedAuthority("ROLE_USER"));
+ PublicKeyCredentialUserEntity userEntity = ImmutablePublicKeyCredentialUserEntity.builder()
+ .name(testUser.getEmail()).id(new Bytes(new byte[] {1, 2, 3})).displayName(testUser.getFullName()).build();
+
+ WebAuthnAuthentication webAuthnAuth = new WebAuthnAuthentication(userEntity, authorities);
+
+ DSUserDetails dsUserDetails = new DSUserDetails(testUser, authorities);
+ when(userDetailsService.loadUserByUsername(testUser.getEmail())).thenReturn(dsUserDetails);
+
+ // When
+ handler.onAuthenticationSuccess(request, response, webAuthnAuth);
+
+ // Then - delegate should be called with converted authentication
+ ArgumentCaptor authCaptor = ArgumentCaptor.forClass(Authentication.class);
+ verify(delegate).onAuthenticationSuccess(org.mockito.ArgumentMatchers.eq(request), org.mockito.ArgumentMatchers.eq(response),
+ authCaptor.capture());
+
+ Authentication convertedAuth = authCaptor.getValue();
+ assertThat(convertedAuth).isInstanceOf(UsernamePasswordAuthenticationToken.class);
+ assertThat(convertedAuth.getPrincipal()).isInstanceOf(DSUserDetails.class);
+ assertThat(((DSUserDetails) convertedAuth.getPrincipal()).getUser()).isEqualTo(testUser);
+ }
+
+ @Test
+ @DisplayName("should update SecurityContext with converted authentication")
+ void shouldUpdateSecurityContext() throws Exception {
+ // Given
+ Collection authorities = Set.of(new SimpleGrantedAuthority("ROLE_USER"));
+ PublicKeyCredentialUserEntity userEntity = ImmutablePublicKeyCredentialUserEntity.builder()
+ .name(testUser.getEmail()).id(new Bytes(new byte[] {1, 2, 3})).displayName(testUser.getFullName()).build();
+
+ WebAuthnAuthentication webAuthnAuth = new WebAuthnAuthentication(userEntity, authorities);
+
+ DSUserDetails dsUserDetails = new DSUserDetails(testUser, authorities);
+ when(userDetailsService.loadUserByUsername(testUser.getEmail())).thenReturn(dsUserDetails);
+
+ // When
+ handler.onAuthenticationSuccess(request, response, webAuthnAuth);
+
+ // Then - SecurityContext should have DSUserDetails as principal
+ Authentication contextAuth = SecurityContextHolder.getContext().getAuthentication();
+ assertThat(contextAuth.getPrincipal()).isInstanceOf(DSUserDetails.class);
+ assertThat(((DSUserDetails) contextAuth.getPrincipal()).getUser().getEmail()).isEqualTo(testUser.getEmail());
+ }
+
+ @Test
+ @DisplayName("should preserve authorities from WebAuthn authentication")
+ void shouldPreserveAuthorities() throws Exception {
+ // Given
+ Collection authorities = Set.of(new SimpleGrantedAuthority("ROLE_USER"),
+ new SimpleGrantedAuthority("ROLE_ADMIN"));
+ PublicKeyCredentialUserEntity userEntity = ImmutablePublicKeyCredentialUserEntity.builder()
+ .name(testUser.getEmail()).id(new Bytes(new byte[] {1, 2, 3})).displayName(testUser.getFullName()).build();
+
+ WebAuthnAuthentication webAuthnAuth = new WebAuthnAuthentication(userEntity, authorities);
+
+ DSUserDetails dsUserDetails = new DSUserDetails(testUser, authorities);
+ when(userDetailsService.loadUserByUsername(testUser.getEmail())).thenReturn(dsUserDetails);
+
+ // When
+ handler.onAuthenticationSuccess(request, response, webAuthnAuth);
+
+ // Then
+ ArgumentCaptor authCaptor = ArgumentCaptor.forClass(Authentication.class);
+ verify(delegate).onAuthenticationSuccess(org.mockito.ArgumentMatchers.any(), org.mockito.ArgumentMatchers.any(), authCaptor.capture());
+
+ Authentication convertedAuth = authCaptor.getValue();
+ assertThat(convertedAuth.getAuthorities()).hasSize(authorities.size());
+ assertThat(convertedAuth.getAuthorities().stream().map(GrantedAuthority::getAuthority).toList())
+ .containsExactlyInAnyOrder("ROLE_USER", "ROLE_ADMIN");
+ }
+ }
+
+ @Nested
+ @DisplayName("Non-WebAuthn Authentication")
+ class NonWebAuthnTests {
+
+ @Test
+ @DisplayName("should pass through non-WebAuthn authentication unchanged")
+ void shouldPassThroughNonWebAuthnAuth() throws Exception {
+ // Given
+ DSUserDetails dsUserDetails = new DSUserDetails(testUser);
+ UsernamePasswordAuthenticationToken formAuth = UsernamePasswordAuthenticationToken.authenticated(dsUserDetails, null,
+ Set.of(new SimpleGrantedAuthority("ROLE_USER")));
+
+ // When
+ handler.onAuthenticationSuccess(request, response, formAuth);
+
+ // Then - delegate should be called with original authentication
+ verify(delegate).onAuthenticationSuccess(request, response, formAuth);
+ }
+ }
+}
diff --git a/src/test/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementServiceTest.java b/src/test/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementServiceTest.java
new file mode 100644
index 0000000..717bc31
--- /dev/null
+++ b/src/test/java/com/digitalsanctuary/spring/user/service/WebAuthnCredentialManagementServiceTest.java
@@ -0,0 +1,253 @@
+package com.digitalsanctuary.spring.user.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import com.digitalsanctuary.spring.user.dto.WebAuthnCredentialInfo;
+import com.digitalsanctuary.spring.user.exceptions.WebAuthnException;
+import com.digitalsanctuary.spring.user.persistence.model.User;
+import com.digitalsanctuary.spring.user.persistence.repository.WebAuthnCredentialQueryRepository;
+import com.digitalsanctuary.spring.user.test.annotations.ServiceTest;
+import com.digitalsanctuary.spring.user.test.fixtures.TestFixtures;
+
+@ServiceTest
+@DisplayName("WebAuthnCredentialManagementService Tests")
+class WebAuthnCredentialManagementServiceTest {
+
+ @Mock
+ private WebAuthnCredentialQueryRepository credentialQueryRepository;
+
+ @InjectMocks
+ private WebAuthnCredentialManagementService service;
+
+ private User testUser;
+
+ @BeforeEach
+ void setUp() {
+ testUser = TestFixtures.Users.standardUser();
+ }
+
+ @Nested
+ @DisplayName("Get User Credentials")
+ class GetUserCredentialsTests {
+
+ @Test
+ @DisplayName("should return credentials for user")
+ void shouldReturnCredentialsForUser() {
+ // Given
+ WebAuthnCredentialInfo cred = WebAuthnCredentialInfo.builder().id("cred-123").label("My iPhone")
+ .created(Instant.now()).build();
+
+ when(credentialQueryRepository.findCredentialsByUserId(testUser.getId())).thenReturn(List.of(cred));
+
+ // When
+ List credentials = service.getUserCredentials(testUser);
+
+ // Then
+ assertThat(credentials).hasSize(1);
+ assertThat(credentials.get(0).getLabel()).isEqualTo("My iPhone");
+ assertThat(credentials.get(0).getId()).isEqualTo("cred-123");
+ verify(credentialQueryRepository).findCredentialsByUserId(testUser.getId());
+ }
+
+ @Test
+ @DisplayName("should return empty list when user has no credentials")
+ void shouldReturnEmptyListWhenNoCredentials() {
+ // Given
+ when(credentialQueryRepository.findCredentialsByUserId(testUser.getId())).thenReturn(Collections.emptyList());
+
+ // When
+ List credentials = service.getUserCredentials(testUser);
+
+ // Then
+ assertThat(credentials).isEmpty();
+ }
+ }
+
+ @Nested
+ @DisplayName("Has Credentials")
+ class HasCredentialsTests {
+
+ @Test
+ @DisplayName("should return true when user has credentials")
+ void shouldReturnTrueWhenHasCredentials() {
+ // Given
+ when(credentialQueryRepository.hasCredentials(testUser.getId())).thenReturn(true);
+
+ // When
+ boolean result = service.hasCredentials(testUser);
+
+ // Then
+ assertThat(result).isTrue();
+ }
+
+ @Test
+ @DisplayName("should return false when user has no credentials")
+ void shouldReturnFalseWhenNoCredentials() {
+ // Given
+ when(credentialQueryRepository.hasCredentials(testUser.getId())).thenReturn(false);
+
+ // When
+ boolean result = service.hasCredentials(testUser);
+
+ // Then
+ assertThat(result).isFalse();
+ }
+ }
+
+ @Nested
+ @DisplayName("Rename Credential")
+ class RenameCredentialTests {
+
+ @Test
+ @DisplayName("should rename credential successfully")
+ void shouldRenameCredentialSuccessfully() throws WebAuthnException {
+ // Given
+ when(credentialQueryRepository.renameCredential("cred-123", "Work Laptop", testUser.getId())).thenReturn(1);
+
+ // When
+ service.renameCredential("cred-123", "Work Laptop", testUser);
+
+ // Then
+ verify(credentialQueryRepository).renameCredential("cred-123", "Work Laptop", testUser.getId());
+ }
+
+ @Test
+ @DisplayName("should throw when credential not found")
+ void shouldThrowWhenCredentialNotFound() {
+ // Given
+ when(credentialQueryRepository.renameCredential("cred-999", "New Name", testUser.getId())).thenReturn(0);
+
+ // When/Then
+ assertThatThrownBy(() -> service.renameCredential("cred-999", "New Name", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("not found");
+ }
+
+ @Test
+ @DisplayName("should throw when label is null")
+ void shouldThrowWhenLabelIsNull() {
+ // When/Then
+ assertThatThrownBy(() -> service.renameCredential("cred-123", null, testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("cannot be empty");
+
+ verify(credentialQueryRepository, never()).renameCredential(anyString(), anyString(), anyLong());
+ }
+
+ @Test
+ @DisplayName("should throw when label is empty")
+ void shouldThrowWhenLabelIsEmpty() {
+ // When/Then
+ assertThatThrownBy(() -> service.renameCredential("cred-123", "", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("cannot be empty");
+
+ verify(credentialQueryRepository, never()).renameCredential(anyString(), anyString(), anyLong());
+ }
+
+ @Test
+ @DisplayName("should throw when label is blank")
+ void shouldThrowWhenLabelIsBlank() {
+ // When/Then
+ assertThatThrownBy(() -> service.renameCredential("cred-123", " ", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("cannot be empty");
+ }
+
+ @Test
+ @DisplayName("should throw when label exceeds 255 characters")
+ void shouldThrowWhenLabelTooLong() {
+ // Given
+ String longLabel = "a".repeat(256);
+
+ // When/Then
+ assertThatThrownBy(() -> service.renameCredential("cred-123", longLabel, testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("too long");
+
+ verify(credentialQueryRepository, never()).renameCredential(anyString(), anyString(), anyLong());
+ }
+ }
+
+ @Nested
+ @DisplayName("Delete Credential")
+ class DeleteCredentialTests {
+
+ @Test
+ @DisplayName("should delete credential when user has multiple passkeys")
+ void shouldDeleteWhenMultiplePasskeys() throws WebAuthnException {
+ // Given
+ when(credentialQueryRepository.countCredentials(testUser.getId())).thenReturn(2L);
+ when(credentialQueryRepository.deleteCredential("cred-123", testUser.getId())).thenReturn(1);
+
+ // When
+ service.deleteCredential("cred-123", testUser);
+
+ // Then
+ verify(credentialQueryRepository).deleteCredential("cred-123", testUser.getId());
+ }
+
+ @Test
+ @DisplayName("should delete last credential when user has a password")
+ void shouldDeleteLastCredentialWhenUserHasPassword() throws WebAuthnException {
+ // Given - user has password set (from TestFixtures)
+ when(credentialQueryRepository.countCredentials(testUser.getId())).thenReturn(1L);
+ when(credentialQueryRepository.deleteCredential("cred-123", testUser.getId())).thenReturn(1);
+
+ // When
+ service.deleteCredential("cred-123", testUser);
+
+ // Then
+ verify(credentialQueryRepository).deleteCredential("cred-123", testUser.getId());
+ }
+
+ @Test
+ @DisplayName("should block deletion of last passkey when user has no password")
+ void shouldBlockDeletionOfLastPasskeyWithoutPassword() {
+ // Given
+ testUser.setPassword(null);
+ when(credentialQueryRepository.countCredentials(testUser.getId())).thenReturn(1L);
+
+ // When/Then
+ assertThatThrownBy(() -> service.deleteCredential("cred-123", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("Cannot delete last passkey");
+
+ verify(credentialQueryRepository, never()).deleteCredential(anyString(), anyLong());
+ }
+
+ @Test
+ @DisplayName("should block deletion of last passkey when user has empty password")
+ void shouldBlockDeletionOfLastPasskeyWithEmptyPassword() {
+ // Given
+ testUser.setPassword("");
+ when(credentialQueryRepository.countCredentials(testUser.getId())).thenReturn(1L);
+
+ // When/Then
+ assertThatThrownBy(() -> service.deleteCredential("cred-123", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("Cannot delete last passkey");
+
+ verify(credentialQueryRepository, never()).deleteCredential(anyString(), anyLong());
+ }
+
+ @Test
+ @DisplayName("should throw when credential not found")
+ void shouldThrowWhenCredentialNotFound() {
+ // Given
+ when(credentialQueryRepository.countCredentials(testUser.getId())).thenReturn(2L);
+ when(credentialQueryRepository.deleteCredential("cred-999", testUser.getId())).thenReturn(0);
+
+ // When/Then
+ assertThatThrownBy(() -> service.deleteCredential("cred-999", testUser)).isInstanceOf(WebAuthnException.class)
+ .hasMessageContaining("not found");
+ }
+ }
+}
diff --git a/src/test/resources/application.properties b/src/test/resources/application.properties
index c3f0334..9c6e6f7 100644
--- a/src/test/resources/application.properties
+++ b/src/test/resources/application.properties
@@ -20,6 +20,9 @@ user.tokenService.expirationInMinutes=60
user.roles.default=ROLE_USER
user.audit.enabled=false
+# WebAuthn (Passkey) - disabled by default for tests
+user.webauthn.enabled=false
+
spring.datasource.driver-class-name=org.h2.Driver
spring.datasource.url=jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;MODE=MySQL