Skip to content

Commit 2e58c0f

Browse files
nsatragnonsatragno
committed
wip: Conditional UI + autofill specification.
1 parent b1454fc commit 2e58c0f

File tree

1 file changed

+140
-81
lines changed

1 file changed

+140
-81
lines changed

‎index.bs‎

Lines changed: 140 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,11 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
164164
text: opaque origin; url: concept-origin-opaque
165165
text: tuple origin; url: concept-origin-tuple
166166
text: document.domain; url:dom-document-domain
167+
urlPrefix: input.html
168+
text: input; url: the-input-element
169+
urlPrefix: form-control-infrastructure
170+
text: autocomplete; url: attr-fe-autocomplete
171+
text: autofill hint set; url: autofill-hint-set
167172

168173
spec: url; urlPrefix: https://url.spec.whatwg.org
169174
type: dfn
@@ -304,6 +309,7 @@ spec: BCP47; urlPrefix: https://tools.ietf.org/html/bcp47
304309
<pre class="link-defaults">
305310
spec:credential-management; type:dfn; text:credentials
306311
spec:html; type:dfn; for:environment settings object; text:global object
312+
spec:html; type:dfn; for:input; text:autocomplete
307313
spec:infra; type:dfn; for:/; text:set
308314
spec:infra; type:dfn; text:list
309315
spec:infra; type:dfn; for:struct; text:item
@@ -1954,6 +1960,106 @@ This
19541960
{{CredentialsContainer/get()|navigator.credentials.get()}} operation can be aborted by leveraging the {{AbortController}};
19551961
see [[dom#abortcontroller-api-integration]] for detailed instructions.
19561962

1963+
#### <dfn for="PublicKeyCredential" algorithm="Issuing a request to an authenticator">Issuing a request to an authenticator</dfn> #### {#sctn-issuing-request-to-authenticator}
1964+
1965+
This algorithm accepts two arguments:
1966+
1967+
<dl dfn-type="argument" dfn-for="Issuing a request to an authenticator">
1968+
: <dfn>authenticator</dfn>
1969+
:: A [=client platform=]-specific handle identifying an [=authenticator=] presently available on this [=client platform=].
1970+
1971+
: <dfn>options</dfn>
1972+
:: This argument is a {{CredentialRequestOptions}} object whose
1973+
<code>|options|.{{CredentialRequestOptions/publicKey}}</code> member contains a {{PublicKeyCredentialRequestOptions}}
1974+
object specifying the desired attributes of the [=public key credential=] to discover.
1975+
</dl>
1976+
1977+
The steps for [=issuing a request to an |authenticator|=] are as follows:
1978+
1979+
1. If <code>|options|.{{PublicKeyCredentialRequestOptions/userVerification}}</code> is set to
1980+
{{UserVerificationRequirement/required}} and the |authenticator| is not capable of performing [=user verification=],
1981+
[=iteration/continue=].
1982+
1983+
1. Let |userVerification| be the <dfn>effective user verification requirement for assertion</dfn>, a Boolean value, as
1984+
follows. If <code>|options|.{{PublicKeyCredentialRequestOptions/userVerification}}</code>
1985+
1986+
<dl class="switch">
1987+
1988+
: is set to {{UserVerificationRequirement/required}}
1989+
:: Let |userVerification| be [TRUE].
1990+
1991+
: is set to {{UserVerificationRequirement/preferred}}
1992+
:: If the |authenticator|
1993+
1994+
<dl class="switch">
1995+
: is capable of [=user verification=]
1996+
:: Let |userVerification| be [TRUE].
1997+
1998+
: is not capable of [=user verification=]
1999+
:: Let |userVerification| be [FALSE].
2000+
</dl>
2001+
2002+
: is set to {{UserVerificationRequirement/discouraged}}
2003+
:: Let |userVerification| be [FALSE].
2004+
2005+
</dl>
2006+
2007+
1. <span id="allowCredentialDescriptorListCreation"></span>
2008+
If <code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code>
2009+
<dl class="switch">
2010+
: [=list/is not empty=]
2011+
:: 1. Let |allowCredentialDescriptorList| be a new [=list=].
2012+
2013+
1. Execute a [=client platform=]-specific procedure to determine which, if any, [=public key credentials=] described by
2014+
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code> are [=bound credential|bound=] to this
2015+
|authenticator|, by matching with |rpId|,
2016+
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}.{{PublicKeyCredentialDescriptor/id}}</code>,
2017+
and
2018+
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}.{{PublicKeyCredentialDescriptor/type}}</code>.
2019+
Set |allowCredentialDescriptorList| to this filtered list.
2020+
2021+
1. If |allowCredentialDescriptorList| [=list/is empty=], [=continue=].
2022+
2023+
1. Let |distinctTransports| be a new [=ordered set=].
2024+
2025+
1. If |allowCredentialDescriptorList| has exactly one value, set
2026+
<code>|savedCredentialIds|[|authenticator|]</code> to <code>|allowCredentialDescriptorList|[0].id</code>'s
2027+
value (see [here](#authenticatorGetAssertion-return-values) in [[#sctn-op-get-assertion]] for more information).
2028+
2029+
1. [=list/For each=] credential descriptor |C| in |allowCredentialDescriptorList|,
2030+
[=set/append=] each value, if any, of <code>|C|.{{transports}}</code> to |distinctTransports|.
2031+
2032+
Note: This will aggregate only distinct values of {{transports}} (for this [=authenticator=]) in
2033+
|distinctTransports| due to the properties of [=ordered sets=].
2034+
2035+
1. If |distinctTransports|
2036+
<dl class="switch">
2037+
: [=list/is not empty=]
2038+
:: The client selects one |transport| value from |distinctTransports|, possibly incorporating local
2039+
configuration knowledge of the appropriate transport to use with |authenticator| in making its
2040+
selection.
2041+
2042+
Then, using |transport|, invoke the [=authenticatorGetAssertion=] operation on
2043+
|authenticator|, with |rpId|, |clientDataHash|, |allowCredentialDescriptorList|,
2044+
|userVerification|, and |authenticatorExtensions| as parameters.
2045+
2046+
: [=list/is empty=]
2047+
:: Using local configuration knowledge of the appropriate transport to use with |authenticator|,
2048+
invoke the [=authenticatorGetAssertion=] operation on |authenticator| with |rpId|,
2049+
|clientDataHash|, |allowCredentialDescriptorList|, |userVerification|, and
2050+
|authenticatorExtensions| as parameters.
2051+
</dl>
2052+
2053+
: [=list/is empty=]
2054+
:: Using local configuration knowledge of the appropriate transport to use with |authenticator|, invoke the
2055+
[=authenticatorGetAssertion=] operation on |authenticator| with |rpId|, |clientDataHash|,
2056+
|userVerification| and |authenticatorExtensions| as parameters.
2057+
2058+
Note: In this case, the [=[RP]=] did not supply a list of acceptable credential descriptors. Thus, the
2059+
authenticator is being asked to exercise any credential it may possess that is [=scoped=] to
2060+
the [=[RP]=], as identified by |rpId|.
2061+
</dl>
2062+
19572063
#### PublicKeyCredential's <code><dfn for="PublicKeyCredential" method>\[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</dfn></code> Method #### {#sctn-discover-from-external-source}
19582064

19592065
<div link-for-hint="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)">
@@ -2098,6 +2204,20 @@ When this method is invoked, the user agent MUST execute the following algorithm
20982204
[=authenticators=] can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
20992205
or discovered (e.g., via NFC or Bluetooth) by the [=client=] by various mechanisms, or permanently built into the [=client=].
21002206

2207+
1. Let |silentlyDiscoveredCredentials| be an empty set.
2208+
2209+
1. If |conditionalFlow| is [TRUE]:
2210+
2211+
1. [=set/For each=] |authenticator| in |authenticators|:
2212+
2213+
1. If |authenticator| is not a [=platform authenticator=], then [=continue=].
2214+
2215+
1. Invoke the [=silent credential discovery=] operation on |authenticator| with |rpId| as parameter.
2216+
2217+
1. For every |credential| returned:
2218+
2219+
1. Add |credential| to |silentlyDiscoveredCredentials|.
2220+
21012221
1. Start |lifetimeTimer|.
21022222

21032223
1. [=While=] |lifetimeTimer| has not expired, perform the following actions depending upon |lifetimeTimer|,
@@ -2113,6 +2233,23 @@ When this method is invoked, the user agent MUST execute the following algorithm
21132233
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
21142234
and [=set/remove=] |authenticator| from |issuedRequests|. Return a {{DOMException}} whose name is "{{NotAllowedError}}".
21152235

2236+
: If |conditionalFlow| is [TRUE] and the user interacts with an [=input=] form control with a `"webauthn"`
2237+
[=autocomplete=] [=autofill hint set=],
2238+
:: 1. Prompt the user to optionally select a [=public key credential source=] from |silentlyDiscoveredCredentials|.
2239+
2240+
1. If the user selects a |credential|,
2241+
2242+
1. Let |optionsCopy| be a temporary copy of |options|.
2243+
2244+
1. Let |authenticator| be the authenticator containing |credential|.
2245+
2246+
1. Set <code>|optionsCopy|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code> to be a list with a
2247+
single [=public key credential=] |credential|.
2248+
2249+
1. Execute the [=issuing a request to an authenticator=] algorithm with |authenticator| and |optionsCopy|.
2250+
2251+
1. [=set/Append=] |authenticator| to |issuedRequests|.
2252+
21162253
: If the {{CredentialRequestOptions/signal}} member is present and the [=AbortSignal/aborted flag=] is set to
21172254
[TRUE],
21182255
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
@@ -2127,89 +2264,11 @@ When this method is invoked, the user agent MUST execute the following algorithm
21272264
: If an |authenticator| becomes available on this [=client device=],
21282265
:: Note: This includes the case where an |authenticator| was available upon |lifetimeTimer| initiation.
21292266

2130-
1. If <code>|options|.{{PublicKeyCredentialRequestOptions/userVerification}}</code> is set to
2131-
{{UserVerificationRequirement/required}} and the |authenticator| is not capable of performing [=user verification=],
2132-
[=iteration/continue=].
2133-
2134-
1. Let |userVerification| be the <dfn>effective user verification requirement for assertion</dfn>, a Boolean value, as
2135-
follows. If <code>|options|.{{PublicKeyCredentialRequestOptions/userVerification}}</code>
2136-
2137-
<dl class="switch">
2138-
2139-
: is set to {{UserVerificationRequirement/required}}
2140-
:: Let |userVerification| be [TRUE].
2141-
2142-
: is set to {{UserVerificationRequirement/preferred}}
2143-
:: If the |authenticator|
2144-
2145-
<dl class="switch">
2146-
: is capable of [=user verification=]
2147-
:: Let |userVerification| be [TRUE].
2148-
2149-
: is not capable of [=user verification=]
2150-
:: Let |userVerification| be [FALSE].
2151-
</dl>
2152-
2153-
: is set to {{UserVerificationRequirement/discouraged}}
2154-
:: Let |userVerification| be [FALSE].
2155-
2156-
</dl>
2157-
2158-
1. <span id="allowCredentialDescriptorListCreation"></span>
2159-
If <code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code>
2160-
<dl class="switch">
2161-
: [=list/is not empty=]
2162-
:: 1. Let |allowCredentialDescriptorList| be a new [=list=].
2163-
2164-
1. Execute a [=client platform=]-specific procedure to determine which, if any, [=public key credentials=] described by
2165-
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code> are [=bound credential|bound=] to this
2166-
|authenticator|, by matching with |rpId|,
2167-
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}.{{PublicKeyCredentialDescriptor/id}}</code>,
2168-
and
2169-
<code>|options|.{{PublicKeyCredentialRequestOptions/allowCredentials}}.{{PublicKeyCredentialDescriptor/type}}</code>.
2170-
Set |allowCredentialDescriptorList| to this filtered list.
2171-
2172-
1. If |allowCredentialDescriptorList| [=list/is empty=], [=continue=].
2173-
2174-
1. Let |distinctTransports| be a new [=ordered set=].
2175-
2176-
1. If |allowCredentialDescriptorList| has exactly one value, set
2177-
<code>|savedCredentialIds|[|authenticator|]</code> to <code>|allowCredentialDescriptorList|[0].id</code>'s
2178-
value (see [here](#authenticatorGetAssertion-return-values) in [[#sctn-op-get-assertion]] for more information).
2179-
2180-
1. [=list/For each=] credential descriptor |C| in |allowCredentialDescriptorList|,
2181-
[=set/append=] each value, if any, of <code>|C|.{{transports}}</code> to |distinctTransports|.
2182-
2183-
Note: This will aggregate only distinct values of {{transports}} (for this [=authenticator=]) in
2184-
|distinctTransports| due to the properties of [=ordered sets=].
2185-
2186-
1. If |distinctTransports|
2187-
<dl class="switch">
2188-
: [=list/is not empty=]
2189-
:: The client selects one |transport| value from |distinctTransports|, possibly incorporating local
2190-
configuration knowledge of the appropriate transport to use with |authenticator| in making its
2191-
selection.
2192-
2193-
Then, using |transport|, invoke the [=authenticatorGetAssertion=] operation on
2194-
|authenticator|, with |rpId|, |clientDataHash|, |allowCredentialDescriptorList|,
2195-
|userVerification|, and |authenticatorExtensions| as parameters.
2196-
2197-
: [=list/is empty=]
2198-
:: Using local configuration knowledge of the appropriate transport to use with |authenticator|,
2199-
invoke the [=authenticatorGetAssertion=] operation on |authenticator| with |rpId|,
2200-
|clientDataHash|, |allowCredentialDescriptorList|, |userVerification|, and
2201-
|authenticatorExtensions| as parameters.
2202-
</dl>
2267+
1. If the |authenticator| is a [=platform authenticator=] and |conditionalFlow| is [TRUE], then [=continue=].
22032268

2204-
: [=list/is empty=]
2205-
:: Using local configuration knowledge of the appropriate transport to use with |authenticator|, invoke the
2206-
[=authenticatorGetAssertion=] operation on |authenticator| with |rpId|, |clientDataHash|,
2207-
|userVerification| and |authenticatorExtensions| as parameters.
2269+
Note: A request will be issued to this authenticator upon user selection of a {{PublicKeyCredentialSource}}.
22082270

2209-
Note: In this case, the [=[RP]=] did not supply a list of acceptable credential descriptors. Thus, the
2210-
authenticator is being asked to exercise any credential it may possess that is [=scoped=] to
2211-
the [=[RP]=], as identified by |rpId|.
2212-
</dl>
2271+
1. Execute the [=issuing a request to an authenticator=] algorithm with |authenticator| and |options|.
22132272

22142273
1. [=set/Append=] |authenticator| to |issuedRequests|.
22152274

0 commit comments

Comments
 (0)