Revert "refactor(mfa): decide registration from the credentials snapshot captured at flow start"

This reverts commit 550345f.

Author: dariusz-biela

src/components/MultifactorAuthentication/Context/MultifactorAuthenticationMainContext.tsx

@@ -81,14 +81,7 @@ function MultifactorAuthenticationContextProvider({children}: MultifactorAuthent
 
         const scenario = getScenarioConfig(scenarioName);
 
-        send({
-            type: 'INIT',
-            accountID,
-            scenarioName,
-            scenario,
-            payload: params && Object.keys(params).length > 0 ? params : undefined,
-            localCredentialsKnownToServer: startCredentialsState.hasLocalCredentials,
-        });
+        send({type: 'INIT', accountID, scenarioName, scenario, payload: params && Object.keys(params).length > 0 ? params : undefined});
     };
 
     const closeModal = () => send({type: 'CLOSE_MODAL'});

src/components/MultifactorAuthentication/biometrics/operations/index.native.ts

@@ -1,10 +1,18 @@
+import addMFABreadcrumb from '@components/MultifactorAuthentication/observability/breadcrumbs';
+
+import {decodeLibraryError, getKeyAlias} from '@libs/MultifactorAuthentication/NativeBiometricsHSM/helpers';
+import readOnyxValueOnce from '@libs/MultifactorAuthentication/shared/readOnyxValueOnce';
+
 import CONST from '@src/CONST';
+import ONYXKEYS from '@src/ONYXKEYS';
+import Base64URL from '@src/utils/Base64URL';
 
-import {isSensorAvailable} from '@sbaiahmed1/react-native-biometrics';
+import {getAllKeys, isSensorAvailable} from '@sbaiahmed1/react-native-biometrics';
+import {mfaCredentialIDsSelector} from '@selectors/Account';
 
 /**
- * Platform-resolved biometric operations for the device check. These functions read no Onyx and no
- * React state, so the MFA machine actors and other non-React callers can import them directly.
+ * Platform-resolved biometric operations for the MFA machine's pre-screen checks. These functions
+ * read no React state, so the machine actors and other non-React callers can import them directly.
  */
 
 /** The authentication method this platform verifies with. Native verifies with HSM-backed biometrics. */
@@ -19,4 +27,29 @@ async function doesDeviceSupportAuthenticationMethod(): Promise<boolean> {
     return sensorResult.isDeviceSecure;
 }
 
-export {deviceVerificationType, deviceCheckFailureReason, doesDeviceSupportAuthenticationMethod};
+/** Resolves to the account's HSM-backed credential ID, or undefined when no key exists or the keystore read fails. */
+async function getLocalCredentialID(accountID: number): Promise<string | undefined> {
+    try {
+        const {keys} = await getAllKeys(getKeyAlias(accountID));
+        const entry = keys.at(0);
+        if (!entry) {
+            return undefined;
+        }
+        return Base64URL.base64ToBase64url(entry.publicKey);
+    } catch (error) {
+        addMFABreadcrumb('Failed to get local credential ID', decodeLibraryError(error), 'error');
+        return undefined;
+    }
+}
+
+/** Resolves to whether the account has a local HSM key the server also knows, meaning it can skip registration. */
+async function areLocalCredentialsKnownToServer(accountID: number): Promise<boolean> {
+    const localCredentialID = await getLocalCredentialID(accountID);
+    if (!localCredentialID) {
+        return false;
+    }
+    const account = await readOnyxValueOnce(ONYXKEYS.ACCOUNT);
+    return (mfaCredentialIDsSelector(account) ?? []).includes(localCredentialID);
+}
+
+export {areLocalCredentialsKnownToServer, deviceVerificationType, deviceCheckFailureReason, doesDeviceSupportAuthenticationMethod};

src/components/MultifactorAuthentication/biometrics/operations/index.ts

@@ -1,10 +1,16 @@
 import {isWebAuthnSupported} from '@libs/MultifactorAuthentication/Passkeys/WebAuthn';
+import readOnyxValueOnce from '@libs/MultifactorAuthentication/shared/readOnyxValueOnce';
+
+import {getPasskeyOnyxKey} from '@userActions/Passkey';
 
 import CONST from '@src/CONST';
+import ONYXKEYS from '@src/ONYXKEYS';
+
+import {mfaCredentialIDsSelector} from '@selectors/Account';
 
 /**
- * Platform-resolved biometric operations for the device check. These functions read no Onyx and no
- * React state, so the MFA machine actors and other non-React callers can import them directly.
+ * Platform-resolved biometric operations for the MFA machine's pre-screen checks. These functions
+ * read no React state, so the machine actors and other non-React callers can import them directly.
  */
 
 /** The authentication method this platform verifies with. Web verifies with passkeys. */
@@ -18,4 +24,11 @@ async function doesDeviceSupportAuthenticationMethod(): Promise<boolean> {
     return isWebAuthnSupported();
 }
 
-export {deviceVerificationType, deviceCheckFailureReason, doesDeviceSupportAuthenticationMethod};
+/** Resolves to whether the account has a local passkey the server also knows, meaning it can skip registration. */
+async function areLocalCredentialsKnownToServer(accountID: number): Promise<boolean> {
+    const [account, localPasskeyCredentials] = await Promise.all([readOnyxValueOnce(ONYXKEYS.ACCOUNT), readOnyxValueOnce(getPasskeyOnyxKey(String(accountID)))]);
+    const serverKnownCredentialIDs = new Set(mfaCredentialIDsSelector(account) ?? []);
+    return (localPasskeyCredentials ?? []).some((credential) => serverKnownCredentialIDs.has(credential.id));
+}
+
+export {areLocalCredentialsKnownToServer, deviceVerificationType, deviceCheckFailureReason, doesDeviceSupportAuthenticationMethod};

src/components/MultifactorAuthentication/machine/mfaActors.ts

@@ -1,4 +1,5 @@
 import checkDeviceEligibility from '@components/MultifactorAuthentication/biometrics/checkDeviceEligibility';
+import {areLocalCredentialsKnownToServer} from '@components/MultifactorAuthentication/biometrics/operations';
 
 import {isHttpSuccess} from '@libs/MultifactorAuthentication/shared/helpers';
 import type {MFAResult} from '@libs/MultifactorAuthentication/shared/MFAResult';
@@ -9,7 +10,7 @@ import {getDeviceBiometricsOnyxKey, requestRegistrationChallenge} from '@userAct
 
 import {fromPromise} from 'xstate';
 
-import type {ReadHasAcceptedSoftPromptInput, RequestRegistrationChallengeInput, RequestRegistrationChallengeOutput, ValidateDeviceInput} from './types';
+import type {CheckLocalCredentialsInput, ReadHasAcceptedSoftPromptInput, RequestRegistrationChallengeInput, RequestRegistrationChallengeOutput, ValidateDeviceInput} from './types';
 
 /**
  * A refused device resolves as a failed MFAResult, so the machine's onError transition for this
@@ -26,6 +27,12 @@ const readHasAcceptedSoftPrompt = fromPromise<boolean, ReadHasAcceptedSoftPrompt
     return deviceBiometrics?.hasAcceptedSoftPrompt ?? false;
 });
 
+/**
+ * Resolves to whether the account's local credentials are known to the server. A returning user
+ * (true) skips the registration path entirely.
+ */
+const checkLocalCredentials = fromPromise<boolean, CheckLocalCredentialsInput>(({input}) => areLocalCredentialsKnownToServer(input.accountID));
+
 /**
  * Exchanges the submitted magic code for a validated registration challenge. The action normalizes
  * backend failures into a reason; the actor exposes them as failed MFA results for machine routing.
@@ -43,7 +50,7 @@ const requestRegistrationChallengeActor = fromPromise<RequestRegistrationChallen
  * these working implementations, so no caller needs to provide stubs or overrides.
  */
 function createActors() {
-    return {validateDevice, readHasAcceptedSoftPrompt, requestRegistrationChallenge: requestRegistrationChallengeActor};
+    return {validateDevice, readHasAcceptedSoftPrompt, checkLocalCredentials, requestRegistrationChallenge: requestRegistrationChallengeActor};
 }
 
 export default createActors;

src/components/MultifactorAuthentication/machine/mfaMachine.ts

@@ -35,7 +35,6 @@ const DEFAULT_CONTEXT: MfaContext = {
     scenarioName: undefined,
     scenario: undefined,
     payload: undefined,
-    localCredentialsKnownToServer: false,
     validateCode: undefined,
     continuableError: undefined,
     registrationChallenge: undefined,
@@ -77,7 +76,6 @@ const MFAMachine = setup({
                 scenarioName: event.scenarioName,
                 scenario: event.scenario,
                 payload: event.payload,
-                localCredentialsKnownToServer: event.localCredentialsKnownToServer,
             };
         }),
         // Deferring the outcome push until the modal-open transition settles lets the screen slide in
@@ -178,12 +176,25 @@ const MFAMachine = setup({
                             },
                         },
                         [MFA_STATE.DECIDING_REGISTRATION]: {
-                            // The Provider captures this value once for start telemetry and INIT. Reusing that
-                            // snapshot here avoids a second native keystore read before the first screen appears.
-                            always: [
-                                {guard: ({context}) => context.localCredentialsKnownToServer, target: SOFT_PROMPT_CHECK_TARGET},
-                                {target: MAGIC_CODE_TARGET, actions: ['requestValidateCode', 'navigateToMagicCode']},
-                            ],
+                            invoke: {
+                                id: 'checkLocalCredentials',
+                                src: 'checkLocalCredentials',
+                                input: ({context}) => {
+                                    if (context.accountID === undefined) {
+                                        throw new Error('MFA account must be initialized before the registration decision');
+                                    }
+                                    return {accountID: context.accountID};
+                                },
+                                // A returning user's credentials are already registered, so only a fresh registration asks for a code.
+                                onDone: [
+                                    {guard: ({event}) => event.output, target: SOFT_PROMPT_CHECK_TARGET},
+                                    {target: MAGIC_CODE_TARGET, actions: ['requestValidateCode', 'navigateToMagicCode']},
+                                ],
+                                onError: {
+                                    target: OUTCOME_TARGET,
+                                    actions: assign({error: ({event}) => createUnhandledExceptionMFAError('Local credentials check', event.error)}),
+                                },
+                            },
                         },
                         [MFA_STATE.CHECKING_SOFT_PROMPT_ACCEPTANCE]: {
                             id: MFA_STATE.CHECKING_SOFT_PROMPT_ACCEPTANCE,

src/components/MultifactorAuthentication/machine/types.ts

@@ -33,9 +33,6 @@ type MfaContext = {
     /** Additional parameters for the current scenario */
     payload: MultifactorAuthenticationScenarioAdditionalParams<MultifactorAuthenticationScenario> | undefined;
 
-    /** Whether the local credential captured at flow start is among the server-known credential IDs */
-    localCredentialsKnownToServer: boolean;
-
     /** Magic code the user entered on this flow's validate-code screen */
     validateCode: string | undefined;
 
@@ -68,7 +65,6 @@ type MultifactorAuthenticationInitEvent<T extends MultifactorAuthenticationScena
     scenarioName: T;
     scenario: MultifactorAuthenticationScenarioConfigFor<T>;
     payload: MultifactorAuthenticationScenarioParams<T> | undefined;
-    localCredentialsKnownToServer: boolean;
 };
 
 /** Events handled by the MFA state machine. */
@@ -86,13 +82,17 @@ type ValidateDeviceInput = {allowedAuthenticationMethods: AllowedAuthenticationM
 /** Identifies the per-account Onyx member read by the soft-prompt actor. */
 type ReadHasAcceptedSoftPromptInput = {accountID: number};
 
+/** Identifies the account whose local credentials the registration-decision actor checks. */
+type CheckLocalCredentialsInput = {accountID: number};
+
 /** Magic code sent to the backend to obtain a registration challenge. */
 type RequestRegistrationChallengeInput = {validateCode: string};
 
 /** A successful response must carry the validated registration challenge. */
 type RequestRegistrationChallengeOutput = MFAResult<{challenge: RegistrationChallenge}>;
 
 export type {
+    CheckLocalCredentialsInput,
     MfaContext,
     MfaEvent,
     MfaModalState,

tests/unit/components/MultifactorAuthentication/biometricsOperations.test.ts

@@ -1,18 +1,36 @@
 // jest-expo defaults to the ios platform, so this import resolves the native operations module
 // (operations/index.native.ts), which checks the HSM biometric sensor.
-import {deviceCheckFailureReason, deviceVerificationType, doesDeviceSupportAuthenticationMethod} from '@components/MultifactorAuthentication/biometrics/operations';
+import {
+    areLocalCredentialsKnownToServer,
+    deviceCheckFailureReason,
+    deviceVerificationType,
+    doesDeviceSupportAuthenticationMethod,
+} from '@components/MultifactorAuthentication/biometrics/operations';
 
 import VALUES from '@libs/MultifactorAuthentication/VALUES';
 
 import CONST from '@src/CONST';
+import ONYXKEYS from '@src/ONYXKEYS';
+
+import Onyx from 'react-native-onyx';
+import waitForBatchedUpdates from 'tests/utils/waitForBatchedUpdates';
 
 const mockIsSensorAvailable = jest.fn();
+const mockGetAllKeys = jest.fn();
 
 jest.mock('@sbaiahmed1/react-native-biometrics', () => ({
     // eslint-disable-next-line @typescript-eslint/no-unsafe-return
     isSensorAvailable: (...args: unknown[]) => mockIsSensorAvailable(...args),
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+    getAllKeys: (...args: unknown[]) => mockGetAllKeys(...args),
 }));
 
+const ACCOUNT_ID = 12345;
+// The keystore returns the public key as plain base64 while the server stores base64url IDs, so the
+// characters below only match after the module's base64url conversion.
+const LOCAL_PUBLIC_KEY_BASE64 = 'Ab+/cd==';
+const LOCAL_CREDENTIAL_ID = 'Ab-_cd';
+
 describe('biometrics operations (native)', () => {
     beforeEach(() => {
         jest.clearAllMocks();
@@ -44,4 +62,39 @@ describe('biometrics operations (native)', () => {
             await expect(doesDeviceSupportAuthenticationMethod()).resolves.toBe(false);
         });
     });
+
+    describe('areLocalCredentialsKnownToServer', () => {
+        afterEach(async () => {
+            await Onyx.clear();
+            await waitForBatchedUpdates();
+        });
+
+        it('should return true when the local HSM key is among the server-known credential IDs', async () => {
+            mockGetAllKeys.mockResolvedValue({keys: [{publicKey: LOCAL_PUBLIC_KEY_BASE64}]});
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: ['other-credential-id', LOCAL_CREDENTIAL_ID]});
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(true);
+        });
+
+        it('should return false when the server does not know the local HSM key', async () => {
+            mockGetAllKeys.mockResolvedValue({keys: [{publicKey: LOCAL_PUBLIC_KEY_BASE64}]});
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: ['other-credential-id']});
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(false);
+        });
+
+        it('should return false when the device holds no key for the account', async () => {
+            mockGetAllKeys.mockResolvedValue({keys: []});
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: [LOCAL_CREDENTIAL_ID]});
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(false);
+        });
+
+        it('should return false when the keystore read throws', async () => {
+            mockGetAllKeys.mockRejectedValue(new Error('Keystore unavailable'));
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: [LOCAL_CREDENTIAL_ID]});
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(false);
+        });
+    });
 });

tests/unit/components/MultifactorAuthentication/biometricsOperationsWeb.test.ts

@@ -6,13 +6,22 @@
  */
 import type * as WebBiometricsOperations from '@components/MultifactorAuthentication/biometrics/operations/index';
 
+import {getPasskeyOnyxKey} from '@userActions/Passkey';
+
 import CONST from '@src/CONST';
+import ONYXKEYS from '@src/ONYXKEYS';
+
+import Onyx from 'react-native-onyx';
+import waitForBatchedUpdates from 'tests/utils/waitForBatchedUpdates';
 
 // jest-expo resolves the native variant by default, so load the web entry point explicitly.
-const {deviceCheckFailureReason, deviceVerificationType, doesDeviceSupportAuthenticationMethod} = jest.requireActual<typeof WebBiometricsOperations>(
+const {areLocalCredentialsKnownToServer, deviceCheckFailureReason, deviceVerificationType, doesDeviceSupportAuthenticationMethod} = jest.requireActual<typeof WebBiometricsOperations>(
     '@components/MultifactorAuthentication/biometrics/operations/index.ts',
 );
 
+const ACCOUNT_ID = 12345;
+const LOCAL_PASSKEY_ID = 'local-passkey-credential-id';
+
 const originalPublicKeyCredentialDescriptor = Object.getOwnPropertyDescriptor(window, 'PublicKeyCredential');
 
 function setWebAuthnSupport(isSupported: boolean) {
@@ -48,4 +57,31 @@ describe('biometrics operations (web)', () => {
 
         await expect(doesDeviceSupportAuthenticationMethod()).resolves.toBe(expected);
     });
+
+    describe('areLocalCredentialsKnownToServer', () => {
+        afterEach(async () => {
+            await Onyx.clear();
+            await waitForBatchedUpdates();
+        });
+
+        it('returns true when a local passkey is among the server-known credential IDs', async () => {
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: ['other-credential-id', LOCAL_PASSKEY_ID]});
+            await Onyx.set(getPasskeyOnyxKey(String(ACCOUNT_ID)), [{id: LOCAL_PASSKEY_ID, type: CONST.PASSKEY_CREDENTIAL_TYPE}]);
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(true);
+        });
+
+        it('returns false when the server does not know the local passkey', async () => {
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: ['other-credential-id']});
+            await Onyx.set(getPasskeyOnyxKey(String(ACCOUNT_ID)), [{id: LOCAL_PASSKEY_ID, type: CONST.PASSKEY_CREDENTIAL_TYPE}]);
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(false);
+        });
+
+        it('returns false when the account has no local passkeys', async () => {
+            await Onyx.merge(ONYXKEYS.ACCOUNT, {multifactorAuthenticationPublicKeyIDs: [LOCAL_PASSKEY_ID]});
+
+            await expect(areLocalCredentialsKnownToServer(ACCOUNT_ID)).resolves.toBe(false);
+        });
+    });
 });