ow

CloudBuilder.Security/Data/BiometricLoginChallengeDto.cs

@@ -0,0 +1,19 @@
+using CloudBuilder.Core.Authorization;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace CloudBuilder.Security.Data
+{
+    [TypeScript]
+    public class BiometricLoginChallengeDto
+    {
+        /// <summary>AssertionOptions JSON to feed to navigator.credentials.get().</summary>
+        public string RequestOptionsJson { get; set; } = null!;
+
+        /// <summary>Opaque id identifying this challenge — we round-trip the requestOptionsJson instead, so this is informational and currently unused.</summary>
+        public string ChallengeId { get; set; } = string.Empty;
+    }
+}

CloudBuilder.Security/Data/BiometricRegistrationResultDto.cs

@@ -0,0 +1,15 @@
+using CloudBuilder.Core.Authorization;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace CloudBuilder.Security.Data
+{
+    [TypeScript]
+    public class BiometricRegistrationResultDto
+    {
+        public string CredentialIdBase64Url { get; set; } = string.Empty;
+    }
+}

CloudBuilder.Security/Data/FinishBiometricLoginData.cs

@@ -0,0 +1,20 @@
+using CloudBuilder.Core.Authorization;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace CloudBuilder.Security.Data
+{
+    [TypeScript]
+    public class FinishBiometricLoginData
+    {
+        public string Username { get; set; } = null!;
+        public string AssertionJson { get; set; } = null!;
+        public string RequestOptionsJson { get; set; } = null!;
+
+        /// <summary>Opaque id; informational only. We round-trip the requestOptionsJson.</summary>
+        public string ChallengeId { get; set; } = string.Empty;
+    }
+}

CloudBuilder.Security/Data/FinishBiometricRegistrationData.cs

@@ -0,0 +1,19 @@
+using CloudBuilder.Core.Authorization;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace CloudBuilder.Security.Data
+{
+    [TypeScript]
+    public class FinishBiometricRegistrationData
+    {
+        /// <summary>JSON the browser returns from navigator.credentials.create().</summary>
+        public string AttestationJson { get; set; } = null!;
+
+        /// <summary>The CredentialCreateOptions JSON we returned from BeginBiometricRegistration. Round-tripped because Fido2NetLib verifies the challenge against it.</summary>
+        public string CreationOptionsJson { get; set; } = null!;
+    }
+}

CloudBuilder.Security/Data/WebAuthnOptions.cs

@@ -0,0 +1,48 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace CloudBuilder.Security.Data
+{
+
+    /// <summary>
+    /// Plain-old-data wrapper for the credential fields we persist on
+    /// SecurityUser. The frontend never sees this type.
+    /// </summary>
+    public class StoredBiometricCredential
+    {
+        public byte[] CredentialId { get; set; } = Array.Empty<byte>();
+        public byte[] PublicKey { get; set; } = Array.Empty<byte>();
+    }
+
+    public class WebAuthnOptions
+    {
+        /// <summary>
+        /// Relying Party ID — the registrable domain suffix of the
+        /// origin's host. For dev: "localhost". For production:
+        /// "eleave.1010printing.com".
+        /// </summary>
+        public string RpId { get; set; } = "localhost";
+
+        /// <summary>
+        /// Human-readable relying-party name. Shown in the OS biometric
+        /// prompt ("Use HR Plus to sign in to localhost").
+        /// </summary>
+        public string RpName { get; set; } = "HR Plus";
+
+        /// <summary>
+        /// The full origin (scheme + host + port) the user is loading
+        /// the page from. Fido2NetLib verifies the attestation/assertion
+        /// origin matches this exactly. Must be HTTPS in production
+        /// (localhost is exempt).
+        /// </summary>
+        public string Origin { get; set; } = "https://localhost:8000";
+
+        /// <summary>
+        /// WebAuthn ceremony timeout in milliseconds. Default 60s.
+        /// </summary>
+        public int TimeoutMs { get; set; } = 60000;
+    }
+}