UserPresent flag enforcement

[explunit]

I see here that the user present flag is always required:
https://github.com/passwordless-lib/fido2-net-lib/blob/v4.0.0/Src/Fido2/AuthenticatorAttestationResponse.cs#L103-L105

But for Apple App Attest attestations, that will not be the case.

Should there be an option to bypass this check?

If I am reading things correctly, the closest current unit test that might encounter this is always using the base _flags value that yields UserPresent = true.

[abergs]

But for Apple App Attest attestations, that will not be the case.

Could you please describe more about this flow, I'm not very aware of it.

[patches2]

It's this process here: https://developer.apple.com/documentation/devicecheck/validating-apps-that-connect-to-your-server

I'm not an iOS developer, but what I understand from my colleague is that they receive the already-signed webauthn attestation back from Apple and of course do not have the ability to set any flags such as User Present.

If I remove that one check for UP, everything else in MakeNewCredentialAsync works fine for the Apple attestation.

See also some previous discussion here: #401 (comment)

[abergs]

Aha I see.

Supporting Apple App Attestation outside of fido2 flows was not a use case we planned on supporting. But since the technologies are overlapping, I agree we could tweak it to support it.

Keeping this issue open until that refactor is done.

[explunit]

Related issue PR, not quite clear to me its intended use: #322