Loading users without all columns (webauthn_id ) causes an error

[inspire22]

In some places in my app I call things like

User.find_by_sql("select user_id as id, count(id) as cnt

Which breaks when using this gem because of the

        after_initialize do
          self.webauthn_id ||= WebAuthn.generate_user_id
        end

It'd be nice to not break on loading users like this, also we load user objects all over the place to show the user who created an object/etc, so I worry about the overhead of WebAuthn.generate_user_id for all these. It might be enough to just call if has_attribute? but I'm not that familiar with the codebase....

[santiagorodriguez96]

Hi @inspire22! 👋 Thanks for the report! ❤️

You're right that the after_initialize callback is problematic with partial selects like find_by_sql. As you mentioned, adding a has_attribute?(:webauthn_id) guard would fix the crash.

However, while investigating this, we also found a deeper issue with how this after_initialize works: the webauthn_id it generates for existing users is never actually persisted to the database, so each request
produces a different ephemeral value. We've opened #120 to track that. This means that that after_initialize will go away soon.

Thanks for bringing this to our attention — it helped us uncover a bug we hadn't noticed!

[santiagorodriguez96]

Hi @inspire22!

This should be fixed now. In v0.4.0, we replaced the after_initialize callback with a before_validation one (see #125), so loading users with partial selects like find_by_sql will no longer trigger webauthn_id generation.

Thanks again for the report!