feat(transport): advertise nfc and hybrid and populate registration transports

Add NFC and hybrid/caBLE to the public Transport enum and report compiled-in transports from available_transports. NFC is gated behind the nfc-backend features and hybrid is always present.

Thread the active transport from the channel into registration response serialization so the response transports member carries the AuthenticatorTransport token. The list is deduplicated, sorted, and stays empty when the transport is unknown. Both the FIDO2 and U2F-downgrade paths are covered.

Author: AlfioEmanueleFresta

libwebauthn/examples/ceremony/webauthn_ble.rs

@@ -75,7 +75,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
                 .unwrap();
         println!("WebAuthn MakeCredential response: {:?}", response);
 
-        match response.to_json_string(&make_credentials_request, JsonFormat::Prettified) {
+        match response.to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        ) {
             Ok(response_json) => {
                 println!(
                     "WebAuthn MakeCredential response (JSON):\n{}",
@@ -113,7 +117,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         println!("WebAuthn GetAssertion response: {:?}", response);
 
         for assertion in &response.assertions {
-            match assertion.to_json_string(&get_assertion, JsonFormat::Prettified) {
+            match assertion.to_json_string(
+                &get_assertion,
+                channel.transport(),
+                JsonFormat::Prettified,
+            ) {
                 Ok(assertion_json) => {
                     println!("WebAuthn GetAssertion response (JSON):\n{}", assertion_json);
                 }

libwebauthn/examples/ceremony/webauthn_cable.rs

@@ -92,7 +92,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
     let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
     let response_json = response
-        .to_json_string(&request, JsonFormat::Prettified)
+        .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
         .expect("Failed to serialize MakeCredential response");
     println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
 

libwebauthn/examples/ceremony/webauthn_cable_wss.rs

@@ -110,7 +110,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
         let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
         let response_json = response
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize MakeCredential response");
         println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
     }
@@ -182,7 +182,7 @@ async fn run_get_assertion(
     let response = retry_user_errors!(channel.webauthn_get_assertion(&request)).unwrap();
     for assertion in &response.assertions {
         let assertion_json = assertion
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize GetAssertion response");
         println!("WebAuthn GetAssertion response (JSON):\n{assertion_json}");
     }

libwebauthn/examples/ceremony/webauthn_hid.rs

@@ -79,7 +79,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
                 .unwrap();
         println!("WebAuthn MakeCredential response: {:?}", response);
 
-        match response.to_json_string(&make_credentials_request, JsonFormat::Prettified) {
+        match response.to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        ) {
             Ok(response_json) => {
                 println!(
                     "WebAuthn MakeCredential response (JSON):\n{}",
@@ -117,7 +121,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         println!("WebAuthn GetAssertion response: {:?}", response);
 
         for assertion in &response.assertions {
-            match assertion.to_json_string(&get_assertion, JsonFormat::Prettified) {
+            match assertion.to_json_string(
+                &get_assertion,
+                channel.transport(),
+                JsonFormat::Prettified,
+            ) {
                 Ok(assertion_json) => {
                     println!("WebAuthn GetAssertion response (JSON):\n{}", assertion_json);
                 }

libwebauthn/examples/ceremony/webauthn_nfc.rs

@@ -77,7 +77,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
     let response =
         retry_user_errors!(channel.webauthn_make_credential(&make_credentials_request)).unwrap();
     let response_json = response
-        .to_json_string(&make_credentials_request, JsonFormat::Prettified)
+        .to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        )
         .expect("Failed to serialize MakeCredential response");
     println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
 
@@ -100,7 +104,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
     let response = retry_user_errors!(channel.webauthn_get_assertion(&get_assertion)).unwrap();
     for assertion in &response.assertions {
         let assertion_json = assertion
-            .to_json_string(&get_assertion, JsonFormat::Prettified)
+            .to_json_string(&get_assertion, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize GetAssertion response");
         println!("WebAuthn GetAssertion response (JSON):\n{assertion_json}");
     }

libwebauthn/examples/features/webauthn_related_origins_hid.rs

@@ -76,7 +76,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
         let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
         let response_json = response
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize MakeCredential response");
         println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
     }

libwebauthn/src/lib.rs

@@ -120,10 +120,12 @@ macro_rules! unwrap_field {
 use pin::{PinNotSetReason, PinRequestReason};
 pub(crate) use unwrap_field;
 
-#[derive(Debug)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Transport {
     Usb,
     Ble,
+    Nfc,
+    Hybrid,
 }
 
 #[derive(Debug, Clone)]
@@ -213,6 +215,36 @@ impl PartialEq for PinNotSetUpdate {
     }
 }
 
+/// Transports compiled into this build. Hybrid/caBLE is always included. Using it
+/// at runtime still needs a BLE adapter (see `transport::cable::is_available`).
+/// NFC appears only when an `nfc-backend-*` feature is enabled.
 pub fn available_transports() -> Vec<Transport> {
-    vec![Transport::Usb, Transport::Ble]
+    [
+        Transport::Usb,
+        Transport::Ble,
+        Transport::Hybrid,
+        #[cfg(any(feature = "nfc-backend-pcsc", feature = "nfc-backend-libnfc"))]
+        Transport::Nfc,
+    ]
+    .into_iter()
+    .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn available_transports_reports_compiled_in() {
+        let transports = available_transports();
+        assert!(transports.contains(&Transport::Usb));
+        assert!(transports.contains(&Transport::Ble));
+        assert!(transports.contains(&Transport::Hybrid));
+
+        let nfc_compiled = cfg!(any(
+            feature = "nfc-backend-pcsc",
+            feature = "nfc-backend-libnfc"
+        ));
+        assert_eq!(transports.contains(&Transport::Nfc), nfc_compiled);
+    }
 }

libwebauthn/src/ops/webauthn/get_assertion.rs

@@ -489,6 +489,7 @@ impl WebAuthnIDLResponse for Assertion {
     fn to_idl_model(
         &self,
         request: &Self::Context,
+        _transport: Option<crate::Transport>,
     ) -> Result<Self::IdlModel, ResponseSerializationError> {
         // Get credential ID - either from credential_id field or from authenticator_data
         let credential_id_bytes = self
@@ -1306,7 +1307,7 @@ mod tests {
 
         let assertion = create_test_assertion();
         let request = create_test_request();
-        let json = assertion.to_json_string(&request, JsonFormat::default());
+        let json = assertion.to_json_string(&request, None, JsonFormat::default());
         assert!(json.is_ok());
 
         let json_str = json.unwrap();
@@ -1332,7 +1333,7 @@ mod tests {
     fn test_assertion_to_idl_model() {
         let assertion = create_test_assertion();
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify the credential ID
         assert_eq!(model.raw_id.0, vec![0x01, 0x02, 0x03, 0x04]);
@@ -1354,7 +1355,7 @@ mod tests {
         ));
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify user handle is present
         assert!(model.response.user_handle.is_some());
@@ -1381,7 +1382,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify extension outputs - PRF should be set with correct values
         let prf = model.client_extension_results.prf.as_ref().unwrap();
@@ -1403,7 +1404,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
         assert_eq!(model.client_extension_results.appid, Some(true));
 
         // The output should also round-trip through the JSON wire format.
@@ -1427,7 +1428,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
         assert_eq!(model.client_extension_results.appid, None);
 
         let json = serde_json::to_value(&model.client_extension_results).unwrap();

libwebauthn/src/ops/webauthn/idl/response.rs

@@ -55,28 +55,33 @@ pub trait WebAuthnIDLResponse: Sized {
     /// Context required for serialization (e.g., client data JSON).
     type Context;
 
-    /// Converts this response to a JSON-serializable IDL model.
+    /// Converts this response to a JSON-serializable IDL model. `transport` is the
+    /// transport the ceremony ran over, used to populate the registration
+    /// `transports` member. Pass `None` when it is unknown.
     fn to_idl_model(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
     ) -> Result<Self::IdlModel, ResponseSerializationError>;
 
     /// Serializes this response to a `serde_json::Value`.
     fn to_json_value(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
     ) -> Result<serde_json::Value, ResponseSerializationError> {
-        let model = self.to_idl_model(ctx)?;
+        let model = self.to_idl_model(ctx, transport)?;
         Ok(serde_json::to_value(&model)?)
     }
 
     /// Serializes this response to a JSON string.
     fn to_json_string(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
         format: JsonFormat,
     ) -> Result<String, ResponseSerializationError> {
-        let value = self.to_json_value(ctx)?;
+        let value = self.to_json_value(ctx, transport)?;
         match format {
             JsonFormat::Minified => Ok(serde_json::to_string(&value)?),
             JsonFormat::Prettified => Ok(serde_json::to_string_pretty(&value)?),

libwebauthn/src/ops/webauthn/make_credential.rs

@@ -29,7 +29,7 @@ use crate::{
             cbor, cbor::Value, cose, parse_unsigned_prf, Ctap2AttestationStatement,
             Ctap2COSEAlgorithmIdentifier, Ctap2CredentialType, Ctap2GetInfoResponse,
             Ctap2MakeCredentialsResponseExtensions, Ctap2PublicKeyCredentialDescriptor,
-            Ctap2PublicKeyCredentialRpEntity, Ctap2PublicKeyCredentialUserEntity,
+            Ctap2PublicKeyCredentialRpEntity, Ctap2PublicKeyCredentialUserEntity, Ctap2Transport,
             UnsignedPrfOutput,
         },
     },
@@ -60,13 +60,29 @@ struct AttestationObject<'a> {
     attestation_statement: &'a Ctap2AttestationStatement,
 }
 
+/// Maps the active transport to AuthenticatorTransport tokens for the registration
+/// `transports` member. The list is deduplicated and lexicographically sorted per
+/// WebAuthn L3 §5.2.1.1, and is empty when the transport is unknown.
+fn registration_transports(transport: Option<crate::Transport>) -> Vec<String> {
+    let mut tokens: Vec<String> = transport
+        .into_iter()
+        .map(Ctap2Transport::from)
+        .filter_map(|t| serde_json::to_value(t).ok())
+        .filter_map(|v| v.as_str().map(str::to_owned))
+        .collect();
+    tokens.sort();
+    tokens.dedup();
+    tokens
+}
+
 impl WebAuthnIDLResponse for MakeCredentialResponse {
     type IdlModel = RegistrationResponseJSON;
     type Context = MakeCredentialRequest;
 
     fn to_idl_model(
         &self,
         request: &Self::Context,
+        transport: Option<crate::Transport>,
     ) -> Result<Self::IdlModel, ResponseSerializationError> {
         // The AT flag MUST be set on makeCredential responses per CTAP 2.2 §6.1.
         let attested = self
@@ -102,8 +118,7 @@ impl WebAuthnIDLResponse for MakeCredentialResponse {
         // Build attestation object (CBOR map with authData, fmt, attStmt)
         let attestation_object_bytes = self.build_attestation_object(&authenticator_data_bytes)?;
 
-        // Get transports (we don't have direct access, so return empty for now)
-        let transports = Vec::new();
+        let transports = registration_transports(transport);
 
         // Build client extension results
         let client_extension_results = self.build_client_extension_results();
@@ -1434,7 +1449,7 @@ mod tests {
 
         let response = create_test_response();
         let request = create_test_request();
-        let json = response.to_json_string(&request, JsonFormat::default());
+        let json = response.to_json_string(&request, None, JsonFormat::default());
         assert!(json.is_ok());
 
         let json_str = json.unwrap();
@@ -1489,7 +1504,7 @@ mod tests {
     fn test_response_to_idl_model() {
         let response = create_test_response();
         let request = create_test_request();
-        let model = response.to_idl_model(&request).unwrap();
+        let model = response.to_idl_model(&request, None).unwrap();
 
         // Verify the credential ID
         assert_eq!(model.raw_id.0, vec![0x01, 0x02, 0x03, 0x04]);
@@ -1503,6 +1518,41 @@ mod tests {
         assert!(model.response.transports.is_empty());
     }
 
+    #[test]
+    fn test_response_to_idl_model_populates_transports() {
+        // WebAuthn L3 §5.2.1.1: the registration `transports` member reports the
+        // transport the credential was created over, as AuthenticatorTransport tokens.
+        // Both the FIDO2 and U2F-downgrade paths converge on this serialization.
+        let response = create_test_response();
+        let request = create_test_request();
+
+        for (transport, token) in [
+            (crate::Transport::Usb, "usb"),
+            (crate::Transport::Ble, "ble"),
+            (crate::Transport::Nfc, "nfc"),
+            (crate::Transport::Hybrid, "hybrid"),
+        ] {
+            let model = response.to_idl_model(&request, Some(transport)).unwrap();
+            assert_eq!(model.response.transports, vec![token.to_string()]);
+        }
+
+        // The token reaches the JSON wire format too.
+        let json = response
+            .to_json_string(
+                &request,
+                Some(crate::Transport::Nfc),
+                crate::ops::webauthn::idl::response::JsonFormat::default(),
+            )
+            .unwrap();
+        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
+        let transports = parsed["response"]["transports"].as_array().unwrap();
+        assert_eq!(transports, &vec![serde_json::Value::from("nfc")]);
+
+        // An unknown transport leaves the list empty.
+        let model = response.to_idl_model(&request, None).unwrap();
+        assert!(model.response.transports.is_empty());
+    }
+
     #[test]
     fn test_response_emits_spki_for_es256() {
         // The test fixture builds an ES256 P-256 credential, so getPublicKey()
@@ -1512,7 +1562,7 @@ mod tests {
         // by the secp256r1 OID and the uncompressed point.
         let response = create_test_response();
         let request = create_test_request();
-        let model = response.to_idl_model(&request).unwrap();
+        let model = response.to_idl_model(&request, None).unwrap();
 
         let public_key_bytes = model
             .response
@@ -1536,7 +1586,7 @@ mod tests {
     fn test_response_attestation_object_format() {
         let response = create_test_response();
         let request = create_test_request();
-        let model = response.to_idl_model(&request).unwrap();
+        let model = response.to_idl_model(&request, None).unwrap();
 
         // Decode the attestation object
         let attestation_bytes = model.response.attestation_object.0;
@@ -1581,7 +1631,7 @@ mod tests {
         };
 
         let request = create_test_request();
-        let model = response.to_idl_model(&request).unwrap();
+        let model = response.to_idl_model(&request, None).unwrap();
 
         // Verify cred_props extension
         let cred_props = model.client_extension_results.cred_props.as_ref().unwrap();