feat(transport): advertise nfc and hybrid and populate registration transports

Add NFC and hybrid/caBLE to the public Transport enum and report compiled-in transports from available_transports. NFC is gated behind the nfc-backend features and hybrid is always present.

Thread the active transport from the channel into registration response serialization so the response transports member carries the AuthenticatorTransport token. The list is deduplicated, sorted, and stays empty when the transport is unknown. Both the FIDO2 and U2F-downgrade paths are covered.

Author: AlfioEmanueleFresta

libwebauthn/examples/ceremony/webauthn_ble.rs

@@ -75,7 +75,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
                 .unwrap();
         println!("WebAuthn MakeCredential response: {:?}", response);
 
-        match response.to_json_string(&make_credentials_request, JsonFormat::Prettified) {
+        match response.to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        ) {
             Ok(response_json) => {
                 println!(
                     "WebAuthn MakeCredential response (JSON):\n{}",
@@ -113,7 +117,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         println!("WebAuthn GetAssertion response: {:?}", response);
 
         for assertion in &response.assertions {
-            match assertion.to_json_string(&get_assertion, JsonFormat::Prettified) {
+            match assertion.to_json_string(
+                &get_assertion,
+                channel.transport(),
+                JsonFormat::Prettified,
+            ) {
                 Ok(assertion_json) => {
                     println!("WebAuthn GetAssertion response (JSON):\n{}", assertion_json);
                 }

libwebauthn/examples/ceremony/webauthn_cable.rs

@@ -92,7 +92,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
     let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
     let response_json = response
-        .to_json_string(&request, JsonFormat::Prettified)
+        .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
         .expect("Failed to serialize MakeCredential response");
     println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
 

libwebauthn/examples/ceremony/webauthn_cable_wss.rs

@@ -110,7 +110,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
         let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
         let response_json = response
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize MakeCredential response");
         println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
     }
@@ -182,7 +182,7 @@ async fn run_get_assertion(
     let response = retry_user_errors!(channel.webauthn_get_assertion(&request)).unwrap();
     for assertion in &response.assertions {
         let assertion_json = assertion
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize GetAssertion response");
         println!("WebAuthn GetAssertion response (JSON):\n{assertion_json}");
     }

libwebauthn/examples/ceremony/webauthn_hid.rs

@@ -79,7 +79,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
                 .unwrap();
         println!("WebAuthn MakeCredential response: {:?}", response);
 
-        match response.to_json_string(&make_credentials_request, JsonFormat::Prettified) {
+        match response.to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        ) {
             Ok(response_json) => {
                 println!(
                     "WebAuthn MakeCredential response (JSON):\n{}",
@@ -117,7 +121,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         println!("WebAuthn GetAssertion response: {:?}", response);
 
         for assertion in &response.assertions {
-            match assertion.to_json_string(&get_assertion, JsonFormat::Prettified) {
+            match assertion.to_json_string(
+                &get_assertion,
+                channel.transport(),
+                JsonFormat::Prettified,
+            ) {
                 Ok(assertion_json) => {
                     println!("WebAuthn GetAssertion response (JSON):\n{}", assertion_json);
                 }

libwebauthn/examples/ceremony/webauthn_nfc.rs

@@ -77,7 +77,11 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
     let response =
         retry_user_errors!(channel.webauthn_make_credential(&make_credentials_request)).unwrap();
     let response_json = response
-        .to_json_string(&make_credentials_request, JsonFormat::Prettified)
+        .to_json_string(
+            &make_credentials_request,
+            channel.transport(),
+            JsonFormat::Prettified,
+        )
         .expect("Failed to serialize MakeCredential response");
     println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
 
@@ -100,7 +104,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
     let response = retry_user_errors!(channel.webauthn_get_assertion(&get_assertion)).unwrap();
     for assertion in &response.assertions {
         let assertion_json = assertion
-            .to_json_string(&get_assertion, JsonFormat::Prettified)
+            .to_json_string(&get_assertion, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize GetAssertion response");
         println!("WebAuthn GetAssertion response (JSON):\n{assertion_json}");
     }

libwebauthn/examples/features/webauthn_prf_cable.rs

@@ -124,7 +124,7 @@ async fn create() -> Result<(), Box<dyn Error>> {
     let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
 
     let response_json = response
-        .to_json_string(&request, JsonFormat::Prettified)
+        .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
         .expect("Failed to serialize MakeCredential response");
     println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
 
@@ -191,7 +191,7 @@ async fn get(credential_id: Option<&str>) -> Result<(), Box<dyn Error>> {
 
     for (num, assertion) in response.assertions.iter().enumerate() {
         let assertion_json = assertion
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize GetAssertion response");
         println!("Assertion {num} (JSON):\n{assertion_json}");
     }

libwebauthn/examples/features/webauthn_related_origins_hid.rs

@@ -76,7 +76,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
 
         let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap();
         let response_json = response
-            .to_json_string(&request, JsonFormat::Prettified)
+            .to_json_string(&request, channel.transport(), JsonFormat::Prettified)
             .expect("Failed to serialize MakeCredential response");
         println!("WebAuthn MakeCredential response (JSON):\n{response_json}");
     }

libwebauthn/src/lib.rs

@@ -120,10 +120,12 @@ macro_rules! unwrap_field {
 use pin::{PinNotSetReason, PinRequestReason};
 pub(crate) use unwrap_field;
 
-#[derive(Debug)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Transport {
     Usb,
     Ble,
+    Nfc,
+    Hybrid,
 }
 
 #[derive(Debug, Clone)]
@@ -213,6 +215,36 @@ impl PartialEq for PinNotSetUpdate {
     }
 }
 
+/// Transports compiled into this build. Hybrid/caBLE is always included. Using it
+/// at runtime still needs a BLE adapter (see `transport::cable::is_available`).
+/// NFC appears only when an `nfc-backend-*` feature is enabled.
 pub fn available_transports() -> Vec<Transport> {
-    vec![Transport::Usb, Transport::Ble]
+    [
+        Transport::Usb,
+        Transport::Ble,
+        Transport::Hybrid,
+        #[cfg(any(feature = "nfc-backend-pcsc", feature = "nfc-backend-libnfc"))]
+        Transport::Nfc,
+    ]
+    .into_iter()
+    .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn available_transports_reports_compiled_in() {
+        let transports = available_transports();
+        assert!(transports.contains(&Transport::Usb));
+        assert!(transports.contains(&Transport::Ble));
+        assert!(transports.contains(&Transport::Hybrid));
+
+        let nfc_compiled = cfg!(any(
+            feature = "nfc-backend-pcsc",
+            feature = "nfc-backend-libnfc"
+        ));
+        assert_eq!(transports.contains(&Transport::Nfc), nfc_compiled);
+    }
 }

libwebauthn/src/ops/webauthn/get_assertion.rs

@@ -489,6 +489,7 @@ impl WebAuthnIDLResponse for Assertion {
     fn to_idl_model(
         &self,
         request: &Self::Context,
+        _transport: Option<crate::Transport>,
     ) -> Result<Self::IdlModel, ResponseSerializationError> {
         // Get credential ID - either from credential_id field or from authenticator_data
         let credential_id_bytes = self
@@ -1306,7 +1307,7 @@ mod tests {
 
         let assertion = create_test_assertion();
         let request = create_test_request();
-        let json = assertion.to_json_string(&request, JsonFormat::default());
+        let json = assertion.to_json_string(&request, None, JsonFormat::default());
         assert!(json.is_ok());
 
         let json_str = json.unwrap();
@@ -1332,7 +1333,7 @@ mod tests {
     fn test_assertion_to_idl_model() {
         let assertion = create_test_assertion();
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify the credential ID
         assert_eq!(model.raw_id.0, vec![0x01, 0x02, 0x03, 0x04]);
@@ -1354,7 +1355,7 @@ mod tests {
         ));
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify user handle is present
         assert!(model.response.user_handle.is_some());
@@ -1381,7 +1382,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
 
         // Verify extension outputs - PRF should be set with correct values
         let prf = model.client_extension_results.prf.as_ref().unwrap();
@@ -1403,7 +1404,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
         assert_eq!(model.client_extension_results.appid, Some(true));
 
         // The output should also round-trip through the JSON wire format.
@@ -1427,7 +1428,7 @@ mod tests {
         });
 
         let request = create_test_request();
-        let model = assertion.to_idl_model(&request).unwrap();
+        let model = assertion.to_idl_model(&request, None).unwrap();
         assert_eq!(model.client_extension_results.appid, None);
 
         let json = serde_json::to_value(&model.client_extension_results).unwrap();

libwebauthn/src/ops/webauthn/idl/response.rs

@@ -55,28 +55,33 @@ pub trait WebAuthnIDLResponse: Sized {
     /// Context required for serialization (e.g., client data JSON).
     type Context;
 
-    /// Converts this response to a JSON-serializable IDL model.
+    /// Converts this response to a JSON-serializable IDL model. `transport` is the
+    /// transport the ceremony ran over, used to populate the registration
+    /// `transports` member. Pass `None` when it is unknown.
     fn to_idl_model(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
     ) -> Result<Self::IdlModel, ResponseSerializationError>;
 
     /// Serializes this response to a `serde_json::Value`.
     fn to_json_value(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
     ) -> Result<serde_json::Value, ResponseSerializationError> {
-        let model = self.to_idl_model(ctx)?;
+        let model = self.to_idl_model(ctx, transport)?;
         Ok(serde_json::to_value(&model)?)
     }
 
     /// Serializes this response to a JSON string.
     fn to_json_string(
         &self,
         ctx: &Self::Context,
+        transport: Option<crate::Transport>,
         format: JsonFormat,
     ) -> Result<String, ResponseSerializationError> {
-        let value = self.to_json_value(ctx)?;
+        let value = self.to_json_value(ctx, transport)?;
         match format {
             JsonFormat::Minified => Ok(serde_json::to_string(&value)?),
             JsonFormat::Prettified => Ok(serde_json::to_string_pretty(&value)?),