feat(session): webauthn can now be a first factor as well

identity/aal.go

@@ -5,6 +5,7 @@ func DetermineAAL(cts []CredentialsType) AuthenticatorAssuranceLevel {
 
 	var firstFactor bool
 	var secondFactor bool
+	var foundWebAuthn bool
 	for _, a := range cts {
 		switch a {
 		case CredentialsTypeRecoveryLink:
@@ -21,13 +22,17 @@ func DetermineAAL(cts []CredentialsType) AuthenticatorAssuranceLevel {
 			secondFactor = true
 		case CredentialsTypeWebAuthn:
 			secondFactor = true
+			foundWebAuthn = true
 		}
 	}
 
 	if firstFactor && secondFactor {
 		aal = AuthenticatorAssuranceLevel2
 	} else if firstFactor {
 		aal = AuthenticatorAssuranceLevel1
+	} else if foundWebAuthn {
+		// If none of the above match but WebAuthn is set, we have AAL1
+		aal = AuthenticatorAssuranceLevel1
 	}
 
 	// Using only the second factor is not enough for any type of assurance.

identity/aal_test.go

@@ -107,6 +107,13 @@ func TestDetermineAAL(t *testing.T) {
 			},
 			expected: AuthenticatorAssuranceLevel2,
 		},
+		{
+			d: "webauthn only is aal1",
+			methods: []CredentialsType{
+				CredentialsTypeWebAuthn,
+			},
+			expected: AuthenticatorAssuranceLevel1,
+		},
 	} {
 		t.Run("case="+tc.d, func(t *testing.T) {
 			assert.Equal(t, tc.expected, DetermineAAL(tc.methods))