Fixes the error code for blocked UV

[kaczmarczyck]

First, with an answer on the specification question, we change the comment on the error code being a potential typo: https://github.com/fido-alliance/fido-2-specs/issues/1672

Also, I realized that the default was wrong before, so now the error code with *_UV_* is used for UV operations as intended.

[gemini-code-assist]

Summary of Changes

Hello @kaczmarczyck, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the error handling for User Verification (UV) operations within the system. It addresses an ambiguity in error codes by ensuring that when UV attempts are exhausted, the internal system correctly reports a CTAP2_ERR_UV_BLOCKED status. To maintain compatibility with the FIDO specification for MakeCredential and GetAssertion operations, a new mapping function is introduced that translates this internal UV_BLOCKED error back to CTAP2_ERR_PIN_BLOCKED before being returned, thus adhering to external standards while improving internal clarity and correctness.

Highlights

• Error Code Correction: The pull request corrects the error code returned when User Verification (UV) retries are exhausted, changing it from CTAP2_ERR_PIN_BLOCKED to CTAP2_ERR_UV_BLOCKED to more accurately reflect the blocked UV state.
• FIDO Specification Compliance: A new helper function, map_uv_block_error, has been introduced to re-map CTAP2_ERR_UV_BLOCKED back to CTAP2_ERR_PIN_BLOCKED specifically for MakeCredential and GetAssertion operations, aligning with clarifications in the FIDO specification (issue #1672).
• Internal Consistency: The change ensures that internal logic correctly distinguishes between PIN and UV blocking states, while maintaining external API compliance with the FIDO specification.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly addresses the error code for blocked User Verification (UV). The approach of using CTAP2_ERR_UV_BLOCKED internally and then mapping it to the spec-required CTAP2_ERR_PIN_BLOCKED at the command boundary is clean and improves the separation of concerns. The changes in fingerprint.rs and the new map_uv_block_error function in mod.rs are well-implemented. I have one minor suggestion to make the new helper function more idiomatic. Also, as noted in the PR description, the comments around the call sites in ctap/mod.rs could be updated to reflect the clarified specification, as they currently still refer to a 'typo' or 'ambiguity' which has now been resolved.

[kaczmarczyck]

Markdown CI failure seems unrelated, and I don't touch markdown.

[ia0]

Markdown CI failure seems unrelated, and I don't touch markdown.

I'm re-running it.

[kaczmarczyck]

I also tried re-running, I think some necessary server is down?

[ia0]

Seems like a problem of the docker image... then we should either bypass to merge (if we believe it's transient) or not make markdown required (or completely remove it).

[kaczmarczyck]

I will merge for now, and retry later to check if transient.

[kaczmarczyck]

Latest run worked.