fix: add domain passthrough to webauthn credential creation functions

lib/new-admin/graphql/modules/authentication/FIDO2FAStrategy.js

@@ -4,25 +4,20 @@ const _ = require('lodash/fp')
 
 const userManagement = require('../userManagement')
 const credentials = require('../../../../hardware-credentials')
-const options = require('../../../../options')
 const T = require('../../../../time')
 const users = require('../../../../users')
 
-const domain = options.hostname
 const devMode = require('minimist')(process.argv.slice(2)).dev
 
 const REMEMBER_ME_AGE = 90 * T.day
 
-const rpID = domain
-const expectedOrigin = `https://${rpID}${devMode ? `:3001` : ``}`
-
 const generateAttestationOptions = (session, options) => {
   return users.getUserById(options.userId).then(user => {
     return Promise.all([credentials.getHardwareCredentialsByUserId(user.id), user])
   }).then(([userDevices, user]) => {
-    const options = simpleWebauthn.generateAttestationOptions({
+    const opts = simpleWebauthn.generateAttestationOptions({
       rpName: 'Lamassu',
-      rpID,
+      rpID: options.domain,
       userName: user.username,
       userID: user.id,
       timeout: 60000,
@@ -40,11 +35,11 @@ const generateAttestationOptions = (session, options) => {
 
     session.webauthn = {
       attestation: {
-        challenge: options.challenge
+        challenge: opts.challenge
       }
     }
 
-    return options
+    return opts
   })
 }
 
@@ -59,7 +54,7 @@ const generateAssertionOptions = (session, options) => {
           transports: ['usb', 'ble', 'nfc', 'internal']
         })),
         userVerification: 'discouraged',
-        rpID
+        rpID: options.domain
       })
 
       session.webauthn = {
@@ -82,8 +77,8 @@ const validateAttestation = (session, options) => {
     simpleWebauthn.verifyAttestationResponse({
       credential: options.attestationResponse,
       expectedChallenge: `${expectedChallenge}`,
-      expectedOrigin,
-      expectedRPID: rpID
+      expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
+      expectedRPID: options.domain
     })
   ])
     .then(([user, verification]) => {
@@ -142,8 +137,8 @@ const validateAssertion = (session, options) => {
         verification = simpleWebauthn.verifyAssertionResponse({
           credential: options.assertionResponse,
           expectedChallenge: `${expectedChallenge}`,
-          expectedOrigin,
-          expectedRPID: rpID,
+          expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
+          expectedRPID: options.domain,
           authenticator: convertedAuthenticator
         })
       } catch (err) {