fix: add domain passthrough to webauthn credential creation functions

lib/new-admin/graphql/modules/authentication/FIDOPasswordlessStrategy.js

@@ -3,25 +3,20 @@ const base64url = require('base64url')
 const _ = require('lodash/fp')
 
 const credentials = require('../../../../hardware-credentials')
-const options = require('../../../../options')
 const T = require('../../../../time')
 const users = require('../../../../users')
 
-const domain = options.hostname
 const devMode = require('minimist')(process.argv.slice(2)).dev
 
 const REMEMBER_ME_AGE = 90 * T.day
 
-const rpID = domain
-const expectedOrigin = `https://${rpID}${devMode ? `:3001` : ``}`
-
 const generateAttestationOptions = (session, options) => {
   return users.getUserById(options.userId).then(user => {
     return Promise.all([credentials.getHardwareCredentialsByUserId(user.id), user])
   }).then(([userDevices, user]) => {
     const opts = simpleWebauthn.generateAttestationOptions({
       rpName: 'Lamassu',
-      rpID,
+      rpID: options.domain,
       userName: user.username,
       userID: user.id,
       timeout: 60000,
@@ -58,7 +53,7 @@ const generateAssertionOptions = (session, options) => {
           transports: ['usb', 'ble', 'nfc', 'internal']
         })),
         userVerification: 'discouraged',
-        rpID
+        rpID: options.domain
       })
 
       session.webauthn = {
@@ -81,8 +76,8 @@ const validateAttestation = (session, options) => {
     simpleWebauthn.verifyAttestationResponse({
       credential: options.attestationResponse,
       expectedChallenge: `${expectedChallenge}`,
-      expectedOrigin,
-      expectedRPID: rpID
+      expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
+      expectedRPID: options.domain
     })
   ])
     .then(([user, verification]) => {
@@ -141,8 +136,8 @@ const validateAssertion = (session, options) => {
         verification = simpleWebauthn.verifyAssertionResponse({
           credential: options.assertionResponse,
           expectedChallenge: `${expectedChallenge}`,
-          expectedOrigin,
-          expectedRPID: rpID,
+          expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
+          expectedRPID: options.domain,
           authenticator: convertedAuthenticator
         })
       } catch (err) {