Merge pull request #3917 from alphagov/set-webauthn-after-adding-token

Set user to WebAuthn login after adding token

app/main/views/webauthn_credentials.py

@@ -52,9 +52,8 @@ def webauthn_complete_register():
         current_app.logger.info(f'User {current_user.id} could not register a new webauthn token - {e}')
         return cbor.encode(str(e)), 400
 
-    user_api_client.create_webauthn_credential_for_user(
-        current_user.id, credential
-    )
+    current_user.create_webauthn_credential(credential)
+    current_user.update(auth_type='webauthn_auth')
 
     flash((
         'Registration complete. Next time you sign in to Notify '

app/models/user.py

@@ -360,6 +360,11 @@ class User(JSONModel, UserMixin):
             for credential in self.webauthn_credentials
         ]
 
+    def create_webauthn_credential(self, credential):
+        user_api_client.create_webauthn_credential_for_user(
+            self.id, credential
+        )
+
     def serialize(self):
         dct = {
             "id": self.id,

tests/app/main/views/test_webauthn_credentials.py

@@ -112,6 +112,7 @@ def test_begin_register_stores_state_in_session(
 def test_complete_register_creates_credential(
     platform_admin_user,
     platform_admin_client,
+    mock_update_user_attribute,
     mocker,
 ):
     with platform_admin_client.session_transaction() as session:
@@ -134,6 +135,10 @@ def test_complete_register_creates_credential(
     assert response.status_code == 200
     credential_mock.assert_called_once_with('state', 'public_key_credential')
     user_api_mock.assert_called_once_with(platform_admin_user['id'], 'cred')
+    mock_update_user_attribute.assert_called_once_with(
+        platform_admin_user['id'],
+        auth_type='webauthn_auth',
+    )
 
 
 def test_complete_register_clears_session(