Avoid registering the same authenticator twice

This passes existing credentials in the server response, to allow
the browser to prevent re-registering the same key for the same
user. Registering the same key multiple times doesn't seem to be
an issue technically; the user has likely got their keys mixed up.

- Chrome says "you don't need to register it again".
- Safari exits with an InvalidStateError.
- Firefox exits with a DOMException.

tests/app/main/views/test_webauthn_credentials.py

@@ -51,6 +51,24 @@ def test_begin_register_returns_encoded_options(
     assert relying_party_options['id'] == 'localhost'
 
 
+def test_begin_register_includes_existing_credentials(
+    platform_admin_client,
+    webauthn_credential,
+    mocker,
+):
+    mocker.patch(
+        'app.user_api_client.get_webauthn_credentials_for_user',
+        return_value=[webauthn_credential, webauthn_credential]
+    )
+
+    response = platform_admin_client.get(
+        url_for('main.webauthn_begin_register')
+    )
+
+    webauthn_options = cbor.decode(response.data)['publicKey']
+    assert len(webauthn_options['excludeCredentials']) == 2
+
+
 def test_begin_register_stores_state_in_session(
     platform_admin_client,
 ):

tests/app/notify_client/test_user_client.py

@@ -243,7 +243,7 @@ def test_add_user_to_service_calls_correct_endpoint_and_deletes_keys_from_cache(
 
 def test_get_webauthn_credentials_for_user_returns_stubbed_data():
     credentials = user_api_client.get_webauthn_credentials_for_user('id')
-    assert credentials[0]['name'] == 'Ben test'
+    assert len(credentials) == 0
 
 
 def test_create_webauthn_credential_for_user_stores_stubbed_data(webauthn_credential):