Merge pull request #3892 from alphagov/update-remove-webauthn-cred

Let admin user update and delete their security key

app/main/forms.py

@@ -2551,3 +2551,13 @@ class BroadcastAreaFormWithSelectAll(BroadcastAreaForm):
         if self.select_all.data:
             return [self.select_all.area_slug]
         return self.areas.data
+
+
+class ChangeSecurityKeyNameForm(StripWhitespaceForm):
+    security_key_name = GovukTextInputField(
+        'Name of key',
+        validators=[
+            DataRequired(message='Cannot be empty'),
+            MustContainAlphanumericCharacters(),
+            Length(max=255, message='Name of key must be 255 characters or fewer')
+        ])

app/main/views/user_profile.py

@@ -3,12 +3,15 @@ import json
 from flask import (
     abort,
     current_app,
+    flash,
     redirect,
     render_template,
+    request,
     session,
     url_for,
 )
 from flask_login import current_user
+from notifications_python_client.errors import HTTPError
 from notifications_utils.url_safe_token import check_token
 
 from app import user_api_client
@@ -18,6 +21,7 @@ from app.main.forms import (
     ChangeMobileNumberForm,
     ChangeNameForm,
     ChangePasswordForm,
+    ChangeSecurityKeyNameForm,
     ConfirmPasswordForm,
     ServiceOnOffSettingForm,
     TwoFactorForm,
@@ -237,3 +241,66 @@ def user_profile_security_keys():
     return render_template(
         'views/user-profile/security-keys.html',
     )
+
+
+def get_key_from_list_of_keys(key_id, list_of_keys):
+    return next((key for key in list_of_keys if key.id == key_id), None)
+
+
+@main.route(
+    "/user-profile/security-keys/<uuid:key_id>/manage",
+    methods=['GET', 'POST'],
+    endpoint="user_profile_manage_security_key"
+)
+@main.route(
+    "/user-profile/security-keys/<uuid:key_id>/delete",
+    methods=['GET'],
+    endpoint="user_profile_confirm_delete_security_key"
+)
+@user_is_platform_admin
+def user_profile_manage_security_key(key_id):
+    security_keys = current_user.webauthn_credentials
+    security_key = get_key_from_list_of_keys(key_id, security_keys)
+
+    if not security_key:
+        abort(404)
+
+    form = ChangeSecurityKeyNameForm(security_key_name=security_key.name)
+
+    if form.validate_on_submit():
+        if form.security_key_name.data != security_key.name:
+            user_api_client.update_webauthn_credential_name_for_user(
+                user_id=current_user.id,
+                credential_id=key_id,
+                new_name_for_credential=form.security_key_name.data
+            )
+        return redirect(url_for('.user_profile_security_keys'))
+
+    if (request.endpoint == "main.user_profile_confirm_delete_security_key"):
+        flash("Are you sure you want to delete this security key?", 'delete')
+
+    return render_template(
+        'views/user-profile/manage-security-key.html',
+        security_key=security_key,
+        form=form
+    )
+
+
+@main.route("/user-profile/security-keys/<uuid:key_id>/delete", methods=['POST'])
+@user_is_platform_admin
+def user_profile_delete_security_key(key_id):
+
+    try:
+        user_api_client.delete_webauthn_credential_for_user(
+            user_id=current_user.id,
+            credential_id=key_id
+        )
+    except HTTPError as e:
+        message = "Cannot delete last remaining webauthn credential for user"
+        if e.message == message:
+            flash("You cannot delete your last security key.")
+            return redirect(url_for('.user_profile_manage_security_key', key_id=key_id))
+        else:
+            raise e
+
+    return redirect(url_for('.user_profile_security_keys'))