Merge pull request #148 from cedarcode/sr--generate-webauthn-id-lazily

Generate `webauthn_id` lazily when registration options are requested

Author: santiagorodriguez96

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Changed
 
 - BREAKING!: The WebAuthn options endpoints (`passkey_registration_options`, `passkey_authentication_options`, `security_key_registration_options` and `security_key_authentication_options`) now respond to `POST` instead of `GET`, since they mutate server state (they store the WebAuthn challenge in the session). If you overrode any of these controllers, rename the overridden `index` action to `create`; if you copied the bundled JavaScript into your app, update your copy. [@santiagorodriguez96]
+- BREAKING!: `webauthn_id` is now generated and persisted when WebAuthn registration options are requested, instead of eagerly in a `before_validation` callback, so backfilling existing records is no longer needed and the migration generated by `devise:webauthn:webauthn_id` no longer includes one. If your app relies on `webauthn_id` being set on create (e.g. you added a `NOT NULL` constraint to the column), add your own callback or database default, or drop the constraint. [@santiagorodriguez96]
 
 ## [v0.4.0](https://github.com/cedarcode/devise-webauthn/compare/v0.3.1...v0.4.0/) - 2026-04-06
 

app/controllers/devise/passkey_registration_options_controller.rb

@@ -5,6 +5,7 @@ class PasskeyRegistrationOptionsController < DeviseController
     skip_forgery_protection
 
     before_action :authenticate_scope!
+    before_action :ensure_webauthn_id!
 
     def create
       passkey_options =
@@ -33,6 +34,10 @@ def authenticate_scope!
       self.resource = send(:"current_#{resource_name}")
     end
 
+    def ensure_webauthn_id!
+      resource.ensure_webauthn_id!
+    end
+
     def resource_human_palatable_identifier
       authentication_keys = resource.class.authentication_keys
       authentication_keys = authentication_keys.keys if authentication_keys.is_a?(Hash)

app/controllers/devise/security_key_registration_options_controller.rb

@@ -5,6 +5,7 @@ class SecurityKeyRegistrationOptionsController < DeviseController
     skip_forgery_protection
 
     before_action :authenticate_scope!
+    before_action :ensure_webauthn_id!
 
     def create
       create_security_key_options =
@@ -33,6 +34,10 @@ def authenticate_scope!
       self.resource = send(:"current_#{resource_name}")
     end
 
+    def ensure_webauthn_id!
+      resource.ensure_webauthn_id!
+    end
+
     def resource_human_palatable_identifier
       authentication_keys = resource.class.authentication_keys
       authentication_keys = authentication_keys.keys if authentication_keys.is_a?(Hash)

lib/devise/models/webauthn_credential_authenticatable.rb

@@ -11,10 +11,15 @@ module WebauthnCredentialAuthenticatable
         has_many :webauthn_credentials, dependent: :destroy
 
         validates :webauthn_id, uniqueness: true, allow_blank: true
+      end
+
+      def ensure_webauthn_id!
+        return webauthn_id if webauthn_id.present?
+
+        self.webauthn_id = WebAuthn.generate_user_id
+        save!(validate: false)
 
-        before_validation do
-          self.webauthn_id ||= WebAuthn.generate_user_id
-        end
+        webauthn_id
       end
     end
   end

lib/devise/webauthn/test/authenticator_helpers.rb

@@ -39,7 +39,7 @@ def add_credential_to_authenticator(authenticator, resource, passkey:, name: "My
             "privateKey" => encoded_private_key,
             "signCount" => 0
           }
-          credential_json["userHandle"] = resource.webauthn_id if passkey
+          credential_json["userHandle"] = resource.ensure_webauthn_id! if passkey
 
           authenticator.add_credential(credential_json)
 

lib/generators/devise/webauthn/webauthn_id/templates/add_webauthn_id.rb.erb

@@ -6,22 +6,17 @@
 module Devise
   module Webauthn
     class WebauthnIdGenerator < Rails::Generators::Base
-      include Rails::Generators::Migration
-
       hide!
       namespace "devise:webauthn:webauthn_id"
 
-      source_root File.expand_path("templates", __dir__)
-
       desc "Add webauthn_id field to User model"
       class_option :resource_name, type: :string, default: "user", desc: "The resource name for Devise (default: user)"
 
-      def self.next_migration_number(dirname)
-        ActiveRecord::Generators::Base.next_migration_number(dirname)
-      end
-
       def generate_migration
-        migration_template "add_webauthn_id.rb.erb", "db/migrate/add_webauthn_id_to_#{user_table_name}.rb"
+        invoke "active_record:migration", [
+          "add_webauthn_id_to_#{user_table_name}",
+          "webauthn_id:string:uniq"
+        ]
       end
 
       def show_instructions

lib/generators/devise/webauthn/webauthn_id/webauthn_id_generator.rb

@@ -1,30 +1,27 @@
 # frozen_string_literal: true
 
 RSpec.describe Devise::Models::PasskeyAuthenticatable, type: :model do
-  describe "webauthn_id initialization" do
-    it "generates a webauthn_id on create" do
+  describe "#ensure_webauthn_id!" do
+    it "does not generate a webauthn_id on create" do
       user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
-      expect(user.webauthn_id).to be_present
+      expect(user.webauthn_id).to be_nil
     end
 
-    it "does not generate a webauthn_id on initialize" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
-      expect(user.webauthn_id).to be_nil
+    it "generates and persists a webauthn_id when missing" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
+
+      webauthn_id = user.ensure_webauthn_id!
+
+      expect(webauthn_id).to be_present
+      expect(user.reload.webauthn_id).to eq(webauthn_id)
     end
 
-    it "keeps webauthn_id if created with one" do
+    it "does not replace an existing webauthn_id" do
       user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password",
                              webauthn_id: "custom")
-      expect(user.webauthn_id).to eq("custom")
-    end
-
-    it "generates a webauthn_id on update if missing" do
-      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
-      user.update_column(:webauthn_id, nil) # rubocop:disable Rails/SkipsModelValidations
-      user.reload
 
-      user.update!(email: "updated@example.com")
-      expect(user.webauthn_id).to be_present
+      expect(user.ensure_webauthn_id!).to eq("custom")
+      expect(user.reload.webauthn_id).to eq("custom")
     end
   end
 
@@ -43,7 +40,8 @@
 
   describe "validations" do
     it "validates uniqueness of webauthn_id" do
-      existing = Account.create!(email: "existing@example.com", password: "password", password_confirmation: "password")
+      existing = Account.create!(email: "existing@example.com", password: "password",
+                                 password_confirmation: "password", webauthn_id: WebAuthn.generate_user_id)
       user = Account.new(email: "new@example.com", webauthn_id: existing.webauthn_id)
       expect(user).not_to be_valid
       expect(user.errors[:webauthn_id]).to include("has already been taken")

spec/devise/models/passkey_authenticatable_spec.rb

@@ -1,30 +1,27 @@
 # frozen_string_literal: true
 
 RSpec.describe Devise::Models::WebauthnTwoFactorAuthenticatable, type: :model do
-  describe "webauthn_id initialization" do
-    it "generates a webauthn_id on create" do
+  describe "#ensure_webauthn_id!" do
+    it "does not generate a webauthn_id on create" do
       user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
-      expect(user.webauthn_id).to be_present
+      expect(user.webauthn_id).to be_nil
     end
 
-    it "does not generate a webauthn_id on initialize" do
-      user = Account.new(email: "user@example.com", password: "password", password_confirmation: "password")
-      expect(user.webauthn_id).to be_nil
+    it "generates and persists a webauthn_id when missing" do
+      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
+
+      webauthn_id = user.ensure_webauthn_id!
+
+      expect(webauthn_id).to be_present
+      expect(user.reload.webauthn_id).to eq(webauthn_id)
     end
 
-    it "keeps webauthn_id if created with one" do
+    it "does not replace an existing webauthn_id" do
       user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password",
                              webauthn_id: "custom")
-      expect(user.webauthn_id).to eq("custom")
-    end
-
-    it "generates a webauthn_id on update if missing" do
-      user = Account.create!(email: "user@example.com", password: "password", password_confirmation: "password")
-      user.update_column(:webauthn_id, nil) # rubocop:disable Rails/SkipsModelValidations
-      user.reload
 
-      user.update!(email: "updated@example.com")
-      expect(user.webauthn_id).to be_present
+      expect(user.ensure_webauthn_id!).to eq("custom")
+      expect(user.reload.webauthn_id).to eq("custom")
     end
   end
 
@@ -66,7 +63,8 @@
 
   describe "validations" do
     it "validates uniqueness of webauthn_id" do
-      existing = Account.create!(email: "existing@example.com", password: "password", password_confirmation: "password")
+      existing = Account.create!(email: "existing@example.com", password: "password",
+                                 password_confirmation: "password", webauthn_id: WebAuthn.generate_user_id)
       user = Account.new(email: "new@example.com", webauthn_id: existing.webauthn_id)
       expect(user).not_to be_valid
       expect(user.errors[:webauthn_id]).to include("has already been taken")

spec/devise/models/webauthn_two_factor_authenticatable_spec.rb

@@ -9,35 +9,25 @@
 
   before do
     prepare_destination
+    allow(generator_instance).to receive(:invoke)
     invoke generator_instance
   end
 
   context "when using default resource name" do
     let(:generator_instance) { generator }
 
-    it "creates a migration that adds webauthn_id to users" do
-      assert_migration "db/migrate/add_webauthn_id_to_users.rb" do |migration|
-        assert_match(/add_column :users, :webauthn_id, :string/, migration)
-        assert_match(/add_index :users, :webauthn_id, unique: true/, migration)
-      end
-    end
-
-    it "creates a migration that backfills existing records" do
-      assert_migration "db/migrate/add_webauthn_id_to_users.rb" do |migration|
-        assert_match(/SELECT id FROM users WHERE webauthn_id IS NULL/, migration)
-        assert_match(/WebAuthn\.generate_user_id/, migration)
-      end
+    it "invokes the active_record:migration generator with correct arguments" do
+      expect(generator).to have_received(:invoke).with("active_record:migration",
+                                                       ["add_webauthn_id_to_users", "webauthn_id:string:uniq"])
     end
   end
 
   context "when using a custom resource name" do
     let(:generator_instance) { generator([destination_root], ["--resource_name=admin"]) }
 
-    it "creates a migration that adds webauthn_id to admins" do
-      assert_migration "db/migrate/add_webauthn_id_to_admins.rb" do |migration|
-        assert_match(/add_column :admins, :webauthn_id, :string/, migration)
-        assert_match(/add_index :admins, :webauthn_id, unique: true/, migration)
-      end
+    it "invokes the active_record:migration generator with correct arguments" do
+      expect(generator).to have_received(:invoke).with("active_record:migration",
+                                                       ["add_webauthn_id_to_admins", "webauthn_id:string:uniq"])
     end
   end
 end