From 18227ae2ab57a94c02adcfb0116a6937297fbc6a Mon Sep 17 00:00:00 2001
From: Baobhan Sith <80159437+Heavrnl@users.noreply.github.com>
Date: Thu, 8 May 2025 14:55:50 +0800
Subject: [PATCH] update

---
 packages/backend/src/auth/auth.controller.ts  | 30 +++++++++++--------
 .../src/repositories/passkey.repository.ts    |  2 ++
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/packages/backend/src/auth/auth.controller.ts b/packages/backend/src/auth/auth.controller.ts
index 7b3721f..fa7df90 100644
--- a/packages/backend/src/auth/auth.controller.ts
+++ b/packages/backend/src/auth/auth.controller.ts
@@ -139,12 +139,15 @@ export const generatePasskeyAuthenticationOptionsHandler = async (req: Request,
  * 验证 Passkey 凭据并登录用户 (POST /api/v1/auth/passkey/authenticate)
  */
 export const verifyPasskeyAuthenticationHandler = async (req: Request, res: Response): Promise<void> => {
-    const authenticationResponse = req.body; // The whole body is the response from @simplewebauthn/browser
+    // Extract assertionResponse and rememberMe from the request body
+    const { assertionResponse, rememberMe } = req.body;
     const expectedChallenge = req.session.currentChallenge;
-    const { rememberMe } = req.body; // Optional rememberMe flag
 
-    if (!authenticationResponse) {
-        res.status(400).json({ message: '认证响应不能为空。' });
+    // Rename assertionResponse to authenticationResponseJSON for clarity within this scope
+    const authenticationResponseJSON = assertionResponse;
+
+    if (!authenticationResponseJSON) {
+        res.status(400).json({ message: '认证响应 (assertionResponse) 不能为空。' });
         return;
     }
     if (!expectedChallenge) {
@@ -153,8 +156,9 @@ export const verifyPasskeyAuthenticationHandler = async (req: Request, res: Resp
     }
 
     try {
+        // Pass the extracted authenticationResponseJSON to the service
         const verification = await passkeyService.verifyAuthentication(
-            authenticationResponse,
+            authenticationResponseJSON,
             expectedChallenge
         );
 
@@ -197,20 +201,20 @@ export const verifyPasskeyAuthenticationHandler = async (req: Request, res: Resp
         } else {
             console.warn(`[AuthController] Passkey 认证验证失败:`, verification);
             const clientIp = req.ip || req.socket?.remoteAddress || 'unknown';
-            auditLogService.logAction('PASSKEY_AUTH_FAILURE', { 
-                credentialId: authenticationResponse.id, 
-                reason: 'Verification failed', 
-                ip: clientIp 
+            auditLogService.logAction('PASSKEY_AUTH_FAILURE', {
+                credentialId: authenticationResponseJSON?.id || 'unknown', // Use the extracted object
+                reason: 'Verification failed',
+                ip: clientIp
             });
             res.status(401).json({ verified: false, message: 'Passkey 认证失败。' });
         }
     } catch (error: any) {
         console.error(`[AuthController] 验证 Passkey 认证时出错:`, error.message, error.stack);
         const clientIp = req.ip || req.socket?.remoteAddress || 'unknown';
-        auditLogService.logAction('PASSKEY_AUTH_FAILURE', { 
-            credentialId: authenticationResponse?.id || 'unknown', 
-            reason: error.message, 
-            ip: clientIp 
+        auditLogService.logAction('PASSKEY_AUTH_FAILURE', {
+            credentialId: authenticationResponseJSON?.id || 'unknown', // Use the extracted object
+            reason: error.message,
+            ip: clientIp
         });
         res.status(500).json({ verified: false, message: '验证 Passkey 认证失败。', error: error.message });
     }
diff --git a/packages/backend/src/repositories/passkey.repository.ts b/packages/backend/src/repositories/passkey.repository.ts
index fe542b7..79193d0 100644
--- a/packages/backend/src/repositories/passkey.repository.ts
+++ b/packages/backend/src/repositories/passkey.repository.ts
@@ -97,6 +97,8 @@ export class PasskeyRepository {
     const db = await getDbInstance();
     const sql = 'SELECT * FROM passkeys WHERE user_id = ? ORDER BY created_at DESC';
     const results = await allDb<any>(db, sql, [userId]);
+    // Log the raw results from the database before mapping
+    console.log(`[PasskeyRepository] Raw passkeys for user ${userId}:`, JSON.stringify(results, null, 2));
     return mapPasskeyResults(results);
   }