Bind passkey enrollment to authenticated user

2026-09-03 12:40:20 -04:00
parent 92ef63ba00
commit 277cffed8c
8 changed files with 43 additions and 9 deletions
@@ -34,3 +34,7 @@ application concern belongs in the shared module.
  explicit operator command.
 - Commerce remains a separately versioned nested module so payment-provider
  policy and catalog evolution do not enlarge the authentication core.
+- Self-service enrollment exposed an authorization seam: completing a valid
+  ceremony and checking its user only after persistence is too late.
+  `FinishRegistrationForUser` now consumes mismatched ceremonies and checks
+  the application-authenticated user before storing a credential.