05/18 Enhanced codes and functionalities 11

app/routes/webauthn.py

@@ -78,11 +78,24 @@ def register_begin():
     """
     Generate PublicKeyCredentialCreationOptions for passkey registration.
     Requires an active JWT session (user must be logged in).
+
+    Optional JSON body:
+      attachment: "platform" (default) | "cross-platform"
+        "platform"       → device biometrics (Touch ID, Face ID, Windows Hello)
+        "cross-platform" → roaming authenticators (YubiKey, phone-as-key via QR)
     """
     user = db.session.get(User, g.current_user_id)
     if not user:
         return jsonify({'error': 'User not found'}), 404
 
+    data = request.get_json(silent=True) or {}
+    attachment_str = (data.get('attachment') or 'platform').strip().lower()
+
+    if attachment_str == 'cross-platform':
+        authenticator_attachment = AuthenticatorAttachment.CROSS_PLATFORM
+    else:
+        authenticator_attachment = AuthenticatorAttachment.PLATFORM
+
     # Collect existing credential IDs to exclude (prevent re-registering same key).
     existing = WebAuthnCredential.query.filter_by(user_id=user.id).all()
     exclude_credentials = [
@@ -102,7 +115,7 @@ def register_begin():
         authenticator_selection=AuthenticatorSelectionCriteria(
             resident_key=ResidentKeyRequirement.PREFERRED,
             user_verification=UserVerificationRequirement.PREFERRED,
-            authenticator_attachment=AuthenticatorAttachment.PLATFORM,
+            authenticator_attachment=authenticator_attachment,
         ),
         exclude_credentials=exclude_credentials,
     )
@@ -389,4 +402,4 @@ def delete_credential(cred_id):
         ip_address=client_ip(),
     )
     db.session.commit()
-    return jsonify({'message': 'Passkey removed'}), 200
+    return jsonify({'message': 'Passkey removed'}), 200