@toa.io/extensions.exposition 1.0.0-alpha.272 → 1.0.0-alpha.274

package/components/identity.tokens/source/authenticate.test.ts

@@ -1,6 +1,7 @@
 import { generate } from 'randomstring'
 import { Computation as Authenticate } from './authenticate'
 import type { Configuration, Context, DecryptOutput, Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -13,8 +14,8 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 2592000,
     refresh: 600,
@@ -68,3 +69,7 @@ it.each([true, false])('should return stale: %s',
 
     expect(result).toEqual({ identity, refresh })
   })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/authenticate.ts

@@ -1,4 +1,3 @@
-import { Err } from 'error-value'
 import type { Maybe, Operation } from '@toa.io/types'
 import type { AuthenticateInput, AuthenticateOutput, Context } from './lib'
 
@@ -43,5 +42,10 @@ export class Computation implements Operation {
   }
 }
 
-const ERR_AUTHORITY = new Err('AUTHORITY_MISMATCH')
-const ERR_TOKEN_REVOKED = new Err('TOKEN_REVOKED')
+const ERR_AUTHORITY = new (class AuthorityMismatchError extends Error {
+  public readonly code = 'AUTHORITY_MISMATCH'
+})()
+
+const ERR_TOKEN_REVOKED = new (class TokenRevokedError extends Error {
+  public readonly code = 'TOKEN_REVOKED'
+})()

package/components/identity.tokens/source/decrypt.test.ts

@@ -3,6 +3,7 @@ import { V3 } from 'paseto'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Configuration, type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -15,10 +16,11 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'key1', key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' },
-      { id: 'legacy1', key: 'k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      // keys are secrets, and a secret is an object
+      { id: 'key1', key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' },
+      { id: 'legacy1', key: secret('k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA'), format: 'paseto' }
     ],
     lifetime: 1000,
     refresh: 500,
@@ -77,7 +79,7 @@ it('should decrypt with key1', async () => {
 it('should decrypt legacy PASETO and require refresh', async () => {
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'legacy0' }
   })
 
@@ -96,7 +98,7 @@ it('should separate JWE and PASETO keys with the same id by format', async () =>
 
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'key0' }
   })
 
@@ -125,7 +127,7 @@ it('should reject JWE with an unknown key', async () => {
   const token = await encrypt.execute({
     authority,
     identity: { id: generate(), roles: [] },
-    key: { id: 'missing', key: configuration.keys[0].key, label: 'missing' }
+    key: { id: 'missing', key: configuration.keys[0].key.unwrap(), label: 'missing' }
   })
 
   if (token instanceof Error)
@@ -133,3 +135,7 @@ it('should reject JWE with an unknown key', async () => {
 
   await expect(decrypt.execute(token)).resolves.toMatchObject({ code: 'INVALID_KEY' })
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/decrypt.ts

@@ -1,5 +1,4 @@
 import { V3 } from 'paseto'
-import { Err } from 'error-value'
 import { LRUCache } from 'lru-cache'
 import { jweKey } from './lib'
 import { load } from './lib/jose'
@@ -28,7 +27,7 @@ export class Computation implements Operation {
     for (const { id, key, format } of context.configuration.keys) {
       const branch = format === 'paseto' ? this.legacy : this.keys
 
-      branch[id] = { key }
+      branch[id] = { key: key.unwrap() }
     }
   }
 
@@ -161,6 +160,14 @@ interface KeyEntry {
   value: Key | null
 }
 
-const ERR_INVALID_TOKEN = new Err('INVALID_TOKEN')
-const ERR_INVALID_KEY = new Err('INVALID_KEY')
-const ERR_FORGED_KEY = new Err('FORGED_KEY')
+const ERR_INVALID_TOKEN = new (class InvalidTokenError extends Error {
+  public readonly code = 'INVALID_TOKEN'
+})()
+
+const ERR_INVALID_KEY = new (class InvalidKeyError extends Error {
+  public readonly code = 'INVALID_KEY'
+})()
+
+const ERR_FORGED_KEY = new (class ForgedKeyError extends Error {
+  public readonly code = 'FORGED_KEY'
+})()

package/components/identity.tokens/source/encrypt.test.ts

@@ -4,6 +4,7 @@ import { timeout } from '@toa.io/generic'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let encrypt: Encrypt
 let decrypt: Decrypt
@@ -18,8 +19,8 @@ const authority = generate()
 beforeEach(() => {
   context.configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 1,
     refresh: 2,
@@ -39,12 +40,12 @@ beforeEach(() => {
 it('should use the first encryption key as active and expose its id as kid', async () => {
   context.configuration.keys.unshift({
     id: 'legacy-first',
-    key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog',
+    key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
     format: 'paseto'
   })
   context.configuration.keys.push({
     id: 'key1',
-    key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0'
+    key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0')
   })
 
   encrypt.mount(context)
@@ -119,3 +120,7 @@ it('should encrypt without lifetime INSECURE', async () => {
 
   expect(decrypted.identity).toMatchObject(identity)
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/encrypt.ts

@@ -1,4 +1,3 @@
-import { Err } from 'error-value'
 import { jweKey } from './lib'
 import { load } from './lib/jose'
 import type { Operation, Maybe } from '@toa.io/types'
@@ -14,7 +13,7 @@ export class Effect implements Operation {
     if (key === undefined)
       throw new TypeError('At least one JWE key must be configured')
 
-    this.key = key
+    this.key = { id: key.id, key: key.key.unwrap() }
     this.lifetime = context.configuration.lifetime * 1000
   }
 
@@ -52,4 +51,6 @@ function within (scope: string, roles: string[]): boolean {
   return roles.some((role) => role === scope || scope.startsWith(role + ':'))
 }
 
-const ERR_INACCESSIBLE_SCOPE = new Err('INACCESSIBLE_SCOPE')
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+  public readonly code = 'INACCESSIBLE_SCOPE'
+})()

package/components/identity.tokens/source/lib/types.ts

@@ -1,4 +1,4 @@
-import type { Call, Maybe, Observation, telemetry } from '@toa.io/types'
+import type { Call, Maybe, Observation, Secret, telemetry } from '@toa.io/types'
 
 export interface Context {
   local: {
@@ -31,7 +31,8 @@ export interface Configuration {
   }
 }
 
-export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+export interface ConfiguredKey extends Pick<Key, 'id'> {
+  key: Secret
   format?: 'jwe' | 'paseto'
 }
 

package/context.toa.yaml

@@ -10,9 +10,9 @@ configuration:
   identity.tokens:
     keys:
       - id: key0
-        key: sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs
+        key: $IDENTITY_TOKENS_ENCRYPTION_KEY0
       - id: legacy0
-        key: k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA
+        key: $IDENTITY_TOKENS_KEY0
         format: paseto
 
   identity.federation:

package/documentation/components.md

@@ -23,7 +23,7 @@ and pepper.
 configuration:
   identity.basic:
     rounds: 10 # salt rounds
-    pepper: '' # hashing pepper
+    pepper: $IDENTITY_BASIC_PEPPER # hashing pepper, a secret
 ```
 
 ### Credentials constraints

package/documentation/identity.md

@@ -181,7 +181,10 @@ name: users
 
 entity:
   schema:
-    name: string
+    type: object
+    properties:
+      name:
+        type: string
 
 exposition:
   /:

package/features/configuration.feature

@@ -0,0 +1,207 @@
+@security
+Feature: Configuration values
+
+  The values component declares how it is exposed in its own manifest, and that manifest
+  is what this mounts. Reading takes `system:configuration:get`, creating takes
+  `system:configuration:create`, and the one who creates is recorded as the originator.
+
+  Background:
+    # developer:secret, user:12345
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                     |
+      | 1c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | efe3a65ebbee47ed95a73edd911ea328 | system:configuration     |
+      | 2c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | e8e4f9c2a68d419b861403d71fabc915 | system:configuration:get |
+    And the `identity.bans` database is empty
+    And the `configuration.values` database is empty
+    And the configuration values are deployed:
+      """yaml
+      dummies.dummy:
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        defaults:
+          foo: deployed
+      """
+    And the configuration values are running
+
+  Scenario: Reading the deployed configuration
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: deployed
+      schema:
+        type: object
+        properties:
+          foo:
+            type: string
+          bar:
+            type: string
+            default: world
+      epoch: e1
+      """
+
+  Scenario: Listing the configurations
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      - component: dummies.dummy
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        configuration:
+          foo: deployed
+      """
+
+  Scenario: Listing without the role
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading without the role
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading the configuration of an unknown component
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Creating configuration
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      epoch: e1
+      """
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+        bar: world
+      epoch: e1
+      """
+
+  Scenario: Creating configuration without the role
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Creating configuration not fitting the schema
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration:
+        foo:
+          nested: true
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Creating configuration for an unknown component
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration: {}
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """

package/features/cors.feature

@@ -20,7 +20,7 @@ Feature: CORS Support
       """
       204 No Content
       access-control-allow-credentials: true
-      access-control-allow-headers: accept, authorization, content-type, if-match, if-none-match, origin
+      access-control-allow-headers: accept, authorization, content-type, if-match, if-none-match
       access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK
       access-control-allow-origin: https://hello.world
       access-control-max-age: 3600

package/features/dev.feature

@@ -74,7 +74,7 @@ Feature: Dev
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-headers: accept, authorization, content-type, if-match, if-none-match, faulty
+      access-control-allow-headers: accept, authorization, content-type, faulty, if-match, if-none-match
       """
     When the following request is received:
       """

package/features/identity.federation.feature

@@ -195,13 +195,14 @@ Feature: Identity Federation
 
     Then after 0.2 seconds
 
-    # check the role
+    # the role is checked over the id token: a Token carries the roles held when it
+    # was issued, and this one was issued before the grant
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
       host: nex.toa.io
       accept: application/yaml
-      authorization: Token ${{ root.token }}
+      authorization: Bearer ${{ root.id_token }}
       """
     Then the following reply is sent:
       """
@@ -334,7 +335,11 @@ Feature: Identity Federation
       trust:
         - iss: http://localhost:44444
           aud: nex
-          secret: secret
+          secret: $IDP_SECRET
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_SECRET: secret
       """
     And auth code for Alice is issued for https://web.toa.io/callback/
     When the following request is received:
@@ -361,12 +366,16 @@ Feature: Identity Federation
           signature:
             iss: io.toa.nex.id
             kid: key-id
-            key: |
-              -----BEGIN PRIVATE KEY-----
-              MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
-              TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
-              HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
-              -----END PRIVATE KEY-----
+            key: $IDP_KEY
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_KEY: |
+        -----BEGIN PRIVATE KEY-----
+        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
+        TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
+        HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
+        -----END PRIVATE KEY-----
       """
     And auth code for Bob is issued for https://web.toa.io/callback/
     When the following request is received:

package/features/{identtiy.tokens.custom.feature → identity.tokens.custom.feature}

@@ -76,6 +76,45 @@ Feature: Custom tokens
       200 OK
       """
 
+  Scenario: Issuing a token for another identity
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                      |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | efe3a65ebbee47ed95a73edd911ea328 | system:identity:tokens    |
+    When the following request is received:
+      """
+      POST /identity/tokens/e8e4f9c2a68d419b861403d71fabc915/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+      accept: application/yaml
+
+      label: On behalf
+      lifetime: 600
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: e8e4f9c2a68d419b861403d71fabc915
+      """
+
   Scenario: Token with restricted scopes
     When the following request is received:
       """

package/features/introspection.map.feature

@@ -90,3 +90,19 @@ Feature: Reading the introspection map
       """
       403 Forbidden
       """
+
+  Scenario: The map does not take the application's root directives
+    Given the annotation of the introspection map under:
+      """yaml
+      /:
+        auth:anonymous: true
+      """
+    When the following request is received:
+      """
+      GET /introspection/nodes/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/map.feature

@@ -84,7 +84,7 @@ Feature: HTTP context mapping
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-headers: accept, accept-language, authorization, content-type, foo, if-match, if-none-match, origin
+      access-control-allow-headers: accept, accept-language, authorization, content-type, foo, if-match, if-none-match
       """
 
   Scenario: Mapping the value of an arbitrary header

package/features/octets.download.feature

@@ -186,5 +186,5 @@ Feature: Download external resources
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-headers: accept, authorization, content-attributes, content-location, content-type, if-match, if-none-match, origin
+      access-control-allow-headers: accept, authorization, content-attributes, content-location, content-type, if-match, if-none-match
       """

package/features/octets.meta.feature

@@ -111,6 +111,6 @@ Feature: Octets metadata
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-headers: accept, authorization, content-attributes, content-location, content-type, if-match, if-none-match, origin
+      access-control-allow-headers: accept, authorization, content-attributes, content-location, content-type, if-match, if-none-match
       access-control-allow-origin: https://example.com
       """

package/features/passkeys.feature

@@ -20,16 +20,16 @@ Feature: Web Authentication
       201 Created
 
       challenge: ${{ challenge }}
-      identity: ${{ identity.id }}
       timeout: 60000
-      authenticatorSelection:
-        requireResidentKey: true
-        residentKey: required
+      identity: ${{ identity.id }}
       pubKeyCredParams:
         - type: public-key
           alg: -7
         - type: public-key
           alg: -257
+      authenticatorSelection:
+        residentKey: required
+        requireResidentKey: true
       """
 
   Scenario: Create a challenge to create a passkey to new identity
@@ -53,14 +53,14 @@ Feature: Web Authentication
       authorization: Token ${{ token }}
 
       challenge: ${{ challenge }}
-      identity: ${{ identity }}
       timeout: 60000
-      authenticatorSelection:
-        requireResidentKey: true
-        residentKey: required
+      identity: ${{ identity }}
       pubKeyCredParams:
         - type: public-key
           alg: -7
         - type: public-key
           alg: -257
+      authenticatorSelection:
+        residentKey: required
+        requireResidentKey: true
       """