[POC] WebAuthn CLI #1

lib/rubygems/gemcutter_utilities.rb

@@ -82,8 +82,8 @@ def host
   #
   # If +allowed_push_host+ metadata is present, then it will only allow that host.
 
-  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, &block)
-    require "net/http"
+  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, email: nil, password: nil, &block)
+    require 'net/http'
 
     self.host = host if host
     unless self.host
@@ -105,7 +105,7 @@ def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scop
     response = request_with_otp(method, uri, &block)
 
     if mfa_unauthorized?(response)
-      ask_otp
+      ask_otp(email, password)
       response = request_with_otp(method, uri, &block)
     end
 
@@ -171,7 +171,7 @@ def sign_in(sign_in_host = nil, scope: nil)
     say "#{warning}\n" if warning
 
     response = rubygems_api_request(:post, "api/v1/api_key",
-                                    sign_in_host, scope: scope) do |request|
+                                    sign_in_host, email: email, password: password, scope: scope) do |request|
       request.basic_auth email, password
       request["OTP"] = otp if otp
       request.body = URI.encode_www_form({ name: key_name }.merge(all_params))
@@ -243,9 +243,26 @@ def request_with_otp(method, uri, &block)
     end
   end
 
-  def ask_otp
-    say "You have enabled multi-factor authentication. Please enter OTP code."
-    options[:otp] = ask "Code: "
+  def ask_otp(email, password)
+    webauthn_url = webauthn_verification_url(email, password)
+    unless webauthn_url
+      say 'You have enabled multi-factor authentication. Please enter OTP code.'
+    else
+      say "You have enabled multi-factor authentication. Please enter OTP code from your security device by visiting #{webauthn_url} or your authenticator app."
+    end
+
+    options[:otp] = ask 'Code: '
+  end
+
+  def webauthn_verification_url(email, password)
+    response = rubygems_api_request(:post, "api/v1/webauthn") do |request|
+      if email
+        request.basic_auth email, password
+      else
+        request.add_field "Authorization",  api_key
+      end
+    end
+    response.is_a?(Net::HTTPSuccess) ? response.body : nil
   end
 
   def pretty_host(host)