[PM-25473] Non-encryption passkeys prevent key rotation (#6359)

* use webauthn credentials that have encrypted user key for user key rotation

* where condition simplification

src/Api/KeyManagement/Validators/WebAuthnLoginKeyRotationValidator.cs

@@ -1,4 +1,5 @@
 using Bit.Api.Auth.Models.Request.WebAuthn;
+using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Entities;
@@ -6,7 +7,13 @@ using Bit.Core.Exceptions;
 
 namespace Bit.Api.KeyManagement.Validators;
 
-public class WebAuthnLoginKeyRotationValidator : IRotationValidator<IEnumerable<WebAuthnLoginRotateKeyRequestModel>, IEnumerable<WebAuthnLoginRotateKeyData>>
+/// <summary>
+/// Validates WebAuthn credentials during key rotation. Only processes credentials that have PRF enabled
+/// and have encrypted user, public, and private keys. Ensures all such credentials are included
+/// in the rotation request with the required encrypted keys.
+/// </summary>
+public class WebAuthnLoginKeyRotationValidator : IRotationValidator<IEnumerable<WebAuthnLoginRotateKeyRequestModel>,
+    IEnumerable<WebAuthnLoginRotateKeyData>>
 {
     private readonly IWebAuthnCredentialRepository _webAuthnCredentialRepository;
 
@@ -15,24 +22,20 @@ public class WebAuthnLoginKeyRotationValidator : IRotationValidator<IEnumerable<
         _webAuthnCredentialRepository = webAuthnCredentialRepository;
     }
 
-    public async Task<IEnumerable<WebAuthnLoginRotateKeyData>> ValidateAsync(User user, IEnumerable<WebAuthnLoginRotateKeyRequestModel> keysToRotate)
+    public async Task<IEnumerable<WebAuthnLoginRotateKeyData>> ValidateAsync(User user,
+        IEnumerable<WebAuthnLoginRotateKeyRequestModel> keysToRotate)
     {
         var result = new List<WebAuthnLoginRotateKeyData>();
-        var existing = await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id);
-        if (existing == null)
+        var validCredentials = (await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id))
+            .Where(credential => credential.GetPrfStatus() == WebAuthnPrfStatus.Enabled).ToList();
+        if (validCredentials.Count == 0)
         {
             return result;
         }
 
-        var validCredentials = existing.Where(credential => credential.SupportsPrf);
-        if (!validCredentials.Any())
+        foreach (var webAuthnCredential in validCredentials)
         {
-            return result;
-        }
-
-        foreach (var ea in validCredentials)
-        {
-            var keyToRotate = keysToRotate.FirstOrDefault(c => c.Id == ea.Id);
+            var keyToRotate = keysToRotate.FirstOrDefault(c => c.Id == webAuthnCredential.Id);
             if (keyToRotate == null)
             {
                 throw new BadRequestException("All existing webauthn prf keys must be included in the rotation.");
@@ -42,6 +45,7 @@ public class WebAuthnLoginKeyRotationValidator : IRotationValidator<IEnumerable<
             {
                 throw new BadRequestException("WebAuthn prf keys must have user-key during rotation.");
             }
+
             if (keyToRotate.EncryptedPublicKey == null)
             {
                 throw new BadRequestException("WebAuthn prf keys must have public-key during rotation.");

src/Core/Auth/Entities/WebAuthnCredential.cs

@@ -22,13 +22,30 @@ public class WebAuthnCredential : ITableObject<Guid>
     [MaxLength(20)]
     public string Type { get; set; }
     public Guid AaGuid { get; set; }
+
+    /// <summary>
+    /// User key encrypted with this WebAuthn credential's public key (EncryptedPublicKey field).
+    /// </summary>
     [MaxLength(2000)]
     public string EncryptedUserKey { get; set; }
+
+    /// <summary>
+    /// Private key encrypted with an external key for secure storage.
+    /// </summary>
     [MaxLength(2000)]
     public string EncryptedPrivateKey { get; set; }
+
+    /// <summary>
+    /// Public key encrypted with the user key for key rotation.
+    /// </summary>
     [MaxLength(2000)]
     public string EncryptedPublicKey { get; set; }
+
+    /// <summary>
+    /// Indicates whether this credential supports PRF (Pseudo-Random Function) extension.
+    /// </summary>
     public bool SupportsPrf { get; set; }
+
     public DateTime CreationDate { get; internal set; } = DateTime.UtcNow;
     public DateTime RevisionDate { get; internal set; } = DateTime.UtcNow;