feat(jans-fido2): add attestation trust policy and attestationTrusted flag for monitor mode

[imran-ishaq]

Prepare

• Read PR guidelines
• Read license information

---

Description

Adds the foundation for permissive monitor / strict enforced attestation semantics (#9640), with no behavior change on its own:

• New AttestationTrustPolicy component centralizing the per-mode handling of attestation-trust failures: enforced rejects; monitor/disabled log a warning, mark the credential not-trusted, and allow registration to complete. Core cryptographic checks are unaffected and remain always-enforced by their existing callers.
• New attestationTrusted flag (default true) on CredAndCounterData and on the persisted Fido2RegistrationData (a JSON-serialized POJO — no schema migration), populated in AttestationService.verify alongside the existing authenticator-data flags.

Target issue

The agreed direction for attestation modes (#9640) is that monitor should be permissive — validate and log attestation-trust problems but still allow registration — while enforced rejects, and core cryptographic checks are always enforced in both. Before the attestation processors can implement that split, the codebase needs two foundations that don't exist yet:

- a single, testable place that decides what to do with an attestation-trust failure based on the configured mode, and
- a way to record, per credential, that its attestation provenance was not verified (so a monitor-allowed credential still registers cleanly but its record is honest).

Without these, the leniency logic would be scattered across every processor and a monitor-allowed credential would
carry no indication that its provenance was unverified.

closes #14385

Implementation Details

- AttestationTrustPolicy.onTrustFailure(type, message, authData, out) throws via ErrorResponseFactory in enforced mode; otherwise logs a WARN with the AAGUID and sets out.setAttestationTrusted(false).

• The flag defaults to true, so until the follow-up wires the processors, every credential remains marked trusted and behavior is identical to today.
• Spans two modules: jans-orm (the Fido2RegistrationData field) and jans-fido2. Build/install jans-orm before jans-fido2.

---

Test and Document the changes

• New unit test AttestationTrustPolicyTest (enforced throws; monitor tolerates and marks not-trusted; mode checks).
• Full jans-fido2 server suite green (190 tests, 0 failures); behavior-neutral change.
• No user-facing docs impacted (internal foundation; the user-visible mode-behavior change lands with the follow-up).

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

Summary by CodeRabbit

• New Features

  • Added configurable attestation trust handling for FIDO2 registrations.
  • In enforced mode, trust failures now stop the registration flow with a clear client error.
  • In monitor mode, registrations can continue while marking the attestation as untrusted for later review.

• Bug Fixes

  • Improved tracking of attestation trust status so untrusted registrations are clearly flagged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c23ffd33-11fe-4f7d-9a2a-6851c8bf49dd

📥 Commits

Reviewing files that changed from the base of the PR and between eaefe2c and 8d4a890.

📒 Files selected for processing (3)

• jans-fido2/server/src/main/java/io/jans/fido2/model/auth/CredAndCounterData.java
• jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AttestationTrustPolicy.java
• jans-fido2/server/src/test/java/io/jans/fido2/service/processor/attestation/AttestationTrustPolicyTest.java

---

📝 Walkthrough

Walkthrough

This PR adds an attestationTrusted boolean flag (default true) with getter/setter to CredAndCounterData, and introduces a new AttestationTrustPolicy class that checks whether attestation mode is enforced and handles trust failures by either throwing an exception or logging and marking credentials untrusted. Unit tests cover both modes.

Changes

Attestation Trust Policy

Layer / File(s)	Summary
Trusted flag on credential data jans-fido2/server/.../model/auth/CredAndCounterData.java	Adds attestationTrusted field defaulting to true, with isAttestationTrusted()/setAttestationTrusted(boolean) accessors.
Trust policy component jans-fido2/server/.../service/processor/attestation/AttestationTrustPolicy.java	New @ApplicationScoped class checking isEnforced() against configuration and onTrustFailure(...) that throws a bad-request exception when enforced, or logs a warning and marks CredAndCounterData as untrusted when in monitor mode.
Trust policy tests jans-fido2/server/.../test/.../AttestationTrustPolicyTest.java	New test class verifying onTrustFailure throws a 400 error in enforced mode and tolerates failures (marking data untrusted) in monitor mode.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related issues

• feat(jans-orm): add attestationTrusted flag to Fido2RegistrationData #14387: Uses the same attestationTrusted flag introduced here for FIDO2 attestation monitor/enforced mode handling.
• feat(jans-fido2): define monitor vs enforced attestation-mode semantics #14347: Implements the monitor-vs-enforced attestation semantics via the trust-failure handling and trusted flag added in this PR.
• feat(jans-fido2): enforce MDS metadata-fetch / status failures in enforced attestation mode #14339: Directly related to the AttestationTrustPolicy enforcement/monitor behavior introduced here.

Suggested reviewers: yurem

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The policy and in-memory flag are covered, but the summary doesn't confirm the persisted registration flag required by the issue.	Add or confirm the jans-orm Fido2RegistrationData attestationTrusted field and where it is populated during attestation verification.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly summarizes the main change: a new attestation trust policy plus the attestationTrusted flag for monitor mode.
Description check	✅ Passed	The PR includes the required sections, target issue, implementation details, test notes, and the docs-impact confirmation.
Out of Scope Changes check	✅ Passed	The changes stay within the attestation-trust foundation: policy, trust flag, and tests, with no unrelated feature work evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jans-fido2-conformance-attestation-trust-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mo-auto]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate passed for 'orm'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'Fido2 API'

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud