From 33cdaf1da2f0384266cc852f8fe8c3db49be7722 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Wed, 9 May 2018 17:45:54 +0200
Subject: [PATCH] Fix issue with |savedCredentialId| scope

This fixes one of the inline issues in the spec.

Since the value of the |savedCredentialId| variable depends on the
credentials contained in each |authenticator|, a single global
|savedCredentialId| variable is not sufficient. Therefore a map of
|authenticator|s to |savedCredentialId|s is used instead.
---
 index.bs | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/index.bs b/index.bs
index 9cc2c53c5..a3a6f68e7 100644
--- a/index.bs
+++ b/index.bs
@@ -1202,6 +1202,8 @@ When this method is invoked, the user agent MUST execute the following algorithm
 
 1. Let |authenticator| be a platform-specific handle whose value identifies an [=authenticator=].
 
+1. Let |savedCredentialIds| be a new [=map=].
+
 1. Start |lifetimeTimer|.
 
 1. [=set/For each=] |authenticator| that becomes available on this platform during the lifetime of
@@ -1260,14 +1262,10 @@ When this method is invoked, the user agent MUST execute the following algorithm
 
                 1. Let |distinctTransports| be a new [=ordered set=].
 
-                1. If |allowCredentialDescriptorList| has exactly one value, let |savedCredentialId| be a new 
-                    {{PublicKeyCredentialDescriptor}}.{{PublicKeyCredentialDescriptor/id}} and set its value to <code>|allowCredentialDescriptorList|[0].id</code>'s
+                1. If |allowCredentialDescriptorList| has exactly one value, set
+                    <code>|savedCredentialIds|[|authenticator|]</code> to <code>|allowCredentialDescriptorList|[0].id</code>'s
                     value (see [here](#authenticatorGetAssertion-return-values) in [[#op-get-assertion]] for more information).
 
-                Issue: The foregoing step _may_ be incorrect, in that we are attempting to create |savedCredentialId|
-                    here and use it later below, and we do not have a global in which to allocate a place for it. Perhaps this
-                    is good enough?  addendum: [@jcjones feels the above step is likely good enough](https://github.com/w3c/webauthn/pull/665#discussion_r148130187).
-
                 1. [=list/For each=] credential descriptor |C| in |allowCredentialDescriptorList|,
                     [=set/append=] each value, if any, of <code>|C|.{{transports}}</code> to |distinctTransports|.
 
@@ -1336,10 +1334,10 @@ When this method is invoked, the user agent MUST execute the following algorithm
             1.  Let <var ignore>assertionCreationData</var> be a [=struct=] whose [=items=] are:
 
                 :   <code><dfn for="assertionCreationData">credentialIdResult</code>
-                ::  If |savedCredentialId| exists, set the value of [=credentialIdResult=] to be the bytes of
-                    |savedCredentialId|. Otherwise, set the value of [=credentialIdResult=] to be the bytes of the
-                    [=credential ID=] returned from the successful [=authenticatorGetAssertion=] operation, as defined in
-                    [[#op-get-assertion]].
+                ::  If <code>|savedCredentialIds|[|authenticator|]</code> exists, set the value of [=credentialIdResult=] to be
+                    the bytes of <code>|savedCredentialIds|[|authenticator|]</code>. Otherwise, set the value of
+                    [=credentialIdResult=] to be the bytes of the [=credential ID=] returned from the successful
+                    [=authenticatorGetAssertion=] operation, as defined in [[#op-get-assertion]].
 
                 :   <code><dfn for="assertionCreationData">clientDataJSONResult</dfn></code>
                 ::  whose value is the bytes of |clientDataJSON|.