Merge pull request #284 from okta/okta-1209004-webauthn-credentials-merge-fix

Fix WebAuthn/Duo credentials merge bug (OKTA-1209004)

Author: AlexNachbaur

Sources/OktaIdxAuth/Internal/Extensions/IDXRemediation+Extensions.swift

@@ -69,12 +69,14 @@ extension Remediation.Form.Field {
             if let form = self.form,
                !form.allFields.isEmpty
             {
+                var nestedJSON = JSON([:])
                 for field in form.allFields {
                     guard let nestedResult = try field.formValue else {
                         continue
                     }
-                    json[name] = nestedResult
+                    nestedJSON.value += nestedResult
                 }
+                json[name] = nestedJSON.value
             }
 
             // Named form values that consist of multiple child options

Tests/OktaIdxAuthTests/IDXExtractFormValueTests.swift

@@ -87,6 +87,54 @@ class IDXExtractFormValueTests: XCTestCase {
         XCTAssertEqual(result["credentials"], .object(["passcode": "password"]))
     }
 
+    // OKTA-1209004: A named field with a nested `form` containing multiple
+    // child fields (e.g. WebAuthn's `credentials` object) must merge all of
+    // its children into a single object, not overwrite with only the last one.
+    func testNestedWithMultipleChildValues() throws {
+        let form = try XCTUnwrap(Form(fields: [
+            Form.Field(name: "stateHandle",
+                      value: "abcEasyAs123",
+                      visible: false,
+                      mutable: false,
+                      required: true,
+                      secret: false),
+            Form.Field(name: "credentials",
+                      type: "object",
+                      visible: true,
+                      mutable: true,
+                      required: true,
+                      secret: false,
+                      form: Form(fields: [
+                        Form.Field(name: "authenticatorData",
+                                  visible: true,
+                                  mutable: true,
+                                  required: true,
+                                  secret: false),
+                        Form.Field(name: "clientData",
+                                  visible: true,
+                                  mutable: true,
+                                  required: true,
+                                  secret: false),
+                        Form.Field(name: "signatureData",
+                                  visible: true,
+                                  mutable: true,
+                                  required: true,
+                                  secret: false)
+                      ]))
+        ]))
+        form["credentials.authenticatorData"]?.value = "IMIVPkdt3y..."
+        form["credentials.clientData"]?.value = "eyJ0e..."
+        form["credentials.signatureData"]?.value = "MEUC..."
+
+        let result = try form.formValue
+        XCTAssertEqual(result["stateHandle"], "abcEasyAs123")
+        XCTAssertEqual(result["credentials"], [
+            "authenticatorData": "IMIVPkdt3y...",
+            "clientData": "eyJ0e...",
+            "signatureData": "MEUC..."
+        ])
+    }
+
     func testNestedWithNestedDefaults() throws {
         let nestedForm = Form.Field(label: "Security Question",
                                    visible: true,