Add controllers and packages for security keys

app/Http/Controllers/Api/Client/SecurityKeyController.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Pterodactyl\Http\Controllers\Api\Client;
+
+use Carbon\CarbonImmutable;
+use Illuminate\Support\Str;
+use Illuminate\Http\Request;
+use Illuminate\Http\JsonResponse;
+use Pterodactyl\Models\SecurityKey;
+use Pterodactyl\Exceptions\DisplayException;
+use Webauthn\PublicKeyCredentialCreationOptions;
+use Illuminate\Contracts\Cache\Repository as CacheRepository;
+use Pterodactyl\Transformers\Api\Client\SecurityKeyTransformer;
+use Pterodactyl\Repositories\SecurityKeys\WebauthnServerRepository;
+use Pterodactyl\Services\Users\SecurityKeys\StoreSecurityKeyService;
+use Pterodactyl\Http\Requests\Api\Client\Account\RegisterSecurityKeyRequest;
+use Pterodactyl\Services\Users\SecurityKeys\CreatePublicKeyCredentialService;
+
+class SecurityKeyController extends ClientApiController
+{
+    public function __construct(
+        protected CreatePublicKeyCredentialService $createPublicKeyCredentialService,
+        protected CacheRepository $cache,
+        protected WebauthnServerRepository $webauthnServerRepository,
+        protected StoreSecurityKeyService $storeSecurityKeyService
+    ) {
+        parent::__construct();
+    }
+
+    /**
+     * Returns all the hardware security keys (WebAuthn) that exists for a user.
+     */
+    public function index(Request $request): array
+    {
+        return $this->fractal->collection($request->user()->securityKeys)
+            ->transformWith(SecurityKeyTransformer::class)
+            ->toArray();
+    }
+
+    /**
+     * Returns the data necessary for creating a new hardware security key for the
+     * user.
+     *
+     * @throws \Webauthn\Exception\InvalidDataException
+     */
+    public function create(Request $request): JsonResponse
+    {
+        $tokenId = Str::random(64);
+        $credentials = $this->createPublicKeyCredentialService->handle($request->user());
+
+        // TODO: session
+        $this->cache->put(
+            "register-security-key:$tokenId",
+            serialize($credentials),
+            CarbonImmutable::now()->addMinutes(10)
+        );
+
+        return new JsonResponse([
+            'data' => [
+                'token_id' => $tokenId,
+                'credentials' => $credentials->jsonSerialize(),
+            ],
+        ]);
+    }
+
+    /**
+     * Stores a new key for a user account.
+     *
+     * @throws \Pterodactyl\Exceptions\DisplayException
+     * @throws \Throwable
+     */
+    public function store(RegisterSecurityKeyRequest $request): array
+    {
+        $credentials = unserialize(
+            $this->cache->pull("register-security-key:{$request->input('token_id')}", serialize(null))
+        );
+
+        if (
+            !is_object($credentials) ||
+            !$credentials instanceof PublicKeyCredentialCreationOptions ||
+            $credentials->getUser()->getId() !== $request->user()->uuid
+        ) {
+            throw new DisplayException('Could not register security key: invalid data present in session, please try again.');
+        }
+
+        $key = $this->storeSecurityKeyService
+            ->setRequest(SecurityKey::getPsrRequestFactory($request))
+            ->setKeyName($request->input('name'))
+            ->handle($request->user(), $request->input('registration'), $credentials);
+
+        return $this->fractal->item($key)
+            ->transformWith(SecurityKeyTransformer::class)
+            ->toArray();
+    }
+
+    /**
+     * Removes a WebAuthn key from a user's account.
+     */
+    public function delete(Request $request, string $securityKey): JsonResponse
+    {
+        $request->user()->securityKeys()->where('uuid', $securityKey)->delete();
+
+        return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);
+    }
+}

app/Http/Controllers/Auth/AbstractLoginController.php

@@ -8,7 +8,6 @@ use Illuminate\Auth\AuthManager;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Auth\Events\Failed;
 use Illuminate\Container\Container;
-use Illuminate\Support\Facades\Event;
 use Pterodactyl\Events\Auth\DirectLogin;
 use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Http\Controllers\Controller;
@@ -37,7 +36,7 @@ abstract class AbstractLoginController extends Controller
     protected string $redirectTo = '/';
 
     /**
-     * LoginController constructor.
+     * AbstractLoginController constructor.
      */
     public function __construct()
     {
@@ -58,7 +57,7 @@ abstract class AbstractLoginController extends Controller
             $this->getField($request->input('user')) => $request->input('user'),
         ]);
 
-        if ($request->route()->named('auth.login-checkpoint')) {
+        if ($request->route()->named('auth.checkpoint') || $request->route()->named('auth.checkpoint.key')) {
             throw new DisplayException($message ?? trans('auth.two_factor.checkpoint_failed'));
         }
 
@@ -77,14 +76,13 @@ abstract class AbstractLoginController extends Controller
 
         $this->auth->guard()->login($user, true);
 
-        Event::dispatch(new DirectLogin($user, true));
+        event(new DirectLogin($user, true));
 
         return new JsonResponse([
-            'data' => [
-                'complete' => true,
-                'intended' => $this->redirectPath(),
-                'user' => $user->toVueObject(),
-            ],
+            'complete' => true,
+            'methods' => [],
+            'intended' => $this->redirectPath(),
+            'user' => $user->toReactObject(),
         ]);
     }
 
@@ -101,6 +99,6 @@ abstract class AbstractLoginController extends Controller
      */
     protected function fireFailedLoginEvent(Authenticatable $user = null, array $credentials = [])
     {
-        Event::dispatch(new Failed('auth', $user, $credentials));
+        event(new Failed('auth', $user, $credentials));
     }
 }

app/Http/Controllers/Auth/LoginCheckpointController.php

@@ -5,14 +5,17 @@ namespace Pterodactyl\Http\Controllers\Auth;
 use Carbon\CarbonImmutable;
 use Carbon\CarbonInterface;
 use Pterodactyl\Models\User;
+use Illuminate\Http\Request;
 use Illuminate\Http\JsonResponse;
 use PragmaRX\Google2FA\Google2FA;
-use Illuminate\Support\Facades\Event;
+use Pterodactyl\Models\SecurityKey;
 use Illuminate\Contracts\Encryption\Encrypter;
+use Webauthn\PublicKeyCredentialRequestOptions;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
-use Pterodactyl\Events\Auth\ProvidedAuthenticationToken;
 use Pterodactyl\Http\Requests\Auth\LoginCheckpointRequest;
 use Illuminate\Contracts\Validation\Factory as ValidationFactory;
+use Pterodactyl\Repositories\SecurityKeys\WebauthnServerRepository;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 
 class LoginCheckpointController extends AbstractLoginController
 {
@@ -24,6 +27,7 @@ class LoginCheckpointController extends AbstractLoginController
     public function __construct(
         private Encrypter $encrypter,
         private Google2FA $google2FA,
+        private WebauthnServerRepository $webauthnServerRepository,
         private ValidationFactory $validation
     ) {
         parent::__construct();
@@ -34,13 +38,80 @@ class LoginCheckpointController extends AbstractLoginController
      * token. Once a user has reached this stage it is assumed that they have already
      * provided a valid username and password.
      *
+     * @return \Illuminate\Http\JsonResponse|void
+     *
      * @throws \PragmaRX\Google2FA\Exceptions\IncompatibleWithGoogleAuthenticatorException
      * @throws \PragmaRX\Google2FA\Exceptions\InvalidCharactersException
      * @throws \PragmaRX\Google2FA\Exceptions\SecretKeyTooShortException
-     * @throws \Exception
      * @throws \Illuminate\Validation\ValidationException
+     * @throws \Pterodactyl\Exceptions\DisplayException
+     * @throws \Exception
      */
-    public function __invoke(LoginCheckpointRequest $request): JsonResponse
+    public function token(LoginCheckpointRequest $request)
+    {
+        $user = $this->extractUserFromRequest($request);
+
+        // Recovery tokens go through a slightly different pathway for usage.
+        if (!is_null($recoveryToken = $request->input('recovery_token'))) {
+            if ($this->isValidRecoveryToken($user, $recoveryToken)) {
+                return $this->sendLoginResponse($user, $request);
+            }
+        } else {
+            if (!$user->use_totp) {
+                $this->sendFailedLoginResponse($request, $user);
+            }
+
+            $decrypted = $this->encrypter->decrypt($user->totp_secret);
+
+            if ($this->google2FA->verifyKey($decrypted, (string) $request->input('authentication_code') ?? '', config('pterodactyl.auth.2fa.window'))) {
+                return $this->sendLoginResponse($user, $request);
+            }
+        }
+
+        $this->sendFailedLoginResponse($request, $user, !empty($recoveryToken) ? 'The recovery token provided is not valid.' : null);
+    }
+
+    /**
+     * Authenticates a login request using a security key for a user.
+     *
+     * @throws \Illuminate\Validation\ValidationException
+     * @throws \Pterodactyl\Exceptions\DisplayException
+     */
+    public function key(Request $request): JsonResponse
+    {
+        $options = $request->session()->get(SecurityKey::PK_SESSION_NAME);
+        if (!$options instanceof PublicKeyCredentialRequestOptions) {
+            throw new BadRequestHttpException('No security keys configured in session.');
+        }
+
+        $user = $this->extractUserFromRequest($request);
+
+        try {
+            $source = $this->webauthnServerRepository->loadAndCheckAssertionResponse(
+                $user,
+                // TODO: we may have to `json_encode` this so it will be decoded properly.
+                $request->input('data'),
+                $options,
+                SecurityKey::getPsrRequestFactory($request)
+            );
+        } catch (\Exception|\Throwable $e) {
+            throw $e;
+        }
+
+        if (hash_equals($user->uuid, $source->getUserHandle())) {
+            return $this->sendLoginResponse($user, $request);
+        }
+
+        throw new BadRequestHttpException('An unexpected error was encountered while validating that security key.');
+    }
+
+    /**
+     * Extracts the user from the session data using the provided confirmation token.
+     *
+     * @throws \Illuminate\Validation\ValidationException
+     * @throws \Pterodactyl\Exceptions\DisplayException
+     */
+    protected function extractUserFromRequest(Request $request): User
     {
         if ($this->hasTooManyLoginAttempts($request)) {
             $this->sendLockoutResponse($request);
@@ -62,24 +133,7 @@ class LoginCheckpointController extends AbstractLoginController
             $this->sendFailedLoginResponse($request, null, self::TOKEN_EXPIRED_MESSAGE);
         }
 
-        // Recovery tokens go through a slightly different pathway for usage.
-        if (!is_null($recoveryToken = $request->input('recovery_token'))) {
-            if ($this->isValidRecoveryToken($user, $recoveryToken)) {
-                Event::dispatch(new ProvidedAuthenticationToken($user, true));
-
-                return $this->sendLoginResponse($user, $request);
-            }
-        } else {
-            $decrypted = $this->encrypter->decrypt($user->totp_secret);
-
-            if ($this->google2FA->verifyKey($decrypted, (string) $request->input('authentication_code') ?? '', config('pterodactyl.auth.2fa.window'))) {
-                Event::dispatch(new ProvidedAuthenticationToken($user));
-
-                return $this->sendLoginResponse($user, $request);
-            }
-        }
-
-        $this->sendFailedLoginResponse($request, $user, !empty($recoveryToken) ? 'The recovery token provided is not valid.' : null);
+        return $user;
     }
 
     /**
@@ -101,14 +155,19 @@ class LoginCheckpointController extends AbstractLoginController
         return false;
     }
 
+    protected function hasValidSessionData(array $data): bool
+    {
+        return static::isValidSessionData($this->validation, $data);
+    }
+
     /**
      * Determines if the data provided from the session is valid or not. This
      * will return false if the data is invalid, or if more time has passed than
      * was configured when the session was written.
      */
-    protected function hasValidSessionData(array $data): bool
+    protected static function isValidSessionData(ValidationFactory $validation, array $data): bool
     {
-        $validator = $this->validation->make($data, [
+        $validator = $validation->make($data, [
             'user_id' => 'required|integer|min:1',
             'token_value' => 'required|string',
             'expires_at' => 'required',

app/Http/Controllers/Auth/LoginController.php

@@ -9,15 +9,19 @@ use Pterodactyl\Models\User;
 use Illuminate\Http\JsonResponse;
 use Pterodactyl\Facades\Activity;
 use Illuminate\Contracts\View\View;
-use Illuminate\Contracts\View\Factory as ViewFactory;
+use Pterodactyl\Models\SecurityKey;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Pterodactyl\Repositories\SecurityKeys\WebauthnServerRepository;
 
 class LoginController extends AbstractLoginController
 {
+    private const METHOD_TOTP = 'totp';
+    private const METHOD_WEBAUTHN = 'webauthn';
+
     /**
      * LoginController constructor.
      */
-    public function __construct(private ViewFactory $view)
+    public function __construct(protected WebauthnServerRepository $webauthnServerRepository)
     {
         parent::__construct();
     }
@@ -29,7 +33,7 @@ class LoginController extends AbstractLoginController
      */
     public function index(): View
     {
-        return $this->view->make('templates/auth.core');
+        return view('templates/auth.core');
     }
 
     /**
@@ -37,6 +41,7 @@ class LoginController extends AbstractLoginController
      *
      * @throws \Pterodactyl\Exceptions\DisplayException
      * @throws \Illuminate\Validation\ValidationException
+     * @throws \Webauthn\Exception\InvalidDataException
      */
     public function login(Request $request): JsonResponse
     {
@@ -62,7 +67,9 @@ class LoginController extends AbstractLoginController
             $this->sendFailedLoginResponse($request, $user);
         }
 
-        if (!$user->use_totp) {
+        // Return early if the user does not have 2FA enabled, otherwise we will require them
+        // to complete a secondary challenge before they can log in.
+        if (!$user->has2FAEnabled()) {
             return $this->sendLoginResponse($user, $request);
         }
 
@@ -74,11 +81,23 @@ class LoginController extends AbstractLoginController
             'expires_at' => CarbonImmutable::now()->addMinutes(5),
         ]);
 
-        return new JsonResponse([
-            'data' => [
-                'complete' => false,
-                'confirmation_token' => $token,
-            ],
-        ]);
+        $response = [
+            'complete' => false,
+            'methods' => array_values(array_filter([
+                $user->use_totp ? self::METHOD_TOTP : null,
+                $user->securityKeys->isNotEmpty() ? self::METHOD_WEBAUTHN : null,
+            ])),
+            'confirm_token' => $token,
+        ];
+
+        if ($user->securityKeys->isNotEmpty()) {
+            $key = $this->webauthnServerRepository->generatePublicKeyCredentialRequestOptions($user);
+
+            $request->session()->put(SecurityKey::PK_SESSION_NAME, $key);
+
+            $request['webauthn'] = ['public_key' => $key];
+        }
+
+        return new JsonResponse($response);
     }
 }

app/Http/Middleware/RequireTwoFactorAuthentication.php

@@ -50,7 +50,7 @@ class RequireTwoFactorAuthentication
         // send them right through, nothing else needs to be checked.
         //
         // If the level is set as admin and the user is not an admin, pass them through as well.
-        if ($level === self::LEVEL_NONE || $user->use_totp) {
+        if ($level === self::LEVEL_NONE || $user->has2FAEnabled()) {
             return $next($request);
         } elseif ($level === self::LEVEL_ADMIN && !$user->root_admin) {
             return $next($request);

app/Http/Requests/Api/Client/Account/RegisterSecurityKeyRequest.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client\Account;
+
+use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
+
+class RegisterSecurityKeyRequest extends ClientApiRequest
+{
+    public function rules(): array
+    {
+        return [
+            'name' => ['string', 'required'],
+            'token_id' => ['required', 'string'],
+            'registration' => ['required', 'array'],
+            'registration.id' => ['required', 'string'],
+            'registration.type' => ['required', 'in:public-key'],
+            'registration.response.attestationObject' => ['required', 'string'],
+            'registration.response.clientDataJSON' => ['required', 'string'],
+        ];
+    }
+}

app/Http/Requests/Api/Client/ClientApiRequest.php

@@ -23,7 +23,7 @@ class ClientApiRequest extends ApplicationApiRequest
                 return $this->user()->can($this->permission(), $server);
             }
 
-            // If there is no server available on the reqest, trigger a failure since
+            // If there is no server available on the request, trigger a failure since
             // we expect there to be one at this point.
             return false;
         }

app/Models/SecurityKey.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Ramsey\Uuid\Uuid;
+use Illuminate\Http\Request;
+use Ramsey\Uuid\UuidInterface;
+use Webauthn\TrustPath\TrustPath;
+use Nyholm\Psr7\Factory\Psr17Factory;
+use Webauthn\PublicKeyCredentialSource;
+use Webauthn\TrustPath\TrustPathLoader;
+use Webauthn\PublicKeyCredentialDescriptor;
+use Psr\Http\Message\ServerRequestInterface;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
+
+class SecurityKey extends Model
+{
+    use HasFactory;
+
+    public const RESOURCE_NAME = 'security_key';
+    public const PK_SESSION_NAME = 'security_key_pk_request';
+
+    protected $casts = [
+        'user_id' => 'int',
+        'transports' => 'array',
+        'other_ui' => 'array',
+    ];
+
+    protected $guarded = [
+        'uuid',
+        'user_id',
+    ];
+
+    public function getPublicKeyAttribute(string $value): string
+    {
+        return base64_decode($value);
+    }
+
+    public function setPublicKeyAttribute(string $value): void
+    {
+        $this->attributes['public_key'] = base64_encode($value);
+    }
+
+    public function getPublicKeyIdAttribute(string $value): string
+    {
+        return base64_decode($value);
+    }
+
+    public function setPublicKeyIdAttribute(string $value): void
+    {
+        $this->attributes['public_key_id'] = base64_encode($value);
+    }
+
+    public function getTrustPathAttribute(?string $value): ?TrustPath
+    {
+        if (is_null($value)) {
+            return null;
+        }
+
+        return TrustPathLoader::loadTrustPath(json_decode($value, true));
+    }
+
+    public function setTrustPathAttribute(?TrustPath $value): void
+    {
+        $this->attributes['trust_path'] = json_encode($value);
+    }
+
+    /**
+     * @param \Ramsey\Uuid\UuidInterface|string|null $value
+     */
+    public function setAaguidAttribute($value): void
+    {
+        $value = $value instanceof UuidInterface ? $value->__toString() : $value;
+
+        $this->attributes['aaguid'] = (is_null($value) || $value === Uuid::NIL) ? null : $value;
+    }
+
+    public function getAaguidAttribute(?string $value): ?UuidInterface
+    {
+        if (!is_null($value) && Uuid::isValid($value)) {
+            return Uuid::fromString($value);
+        }
+
+        return null;
+    }
+
+    public function getPublicKeyCredentialDescriptor(): PublicKeyCredentialDescriptor
+    {
+        return new PublicKeyCredentialDescriptor($this->type, $this->public_key_id, $this->transports);
+    }
+
+    public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
+    {
+        return new PublicKeyCredentialSource(
+            $this->public_key_id,
+            $this->type,
+            $this->transports,
+            $this->attestation_type,
+            $this->trust_path,
+            $this->aaguid ?? Uuid::fromString(Uuid::NIL),
+            $this->public_key,
+            $this->user_handle,
+            $this->counter
+        );
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    /**
+     * Returns a PSR17 Request factory to be used by different Webauthn tooling.
+     */
+    public static function getPsrRequestFactory(Request $request): ServerRequestInterface
+    {
+        $factory = new Psr17Factory();
+
+        $httpFactory = new PsrHttpFactory($factory, $factory, $factory, $factory);
+
+        return $httpFactory->createRequest($request);
+    }
+}

app/Models/User.php

@@ -9,6 +9,7 @@ use Illuminate\Validation\Rules\In;
 use Illuminate\Auth\Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Database\Eloquent\Builder;
+use Webauthn\PublicKeyCredentialUserEntity;
 use Pterodactyl\Models\Traits\HasAccessTokens;
 use Illuminate\Auth\Passwords\CanResetPassword;
 use Pterodactyl\Traits\Helpers\AvailableLanguages;
@@ -47,6 +48,8 @@ use Pterodactyl\Notifications\SendPasswordReset as ResetPasswordNotification;
  * @property int|null $notifications_count
  * @property \Illuminate\Database\Eloquent\Collection|\Pterodactyl\Models\RecoveryToken[] $recoveryTokens
  * @property int|null $recovery_tokens_count
+ * @property \Illuminate\Database\Eloquent\Collection|\Pterodactyl\Models\SecurityKey[] $securityKeys
+ * @property int|null $security_keys_count
  * @property \Illuminate\Database\Eloquent\Collection|\Pterodactyl\Models\Server[] $servers
  * @property int|null $servers_count
  * @property \Illuminate\Database\Eloquent\Collection|\Pterodactyl\Models\UserSSHKey[] $sshKeys
@@ -186,9 +189,9 @@ class User extends Model implements
     }
 
     /**
-     * Return the user model in a format that can be passed over to Vue templates.
+     * Return the user model in a format that can be passed over to React templates.
      */
-    public function toVueObject(): array
+    public function toReactObject(): array
     {
         return Collection::make($this->toArray())->except(['id', 'external_id'])->toArray();
     }
@@ -248,6 +251,11 @@ class User extends Model implements
         return $this->hasMany(UserSSHKey::class);
     }
 
+    public function securityKeys(): HasMany
+    {
+        return $this->hasMany(SecurityKey::class);
+    }
+
     /**
      * Returns all the activity logs where this user is the subject — not to
      * be confused by activity logs where this user is the _actor_.
@@ -271,4 +279,17 @@ class User extends Model implements
             })
             ->groupBy('servers.id');
     }
+
+    public function toPublicKeyCredentialEntity(): PublicKeyCredentialUserEntity
+    {
+        return PublicKeyCredentialUserEntity::create($this->username, $this->uuid, $this->email);
+    }
+
+    /**
+     * Returns true if the user has two-factor authentication enabled.
+     */
+    public function has2FAEnabled(): bool
+    {
+        return $this->use_totp || $this->securityKeys->isNotEmpty();
+    }
 }

app/Repositories/SecurityKeys/PublicKeyCredentialSourceRepository.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Pterodactyl\Repositories\SecurityKeys;
+
+use Pterodactyl\Models\User;
+use Illuminate\Container\Container;
+use Webauthn\PublicKeyCredentialSource;
+use Webauthn\PublicKeyCredentialUserEntity;
+use Pterodactyl\Models\SecurityKey;
+use Webauthn\PublicKeyCredentialSourceRepository as PublicKeyRepositoryInterface;
+
+class PublicKeyCredentialSourceRepository implements PublicKeyRepositoryInterface
+{
+    protected User $user;
+
+    public function __construct(User $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Find a single hardware security token for a user by using the credential ID.
+     */
+    public function findOneByCredentialId(string $id): ?PublicKeyCredentialSource
+    {
+        /** @var \Pterodactyl\Models\SecurityKey $key */
+        $key = $this->user->securityKeys()
+            ->where('public_key_id', base64_encode($id))
+            ->first();
+
+        return optional($key)->getPublicKeyCredentialSource();
+    }
+
+    /**
+     * Find all the hardware tokens that exist for the user using the given
+     * entity handle.
+     */
+    public function findAllForUserEntity(PublicKeyCredentialUserEntity $entity): array
+    {
+        $results = $this->user->securityKeys()
+            ->where('user_handle', $entity->getId())
+            ->get();
+
+        return $results->map(function (SecurityKey $key) {
+            return $key->getPublicKeyCredentialSource();
+        })->values()->toArray();
+    }
+
+    /**
+     * Save a credential to the database and link it with the user.
+     *
+     * @throws \Throwable
+     */
+    public function saveCredentialSource(PublicKeyCredentialSource $source): void
+    {
+        // no-op — we handle creation of the keys in StoreSecurityKeyService
+        //
+        // If you put logic in here it is triggered on each login.
+    }
+
+    /**
+     * Returns a new instance of the repository with the provided user attached.
+     */
+    public static function factory(User $user): self
+    {
+        return Container::getInstance()->make(static::class, ['user' => $user]);
+    }
+}

app/Repositories/SecurityKeys/WebauthnServerRepository.php

@@ -0,0 +1,161 @@
+<?php
+
+namespace Pterodactyl\Repositories\SecurityKeys;
+
+use Cose\Algorithms;
+use Illuminate\Support\Str;
+use Pterodactyl\Models\User;
+use Pterodactyl\Models\SecurityKey;
+use Webauthn\PublicKeyCredentialLoader;
+use Webauthn\PublicKeyCredentialSource;
+use Webauthn\PublicKeyCredentialRpEntity;
+use Webauthn\PublicKeyCredentialParameters;
+use Psr\Http\Message\ServerRequestInterface;
+use Webauthn\AuthenticatorAssertionResponse;
+use Webauthn\AuthenticatorSelectionCriteria;
+use Webauthn\AuthenticatorAttestationResponse;
+use Cose\Algorithm\Manager as AlgorithmManager;
+use Webauthn\PublicKeyCredentialRequestOptions;
+use Webauthn\PublicKeyCredentialCreationOptions;
+use Webauthn\AuthenticatorAssertionResponseValidator;
+use Webauthn\AuthenticatorAttestationResponseValidator;
+use Webauthn\AttestationStatement\AttestationObjectLoader;
+use Webauthn\AuthenticationExtensions\ExtensionOutputCheckerHandler;
+use Webauthn\AttestationStatement\AttestationStatementSupportManager;
+
+final class WebauthnServerRepository
+{
+    private PublicKeyCredentialSourceRepository $publicKeyCredentialSourceRepository;
+
+    private PublicKeyCredentialRpEntity $rpEntity;
+    private PublicKeyCredentialLoader $credentialLoader;
+    private AuthenticatorAssertionResponseValidator $assertionValidator;
+    private AuthenticatorAttestationResponseValidator $attestationValidator;
+
+    public function __construct(PublicKeyCredentialSourceRepository $publicKeyCredentialSourceRepository)
+    {
+        $url = str_replace(['http://', 'https://'], '', config('app.url'));
+
+        $this->publicKeyCredentialSourceRepository = $publicKeyCredentialSourceRepository;
+
+        $this->rpEntity = new PublicKeyCredentialRpEntity(config('app.name'), trim($url, '/'));
+        $this->credentialLoader = new PublicKeyCredentialLoader(new AttestationObjectLoader(new AttestationStatementSupportManager()));
+        $this->assertionValidator = new AuthenticatorAssertionResponseValidator(
+            $this->publicKeyCredentialSourceRepository,
+            null,
+            ExtensionOutputCheckerHandler::create(),
+            AlgorithmManager::create(),
+        );
+        $this->attestationValidator = new AuthenticatorAttestationResponseValidator(
+            new AttestationStatementSupportManager(),
+            $this->publicKeyCredentialSourceRepository,
+            null,
+            new ExtensionOutputCheckerHandler(),
+        );
+    }
+
+    /**
+     * @throws \Webauthn\Exception\InvalidDataException
+     */
+    public function getPublicKeyCredentialCreationOptions(User $user): PublicKeyCredentialCreationOptions
+    {
+        $excluded = $user->securityKeys->map(function (SecurityKey $key) {
+            return $key->getPublicKeyCredentialDescriptor();
+        })->values()->toArray();
+
+        $challenge = Str::random(16);
+
+        return (new PublicKeyCredentialCreationOptions(
+            $this->rpEntity,
+            $user->toPublicKeyCredentialEntity(),
+            $challenge,
+            [
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES256),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES256K),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES384),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES512),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_RS256),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_RS384),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_RS512),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_PS256),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_PS384),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_PS512),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ED256),
+                PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ED512),
+            ],
+        ))
+            ->setTimeout(30_000)
+            ->excludeCredentials(...$excluded)
+            ->setAttestation(PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE)
+            ->setAuthenticatorSelection(AuthenticatorSelectionCriteria::create());
+    }
+
+    /**
+     * @throws \Webauthn\Exception\InvalidDataException
+     */
+    public function generatePublicKeyCredentialRequestOptions(User $user): PublicKeyCredentialRequestOptions
+    {
+        $allowedCredentials = $user->securityKeys->map(function (SecurityKey $key) {
+            return $key->getPublicKeyCredentialDescriptor();
+        })->values()->toArray();
+
+        return (new PublicKeyCredentialRequestOptions(Str::random(32)))
+            ->allowCredentials(...$allowedCredentials)
+            ->setUserVerification(PublicKeyCredentialRequestOptions::USER_VERIFICATION_REQUIREMENT_PREFERRED);
+    }
+
+    /**
+     * @throws \Throwable
+     * @throws \JsonException
+     */
+    public function loadAndCheckAssertionResponse(
+        User $user,
+        array $data,
+        PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions,
+        ServerRequestInterface $request
+    ): PublicKeyCredentialSource {
+        $credential = $this->credentialLoader->loadArray($data);
+
+        $authenticatorAssertionResponse = $credential->getResponse();
+        if (!$authenticatorAssertionResponse instanceof AuthenticatorAssertionResponse) {
+            // TODO
+            throw new \Exception('');
+        }
+
+        return $this->assertionValidator->check(
+            $credential->getRawId(),
+            $authenticatorAssertionResponse,
+            $publicKeyCredentialRequestOptions,
+            $request,
+            null, // TODO: use handle?
+//            $user->toPublicKeyCredentialEntity()
+        );
+    }
+
+    /**
+     * Register a new security key for a user.
+     *
+     * @throws \Throwable
+     * @throws \JsonException
+     */
+    public function loadAndCheckAttestationResponse(
+        User $user,
+        array $data,
+        PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions,
+        ServerRequestInterface $request
+    ): PublicKeyCredentialSource {
+        $credential = $this->credentialLoader->loadArray($data);
+
+        $authenticatorAttestationResponse = $credential->getResponse();
+        if (!$authenticatorAttestationResponse instanceof AuthenticatorAttestationResponse) {
+            // TODO
+            throw new \Exception('');
+        }
+
+        return $this->attestationValidator->check(
+            $authenticatorAttestationResponse,
+            $publicKeyCredentialCreationOptions,
+            $request,
+        );
+    }
+}

app/Services/Users/SecurityKeys/CreatePublicKeyCredentialService.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Pterodactyl\Services\Users\SecurityKeys;
+
+use Pterodactyl\Models\User;
+use Webauthn\PublicKeyCredentialCreationOptions;
+use Pterodactyl\Repositories\SecurityKeys\WebauthnServerRepository;
+
+class CreatePublicKeyCredentialService
+{
+    protected WebauthnServerRepository $webauthnServerRepository;
+
+    public function __construct(WebauthnServerRepository $webauthnServerRepository)
+    {
+        $this->webauthnServerRepository = $webauthnServerRepository;
+    }
+
+    /**
+     * @throws \Webauthn\Exception\InvalidDataException
+     */
+    public function handle(User $user): PublicKeyCredentialCreationOptions
+    {
+        return $this->webauthnServerRepository->getPublicKeyCredentialCreationOptions($user);
+    }
+}

app/Services/Users/SecurityKeys/StoreSecurityKeyService.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace Pterodactyl\Services\Users\SecurityKeys;
+
+use Ramsey\Uuid\Uuid;
+use Illuminate\Support\Str;
+use Pterodactyl\Models\User;
+use Webmozart\Assert\Assert;
+use Pterodactyl\Models\SecurityKey;
+use Psr\Http\Message\ServerRequestInterface;
+use Webauthn\PublicKeyCredentialCreationOptions;
+use Pterodactyl\Repositories\SecurityKeys\WebauthnServerRepository;
+
+class StoreSecurityKeyService
+{
+    protected ?ServerRequestInterface $request = null;
+
+    protected ?string $keyName = null;
+
+    public function __construct(protected WebauthnServerRepository $webauthnServerRepository)
+    {
+    }
+
+    /**
+     * Sets the server request interface on the service, this is needed by the attestation
+     * checking service on the Webauthn server.
+     */
+    public function setRequest(ServerRequestInterface $request): self
+    {
+        $this->request = $request;
+
+        return $this;
+    }
+
+    /**
+     * Sets the security key's name. If not provided a random string will be used.
+     */
+    public function setKeyName(?string $name): self
+    {
+        $this->keyName = $name;
+
+        return $this;
+    }
+
+    /**
+     * Validates and stores a new hardware security key on a user's account.
+     *
+     * @throws \Throwable
+     */
+    public function handle(User $user, array $registration, PublicKeyCredentialCreationOptions $options): SecurityKey
+    {
+        Assert::notNull($this->request, 'A request interface must be set on the service before it can be called.');
+
+        $source = $this->webauthnServerRepository->loadAndCheckAttestationResponse($user, $registration, $options, $this->request);
+
+        // Unfortunately this repository interface doesn't define a response — it is explicitly
+        // void — so we need to just query the database immediately after this to pull the information
+        // we just stored to return to the caller.
+        /** @var \Pterodactyl\Models\SecurityKey $key */
+        $key = $user->securityKeys()->make()->forceFill([
+            'uuid' => Uuid::uuid4(),
+            'name' => $this->keyName ?? 'Security Key (' . Str::random() . ')',
+            'public_key_id' => $source->getPublicKeyCredentialId(),
+            'public_key' => $source->getCredentialPublicKey(),
+            'aaguid' => $source->getAaguid(),
+            'type' => $source->getType(),
+            'transports' => $source->getTransports(),
+            'attestation_type' => $source->getAttestationType(),
+            'trust_path' => $source->getTrustPath(),
+            'user_handle' => $user->uuid,
+            'counter' => $source->getCounter(),
+            'other_ui' => $source->getOtherUI(),
+        ]);
+
+        $key->saveOrFail();
+
+        return $key;
+    }
+}

app/Transformers/Api/Client/SecurityKeyTransformer.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Pterodactyl\Transformers\Api\Client;
+
+use Pterodactyl\Models\SecurityKey;
+
+class SecurityKeyTransformer extends BaseClientTransformer
+{
+    public function getResourceName(): string
+    {
+        return SecurityKey::RESOURCE_NAME;
+    }
+
+    public function transform(SecurityKey $model): array
+    {
+        return [
+            'uuid' => $model->uuid,
+            'name' => $model->name,
+            'type' => $model->type,
+            'public_key_id' => base64_encode($model->public_key_id),
+            'created_at' => self::formatTimestamp($model->created_at),
+            'updated_at' => self::formatTimestamp($model->updated_at),
+        ];
+    }
+}