Credentials Portal Spec

[iinuwa]

Hey all,

I've spoken with some of you about the desire to create a new credentials portal based on credentialsd before, but opening a discussion here to talk more specifically about it.

I started some work on documenting the DBus API in its current state in credentialsd, but I'm not quite sure how to annotate all of it. So I wanted to post it here to get some pointers. Let me know if this is easier to discuss in a draft PR instead.

Frontend

<?xml version="1.0"?>

<!--
 Copyright (C) 2025 Red Hat, Inc.

 SPDX-License-Identifier: LGPL-2.1-or-later

 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.

 This library is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.

 You should have received a copy of the GNU Lesser General Public
 License along with this library. If not, see <http://www.gnu.org/licenses/>.

 Author: Isaiah Inuwa <[email protected]>
-->

<node name="/" xmlns:doc="http://www.freedesktop.org/dbus/1.0/doc.dtd">
  <!--
      org.freedesktop.portal.CredentialsX:
      @short_description: Credentials portal

      The credentials portal allows applications to request web
      credentials. The user will be prompted to select a credential,
      which the application can use to authenticate.

      Currently the only supported credential type is WebAuthn
      credentials.

      Credentials are created by CreateCredential() and retrieved
      by GetCredential().

      The D-Bus interface for the credentials portal is available
      under the bus name org.freedesktop.portal.Credentials and the
      object path /org/freedesktop/portal/credentials.

      This documentation describes a pre-release version of this
      interface.
  -->
  <interface name="org.freedesktop.portal.CredentialsX">

    <!--
        CreateCredential:
        @request: The credential request context and parameters.

        Returns a credential.
    -->
    <method name="CreateCredential">
      <!--
        CreateCredentialRequest:
        @origin: the web origin at which the request is made.
        @is_same_origin: Whether the top-level origin of the client
        is the same as the origin for which the request is made.
        @type: the type of credential to create. One of
        ["publicKey"].
        @public_key: if @type is "publicKey", this field contains
        a dictionary, with a single field, `request_json`, which
        is a string of JSON that corresponds to the WebAuthn
        PublicKeyCredentialCreationOptions type.
      -->
      <annotation name="org.qtproject.QtDBus.QtTypeName.In0" value="QVariantMap"/>
      <arg name="request" type="a{sv}" direction="in"/>
      <!--
          CreateCredentialResponse:
          @type: string denoting what type of credential has been
          returned. One of ["publicKey"].
          @registration_response_json: if @type is "publicKey", a
          string of JSON that corresonds to the WebAuthn
          PublicKeyCredential type with the `response` field set as
          an AuthenticatorAttestationResponse.
      -->
      <annotation name="org.qtproject.QtDBus.QtTypeName.Out0" value="QVariantMap"/>
      <arg type="a{sv}" direction="out"/>
    </method>
    <!--
        GetCredential:
        @request: The credential request context and parameters.

        Returns a credential.
    -->
    <method name="GetCredential">
      <!--
        GetCredentialRequest:
        @origin: the web origin at which the request is made.
        @is_same_origin: Whether the top-level origin of the client
        is the same as the origin for which the request is made.
        @type: the type of credential to create. One of
        ["publicKey"].
        @public_key: if @type is "publicKey", this field contains
        the a dictionary, with a single field, `request_json`, which
        is a string of JSON that corresponds to the WebAuthn
        PublicKeyCredentialRequestOptions type.
      -->
      <annotation name="org.qtproject.QtDBus.QtTypeName.In0" value="QVariantMap"/>
      <arg name="request" type="a{sv}" direction="in"/>

      <!--
          GetCredentialResponse:
          @type: string denoting what type of credential has been
          returned. One of ["publicKey"].
          @authentication_response_json: if @type is "publicKey", a
          string of JSON that corresonds to the WebAuthn
          PublicKeyCredential type with the `response` field set as
          an AuthenticatorAssertionResponse.
      -->
      <annotation name="org.qtproject.QtDBus.QtTypeName.Out0" value="QVariantMap"/>
      <arg type="a{sv}" direction="out"/>
    </method>
      <!--
          GetClientCapabilities:

          Returns a set of boolean flags indicating what features
          this API supports.

          See the WebAuthn spec for meanings of the client
          capability keys.
      -->
    <method name="GetClientCapabilities">
      <!--
          Response:
          @conditional_create: Whether conditional mediation is
          supported for credential registration.
          @conditional_get: Whether conditional mediation is
          supported for authentication.
          @hybrid_transport: Whether hybrid authenticators are
          supported.
          @passkey_platform_authenticator: Whether a passkey
          platform authenticator (local or via hybrid transport) is
          accessible via this API.
          @user_verifying_platform_authenticator: Whether a
          user-verifying platform authenticator is available via
          this API.
          @related_origins: Whether matching origins using WebAuthn
          Related Origin Requests is supported.
          @signal_all_accepted_credentials: Whether WebAuthn
          signalAllAcceptedCredentials() is supported.
          @signal_current_user_details: Whether WebAuthn
          signalCurrentUserDetails() is supported.
          @signal_unknown_credential: The WebAuthn Client supports
          signalUnknownCredential().
      -->
      <arg type="a{sb}" direction="out"/>
    </method>
  </interface>
</node>

Backend

<?xml version="1.0"?>
<!--
 Copyright (C) 2016 Red Hat, Inc.

 SPDX-License-Identifier: LGPL-2.1-or-later

 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2.1 of the License, or (at your option) any later version.

 This library is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.

 You should have received a copy of the GNU Lesser General Public
 License along with this library. If not, see <http://www.gnu.org/licenses/>.

 Author: Isaiah Inuwa <[email protected]>
-->
<node name="/" xmlns:doc="http://www.freedesktop.org/dbus/1.0/doc.dtd">
  <!--
      org.freedesktop.impl.portal.CredentialsX:
      @short_description: Credentials portal backend interface

      The Credentials portal allows sandboxed applications to retrieve
      web credentials.
  -->
  <interface name="org.freedesktop.impl.portal.CredentialsX">
    <!--
        SelectCredential:
        @handle: Object path for the :ref:`org.freedesktop.impl.portal.Request` object representing this call
        @app_id: App id of the application
        @parent_window: Identifier for the application window, see :doc:`window-identifiers`
        @request_id: ID for the request.
        @request_type: Type of credential ceremony. One of ["CreatePassword", "CreatePublicKey", "GetCredential"].
        @requestor_id: Third-party service requesting the credential.
        @options: Vardict with optional further information
        @response: Vardict with the results of the call

        Presents a print dialog to the user and returns print settings
        and page setup.

        Supported keys in the @options vardict:

        * ``requestor_name`` (``s``)

          The human-readable name of the requestor, suitable for display.

    -->
    <method name="SelectCredential">
      <arg type="o" name="handle" direction="in"/>
      <arg type="s" name="app_id" direction="in"/>
      <arg type="s" name="parent_window" direction="in"/>
      <arg type="s" name="request_id" direction="in"/>
      <arg type="s" name="request_type" direction="in"/>
      <arg type="u" name="requestor_id" direction="in"/>
      <annotation name="org.qtproject.QtDBus.QtTypeName.In6" value="QVariantMap"/>
      <arg type="a{sv}" name="options" direction="in"/>
      <annotation name="org.qtproject.QtDBus.QtTypeName.Out0" value="QVariantMap"/>
      <arg type="a{sv}" name="response" direction="out"/>
    </method>

    <!--
        Print:
        @handle: Object path for the :ref:`org.freedesktop.impl.portal.Request` object representing this call
        @app_id: App id of the application
        @parent_window: Identifier for the application window, see :doc:`window-identifiers`
        @title: Title for the print dialog
        @fd: File descriptor from which to read the content to print
        @options: Vardict with optional further information
        @response: Numeric response
        @results: Vardict with the results of the call

        Prints a file.

        The file is given in the form of a file descriptor open for reading.

        If a valid token is present in the @options, then this call will print
        with the settings from the Print call that the token refers to. If
        no token is present, then a print dialog will be presented to the user.

        Note that it is up to the portal implementation to determine how long
        it considers tokens valid.

        Supported keys in the @options vardict:

        * ``modal`` (``b``)

          Whether to make the dialog modal. Defaults to yes.

        * ``token`` (``u``)

          Token that was returned by a previous org.freedesktop.impl.portal.Print.PreparePrint() call.
    -->
    <method name="Print">
      <annotation name="org.gtk.GDBus.C.UnixFD" value="true"/>
      <arg type="o" name="handle" direction="in"/>
      <arg type="s" name="app_id" direction="in"/>
      <arg type="s" name="parent_window" direction="in"/>
      <arg type="s" name="title" direction="in"/>
      <arg type="h" name="fd" direction="in"/>
      <annotation name="org.qtproject.QtDBus.QtTypeName.In5" value="QVariantMap"/>
      <arg type="a{sv}" name="options" direction="in"/>
      <arg type="u" name="response" direction="out"/>
      <annotation name="org.qtproject.QtDBus.QtTypeName.Out1" value="QVariantMap"/>
      <arg type="a{sv}" name="results" direction="out"/>
    </method>
  </interface>
</node>