B2Bパスキー アーキテクチャ設計書

public class B2BUser
{
    public int Id { get; set; }
    public string Subject { get; set; }           // UUID（EcAuth内部識別子）
    public string? ExternalId { get; set; }       // EC-CUBEのlogin_id等
    public string UserType { get; set; }          // "admin", "staff" 等
    public int OrganizationId { get; set; }       // マルチテナント
    public DateTimeOffset CreatedAt { get; set; }
    public DateTimeOffset UpdatedAt { get; set; }

    // Navigation properties
    public Organization Organization { get; set; }
    public ICollection<B2BPasskeyCredential> PasskeyCredentials { get; set; }
}

public class B2BPasskeyCredential
{
    public int Id { get; set; }
    public string B2BSubject { get; set; }        // B2BUser.Subject
    public byte[] CredentialId { get; set; }      // WebAuthn credential ID
    public byte[] PublicKey { get; set; }         // COSE形式公開鍵
    public uint SignCount { get; set; }           // リプレイ攻撃防止カウンター
    public string? DeviceName { get; set; }       // "MacBook Pro", "iPhone" 等
    public Guid AaGuid { get; set; }              // Authenticator Attestation GUID
    public string[] Transports { get; set; }      // ["internal", "usb", "nfc", "ble"] 等
    public DateTimeOffset CreatedAt { get; set; }
    public DateTimeOffset? LastUsedAt { get; set; }

    // Navigation property
    public B2BUser B2BUser { get; set; }
}

public class WebAuthnChallenge
{
    public int Id { get; set; }
    public string Challenge { get; set; }         // Base64URL形式
    public string SessionId { get; set; }         // セッション識別子
    public string Type { get; set; }              // "registration" or "authentication"
    public string UserType { get; set; }          // "b2b" or "b2c"
    public string? Subject { get; set; }          // ユーザーSubject
                                                 // - UserType == "b2b": 登録・認証ともに必須（既存ユーザーへのパスキー追加）
                                                 // - UserType == "b2c" && Type == "authentication": 必須
                                                 // - UserType == "b2c" && Type == "registration": null許容（JITプロビジョニング）
    public string? RpId { get; set; }             // EC-CUBEサイトのドメイン
    public int ClientId { get; set; }             // クライアントID
    public DateTimeOffset ExpiresAt { get; set; } // 5分で期限切れ
    public DateTimeOffset CreatedAt { get; set; }
}

{
  "client_id": "your_client_id",
  "rp_id": "shop.example.com",
  "b2b_subject": "uuid-of-admin-user",
  "device_name": "MacBook Pro"
}

{
  "session_id": "random-session-id",
  "challenge": "base64url-encoded-challenge",
  "rp": {
    "id": "shop.example.com",
    "name": "ショップ名"
  },
  "user": {
    "id": "base64url-encoded-user-id",
    "name": "admin@shop.example.com",
    "displayName": "管理者"
  },
  "pubKeyCredParams": [
    { "type": "public-key", "alg": -7 },
    { "type": "public-key", "alg": -257 }
  ],
  "authenticatorSelection": {
    "authenticatorAttachment": "platform",
    "residentKey": "preferred",
    "userVerification": "preferred"
  },
  "timeout": 60000,
  "attestation": "none"
}

{
  "session_id": "random-session-id",
  "client_id": "your_client_id",
  "response": {
    "id": "credential-id",
    "rawId": "base64url-encoded-raw-id",
    "response": {
      "attestationObject": "base64url-encoded-attestation",
      "clientDataJSON": "base64url-encoded-client-data"
    },
    "type": "public-key"
  },
  "device_name": "MacBook Pro"
}

{
  "success": true,
  "credential_id": "base64url-encoded-credential-id"
}

{
  "client_id": "your_client_id",
  "rp_id": "shop.example.com"
}

{
  "session_id": "random-session-id",
  "challenge": "base64url-encoded-challenge",
  "rpId": "shop.example.com",
  "allowCredentials": [
    {
      "id": "base64url-encoded-credential-id",
      "type": "public-key",
      "transports": ["internal"]
    }
  ],
  "userVerification": "preferred",
  "timeout": 60000
}

{
  "session_id": "random-session-id",
  "client_id": "your_client_id",
  "redirect_uri": "https://shop.example.com/admin/ecauth/callback",
  "state": "random-state",
  "response": {
    "id": "credential-id",
    "rawId": "base64url-encoded-raw-id",
    "response": {
      "authenticatorData": "base64url-encoded-auth-data",
      "clientDataJSON": "base64url-encoded-client-data",
      "signature": "base64url-encoded-signature"
    },
    "type": "public-key"
  }
}

{
  "redirect_url": "https://shop.example.com/admin/ecauth/callback?code=xxx&state=xxx"
}

public class Client
{
    // 既存フィールド...

    // パスキー用：許可されるRP ID（ドメイン）一覧
    public List<string> AllowedRpIds { get; set; } = new();
}