feat(api/v2): implement U2F session check (#6339)

internal/api/grpc/session/v2/session.go

@@ -47,7 +47,7 @@ func (s *Server) CreateSession(ctx context.Context, req *session.CreateSessionRe
 	}
 	challengeResponse, cmds := s.challengesToCommand(req.GetChallenges(), checks)
 
-	set, err := s.command.CreateSession(ctx, cmds, req.GetDomain(), metadata)
+	set, err := s.command.CreateSession(ctx, cmds, metadata)
 	if err != nil {
 		return nil, err
 	}
@@ -107,7 +107,6 @@ func sessionToPb(s *query.Session) *session.Session {
 		Sequence:     s.Sequence,
 		Factors:      factorsToPb(s),
 		Metadata:     s.Metadata,
-		Domain:       s.Domain,
 	}
 }
 
@@ -119,7 +118,7 @@ func factorsToPb(s *query.Session) *session.Factors {
 	return &session.Factors{
 		User:     user,
 		Password: passwordFactorToPb(s.PasswordFactor),
-		Passkey:  passkeyFactorToPb(s.PasskeyFactor),
+		WebAuthN: webAuthNFactorToPb(s.WebAuthNFactor),
 		Intent:   intentFactorToPb(s.IntentFactor),
 	}
 }
@@ -142,12 +141,13 @@ func intentFactorToPb(factor query.SessionIntentFactor) *session.IntentFactor {
 	}
 }
 
-func passkeyFactorToPb(factor query.SessionPasskeyFactor) *session.PasskeyFactor {
-	if factor.PasskeyCheckedAt.IsZero() {
+func webAuthNFactorToPb(factor query.SessionWebAuthNFactor) *session.WebAuthNFactor {
+	if factor.WebAuthNCheckedAt.IsZero() {
 		return nil
 	}
-	return &session.PasskeyFactor{
-		VerifiedAt: timestamppb.New(factor.PasskeyCheckedAt),
+	return &session.WebAuthNFactor{
+		VerifiedAt:   timestamppb.New(factor.WebAuthNCheckedAt),
+		UserVerified: factor.UserVerified,
 	}
 }
 
@@ -244,36 +244,47 @@ func (s *Server) checksToCommand(ctx context.Context, checks *session.Checks) ([
 	if intent := checks.GetIntent(); intent != nil {
 		sessionChecks = append(sessionChecks, command.CheckIntent(intent.GetIntentId(), intent.GetToken()))
 	}
-	if passkey := checks.GetPasskey(); passkey != nil {
-		sessionChecks = append(sessionChecks, s.command.CheckPasskey(passkey.GetCredentialAssertionData()))
+	if passkey := checks.GetWebAuthN(); passkey != nil {
+		sessionChecks = append(sessionChecks, s.command.CheckWebAuthN(passkey.GetCredentialAssertionData()))
 	}
 
 	return sessionChecks, nil
 }
 
-func (s *Server) challengesToCommand(challenges []session.ChallengeKind, cmds []command.SessionCommand) (*session.Challenges, []command.SessionCommand) {
-	if len(challenges) == 0 {
+func (s *Server) challengesToCommand(challenges *session.RequestChallenges, cmds []command.SessionCommand) (*session.Challenges, []command.SessionCommand) {
+	if challenges == nil {
 		return nil, cmds
 	}
 	resp := new(session.Challenges)
-	for _, c := range challenges {
-		switch c {
-		case session.ChallengeKind_CHALLENGE_KIND_UNSPECIFIED:
-			continue
-		case session.ChallengeKind_CHALLENGE_KIND_PASSKEY:
-			passkeyChallenge, cmd := s.createPasskeyChallengeCommand()
-			resp.Passkey = passkeyChallenge
-			cmds = append(cmds, cmd)
-		}
+	if req := challenges.GetWebAuthN(); req != nil {
+		challenge, cmd := s.createWebAuthNChallengeCommand(req)
+		resp.WebAuthN = challenge
+		cmds = append(cmds, cmd)
 	}
 	return resp, cmds
 }
 
-func (s *Server) createPasskeyChallengeCommand() (*session.Challenges_Passkey, command.SessionCommand) {
-	challenge := &session.Challenges_Passkey{
+func (s *Server) createWebAuthNChallengeCommand(req *session.RequestChallenges_WebAuthN) (*session.Challenges_WebAuthN, command.SessionCommand) {
+	challenge := &session.Challenges_WebAuthN{
 		PublicKeyCredentialRequestOptions: new(structpb.Struct),
 	}
-	return challenge, s.command.CreatePasskeyChallenge(domain.UserVerificationRequirementRequired, challenge.PublicKeyCredentialRequestOptions)
+	userVerification := userVerificationRequirementToDomain(req.GetUserVerificationRequirement())
+	return challenge, s.command.CreateWebAuthNChallenge(userVerification, req.GetDomain(), challenge.PublicKeyCredentialRequestOptions)
+}
+
+func userVerificationRequirementToDomain(req session.UserVerificationRequirement) domain.UserVerificationRequirement {
+	switch req {
+	case session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_UNSPECIFIED:
+		return domain.UserVerificationRequirementUnspecified
+	case session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED:
+		return domain.UserVerificationRequirementRequired
+	case session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_PREFERRED:
+		return domain.UserVerificationRequirementPreferred
+	case session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_DISCOURAGED:
+		return domain.UserVerificationRequirementDiscouraged
+	default:
+		return domain.UserVerificationRequirementUnspecified
+	}
 }
 
 func userCheck(user *session.CheckUser) (userSearch, error) {

internal/api/grpc/session/v2/session_integration_test.go

@@ -69,7 +69,8 @@ type wantFactor int
 const (
 	wantUserFactor wantFactor = iota
 	wantPasswordFactor
-	wantPasskeyFactor
+	wantWebAuthNFactor
+	wantWebAuthNFactorUserVerified
 	wantIntentFactor
 )
 
@@ -85,10 +86,16 @@ func verifyFactors(t testing.TB, factors *session.Factors, window time.Duration,
 			pf := factors.GetPassword()
 			assert.NotNil(t, pf)
 			assert.WithinRange(t, pf.GetVerifiedAt().AsTime(), time.Now().Add(-window), time.Now().Add(window))
-		case wantPasskeyFactor:
-			pf := factors.GetPasskey()
+		case wantWebAuthNFactor:
+			pf := factors.GetWebAuthN()
 			assert.NotNil(t, pf)
 			assert.WithinRange(t, pf.GetVerifiedAt().AsTime(), time.Now().Add(-window), time.Now().Add(window))
+			assert.False(t, pf.UserVerified)
+		case wantWebAuthNFactorUserVerified:
+			pf := factors.GetWebAuthN()
+			assert.NotNil(t, pf)
+			assert.WithinRange(t, pf.GetVerifiedAt().AsTime(), time.Now().Add(-window), time.Now().Add(window))
+			assert.True(t, pf.UserVerified)
 		case wantIntentFactor:
 			pf := factors.GetIntent()
 			assert.NotNil(t, pf)
@@ -127,7 +134,6 @@ func TestServer_CreateSession(t *testing.T) {
 					},
 				},
 				Metadata: map[string][]byte{"foo": []byte("bar")},
-				Domain:   "domain",
 			},
 			want: &session.CreateSessionResponse{
 				Details: &object.Details{
@@ -150,8 +156,11 @@ func TestServer_CreateSession(t *testing.T) {
 		{
 			name: "passkey without user error",
 			req: &session.CreateSessionRequest{
-				Challenges: []session.ChallengeKind{
-					session.ChallengeKind_CHALLENGE_KIND_PASSKEY,
+				Challenges: &session.RequestChallenges{
+					WebAuthN: &session.RequestChallenges_WebAuthN{
+						Domain:                      Tester.Config.ExternalDomain,
+						UserVerificationRequirement: session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED,
+					},
 				},
 			},
 			wantErr: true,
@@ -166,8 +175,10 @@ func TestServer_CreateSession(t *testing.T) {
 						},
 					},
 				},
-				Challenges: []session.ChallengeKind{
-					session.ChallengeKind_CHALLENGE_KIND_PASSKEY,
+				Challenges: &session.RequestChallenges{
+					WebAuthN: &session.RequestChallenges_WebAuthN{
+						UserVerificationRequirement: session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED,
+					},
 				},
 			},
 			wantErr: true,
@@ -188,8 +199,8 @@ func TestServer_CreateSession(t *testing.T) {
 	}
 }
 
-func TestServer_CreateSession_passkey(t *testing.T) {
-	// create new session with user and request the passkey challenge
+func TestServer_CreateSession_webauthn(t *testing.T) {
+	// create new session with user and request the webauthn challenge
 	createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{
 		Checks: &session.Checks{
 			User: &session.CheckUser{
@@ -198,29 +209,31 @@ func TestServer_CreateSession_passkey(t *testing.T) {
 				},
 			},
 		},
-		Challenges: []session.ChallengeKind{
-			session.ChallengeKind_CHALLENGE_KIND_PASSKEY,
+		Challenges: &session.RequestChallenges{
+			WebAuthN: &session.RequestChallenges_WebAuthN{
+				Domain:                      Tester.Config.ExternalDomain,
+				UserVerificationRequirement: session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED,
+			},
 		},
-		Domain: Tester.Config.ExternalDomain,
 	})
 	require.NoError(t, err)
 	verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil)
 
-	assertionData, err := Tester.WebAuthN.CreateAssertionResponse(createResp.GetChallenges().GetPasskey().GetPublicKeyCredentialRequestOptions())
+	assertionData, err := Tester.WebAuthN.CreateAssertionResponse(createResp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), true)
 	require.NoError(t, err)
 
-	// update the session with passkey assertion data
+	// update the session with webauthn assertion data
 	updateResp, err := Client.SetSession(CTX, &session.SetSessionRequest{
 		SessionId:    createResp.GetSessionId(),
 		SessionToken: createResp.GetSessionToken(),
 		Checks: &session.Checks{
-			Passkey: &session.CheckPasskey{
+			WebAuthN: &session.CheckWebAuthN{
 				CredentialAssertionData: assertionData,
 			},
 		},
 	})
 	require.NoError(t, err)
-	verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, wantUserFactor, wantPasskeyFactor)
+	verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, wantUserFactor, wantWebAuthNFactorUserVerified)
 }
 
 func TestServer_CreateSession_successfulIntent(t *testing.T) {
@@ -326,16 +339,14 @@ func TestServer_CreateSession_startedIntentFalseToken(t *testing.T) {
 }
 
 func TestServer_SetSession_flow(t *testing.T) {
-	var wantFactors []wantFactor
-
 	// create new, empty session
-	createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{Domain: Tester.Config.ExternalDomain})
+	createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{})
 	require.NoError(t, err)
-	verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
 	sessionToken := createResp.GetSessionToken()
+	verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, createResp.GetDetails().GetSequence(), time.Minute, nil)
 
 	t.Run("check user", func(t *testing.T) {
-		wantFactors = append(wantFactors, wantUserFactor)
+		wantFactors := []wantFactor{wantUserFactor}
 		resp, err := Client.SetSession(CTX, &session.SetSessionRequest{
 			SessionId:    createResp.GetSessionId(),
 			SessionToken: sessionToken,
@@ -348,43 +359,92 @@ func TestServer_SetSession_flow(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
-		verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
 		sessionToken = resp.GetSessionToken()
+		verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
 	})
 
-	t.Run("check passkey", func(t *testing.T) {
+	t.Run("check webauthn, user verified (passkey)", func(t *testing.T) {
 		resp, err := Client.SetSession(CTX, &session.SetSessionRequest{
 			SessionId:    createResp.GetSessionId(),
 			SessionToken: sessionToken,
-			Challenges: []session.ChallengeKind{
-				session.ChallengeKind_CHALLENGE_KIND_PASSKEY,
+			Challenges: &session.RequestChallenges{
+				WebAuthN: &session.RequestChallenges_WebAuthN{
+					Domain:                      Tester.Config.ExternalDomain,
+					UserVerificationRequirement: session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED,
+				},
 			},
 		})
 		require.NoError(t, err)
-		verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
+		verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil)
 		sessionToken = resp.GetSessionToken()
 
-		wantFactors = append(wantFactors, wantPasskeyFactor)
-		assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetPasskey().GetPublicKeyCredentialRequestOptions())
+		wantFactors := []wantFactor{wantUserFactor, wantWebAuthNFactorUserVerified}
+		assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), true)
 		require.NoError(t, err)
 
 		resp, err = Client.SetSession(CTX, &session.SetSessionRequest{
 			SessionId:    createResp.GetSessionId(),
 			SessionToken: sessionToken,
 			Checks: &session.Checks{
-				Passkey: &session.CheckPasskey{
+				WebAuthN: &session.CheckWebAuthN{
 					CredentialAssertionData: assertionData,
 				},
 			},
 		})
 		require.NoError(t, err)
-		verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
+		sessionToken = resp.GetSessionToken()
+		verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
+	})
+
+	t.Run("check webauthn, user not verified (U2F)", func(t *testing.T) {
+		Tester.RegisterUserU2F(
+			Tester.WithAuthorizationToken(context.Background(), sessionToken),
+			User.GetUserId(),
+		)
+
+		for _, userVerificationRequirement := range []session.UserVerificationRequirement{
+			session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_PREFERRED,
+			session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_DISCOURAGED,
+		} {
+			t.Run(userVerificationRequirement.String(), func(t *testing.T) {
+				resp, err := Client.SetSession(CTX, &session.SetSessionRequest{
+					SessionId:    createResp.GetSessionId(),
+					SessionToken: sessionToken,
+					Challenges: &session.RequestChallenges{
+						WebAuthN: &session.RequestChallenges_WebAuthN{
+							Domain:                      Tester.Config.ExternalDomain,
+							UserVerificationRequirement: userVerificationRequirement,
+						},
+					},
+				})
+				require.NoError(t, err)
+				verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil)
+				sessionToken = resp.GetSessionToken()
+
+				wantFactors := []wantFactor{wantUserFactor, wantWebAuthNFactor}
+				assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), false)
+				require.NoError(t, err)
+
+				resp, err = Client.SetSession(CTX, &session.SetSessionRequest{
+					SessionId:    createResp.GetSessionId(),
+					SessionToken: sessionToken,
+					Checks: &session.Checks{
+						WebAuthN: &session.CheckWebAuthN{
+							CredentialAssertionData: assertionData,
+						},
+					},
+				})
+				require.NoError(t, err)
+				sessionToken = resp.GetSessionToken()
+				verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, wantFactors...)
+			})
+		}
 	})
 }
 
 func Test_ZITADEL_API_missing_authentication(t *testing.T) {
 	// create new, empty session
-	createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{Domain: Tester.Config.ExternalDomain})
+	createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{})
 	require.NoError(t, err)
 
 	ctx := metadata.AppendToOutgoingContext(context.Background(), "Authorization", fmt.Sprintf("Bearer %s", createResp.GetSessionToken()))
@@ -403,16 +463,19 @@ func Test_ZITADEL_API_missing_mfa(t *testing.T) {
 }
 
 func Test_ZITADEL_API_success(t *testing.T) {
-	id, token, _, _ := Tester.CreatePasskeySession(t, CTX, User.GetUserId())
+	id, token, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, User.GetUserId())
 
 	ctx := Tester.WithAuthorizationToken(context.Background(), token)
 	sessionResp, err := Tester.Client.SessionV2.GetSession(ctx, &session.GetSessionRequest{SessionId: id})
 	require.NoError(t, err)
-	require.NotNil(t, id, sessionResp.GetSession().GetFactors().GetPasskey().GetVerifiedAt().AsTime())
+
+	webAuthN := sessionResp.GetSession().GetFactors().GetWebAuthN()
+	require.NotNil(t, id, webAuthN.GetVerifiedAt().AsTime())
+	require.True(t, webAuthN.GetUserVerified())
 }
 
 func Test_ZITADEL_API_session_not_found(t *testing.T) {
-	id, token, _, _ := Tester.CreatePasskeySession(t, CTX, User.GetUserId())
+	id, token, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, User.GetUserId())
 
 	// test session token works
 	ctx := Tester.WithAuthorizationToken(context.Background(), token)

internal/api/grpc/session/v2/session_test.go

@@ -70,7 +70,7 @@ func Test_sessionsToPb(t *testing.T) {
 			},
 			Metadata: map[string][]byte{"hello": []byte("world")},
 		},
-		{ // passkey factor
+		{ // webAuthN factor
 			ID:            "999",
 			CreationDate:  now,
 			ChangeDate:    now,
@@ -85,8 +85,9 @@ func Test_sessionsToPb(t *testing.T) {
 				DisplayName:   "donald duck",
 				ResourceOwner: "org1",
 			},
-			PasskeyFactor: query.SessionPasskeyFactor{
-				PasskeyCheckedAt: past,
+			WebAuthNFactor: query.SessionWebAuthNFactor{
+				WebAuthNCheckedAt: past,
+				UserVerified:      true,
 			},
 			Metadata: map[string][]byte{"hello": []byte("world")},
 		},
@@ -136,7 +137,7 @@ func Test_sessionsToPb(t *testing.T) {
 			},
 			Metadata: map[string][]byte{"hello": []byte("world")},
 		},
-		{ // passkey factor
+		{ // webAuthN factor
 			Id:           "999",
 			CreationDate: timestamppb.New(now),
 			ChangeDate:   timestamppb.New(now),
@@ -149,8 +150,9 @@ func Test_sessionsToPb(t *testing.T) {
 					DisplayName:    "donald duck",
 					OrganisationId: "org1",
 				},
-				Passkey: &session.PasskeyFactor{
-					VerifiedAt: timestamppb.New(past),
+				WebAuthN: &session.WebAuthNFactor{
+					VerifiedAt:   timestamppb.New(past),
+					UserVerified: true,
 				},
 			},
 			Metadata: map[string][]byte{"hello": []byte("world")},
@@ -432,3 +434,40 @@ func Test_userCheck(t *testing.T) {
 		})
 	}
 }
+
+func Test_userVerificationRequirementToDomain(t *testing.T) {
+	type args struct {
+		req session.UserVerificationRequirement
+	}
+	tests := []struct {
+		args args
+		want domain.UserVerificationRequirement
+	}{
+		{
+			args: args{session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_UNSPECIFIED},
+			want: domain.UserVerificationRequirementUnspecified,
+		},
+		{
+			args: args{session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED},
+			want: domain.UserVerificationRequirementRequired,
+		},
+		{
+			args: args{session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_PREFERRED},
+			want: domain.UserVerificationRequirementPreferred,
+		},
+		{
+			args: args{session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_DISCOURAGED},
+			want: domain.UserVerificationRequirementDiscouraged,
+		},
+		{
+			args: args{999},
+			want: domain.UserVerificationRequirementUnspecified,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.args.req.String(), func(t *testing.T) {
+			got := userVerificationRequirementToDomain(tt.args.req)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

internal/api/grpc/user/v2/otp_integration_test.go

@@ -16,13 +16,13 @@ import (
 func TestServer_AddOTPSMS(t *testing.T) {
 	userID := Tester.CreateHumanUser(CTX).GetUserId()
 	Tester.RegisterUserPasskey(CTX, userID)
-	_, sessionToken, _, _ := Tester.CreatePasskeySession(t, CTX, userID)
+	_, sessionToken, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userID)
 
 	// TODO: add when phone can be added to user
 	/*
 		userIDPhone := Tester.CreateHumanUser(CTX).GetUserId()
 		Tester.RegisterUserPasskey(CTX, userIDPhone)
-		_, sessionTokenPhone, _, _ := Tester.CreatePasskeySession(t, CTX, userIDPhone)
+		_, sessionTokenPhone, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userIDPhone)
 	*/
 	type args struct {
 		ctx context.Context
@@ -99,7 +99,7 @@ func TestServer_RemoveOTPSMS(t *testing.T) {
 	/*
 		userID := Tester.CreateHumanUser(CTX).GetUserId()
 		Tester.RegisterUserPasskey(CTX, userID)
-		_, sessionToken, _, _ := Tester.CreatePasskeySession(t, CTX, userID)
+		_, sessionToken, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userID)
 	*/
 
 	type args struct {
@@ -157,7 +157,7 @@ func TestServer_RemoveOTPSMS(t *testing.T) {
 func TestServer_AddOTPEmail(t *testing.T) {
 	userID := Tester.CreateHumanUser(CTX).GetUserId()
 	Tester.RegisterUserPasskey(CTX, userID)
-	_, sessionToken, _, _ := Tester.CreatePasskeySession(t, CTX, userID)
+	_, sessionToken, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userID)
 
 	userVerified := Tester.CreateHumanUser(CTX)
 	_, err := Tester.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{
@@ -166,7 +166,7 @@ func TestServer_AddOTPEmail(t *testing.T) {
 	})
 	require.NoError(t, err)
 	Tester.RegisterUserPasskey(CTX, userVerified.GetUserId())
-	_, sessionTokenVerified, _, _ := Tester.CreatePasskeySession(t, CTX, userVerified.GetUserId())
+	_, sessionTokenVerified, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userVerified.GetUserId())
 
 	type args struct {
 		ctx context.Context
@@ -238,11 +238,11 @@ func TestServer_AddOTPEmail(t *testing.T) {
 func TestServer_RemoveOTPEmail(t *testing.T) {
 	userID := Tester.CreateHumanUser(CTX).GetUserId()
 	Tester.RegisterUserPasskey(CTX, userID)
-	_, sessionToken, _, _ := Tester.CreatePasskeySession(t, CTX, userID)
+	_, sessionToken, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userID)
 
 	userVerified := Tester.CreateHumanUser(CTX)
 	Tester.RegisterUserPasskey(CTX, userVerified.GetUserId())
-	_, sessionTokenVerified, _, _ := Tester.CreatePasskeySession(t, CTX, userVerified.GetUserId())
+	_, sessionTokenVerified, _, _ := Tester.CreateVerfiedWebAuthNSession(t, CTX, userVerified.GetUserId())
 	userVerifiedCtx := Tester.WithAuthorizationToken(context.Background(), sessionTokenVerified)
 	_, err := Tester.Client.UserV2.VerifyEmail(userVerifiedCtx, &user.VerifyEmailRequest{
 		UserId:           userVerified.GetUserId(),