nk3 test/fido2: early exit if pin not set - fixes #411

Nitrokey · Sep 20, 2023 · c97984b · c97984b
1 parent dc48ea4
commit c97984b
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/pynitrokey/cli/nk3/test.py b/pynitrokey/cli/nk3/test.py
@@ -19,6 +19,7 @@
 
 from pynitrokey.cli.exceptions import CliException
 from pynitrokey.fido2 import device_path_to_str
+from pynitrokey.fido2.client import NKFido2Client
 from pynitrokey.helpers import local_print
 from pynitrokey.nk3.admin_app import AdminApp
 from pynitrokey.nk3.base import Nitrokey3Base
@@ -238,6 +239,13 @@ def test_fido2(ctx: TestContext, device: Nitrokey3Base) -> TestResult:
     if not isinstance(device, Nitrokey3Device):
         return TestResult(TestStatus.SKIPPED)
 
+    # drop out early, if pin is needed, but not provided
+    client = NKFido2Client()
+    client.find_device(device.device)
+
+    if client.has_pin() and not ctx.pin:
+        return TestResult(TestStatus.FAILURE, "FIDO2 pin is set, but not provided")
+
     # Based on https://github.com/Yubico/python-fido2/blob/142587b3e698ca0e253c78d75758fda635cac51a/examples/credential.py
 
     from fido2.client import Fido2Client, PinRequiredError, UserInteraction