chore(ci): add code formatting checks (#180)

* Runs `cargo fmt`
* Adds pre-commit hook to fail unformatted commits
* Adds CI to enforce commit format if pre-commit hook is skipped

Author: AlfioEmanueleFresta

.githooks/pre-commit

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Pre-commit hook: runs cargo fmt and fails if code is not formatted.
+# Install: git config core.hooksPath .githooks
+
+set -eu
+
+# Find the Cargo.toml relative to the repo root
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+MANIFEST="$REPO_ROOT/libwebauthn/Cargo.toml"
+
+if ! command -v cargo >/dev/null 2>&1; then
+    echo "warning: cargo not found, skipping format check"
+    exit 0
+fi
+
+if ! cargo fmt --manifest-path "$MANIFEST" -- --check >/dev/null 2>&1; then
+    echo "error: code is not formatted. Run 'cargo fmt --manifest-path libwebauthn/Cargo.toml' and re-commit."
+    exit 1
+fi

.github/workflows/rust.yml

@@ -21,6 +21,8 @@ jobs:
         run: sudo apt-get install libudev-dev libdbus-1-dev libsodium-dev libnfc-dev libpcsclite-dev
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
+      - name: Check formatting
+        run: cargo fmt -- --check
       - name: Build
         run: cargo build --all-targets --all-features
       - name: Run tests

libwebauthn/examples/prf_test.rs

@@ -131,14 +131,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
             eval_by_credential,
         };
 
-        run_success_test(
-            &mut channel,
-            &credential,
-            &challenge,
-            prf,
-            "PRF output: ",
-        )
-        .await;
+        run_success_test(&mut channel, &credential, &challenge, prf, "PRF output: ").await;
     }
     Ok(())
 }

libwebauthn/examples/u2f_ble.rs

@@ -55,8 +55,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         // Signature ceremony
         println!("Signature request sent (timeout: {:?} seconds).", TIMEOUT);
         let new_key = response.as_registered_key()?;
-        let sign_request =
-            SignRequest::new(APP_ID, challenge, &new_key.key_handle, TIMEOUT, true);
+        let sign_request = SignRequest::new(APP_ID, challenge, &new_key.key_handle, TIMEOUT, true);
         let response = channel.u2f_sign(&sign_request).await?;
         println!("Response: {:?}", response);
     }

libwebauthn/examples/u2f_hid.rs

@@ -58,8 +58,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
         // Signature ceremony
         println!("Signature request sent (timeout: {:?} seconds).", TIMEOUT);
         let new_key = response.as_registered_key()?;
-        let sign_request =
-            SignRequest::new(APP_ID, challenge, &new_key.key_handle, TIMEOUT, true);
+        let sign_request = SignRequest::new(APP_ID, challenge, &new_key.key_handle, TIMEOUT, true);
         let response = channel.u2f_sign(&sign_request).await?;
         println!("Response: {:?}", response);
     }

libwebauthn/examples/webauthn_cable.rs

@@ -4,8 +4,8 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use libwebauthn::pin::PinRequestReason;
-use libwebauthn::transport::cable::is_available;
 use libwebauthn::transport::cable::channel::{CableUpdate, CableUxUpdate};
+use libwebauthn::transport::cable::is_available;
 use libwebauthn::transport::cable::known_devices::{
     CableKnownDevice, ClientPayloadHint, EphemeralDeviceInfoStore,
 };

libwebauthn/examples/webauthn_json_hid.rs

@@ -8,8 +8,8 @@ use tokio::sync::broadcast::Receiver;
 use tracing_subscriber::{self, EnvFilter};
 
 use libwebauthn::ops::webauthn::{
-    GetAssertionRequest, JsonFormat, MakeCredentialRequest, RelyingPartyId,
-    WebAuthnIDL as _, WebAuthnIDLResponse as _,
+    GetAssertionRequest, JsonFormat, MakeCredentialRequest, RelyingPartyId, WebAuthnIDL as _,
+    WebAuthnIDLResponse as _,
 };
 use libwebauthn::pin::PinRequestReason;
 use libwebauthn::transport::hid::list_devices;

libwebauthn/examples/webauthn_prf_hid.rs

@@ -200,14 +200,7 @@ pub async fn main() -> Result<(), Box<dyn Error>> {
             eval,
             eval_by_credential,
         };
-        run_success_test(
-            &mut channel,
-            &credential,
-            &challenge,
-            prf,
-            "eval only",
-        )
-        .await;
+        run_success_test(&mut channel, &credential, &challenge, prf, "eval only").await;
 
         // Test 4: eval and a full list of eval_by_credential
         let eval = Some(PRFValue {

libwebauthn/src/fido.rs

@@ -203,9 +203,9 @@ impl<'de, T: DeserializeOwned> Deserialize<'de> for AuthenticatorData<T> {
                     .read_u8()
                     .map_err(|e| DesError::custom(format!("failed to read flags: {e}")))?;
                 let flags = AuthenticatorDataFlags::from_bits_truncate(flags_raw);
-                let signature_count = cursor
-                    .read_u32::<BigEndian>()
-                    .map_err(|e| DesError::custom(format!("failed to read signature_count: {e}")))?;
+                let signature_count = cursor.read_u32::<BigEndian>().map_err(|e| {
+                    DesError::custom(format!("failed to read signature_count: {e}"))
+                })?;
 
                 let attested_credential =
                     if flags.contains(AuthenticatorDataFlags::ATTESTED_CREDENTIALS) {
@@ -218,17 +218,16 @@ impl<'de, T: DeserializeOwned> Deserialize<'de> for AuthenticatorData<T> {
                         cursor
                             .read_exact(&mut aaguid)
                             .map_err(|e| DesError::custom(format!("failed to read aaguid: {e}")))?;
-                        let credential_id_len = cursor
-                            .read_u16::<BigEndian>()
-                            .map_err(|e| DesError::custom(format!("failed to read credential_id_len: {e}")))?
-                            as usize;
+                        let credential_id_len = cursor.read_u16::<BigEndian>().map_err(|e| {
+                            DesError::custom(format!("failed to read credential_id_len: {e}"))
+                        })? as usize;
                         if data.len() < 55 + credential_id_len {
                             return Err(DesError::invalid_length(data.len(), &"55+L"));
                         }
                         let mut credential_id = vec![0u8; credential_id_len];
-                        cursor
-                            .read_exact(&mut credential_id)
-                            .map_err(|e| DesError::custom(format!("failed to read credential_id: {e}")))?;
+                        cursor.read_exact(&mut credential_id).map_err(|e| {
+                            DesError::custom(format!("failed to read credential_id: {e}"))
+                        })?;
 
                         let credential_public_key: PublicKey =
                             cbor::from_cursor(&mut cursor).map_err(DesError::custom)?;

libwebauthn/src/management/authenticator_config.rs

@@ -181,7 +181,6 @@ impl Ctap2UserVerifiableRequest for Ctap2AuthenticatorConfigRequest {
         Ok(())
     }
 
-
     fn permissions(&self) -> Ctap2AuthTokenPermissionRole {
         Ctap2AuthTokenPermissionRole::AUTHENTICATOR_CONFIGURATION
     }