// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chrome/browser/webauthn/chrome_web_authentication_delegate.h"

#include <algorithm>
#include <cstdint>
#include <memory>
#include <optional>
#include <string>
#include <string_view>
#include <utility>
#include <vector>

#include "base/base64.h"
#include "base/command_line.h"
#include "base/containers/contains.h"
#include "base/containers/span.h"
#include "base/feature_list.h"
#include "base/functional/bind.h"
#include "base/functional/callback.h"
#include "base/location.h"
#include "base/memory/weak_ptr.h"
#include "base/metrics/histogram_functions.h"
#include "base/strings/string_split.h"
#include "base/strings/string_util.h"
#include "base/task/task_traits.h"
#include "base/task/thread_pool.h"
#include "base/values.h"
#include "build/buildflag.h"
#include "chrome/browser/extensions/api/web_authentication_proxy/web_authentication_proxy_service.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/signin/identity_manager_factory.h"
#include "chrome/browser/sync/sync_service_factory.h"
#include "chrome/browser/ui/passwords/passwords_client_ui_delegate.h"
#include "chrome/browser/webauthn/passkey_model_factory.h"
#include "chrome/browser/webauthn/unexportable_key_utils.h"
#include "chrome/browser/webauthn/webauthn_pref_names.h"
#include "chrome/browser/webauthn/webauthn_switches.h"
#include "chrome/common/chrome_version.h"
#include "chrome/common/pref_names.h"
#include "components/device_event_log/device_event_log.h"
#include "components/prefs/pref_service.h"
#include "components/signin/public/base/consent_level.h"
#include "components/signin/public/identity_manager/identity_manager.h"
#include "components/sync/base/user_selectable_type.h"
#include "components/sync/protocol/webauthn_credential_specifics.pb.h"
#include "components/sync/service/sync_service.h"
#include "components/sync/service/sync_user_settings.h"
#include "components/webauthn/core/browser/passkey_change_quota_tracker.h"
#include "components/webauthn/core/browser/passkey_model.h"
#include "content/public/browser/authenticator_request_client_delegate.h"
#include "content/public/browser/browser_context.h"
#include "content/public/browser/render_frame_host.h"
#include "content/public/browser/visibility.h"
#include "content/public/browser/web_authentication_request_proxy.h"
#include "content/public/browser/web_contents.h"
#include "crypto/unexportable_key.h"
#include "device/fido/enclave/constants.h"
#include "device/fido/features.h"
#include "device/fido/mac/credential_metadata.h"
#include "extensions/browser/extension_registry.h"
#include "extensions/common/constants.h"
#include "extensions/common/extension.h"
#include "extensions/common/permissions/permissions_data.h"
#include "extensions/common/url_pattern.h"
#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
#include "net/base/url_util.h"
#include "url/origin.h"
#include "url/url_constants.h"
#include "url/url_util.h"

#if BUILDFLAG(IS_CHROMEOS)
#include "chromeos/components/webauthn/webauthn_request_registrar.h"
#include "content/public/browser/browser_thread.h"
#include "ui/aura/window.h"
#endif

namespace {

void LogSignalUnknownCredential(
    ChromeWebAuthenticationDelegate::SignalUnknownCredentialResult result) {
  base::UmaHistogramEnumeration(
      "WebAuthentication.SignalUnknownCredentialRemovedGPMPasskey", result);
}

void LogSignalAllAcceptedCredentials(
    ChromeWebAuthenticationDelegate::SignalAllAcceptedCredentialsResult
        result) {
  base::UmaHistogramEnumeration(
      "WebAuthentication.SignalAllAcceptedCredentialsRemovedGPMPasskey",
      result);
}

void LogSignalCurrentUserDetailsUpdated(
    ChromeWebAuthenticationDelegate::SignalCurrentUserDetailsResult result) {
  base::UmaHistogramEnumeration(
      "WebAuthentication.SignalCurrentUserDetailsUpdatedGPMPasskey", result);
}

// Returns true iff |relying_party_id| is listed in the
// SecurityKeyPermitAttestation policy.
bool IsWebAuthnRPIDListedInSecurityKeyPermitAttestationPolicy(
    content::BrowserContext* browser_context,
    const std::string& relying_party_id) {
  const Profile* profile = Profile::FromBrowserContext(browser_context);
  const PrefService* prefs = profile->GetPrefs();
  const base::Value::List& permit_attestation =
      prefs->GetList(prefs::kSecurityKeyPermitAttestation);
  return base::Contains(permit_attestation, relying_party_id);
}

bool IsOriginListedInEnterpriseAttestationSwitch(
    const url::Origin& caller_origin) {
  std::string cmdline_origins =
      base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
          webauthn::switches::kPermitEnterpriseAttestationOriginList);
  std::vector<std::string_view> origin_strings = base::SplitStringPiece(
      cmdline_origins, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
  return std::ranges::any_of(
      origin_strings, [&caller_origin](std::string_view origin_string) {
        return url::Origin::Create(GURL(origin_string)) == caller_origin;
      });
}

// Returns true if |extension| is allowed to create and assert |rp_id|.
bool ExtensionCanAssertRpId(const extensions::Extension& extension,
                            const std::string& rp_id) {
  // Extensions are always allowed to assert their own extension identifier.
  // This has special handling in
  // ChromeWebAuthenticationDelegate::MaybeGetRelyingPartyIdOverride, the
  // RP ID will be prefixed with the extension scheme to isolate it from web
  // origins.
  if (extension.id() == rp_id) {
    return true;
  }

  // Extensions may not claim eTLDs as RP IDs, even if WebAuthn does not
  // forbid origins from doing so if they are eTLDs themselves.
  if (!net::registry_controlled_domains::HostHasRegistryControlledDomain(
          base::TrimString(rp_id, ".", base::TrimPositions::TRIM_TRAILING),
          net::registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES,
          net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES) &&
      !net::HostStringIsLocalhost(rp_id)) {
    return false;
  }

  // An extension should be able to assert a WebAuthn RP ID if it has host
  // permissions over any host that can assert that RP ID. This code duplicates
  // some of the logic on content/public/browser/webauthn_security_utils.h.
  // https://w3c.github.io/webauthn/#relying-party-identifier
  for (const URLPattern& pattern :
       extension.permissions_data()->active_permissions().explicit_hosts()) {
    // Only https hosts and localhost are allowed to assert RP IDs. By design,
    // this means extensions cannot claim RP IDs for other extensions.
    if (!pattern.MatchesScheme(url::kHttpsScheme) &&
        !(pattern.MatchesScheme(url::kHttpScheme) &&
          net::HostStringIsLocalhost(pattern.host()))) {
      continue;
    }
    // IP hosts are not allowed to assert RP IDs.
    if (url::HostIsIPAddress(pattern.host())) {
      continue;
    }
    // If the pattern matches the RP ID, then it is allowed to assert it.
    // Pattern                   RP ID                     Allowed?
    // *.com                     example.com               Yes
    // example.com               example.com               Yes
    // *.example.com             subdomain.example.com     Yes
    if (pattern.MatchesHost(rp_id)) {
      return true;
    }
    // If the pattern matchens any valid subdomain of the RP ID, then it is
    // allowed to assert it, since subdomains can assert parent components up to
    // eTLD+1 on WebAuthn.
    // Pattern                   RP ID                     Allowed?
    // subdomain.example.com     example.com               Yes
    // *.subdomain.example.com   example.com               Yes
    // example.com               subdomain.example.com     No
    if (url::DomainIs(pattern.host(), rp_id)) {
      return true;
    }
  }
  return false;
}

void DeleteUnacceptedPasskeys(
    content::WebContents* web_contents,
    const std::string& relying_party_id,
    const std::vector<uint8_t>& user_id,
    const std::vector<std::vector<uint8_t>>& all_accepted_credentials_ids) {
  webauthn::PasskeyModel* passkey_store =
      PasskeyModelFactory::GetInstance()->GetForProfile(
          Profile::FromBrowserContext(web_contents->GetBrowserContext()));
  bool is_passkey_deleted = false;
  for (const auto& passkey :
       passkey_store->GetPasskeysForRelyingPartyId(relying_party_id)) {
    if (std::vector<uint8_t>(passkey.user_id().begin(),
                             passkey.user_id().end()) == user_id &&
        !base::Contains(all_accepted_credentials_ids,
                        std::vector<uint8_t>(passkey.credential_id().begin(),
                                             passkey.credential_id().end()))) {
      passkey_store->DeletePasskey(passkey.credential_id(), FROM_HERE);
      is_passkey_deleted = true;
    }
  }
  if (is_passkey_deleted) {
    PasswordsClientUIDelegate* manage_passwords_ui_controller =
        PasswordsClientUIDelegateFromWebContents(web_contents);
    if (manage_passwords_ui_controller) {
      manage_passwords_ui_controller->OnPasskeyNotAccepted(relying_party_id);
    }
  }
  LogSignalAllAcceptedCredentials(
      is_passkey_deleted
          ? ChromeWebAuthenticationDelegate::
                SignalAllAcceptedCredentialsResult::kPasskeyRemoved
          : ChromeWebAuthenticationDelegate::
                SignalAllAcceptedCredentialsResult::kNoPasskeyChanged);
}

void HideAndRestorePasskeys(
    content::WebContents* web_contents,
    const url::Origin& origin,
    const std::string& relying_party_id,
    const std::vector<uint8_t>& user_id,
    const std::vector<std::vector<uint8_t>>& all_accepted_credentials_ids) {
  webauthn::PasskeyChangeQuotaTracker* quota_tracker =
      webauthn::PasskeyChangeQuotaTracker::GetInstance();
  if (!quota_tracker->CanMakeChange(origin)) {
    LogSignalAllAcceptedCredentials(
        ChromeWebAuthenticationDelegate::SignalAllAcceptedCredentialsResult::
            kQuotaExceeded);
    FIDO_LOG(ERROR) << "Dropping all accepted credentials request from "
                    << origin << ": quota exceeded.";
    return;
  }
  webauthn::PasskeyModel* passkey_store =
      PasskeyModelFactory::GetInstance()->GetForProfile(
          Profile::FromBrowserContext(web_contents->GetBrowserContext()));
  std::vector<sync_pb::WebauthnCredentialSpecifics> passkeys =
      passkey_store->GetPasskeysForRelyingPartyId(relying_party_id);
  const auto passkey_it =
      std::ranges::find_if(passkeys, [&user_id](const auto& passkey) {
        return std::vector<uint8_t>(passkey.user_id().begin(),
                                    passkey.user_id().end()) == user_id;
      });
  if (passkey_it == passkeys.end()) {
    LogSignalAllAcceptedCredentials(
        ChromeWebAuthenticationDelegate::SignalAllAcceptedCredentialsResult::
            kNoPasskeyChanged);
    return;
  }
  bool passkey_in_list =
      base::Contains(all_accepted_credentials_ids,
                     std::vector<uint8_t>(passkey_it->credential_id().begin(),
                                          passkey_it->credential_id().end()));
  if ((passkey_in_list && !passkey_it->hidden()) ||
      (!passkey_in_list && passkey_it->hidden())) {
    LogSignalAllAcceptedCredentials(
        ChromeWebAuthenticationDelegate::SignalAllAcceptedCredentialsResult::
            kNoPasskeyChanged);
    return;
  }
  passkey_store->SetPasskeyHidden(passkey_it->credential_id(),
                                  !passkey_in_list);
  quota_tracker->TrackChange(origin);
  LogSignalAllAcceptedCredentials(
      passkey_in_list ? ChromeWebAuthenticationDelegate::
                            SignalAllAcceptedCredentialsResult::kPasskeyRestored
                      : ChromeWebAuthenticationDelegate::
                            SignalAllAcceptedCredentialsResult::kPasskeyHidden);
  PasswordsClientUIDelegate* manage_passwords_ui_controller =
      PasswordsClientUIDelegateFromWebContents(web_contents);
  if (passkey_in_list && manage_passwords_ui_controller) {
    manage_passwords_ui_controller->OnPasskeyUpdated(relying_party_id);
  }
  if (!passkey_in_list && manage_passwords_ui_controller) {
    manage_passwords_ui_controller->OnPasskeyNotAccepted(relying_party_id);
  }
}

}  // namespace

ChromeWebAuthenticationDelegate::ChromeWebAuthenticationDelegate() = default;
ChromeWebAuthenticationDelegate::~ChromeWebAuthenticationDelegate() = default;

bool ChromeWebAuthenticationDelegate::
    OverrideCallerOriginAndRelyingPartyIdValidation(
        content::BrowserContext* browser_context,
        const url::Origin& caller_origin,
        const std::string& relying_party_id) {
  // Allow chrome-extensions:// origins to make WebAuthn requests.
  // `MaybeGetRelyingPartyId` will override the RP ID if it matches the
  // extension origin.
  if (caller_origin.scheme() != extensions::kExtensionScheme) {
    return false;
  }
  const extensions::Extension* extension =
      extensions::ExtensionRegistry::Get(browser_context)
          ->enabled_extensions()
          .GetByID(caller_origin.host());
  if (!extension) {
    return false;
  }
  return ExtensionCanAssertRpId(*extension, relying_party_id);
}

std::optional<std::string>
ChromeWebAuthenticationDelegate::MaybeGetRelyingPartyIdOverride(
    const std::string& claimed_relying_party_id,
    const url::Origin& caller_origin) {
  // Extensions may claim their origin as an RP ID. In that case, we use the
  // whole origin to avoid collisions with the RP ID space for HTTPS origins.
  // Extensions may not claim other extensions RP IDs, even if they have host
  // permissions on them.
  if (caller_origin.scheme() == extensions::kExtensionScheme &&
      claimed_relying_party_id == caller_origin.host()) {
    return caller_origin.Serialize();
  }

  return std::nullopt;
}

bool ChromeWebAuthenticationDelegate::ShouldPermitIndividualAttestation(
    content::BrowserContext* browser_context,
    const url::Origin& caller_origin,
    const std::string& relying_party_id) {
  return IsOriginListedInEnterpriseAttestationSwitch(caller_origin) ||
         IsWebAuthnRPIDListedInSecurityKeyPermitAttestationPolicy(
             browser_context, relying_party_id);
}

bool ChromeWebAuthenticationDelegate::SupportsResidentKeys(
    content::RenderFrameHost* render_frame_host) {
  return true;
}

bool ChromeWebAuthenticationDelegate::IsFocused(
    content::WebContents* web_contents) {
  return web_contents->GetVisibility() == content::Visibility::VISIBLE;
}

void ChromeWebAuthenticationDelegate::
    IsUserVerifyingPlatformAuthenticatorAvailableOverride(
        content::RenderFrameHost* render_frame_host,
        base::OnceCallback<void(std::optional<bool>)> callback) {
  const bool is_google =
      render_frame_host->GetLastCommittedOrigin().DomainIs("google.com");
  content::WebAuthenticationDelegate::
      IsUserVerifyingPlatformAuthenticatorAvailableOverride(
          render_frame_host,
          base::BindOnce(
              [](base::WeakPtr<ChromeWebAuthenticationDelegate>
                     web_authentication_delegate,
                 base::WeakPtr<content::BrowserContext> browser_context,
                 const bool is_google,
                 base::OnceCallback<void(std::optional<bool>)> callback,
                 std::optional<bool> testing_api_override) {
                if (!browser_context || !web_authentication_delegate) {
                  return;
                }

                // If the testing API is active, its override takes precedence.
                if (testing_api_override) {
                  std::move(callback).Run(*testing_api_override);
                  return;
                }

                // Chrome disables platform authenticators in Guest sessions.
                // They may be available (behind an additional interstitial) in
                // Incognito mode.
                Profile* profile =
                    Profile::FromBrowserContext(browser_context.get());
                if (profile->IsGuestSession()) {
                  std::move(callback).Run(false);
                  return;
                }

                // The enclave won't allow credentials for an account to be
                // stored in GPM _in_ that account. So we don't want to tell
                // accounts.google.com that there is a platform authenticator
                // if we're later going to reject a create() request for that
                // reason. Thus we have to be conservative with IsUVPAA
                // responses on google.com and ignore the possibility of using
                // the enclave authenticator.
                if (is_google) {
                  std::move(callback).Run(std::nullopt);
                  return;
                }

                web_authentication_delegate->BrowserProvidedPasskeysAvailable(
                    browser_context.get(),
                    base::BindOnce(
                        [](base::OnceCallback<void(std::optional<bool>)>
                               callback,
                           bool available) {
                          if (available) {
                            std::move(callback).Run(true);
                            return;
                          }
                          std::move(callback).Run(std::nullopt);
                        },
                        std::move(callback)));
              },
              weak_ptr_factory_.GetWeakPtr(),
              render_frame_host->GetBrowserContext()->GetWeakPtr(), is_google,
              std::move(callback)));
}

content::WebAuthenticationRequestProxy*
ChromeWebAuthenticationDelegate::MaybeGetRequestProxy(
    content::BrowserContext* browser_context,
    const url::Origin& caller_origin) {
  auto* service = extensions::WebAuthenticationProxyService::GetIfProxyAttached(
      Profile::FromBrowserContext(browser_context));
  return service && service->IsActive(caller_origin) ? service : nullptr;
}

void ChromeWebAuthenticationDelegate::PasskeyUnrecognized(
    content::WebContents* web_contents,
    const url::Origin& origin,
    const std::vector<uint8_t>& passkey_credential_id,
    const std::string& relying_party_id) {
  webauthn::PasskeyChangeQuotaTracker* quota_tracker =
      webauthn::PasskeyChangeQuotaTracker::GetInstance();
  if (base::FeatureList::IsEnabled(device::kWebAuthnSignalApiHidePasskeys)) {
    if (!quota_tracker->CanMakeChange(origin)) {
      LogSignalUnknownCredential(SignalUnknownCredentialResult::kQuotaExceeded);
      FIDO_LOG(ERROR) << "Dropping removal request from " << origin
                      << ": quota exceeded.";
      return;
    }
  }
  webauthn::PasskeyModel* passkey_store =
      PasskeyModelFactory::GetInstance()->GetForProfile(
          Profile::FromBrowserContext(web_contents->GetBrowserContext()));
  std::string credential_id(passkey_credential_id.begin(),
                            passkey_credential_id.end());
  std::optional<sync_pb::WebauthnCredentialSpecifics> credential_specifics =
      passkey_store->GetPasskeyByCredentialId(relying_party_id, credential_id);
  if (!credential_specifics) {
    LogSignalUnknownCredential(SignalUnknownCredentialResult::kPasskeyNotFound);
    return;
  }
  if (base::FeatureList::IsEnabled(device::kWebAuthnSignalApiHidePasskeys)) {
    if (credential_specifics->hidden()) {
      LogSignalUnknownCredential(
          SignalUnknownCredentialResult::kPasskeyAlreadyHidden);
      return;
    }
    quota_tracker->TrackChange(origin);
    passkey_store->SetPasskeyHidden(std::move(credential_id),
                                    /*hidden=*/true);
    LogSignalUnknownCredential(SignalUnknownCredentialResult::kPasskeyHidden);
  } else {
    passkey_store->DeletePasskey(std::move(credential_id), FROM_HERE);
    LogSignalUnknownCredential(SignalUnknownCredentialResult::kPasskeyRemoved);
  }
  PasswordsClientUIDelegate* manage_passwords_ui_controller =
      PasswordsClientUIDelegateFromWebContents(web_contents);
  if (manage_passwords_ui_controller) {
    manage_passwords_ui_controller->OnPasskeyDeleted();
  }
}

void ChromeWebAuthenticationDelegate::SignalAllAcceptedCredentials(
    content::WebContents* web_contents,
    const url::Origin& origin,
    const std::string& relying_party_id,
    const std::vector<uint8_t>& user_id,
    const std::vector<std::vector<uint8_t>>& all_accepted_credentials_ids) {
  if (base::FeatureList::IsEnabled(device::kWebAuthnSignalApiHidePasskeys)) {
    HideAndRestorePasskeys(web_contents, origin, relying_party_id, user_id,
                           all_accepted_credentials_ids);
  } else {
    DeleteUnacceptedPasskeys(web_contents, relying_party_id, user_id,
                             all_accepted_credentials_ids);
  }
}

void ChromeWebAuthenticationDelegate::UpdateUserPasskeys(
    content::WebContents* web_contents,
    const url::Origin& origin,
    const std::string& relying_party_id,
    std::vector<uint8_t>& user_id,
    const std::string& name,
    const std::string& display_name) {
  webauthn::PasskeyChangeQuotaTracker* quota_tracker =
      webauthn::PasskeyChangeQuotaTracker::GetInstance();
  if (!quota_tracker->CanMakeChange(origin)) {
    LogSignalCurrentUserDetailsUpdated(
        SignalCurrentUserDetailsResult::kQuotaExceeded);
    FIDO_LOG(ERROR) << "Dropping update request from " << origin
                    << ": quota exceeded.";
    return;
  }
  webauthn::PasskeyModel* passkey_store =
      PasskeyModelFactory::GetInstance()->GetForProfile(
          Profile::FromBrowserContext(web_contents->GetBrowserContext()));
  bool is_passkey_updated = false;
  for (const auto& passkey :
       passkey_store->GetPasskeysForRelyingPartyId(relying_party_id)) {
    if (std::vector<uint8_t>(passkey.user_id().begin(),
                             passkey.user_id().end()) == user_id &&
        (passkey.user_name() != name ||
         passkey.user_display_name() != display_name)) {
      passkey_store->UpdatePasskey(
          passkey.credential_id(),
          {.user_name = name, .user_display_name = display_name},
          /*updated_by_user=*/false);
      is_passkey_updated = true;
    }
  }
  if (is_passkey_updated) {
    FIDO_LOG(EVENT) << "Updating passkey user details for " << origin;
    quota_tracker->TrackChange(origin);
    PasswordsClientUIDelegate* manage_passwords_ui_controller =
        PasswordsClientUIDelegateFromWebContents(web_contents);
    if (manage_passwords_ui_controller) {
      manage_passwords_ui_controller->OnPasskeyUpdated(relying_party_id);
    }
  }
  LogSignalCurrentUserDetailsUpdated(
      is_passkey_updated ? SignalCurrentUserDetailsResult::kPasskeyUpdated
                         : SignalCurrentUserDetailsResult::kPasskeyNotUpdated);
}

#if BUILDFLAG(IS_MAC)
// static
ChromeWebAuthenticationDelegate::TouchIdAuthenticatorConfig
ChromeWebAuthenticationDelegate::TouchIdAuthenticatorConfigForProfile(
    Profile* profile) {
  constexpr char kKeychainAccessGroup[] =
      MAC_TEAM_IDENTIFIER_STRING "." MAC_BUNDLE_IDENTIFIER_STRING ".webauthn";

  std::string metadata_secret = profile->GetPrefs()->GetString(
      webauthn::pref_names::kWebAuthnTouchIdMetadataSecretPrefName);
  if (metadata_secret.empty() ||
      !base::Base64Decode(metadata_secret, &metadata_secret)) {
    metadata_secret = device::fido::mac::GenerateCredentialMetadataSecret();
    profile->GetPrefs()->SetString(
        webauthn::pref_names::kWebAuthnTouchIdMetadataSecretPrefName,
        base::Base64Encode(base::as_byte_span(metadata_secret)));
  }

  return TouchIdAuthenticatorConfig{
      .keychain_access_group = kKeychainAccessGroup,
      .metadata_secret = std::move(metadata_secret)};
}

std::optional<ChromeWebAuthenticationDelegate::TouchIdAuthenticatorConfig>
ChromeWebAuthenticationDelegate::GetTouchIdAuthenticatorConfig(
    content::BrowserContext* browser_context) {
  return TouchIdAuthenticatorConfigForProfile(
      Profile::FromBrowserContext(browser_context));
}
#endif  // BUILDFLAG(IS_MAC)

#if BUILDFLAG(IS_CHROMEOS)
content::WebAuthenticationDelegate::ChromeOSGenerateRequestIdCallback
ChromeWebAuthenticationDelegate::GetGenerateRequestIdCallback(
    content::RenderFrameHost* render_frame_host) {
  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
  aura::Window* window =
      render_frame_host->GetNativeView()->GetToplevelWindow();
  return chromeos::webauthn::WebAuthnRequestRegistrar::Get()
      ->GetRegisterCallback(window);
}
#endif  // BUILDFLAG(IS_CHROMEOS)

void ChromeWebAuthenticationDelegate::BrowserProvidedPasskeysAvailable(
    content::BrowserContext* browser_context,
    base::OnceCallback<void(bool)> callback) {
  auto* profile =
      Profile::FromBrowserContext(browser_context)->GetOriginalProfile();
  auto* const identity_manager = IdentityManagerFactory::GetForProfile(profile);
  if (!identity_manager ||
      !identity_manager->HasPrimaryAccount(signin::ConsentLevel::kSignin)) {
    FIDO_LOG(EVENT)
        << "Enclave authenticator disabled because no suitable account";
    std::move(callback).Run(false);
    return;
  }

  auto* const sync_service = SyncServiceFactory::GetForProfile(profile);
  if (!sync_service || !sync_service->GetUserSettings()->GetSelectedTypes().Has(
                           syncer::UserSelectableType::kPasswords)) {
    FIDO_LOG(EVENT)
        << "Enclave authenticator disabled because password sync not active";
    std::move(callback).Run(false);
    return;
  }
  // Check for TPM availability.
  if (tpm_available_.has_value()) {
    std::move(callback).Run(*tpm_available_);
    return;
  }
  base::Time tpm_check_start_time = base::Time::Now();
  base::ThreadPool::PostTaskAndReplyWithResult(
      FROM_HERE, {base::TaskPriority::USER_BLOCKING, base::MayBlock()},
      base::BindOnce([]() -> bool {
        std::unique_ptr<crypto::UnexportableKeyProvider> provider =
            GetWebAuthnUnexportableKeyProvider();
        if (!provider) {
          FIDO_LOG(EVENT)
              << "Enclave authenticator disabled because no key provider";
          return false;
        }
        return provider->SelectAlgorithm(device::enclave::kSigningAlgorithms) !=
               std::nullopt;
      }),
      base::BindOnce(
          [](base::OnceCallback<void(bool)> callback,
             base::Time tpm_check_start_time,
             base::WeakPtr<ChromeWebAuthenticationDelegate> webauthn_delegate,
             bool available) {
            FIDO_LOG(DEBUG) << "Checking for TPM availability took "
                            << (base::Time::Now() - tpm_check_start_time);
            if (webauthn_delegate) {
              webauthn_delegate->tpm_available_ = available;
            }
            if (!available) {
              FIDO_LOG(EVENT)
                  << "Enclave authenticator disabled because of lack of TPM";
            }
            std::move(callback).Run(available);
          },
          std::move(callback), tpm_check_start_time,
          weak_ptr_factory_.GetWeakPtr()));
}