Allow UV retry reset without PIN configured

[pando85]

Problem

When uv_retries is exhausted (e.g., after repeated failed UV ceremonies), the only CLI reset path is passless client pin uv-reset, which requires PIN authentication. If no PIN is configured (min_pin_length: 0), there is no way to reset the UV retry counter via the client — the authenticator becomes permanently locked out of UV operations.

The only workaround is manually editing the encrypted pin_retries.gpg file in the password store, which is error-prone and not discoverable.

Expected Behavior

passless client pin uv-reset (or an equivalent command) should work even when no PIN is set. Since UV is handled by the notification callback (not PIN), the reset should not require PIN authentication when min_pin_length == 0.

Reproduction

1. Configure passless with no PIN (min_pin_length: 0)
2. Trigger multiple failed UV ceremonies (e.g., dismiss notifications) until uv_retries reaches 0
3. Attempt passless client pin uv-reset → fails because no PIN is set
4. All subsequent WebAuthn assertions fail with UV denied

Suggested Fix

• Allow uv-reset without PIN when no PIN is configured (skip pinUvAuthParam verification)
• Or add a dedicated passless client uv-reset command that resets UV retries via the admin socket (which already has privileged access)
• Consider also resetting uv_retries on daemon restart when no PIN is configured (since the counter is only meaningful as a brute-force guard for PIN/UV)

Environment

• passless 0.13.0 (v0.13.0, commit 00f5c9cb)
• soft-fido2 0.15.0
• Storage backend: pass (password-store)
• No PIN configured (min_pin_length: 0)

[pando85]

@forkline take this

[forkline-bot]

PR created at #366

Summary

Problem: passless client pin uv-reset always required PIN authentication, making it impossible to reset the UV retry counter when no PIN was configured.

Changes (2 files):

1. Server-side (authenticator.rs): Made pinUvAuthProtocol (CBOR key 3) and pinUvAuthParam (key 4) optional fields in the CMD_PASSLESS_RESET_UV_RETRIES handler. When absent, PIN verification is skipped. The command is already gated by local UHID access, consistent with the existing passless client reset command which works without PIN.

2. Client-side (client.rs): Moved the GetInfo call to before the PIN prompt. Checks the clientPin option — when false (no PIN configured), sends the reset command without authentication parameters; when true, prompts for PIN as before.

[forkline-bot]

This issue was already resolved by a prior session. Here's a summary:

PR #366 — fix: allow uv-reset without PIN when no PIN is configured is already open and mergeable on branch fix/365-uv-reset-without-pin.

Changes (2 commits):

1. a39732b — Core fix in two files:

   • cmd/passless/src/commands/client.rs: pin_uv_reset() now checks the clientPin option from GetInfo before deciding the flow. If no PIN is configured, it sends the reset command without pinUvAuthProtocol/pinUvAuthParam CBOR fields.
   • cmd/passless/src/authenticator.rs: The vendor command 0x42 handler makes pinUvAuthProtocol (key 3) and pinUvAuthParam (key 4) optional. When absent, PIN auth verification is skipped entirely.

2. 94891db — Refactoring: replaced magic numbers with named constant RESET_UV_RETRIES_SUBCOMMAND.

The build failure in this environment is due to a missing system dependency (libudev-dev), not a code issue.