[RDMW-21965] Add a .NET wrapper for the WebAuthn authenticator

[Bea (B-E-A-F)]

• 🔗 RDMW-21965

The RDM Desktop Extension acts as a Windows WebAuthn plugin and currently reimplements slauth's credential
envelope, COSE encoding and assertion signing by hand in C#, which risks drifting from the format Hub
writes through slauth-web. This adds a .NET wrapper so it can call slauth instead.

The authenticator C ABI was gated on target_os = "ios", so nothing declared in slauth.h existed on any
other platform. The ABI is platform-neutral, so it is gated on the native-bindings feature instead,
matching oath and u2f. The not(feature = "android") half is required rather than cosmetic: the
android module exports four of the same symbol names with different signatures and they would collide at
link time. iOS is unaffected.

Three leaks in that ABI are also fixed. slauth_string_free reclaims the char* returns — they are
CString::into_raw allocations, so the caller's free is the wrong allocator, which is what the swift
wrapper currently does; the private key string is wiped before release. request_response_free releases
AuthenticatorRequestResponse, which had no free function at all, so every assertion leaked. And
response_free now null-checks.

The wrapper exposes no raw pointers: SafeHandles own the handles, strings go back through
slauth_string_free, and because Buffer borrows the response's storage every byte array handed out is an
owned copy. build.ps1 cross-compiles, stages natives per RID, tests and packs. rust.yml gains a
build-dotnet job and publish.yml a nuget input. Tests run against the real ABI: all three algorithms,
assertion signing, a PKCS#8 round trip, and a create/free loop.

[Copilot]

Pull request overview

Adds managed .NET WebAuthn bindings with native-library packaging, lifecycle management, tests, and CI publishing support.

Changes:

• Adds the .NET API, native interop layer, tests, and build tooling.
• Makes the authenticator C ABI platform-neutral and adds deallocation functions.
• Adds NuGet build and publication workflows.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wrappers/dotnet/README.md	Documents usage, ownership, building, and tests.
wrappers/dotnet/Devolutions.Slauth/WebAuthn.cs	Implements the public managed API.
wrappers/dotnet/Devolutions.Slauth/Native.cs	Defines P/Invoke bindings and safe handles.
wrappers/dotnet/Devolutions.Slauth/Devolutions.Slauth.csproj	Configures the NuGet library package.
wrappers/dotnet/Devolutions.Slauth.Tests/WebAuthnTests.cs	Adds native ABI integration tests.
wrappers/dotnet/Devolutions.Slauth.Tests/Devolutions.Slauth.Tests.csproj	Configures the managed test project.
wrappers/dotnet/build.ps1	Builds, tests, stages, and packs native assets.
src/webauthn/authenticator/native.rs	Broadens ABI availability and adds free functions.
slauth.h	Declares the new deallocation APIs.
.gitignore	Excludes .NET outputs and staged native libraries.
.github/workflows/rust.yml	Adds .NET CI validation.
.github/workflows/publish.yml	Adds NuGet packaging and publication.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated no new comments.

Suppressed comments (4)

wrappers/dotnet/Devolutions.Slauth/WebAuthn.cs:120

• This validation still permits ExtensionDataIncluded, although the native AuthenticatorData::to_vec implementation never appends extension CBOR (src/webauthn/proto/raw_message.rs:189-202). Setting ED therefore produces registration data whose flags claim an extension map follows when none does. Reject ED until the ABI accepts and serializes extension data.

        if ((attestationFlags & AttestationFlags.AttestedCredentialDataIncluded) == 0)
        {
            throw new ArgumentException(
                "AttestedCredentialDataIncluded is required when creating a credential.",
                nameof(attestationFlags));
        }

wrappers/dotnet/Devolutions.Slauth/WebAuthn.cs:215

• Assertions must not set AT without attested credential data, and ED must not be set without extension CBOR. This native path always passes None for attested data and serializes no extensions, so either flag yields malformed authenticator data while IsSuccess remains true. Reject both unsupported structural flags before calling native code.

        IntPtr rpIdPointer = Utf8.Allocate(rpId);

wrappers/dotnet/Devolutions.Slauth/WebAuthn.cs:213

• WebAuthn's clientDataHash is always a 32-byte SHA-256 digest, but the native signer accepts any length and still reports success. A caller can therefore receive IsSuccess == true for an assertion that every relying party will reject because it signs the wrong byte sequence. Validate the fixed hash length before invoking the ABI.

        if (clientDataHash is null)
        {
            throw new ArgumentNullException(nameof(clientDataHash));
        }

wrappers/dotnet/Devolutions.Slauth/WebAuthn.cs:101

• credentialId is unbounded here, but the native serializer writes its length as credential_id.len() as u16 (src/webauthn/proto/raw_message.rs:197). For arrays larger than 65,535 bytes the length wraps while all bytes are still appended, so the relying party parses the remaining ID bytes as the COSE key and receives a malformed attestation. Reject IDs that cannot fit in the encoded length field before crossing the ABI.

This issue also appears in the following locations of the same file:

• line 115
• line 215

        if (credentialId is null)
        {
            throw new ArgumentNullException(nameof(credentialId));
        }