get_assertion: Load full credential if allowList is passed

Normally, we load discoverable credentials from the filesystem so we
have access to all metadata. But if an allowList is passed, we currently
just use the metadata from the credential ID. To be able to access the
full metadata like the credBlob value, we have to load the full
credential from the filessytem.

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Update to `ctap-types` v0.6.0-rc.1.
 - Set `algorithms`, `firmware_version` and `remaining_discoverable_credentials` in `get_info` and add `firmware_version` to `Config`.
 - Implement the `credBlob` extension.
+- Load full credential from filesstem for getAssertion if an allow list is used with a discoverable credential.
 
 ## [v0.3.0](https://github.com/trussed-dev/fido-authenticator/releases/tag/v0.3.0) (2026-03-25)
 

src/ctap2.rs

@@ -1160,7 +1160,8 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
             // they probably meant to send None.
             if !allow_list.is_empty() {
                 for credential_id in allow_list {
-                    let credential = match Credential::try_from(self, rp_id_hash, credential_id) {
+                    let mut credential = match Credential::try_from(self, rp_id_hash, credential_id)
+                    {
                         Ok(credential) => credential,
                         _ => continue,
                     };
@@ -1169,6 +1170,28 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
                         continue;
                     }
 
+                    // If this is an RK, we still need to load it from the filesystem to have access
+                    // to all metadata
+                    if let Credential::Stripped(stripped) = &credential {
+                        if matches!(stripped.key, Key::ResidentKey(_)) {
+                            let credential_id_hash = self.hash(credential_id.id);
+                            let rk_path = rk_path(rp_id_hash, &credential_id_hash);
+                            let credential_data = match try_syscall!(self
+                                .trussed
+                                .read_file(Location::Internal, rk_path))
+                            {
+                                Ok(reply) => reply.data,
+                                Err(_) => continue,
+                            };
+                            match FullCredential::deserialize(&credential_data) {
+                                Ok(full_credential) => {
+                                    credential = Credential::Full(full_credential);
+                                }
+                                Err(_) => continue,
+                            }
+                        }
+                    }
+
                     return Ok(Some((credential, 1)));
                 }