verifyRegistrationResponse fails if not metadata was found

When trying to register the an authenticator using fingerprint on my Pixel 3a I get

 Error: No metadata statement found for aaguid "b93fd961-f2e6-462f-b122-82002247de78"

Looks like MetadataService.getStatement always throws if no meta data was found: https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/services/metadataService.ts#L138

Is this intentional? Because then this code block doesn’t really make sense: https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/registration/verifications/verifyAndroidSafetyNet.ts#L94-L110

My guess is that getStatement should probably just return null if no metadata was found for a given aaguid, no?

[MasterKale]

How about a verificationMode enum / union-type string instead?

Good call, I’d considered this earlier but was still indecisive on what exactly I needed to change about MetadataService to make things more permissive. A boolean seemed the simplest, but then I remembered that that’s what led to there being a requireResidentKey: boolean and “residentKey: ResidentKeyRequirement + instructions on what to set requireResidentKey to for a given residentKey” in L2 of the WebAuthn spec (because in L1 it made sense for resident key requirement to be a simple yes/no!)

I settled on this:

// Allow MetadataService to accommodate unregistered AAGUIDs ("permissive"), or only allow
// registered AAGUIDs ("strict"). Currently primarily impacts how `getStatement()` operates
type VerificationMode = 'permissive' | 'strict';

An optional verificationMode can be set when calling MetadataService.initialize(opts); to control how the service behaves. It will default to "strict" because that’s how MetadataService currently operates and I don’t want this to be a breaking change.

[MaKleSoft]

How about a verificationMode enum / union-type string instead? Something like

export type VerificationMode = "none" | "default" | "strict";

? Using verificationMode: "none" would be helpful for the use-case I described earlier where someone wants to fetch metadata only for logging or display purposes. Not sure what to call the “middle tier”. Maybe something more descriptive like fallback? Or perhaps you can come up with even more options for the verification behaviour 😃 That’s the nice things about using an enum instead of a boolean - it leaves you the option of adding additional modes in the future.