[rubygems/rubygems] Rename credential email to identifier in WebAuthn poller

https://github.com/rubygems/rubygems/commit/5e3e55f8bc

2 files changed, 14 insertions, 2 deletions

diff --git a/lib/rubygems/gemcutter_utilities/webauthn_poller.rb b/lib/rubygems/gemcutter_utilities/webauthn_poller.rb
index 0fdd1d5bf4..fe3f163a88 100644
--- a/lib/rubygems/gemcutter_utilities/webauthn_poller.rb
+++ b/lib/rubygems/gemcutter_utilities/webauthn_poller.rb
@@ -69,8 +69,10 @@ module Gem::GemcutterUtilities
       rubygems_api_request(:get, "api/v1/webauthn_verification/#{webauthn_token}/status.json") do |request|
         if credentials.empty?
           request.add_field "Authorization", api_key
+        elsif credentials[:identifier] && credentials[:password]
+          request.basic_auth credentials[:identifier], credentials[:password]
         else
-          request.basic_auth credentials[:email], credentials[:password]
+          raise Gem::WebauthnVerificationError, "Provided missing credentials"
         end
       end
     end
diff --git a/test/rubygems/test_webauthn_poller.rb b/test/rubygems/test_webauthn_poller.rb
index 23290d8ea1..fd24081758 100644
--- a/test/rubygems/test_webauthn_poller.rb
+++ b/test/rubygems/test_webauthn_poller.rb
@@ -13,7 +13,7 @@ class WebauthnPollerTest < Gem::TestCase
     @fetcher = Gem::FakeFetcher.new
     Gem::RemoteFetcher.fetcher = @fetcher
     @credentials = {
-      email: "email@example.com",
+      identifier: "email@example.com",
       password: "password",
     }
   end
@@ -121,4 +121,14 @@ class WebauthnPollerTest < Gem::TestCase
     assert_equal error.message,
       "Security device verification failed: The token in the link you used has either expired or been used already."
   end
+
+  def test_poll_for_otp_missing_credentials
+    @credentials = { password: "password" }
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message, "Security device verification failed: Provided missing credentials"
+  end
 end