diff --git a/index.bs b/index.bs
index cb7037169..41626ea9f 100644
--- a/index.bs
+++ b/index.bs
@@ -36,6 +36,7 @@ Former Editor: Rolf Lindemann, w3cid 84447, Nok Nok Labs, rolf@noknok.com
!Contributors: Christiaan Brand (Google)
!Contributors: Adam Langley (Google)
!Contributors: Giridhar Mandyam (Qualcomm)
+!Contributors: Pascoe (Apple)
!Contributors: Nina Satragno (Google)
!Contributors: Ki-Eun Shin (SK Telecom)
!Contributors: Nick Steele (1Password)
@@ -1582,15 +1583,16 @@ that are returned to the caller when a new credential is created, or a new asser
: {{PublicKeyCredential/isConditionalMediationAvailable()}}
:: {{PublicKeyCredential}} overrides this method to indicate availability for {{CredentialMediationRequirement/conditional}}
- mediation. [=[WRPS]=] SHOULD verify availability before attempting to set
- |options|.{{CredentialRequestOptions/mediation}}
to {{CredentialMediationRequirement/conditional}}.
+ mediation during {{CredentialsContainer/get()|navigator.credentials.get()}}. [=[WRPS]=] SHOULD verify availability before
+ attempting to set |options|.{{CredentialRequestOptions/mediation}}
to {{CredentialMediationRequirement/conditional}}.
Upon invocation, a promise is returned that resolves with a value of [TRUE] if {{CredentialMediationRequirement/conditional}}
[=user mediation=] is available, or [FALSE] otherwise.
This method has no arguments and returns a promise to a Boolean value.
- Note: If this method is not present, {{CredentialMediationRequirement/conditional}} [=user mediation=] is not available.
+ Note: If this method is not present, {{CredentialMediationRequirement/conditional}} [=user mediation=] is not available for
+ {{CredentialsContainer/get()|navigator.credentials.get()}}.
: {{PublicKeyCredential/toJSON()}}
:: This operation returns {{RegistrationResponseJSON}} or {{AuthenticationResponseJSON}},
@@ -1736,8 +1738,16 @@ To support obtaining assertions via {{CredentialsContainer/get()|navigator.crede
{{PublicKeyCredential}}'s [=interface object=]'s implementation of the \[[Create]](origin,
options, sameOriginWithAncestors) [=internal method=] [[!CREDENTIAL-MANAGEMENT-1]] allows
[=[WRP]=] scripts to call {{CredentialsContainer/create()|navigator.credentials.create()}} to request the creation of a new
-[=public key credential source=], [=bound credential|bound=] to an [=authenticator=]. This
-{{CredentialsContainer/create()|navigator.credentials.create()}} operation can be aborted by leveraging the {{AbortController}};
+[=public key credential source=], [=bound credential|bound=] to an [=authenticator=].
+
+By setting |options|.{{CredentialCreationOptions/mediation}}
to {{CredentialMediationRequirement/conditional}},
+[=[RPS]=] can indicate that they would like to register a credential without prominent modal UI if user has already consented to create a credential. The [=[RP]=] SHOULD first check that {{ClientCapability/conditionalCreate}} is present
+in the result of {{PublicKeyCredential/getClientCapabilities()}} in order to avoid the possibility of causing a user-visible error to be returned if the user agent does
+not support {{CredentialMediationRequirement/conditional}} [=user mediation=] for {{CredentialsContainer/create()|navigator.credentials.create()}}.
+The client MUST set BOTH |requireUserPresence| and |requireUserVerification| to |FALSE| when |options|.{{CredentialCreationOptions/mediation}}
is set to {{CredentialMediationRequirement/conditional}}
+unless they may explicitly performed during the ceremony.
+
+Any {{CredentialsContainer/create()|navigator.credentials.create()}} operation can be aborted by leveraging the {{AbortController}};
see [[dom#abortcontroller-api-integration]] for detailed instructions.
@@ -1776,6 +1786,11 @@ When this method is invoked, the user agent MUST execute the following algorithm
1. If sameOriginWithAncestors is [FALSE]:
+ 1. If |options|.{{CredentialCreationOptions/mediation}}
is present with the value
+ {{CredentialMediationRequirement/conditional}}:
+
+ 1. Throw a "{{NotAllowedError}}" {{DOMException}}
+
1. If the [=relevant global object=], as determined by the calling
{{CredentialsContainer/create()}} implementation, does not have
[=transient activation=]:
@@ -1912,6 +1927,16 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
[=authenticators=] can be hot-plugged into (e.g., via USB)
or discovered (e.g., via NFC or Bluetooth) by the [=client=] by various mechanisms, or permanently built into the [=client=].
+1. If |options|.{{CredentialCreationOptions/mediation}}
is present with the value
+ {{CredentialMediationRequirement/conditional}}:
+
+ 1. If the user agent has not recently mediated an authentication, the origin of said authentication is not |callerOrigin|, or the user
+ does not consent to this type of credential creation, throw a "{{NotAllowedError}}" {{DOMException}}.
+
+ It is up to the user agent to decide when it believes an authentication ceremony has
+ been completed. That authentication ceremony MAY be performed via other means than the
+ [=Web Authentication API=].
+
1. Consider the value of {{PublicKeyCredentialCreationOptions/hints}} and craft the user interface accordingly, as the user-agent sees fit.
1. Start |lifetimeTimer|.
@@ -2000,7 +2025,10 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
|options|.{{CredentialCreationOptions/mediation}}
is set to {{CredentialMediationRequirement/conditional}}
+ and [=user verification=] cannot be collected during the ceremony,
+ throw a {{ConstraintError}} {{DOMException}}.
+ 1. Let |userVerification| be [TRUE].
: is set to {{UserVerificationRequirement/preferred}}
:: If the |authenticator|
@@ -2199,7 +2227,7 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
[[#sctn-make-credential-privacy]] for details.
During the above process, the user agent SHOULD show some UI to the user to guide them in the process of selecting and
-authorizing an authenticator.
+authorizing an authenticator. When |options|.{{CredentialCreationOptions/mediation}}
is set to {{CredentialMediationRequirement/conditional}}, prominent modal UI should not be shown unless credential creation was previously consented to via means determined by the user agent.
@@ -4612,9 +4640,7 @@ It takes the following input parameters:
: |requireResidentKey|
:: The [=effective resident key requirement for credential creation=], a Boolean value determined by the [=client=].
: |requireUserPresence|
-:: The constant Boolean value [TRUE].
- It is included here as a pseudo-parameter to simplify applying this abstract authenticator model to implementations that may
- wish to make a [=test of user presence=] optional although WebAuthn does not.
+:: The constant Boolean value [TRUE], or |FALSE| when |options|.{{CredentialCreationOptions/mediation}}
is set to {{CredentialMediationRequirement/conditional}} and the user agent previously collected consent from the user.
: |requireUserVerification|
:: The [=effective user verification requirement for credential creation=], a Boolean value determined by the [=client=].
: |credTypesAndPubKeyAlgs|
@@ -5369,7 +5395,7 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
1. Verify that the [=rpIdHash=]
in |authData| is the SHA-256 hash of the [=RP ID=] expected by the [=[RP]=].
-1. Verify that the [=UP=] bit of the [=flags=]
in |authData| is set.
+1. Verify that the [=UP=] bit of the [=flags=]
in |authData| is set, unless |options|.{{CredentialCreationOptions/mediation}}
is set to {{CredentialMediationRequirement/conditional}}.
1. If the [=[RP]=] requires [=user verification=] for this registration,
verify that the [=authData/flags/UV=] bit of the [=flags=]
in |authData| is set.