From 80240674b463295e9eb7b012c1273c870bf1bce4 Mon Sep 17 00:00:00 2001
From: Alfie Fresta <alfie.fresta@gmail.com>
Date: Tue, 3 Mar 2026 09:43:42 +0000
Subject: [PATCH] feat(ble): Support FIDO2 for BLE transport, chooses best
 protocol available

---
 .../src/transport/ble/btleplug/manager.rs     | 61 +++++++++++++++++++
 libwebauthn/src/transport/ble/channel.rs      |  4 +-
 2 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/libwebauthn/src/transport/ble/btleplug/manager.rs b/libwebauthn/src/transport/ble/btleplug/manager.rs
index 1a87fe9b..677de75f 100644
--- a/libwebauthn/src/transport/ble/btleplug/manager.rs
+++ b/libwebauthn/src/transport/ble/btleplug/manager.rs
@@ -49,6 +49,11 @@ impl SupportedRevisions {
             }
         }
     }
+
+    pub fn select_best(&self) -> Option<FidoRevision> {
+        self.select_protocol(FidoProtocol::FIDO2)
+            .or_else(|| self.select_protocol(FidoProtocol::U2F))
+    }
 }
 
 async fn on_peripheral_service_data(
@@ -241,3 +246,59 @@ async fn discover_services(peripheral: &Peripheral) -> Result<FidoEndpoints, Err
         service_revision_bitfield,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::fido::FidoRevision;
+
+    #[test]
+    fn select_best_prefers_fido2() {
+        let revisions = SupportedRevisions {
+            u2fv11: true,
+            u2fv12: true,
+            v2: true,
+        };
+        assert_eq!(revisions.select_best(), Some(FidoRevision::V2));
+    }
+
+    #[test]
+    fn select_best_falls_back_to_u2f() {
+        let revisions = SupportedRevisions {
+            u2fv11: true,
+            u2fv12: true,
+            v2: false,
+        };
+        assert_eq!(revisions.select_best(), Some(FidoRevision::U2fv12));
+    }
+
+    #[test]
+    fn select_best_falls_back_to_u2fv11() {
+        let revisions = SupportedRevisions {
+            u2fv11: true,
+            u2fv12: false,
+            v2: false,
+        };
+        assert_eq!(revisions.select_best(), Some(FidoRevision::U2fv11));
+    }
+
+    #[test]
+    fn select_best_fido2_only() {
+        let revisions = SupportedRevisions {
+            u2fv11: false,
+            u2fv12: false,
+            v2: true,
+        };
+        assert_eq!(revisions.select_best(), Some(FidoRevision::V2));
+    }
+
+    #[test]
+    fn select_best_none_supported() {
+        let revisions = SupportedRevisions {
+            u2fv11: false,
+            u2fv12: false,
+            v2: false,
+        };
+        assert_eq!(revisions.select_best(), None);
+    }
+}
diff --git a/libwebauthn/src/transport/ble/channel.rs b/libwebauthn/src/transport/ble/channel.rs
index c052c7c4..41c3ee70 100644
--- a/libwebauthn/src/transport/ble/channel.rs
+++ b/libwebauthn/src/transport/ble/channel.rs
@@ -2,7 +2,7 @@ use std::convert::TryInto;
 use std::fmt::{Display, Formatter};
 use std::time::Duration;
 
-use crate::fido::{FidoProtocol, FidoRevision};
+use crate::fido::FidoRevision;
 use crate::proto::ctap1::apdu::{ApduRequest, ApduResponse};
 use crate::proto::ctap2::cbor::{CborRequest, CborResponse};
 use crate::proto::CtapError;
@@ -40,7 +40,7 @@ impl<'a> BleChannel<'a> {
         let (ux_update_sender, _) = broadcast::channel(16);
 
         let revision = revisions
-            .select_protocol(FidoProtocol::U2F)
+            .select_best()
             .ok_or(Error::Transport(TransportError::NegotiationFailed))?;
         let connection = btleplug::connect(&device.btleplug_device.peripheral, &revision)
             .await