From 0e6594bf1f9e03541bcc9d976745e1ed9a941f84 Mon Sep 17 00:00:00 2001
From: uglyegg <uglyegg@entropy.quest>
Date: Sat, 29 Aug 2026 11:45:47 -0500
Subject: [PATCH] fix: avoid deprecated FIDO2 capability query

ProtonVPNAPI.supports_fido2 calls its deprecated
is_fido2_lib_available compatibility property, which emits a warning during a
normal capability check.

Read both capability values from the current session instead. Preserve the
existing truth table and keep the deprecated public property available for
external callers.

Cover all four library/key combinations and fail the regression test if the
deprecated property is consulted.
---
 proton/vpn/core/api.py        |  5 ++--
 tests/python/core/test_api.py | 47 +++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 tests/python/core/test_api.py

diff --git a/proton/vpn/core/api.py b/proton/vpn/core/api.py
index 47052a4..c008114 100644
--- a/proton/vpn/core/api.py
+++ b/proton/vpn/core/api.py
@@ -217,8 +217,9 @@ def supports_fido2(self) -> bool:
         This only returns True if both conditions are met and if the user
         is currently authenticating a session that requires 2FA.
         """
-        lib_available = self.is_fido2_lib_available
-        supports_fido2 = self._session_holder.session.supports_fido2
+        session = self._session_holder.session
+        lib_available = session.fido2_lib_available
+        supports_fido2 = session.supports_fido2
         return bool(lib_available and supports_fido2)
 
     async def generate_2fa_fido2_assertion(
diff --git a/tests/python/core/test_api.py b/tests/python/core/test_api.py
new file mode 100644
index 0000000..f90c14a
--- /dev/null
+++ b/tests/python/core/test_api.py
@@ -0,0 +1,47 @@
+"""
+Copyright (c) 2026 Proton AG
+
+This file is part of Proton VPN.
+
+Proton VPN is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+"""
+from types import SimpleNamespace
+
+import pytest
+
+from proton.vpn.core.api import ProtonVPNAPI
+
+
+@pytest.mark.parametrize(
+    "library_available,registered_key,expected",
+    [
+        (False, False, False),
+        (False, True, False),
+        (True, False, False),
+        (True, True, True),
+    ],
+)
+def test_supports_fido2_uses_current_session_capabilities(
+        monkeypatch, library_available, registered_key, expected
+):
+    api = object.__new__(ProtonVPNAPI)
+    api._session_holder = SimpleNamespace(
+        session=SimpleNamespace(
+            fido2_lib_available=library_available,
+            supports_fido2=registered_key,
+        )
+    )
+
+    def fail_if_deprecated_property_is_used(_api):
+        pytest.fail("supports_fido2 called the deprecated capability property")
+
+    monkeypatch.setattr(
+        ProtonVPNAPI,
+        "is_fido2_lib_available",
+        property(fail_if_deprecated_property_is_used),
+    )
+
+    assert api.supports_fido2 is expected