Fix handling of residentKey "preferred"

fido2/client.py

@@ -45,6 +45,7 @@
     AuthenticatorAttestationResponse,
     AuthenticatorAssertionResponse,
     AttestationConveyancePreference,
+    ResidentKeyRequirement,
     _as_cbor,
 )
 from .cose import ES256
@@ -631,7 +632,6 @@ def do_make_credential(
         exclude_list = options.exclude_credentials
         extensions = options.extensions
         selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
-        rk = selection.require_resident_key
         user_verification = selection.user_verification
 
         on_keepalive = _user_keepalive(self.user_interaction)
@@ -693,6 +693,18 @@ def _do_make():
             except ValueError as e:
                 raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(e)
 
+            can_rk = self.info.options.get("rk", False)
+            if selection.resident_key == ResidentKeyRequirement.REQUIRED:
+                if not can_rk:
+                    raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
+                        "Resident key not supported"
+                    )
+                rk = True
+            elif selection.resident_key == ResidentKeyRequirement.PREFERRED:
+                rk = can_rk
+            else:
+                rk = False
+
             if not (rk or internal_uv):
                 options = None
             else: