@adminforth/two-factors-auth 4.4.5 → 4.4.6

package/dist/index.js

@@ -198,16 +198,21 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             if (!this.options.passkeys.credentialMetaFieldName) {
                 throw new Error('Passkeys credentialMetaFieldName is required');
             }
-            const metaResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialMetaFieldName);
             const metaField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialMetaFieldName);
             if (!metaField) {
-                const similar = suggestIfTypo(metaResource.columns.map(c => c.name), this.options.passkeys.credentialMetaFieldName);
-                throw new Error(`Passkeys credentialMetaFieldName '${this.options.passkeys.credentialMetaFieldName}' not found in resource '${this.options.passkeys.credentialMetaFieldName}'. ${similar ? `Did you mean '${similar}'?` : ''}`);
+                const similar = suggestIfTypo(credentialResource.columns.map(c => c.name), this.options.passkeys.credentialMetaFieldName);
+                throw new Error(`Passkeys credentialMetaFieldName '${this.options.passkeys.credentialMetaFieldName}' not found in resource '${this.options.passkeys.credentialResourceID}'. ${similar ? `Did you mean '${similar}'?` : ''}`);
             }
             metaField.backendOnly = true;
             if (!this.options.passkeys.credentialUserIdFieldName) {
                 throw new Error('Passkeys credentialUserIdFieldName is required');
             }
+            const credentialUserIdField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialUserIdFieldName);
+            if (!credentialUserIdField) {
+                const similar = suggestIfTypo(credentialResource.columns.map(c => c.name), this.options.passkeys.credentialUserIdFieldName);
+                throw new Error(`Passkeys credentialUserIdFieldName '${this.options.passkeys.credentialUserIdFieldName}' not found in resource '${this.options.passkeys.credentialResourceID}'. ${similar ? `Did you mean '${similar}'?` : ''}`);
+            }
+            credentialUserIdField.backendOnly = true;
             if (!this.options.passkeys.settings) {
                 throw new Error('Passkeys settings are required when passkeys option is enabled');
             }

package/dist/services/passkeyService.d.ts

@@ -3,7 +3,7 @@ import type { PluginOptions } from "../types.js";
 import { PasskeyRepository } from "../repositories/passkeyRepository.js";
 import { UserRepository } from "../repositories/userRepository.js";
 import { CookieService } from "./cookieService.js";
-import type { CookieList } from "../utils/types.js";
+import type { AnyRecord, CookieList } from "../utils/types.js";
 type PasskeyAuthenticationPayload = {
     response: string;
     origin: string;
@@ -29,11 +29,14 @@ export declare class PasskeyService {
         };
         error?: string;
     }>;
-    verifyPasskeyResponse(body: PasskeyAuthenticationPayload, user_id: string, cookies: {
+    private decodeUserHandle;
+    private resolveCredentialUserPk;
+    verifyPasskeyResponse(body: PasskeyAuthenticationPayload, expectedUserPk: string | null, cookies: {
         challenge: string;
     }): Promise<import("../utils/types.js").ErrorResponse | {
         ok: boolean;
         passkeyConfirmed: boolean;
+        userPk: string;
     }>;
     createRegistrationOptions(mode: PluginAuthenticatorAttachment, adminUser: AdminUser, response: IAdminForthHttpResponse): Promise<import("../utils/types.js").ErrorResponse | {
         ok: boolean;
@@ -77,7 +80,7 @@ export declare class PasskeyService {
         user?: undefined;
     } | {
         ok: boolean;
-        user: import("../utils/types.js").AnyRecord;
+        user: AnyRecord;
         error?: undefined;
     }>;
 }

package/dist/services/passkeyService.js

@@ -59,9 +59,29 @@ export class PasskeyService {
             return { ok: true, decodedPasskeysCookies };
         });
     }
-    verifyPasskeyResponse(body, user_id, cookies) {
+    decodeUserHandle(userHandle) {
+        if (typeof userHandle !== 'string' || !userHandle) {
+            return undefined;
+        }
+        try {
+            return isoUint8Array.toUTF8String(isoBase64URL.toBuffer(userHandle));
+        }
+        catch (e) {
+            return undefined;
+        }
+    }
+    resolveCredentialUserPk(cred) {
+        const credMeta = cred[this.options.passkeys.credentialMetaFieldName];
+        const storedUserHandle = credMeta === null || credMeta === void 0 ? void 0 : credMeta.user_handle;
+        if (storedUserHandle) {
+            return { userPk: String(storedUserHandle), boundByUserHandle: true };
+        }
+        const columnUserPk = cred[this.options.passkeys.credentialUserIdFieldName];
+        return { userPk: columnUserPk ? String(columnUserPk) : undefined, boundByUserHandle: false };
+    }
+    verifyPasskeyResponse(body, expectedUserPk, cookies) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f;
+            var _a, _b, _c, _d, _e, _f, _g;
             const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
             const expectedOrigin = body.origin;
             const expectedChallenge = cookies.challenge;
@@ -79,12 +99,22 @@ export class PasskeyService {
                 if (!credMeta || !credMeta.public_key) {
                     throw new Error('Credential public key not found.');
                 }
-                const usersPrimaryKeyFieldName = this.userRepository.getUserPkField();
-                const user = yield this.userRepository.getAuthUser(cred[this.options.passkeys.credentialUserIdFieldName]);
-                if (!user || !user_id || user[usersPrimaryKeyFieldName] !== user_id) {
+                const { userPk: credentialUserPk, boundByUserHandle } = this.resolveCredentialUserPk(cred);
+                if (!credentialUserPk) {
+                    throw new Error('Credential is not bound to any user.');
+                }
+                const presentedUserHandle = this.decodeUserHandle((_e = response.response) === null || _e === void 0 ? void 0 : _e.userHandle);
+                if (boundByUserHandle && presentedUserHandle && presentedUserHandle !== credentialUserPk) {
+                    throw new Error('Passkey user handle does not match the credential owner.');
+                }
+                if (expectedUserPk !== null && (!expectedUserPk || String(expectedUserPk) !== credentialUserPk)) {
+                    throw new Error('Passkey does not belong to this user.');
+                }
+                const user = yield this.userRepository.getAuthUser(credentialUserPk);
+                if (!user) {
                     throw new Error('User not found.');
                 }
-                const counter = (_e = credMeta.sign_count) !== null && _e !== void 0 ? _e : 0;
+                const counter = (_f = credMeta.sign_count) !== null && _f !== void 0 ? _f : 0;
                 const { verified, authenticationInfo } = yield verifyAuthenticationResponse({
                     response,
                     expectedChallenge,
@@ -96,7 +126,7 @@ export class PasskeyService {
                         counter,
                         transports: credMeta.transports,
                     },
-                    requireUserVerification: ((_f = this.options.passkeys) === null || _f === void 0 ? void 0 : _f.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
+                    requireUserVerification: ((_g = this.options.passkeys) === null || _g === void 0 ? void 0 : _g.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
                 });
                 if (!verified) {
                     return errorResult('User verification failed.');
@@ -104,7 +134,7 @@ export class PasskeyService {
                 credMeta.sign_count = authenticationInfo.newCounter;
                 credMeta.last_used_at = new Date().toISOString();
                 yield this.passkeyRepository.updateMeta(cred, credMeta);
-                return { ok: true, passkeyConfirmed: true };
+                return { ok: true, passkeyConfirmed: true, userPk: credentialUserPk };
             }
             catch (e) {
                 return prefixedErrorResult('Error authenticating passkey: ', e);
@@ -210,6 +240,7 @@ export class PasskeyService {
                     [this.options.passkeys.credentialIdFieldName]: base64CredentialID,
                     [this.options.passkeys.credentialUserIdFieldName]: adminUser.pk,
                     [this.options.passkeys.credentialMetaFieldName]: {
+                        user_handle: adminUser.pk,
                         public_key: base64PublicKey,
                         public_key_algorithm: response.response.publicKeyAlgorithm,
                         sign_count: 0,
@@ -358,18 +389,14 @@ export class PasskeyService {
             if (!passkeyRecord) {
                 return { error: 'No such passkey found, most likely it was removed on this website but you still have it on your device' };
             }
-            const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
-            if (!userPk) {
-                return { error: 'User ID not found in passkey record' };
+            const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, null, cookiesValidationResult.decodedPasskeysCookies);
+            if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
+                return { error: 'Passkey verification failed' };
             }
-            const user = yield this.userRepository.getAuthUser(userPk);
+            const user = yield this.userRepository.getAuthUser(verificationResult.userPk);
             if (!user) {
                 return { error: 'User not found' };
             }
-            const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
-            if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
-                return { error: 'Passkey verification failed' };
-            }
             return { ok: true, user };
         });
     }

package/index.ts

@@ -229,12 +229,11 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         throw new Error('Passkeys credentialMetaFieldName is required');
       }
 
-      const metaResource = adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialMetaFieldName); 
       const metaField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialMetaFieldName);
       if ( !metaField ) {
-        const similar = suggestIfTypo(metaResource.columns.map(c => c.name), this.options.passkeys.credentialMetaFieldName);
+        const similar = suggestIfTypo(credentialResource.columns.map(c => c.name), this.options.passkeys.credentialMetaFieldName);
         throw new Error(
-          `Passkeys credentialMetaFieldName '${this.options.passkeys.credentialMetaFieldName}' not found in resource '${this.options.passkeys.credentialMetaFieldName}'. ${
+          `Passkeys credentialMetaFieldName '${this.options.passkeys.credentialMetaFieldName}' not found in resource '${this.options.passkeys.credentialResourceID}'. ${
             similar ? `Did you mean '${similar}'?` : ''
           }`
         );
@@ -245,6 +244,18 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       if (!this.options.passkeys.credentialUserIdFieldName) {
         throw new Error('Passkeys credentialUserIdFieldName is required');
       }
+
+      const credentialUserIdField = credentialResource.columns.find(c => c.name === this.options.passkeys.credentialUserIdFieldName);
+      if ( !credentialUserIdField ) {
+        const similar = suggestIfTypo(credentialResource.columns.map(c => c.name), this.options.passkeys.credentialUserIdFieldName);
+        throw new Error(
+          `Passkeys credentialUserIdFieldName '${this.options.passkeys.credentialUserIdFieldName}' not found in resource '${this.options.passkeys.credentialResourceID}'. ${
+            similar ? `Did you mean '${similar}'?` : ''
+          }`
+        );
+      }
+      credentialUserIdField.backendOnly = true;
+
       if (!this.options.passkeys.settings) {
         throw new Error('Passkeys settings are required when passkeys option is enabled');
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.4.5",
+  "version": "4.4.6",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/services/passkeyService.ts

@@ -15,7 +15,7 @@ import { PasskeyRepository } from "../repositories/passkeyRepository.js";
 import { UserRepository } from "../repositories/userRepository.js";
 import { CookieService } from "./cookieService.js";
 import { errorMessage, errorResult, prefixedErrorResult } from "../utils/errors.js";
-import type { CookieList } from "../utils/types.js";
+import type { AnyRecord, CookieList } from "../utils/types.js";
 
 type AaguidEntry = {
   name: string;
@@ -86,7 +86,28 @@ export class PasskeyService {
     return { ok: true, decodedPasskeysCookies };
   }
 
-  public async verifyPasskeyResponse(body: PasskeyAuthenticationPayload, user_id: string, cookies: { challenge: string }) {
+  private decodeUserHandle(userHandle: unknown): string | undefined {
+    if (typeof userHandle !== 'string' || !userHandle) {
+      return undefined;
+    }
+    try {
+      return isoUint8Array.toUTF8String(isoBase64URL.toBuffer(userHandle));
+    } catch (e) {
+      return undefined;
+    }
+  }
+
+  private resolveCredentialUserPk(cred: AnyRecord): { userPk?: string, boundByUserHandle: boolean } {
+    const credMeta = cred[this.options.passkeys.credentialMetaFieldName];
+    const storedUserHandle = credMeta?.user_handle;
+    if (storedUserHandle) {
+      return { userPk: String(storedUserHandle), boundByUserHandle: true };
+    }
+    const columnUserPk = cred[this.options.passkeys.credentialUserIdFieldName];
+    return { userPk: columnUserPk ? String(columnUserPk) : undefined, boundByUserHandle: false };
+  }
+
+  public async verifyPasskeyResponse(body: PasskeyAuthenticationPayload, expectedUserPk: string | null, cookies: { challenge: string }) {
     const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
     const expectedOrigin = body.origin;
     const expectedChallenge = cookies.challenge;
@@ -104,9 +125,19 @@ export class PasskeyService {
       if (!credMeta || !credMeta.public_key) {
         throw new Error('Credential public key not found.');
       }
-      const usersPrimaryKeyFieldName = this.userRepository.getUserPkField();
-      const user = await this.userRepository.getAuthUser(cred[this.options.passkeys.credentialUserIdFieldName]);
-      if (!user || !user_id || user[usersPrimaryKeyFieldName] !== user_id) {
+      const { userPk: credentialUserPk, boundByUserHandle } = this.resolveCredentialUserPk(cred);
+      if (!credentialUserPk) {
+        throw new Error('Credential is not bound to any user.');
+      }
+      const presentedUserHandle = this.decodeUserHandle(response.response?.userHandle);
+      if (boundByUserHandle && presentedUserHandle && presentedUserHandle !== credentialUserPk) {
+        throw new Error('Passkey user handle does not match the credential owner.');
+      }
+      if (expectedUserPk !== null && (!expectedUserPk || String(expectedUserPk) !== credentialUserPk)) {
+        throw new Error('Passkey does not belong to this user.');
+      }
+      const user = await this.userRepository.getAuthUser(credentialUserPk);
+      if (!user) {
         throw new Error('User not found.');
       }
       const counter = credMeta.sign_count ?? 0;
@@ -130,7 +161,7 @@ export class PasskeyService {
       credMeta.sign_count = authenticationInfo.newCounter;
       credMeta.last_used_at = new Date().toISOString();
       await this.passkeyRepository.updateMeta(cred, credMeta);
-      return { ok: true, passkeyConfirmed: true };
+      return { ok: true, passkeyConfirmed: true, userPk: credentialUserPk };
     } catch (e) {
       return prefixedErrorResult('Error authenticating passkey: ', e);
     }
@@ -238,6 +269,7 @@ export class PasskeyService {
           [this.options.passkeys.credentialIdFieldName]           : base64CredentialID,
           [this.options.passkeys.credentialUserIdFieldName]       : adminUser.pk,
           [this.options.passkeys.credentialMetaFieldName]         : {
+            user_handle             : adminUser.pk,
             public_key              : base64PublicKey,
             public_key_algorithm    : response.response.publicKeyAlgorithm,
             sign_count              : 0,
@@ -375,21 +407,16 @@ export class PasskeyService {
       return { error: 'No such passkey found, most likely it was removed on this website but you still have it on your device' };
     }
 
-    const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
-    if (!userPk) {
-      return { error: 'User ID not found in passkey record' };
+    const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, null, cookiesValidationResult.decodedPasskeysCookies);
+    if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
+      return { error: 'Passkey verification failed' };
     }
 
-    const user = await this.userRepository.getAuthUser(userPk);
+    const user = await this.userRepository.getAuthUser(verificationResult.userPk);
     if (!user) {
       return { error: 'User not found' };
     }
 
-    const verificationResult = await this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
-    if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
-      return { error: 'Passkey verification failed' };
-    }
-
     return { ok: true, user };
   }
 }