@ambushsoftworks/nestjs-auth-graphql 0.16.0 → 0.17.0-rc.2

package/dist/services/passkey-signup-token.service.js

@@ -0,0 +1,102 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeySignupTokenService = exports.PASSKEY_SIGNUP_TTL_MINUTES = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const crypto_1 = require("crypto");
+const constants_1 = require("../constants");
+exports.PASSKEY_SIGNUP_TTL_MINUTES = 15;
+const AUDIENCE = 'nestjs-auth-graphql:passkey-signup';
+const PURPOSE = 'passkey-signup';
+const HKDF_INFO = 'nestjs-auth-graphql passkey-signup/v1';
+let PasskeySignupTokenService = class PasskeySignupTokenService {
+    constructor(options, jwtService) {
+        this.jwtService = jwtService;
+        this.key = Buffer.from((0, crypto_1.hkdfSync)('sha256', options.jwtSecret, Buffer.alloc(0), HKDF_INFO, 32)).toString('hex');
+        this.codeSecret = options.verificationCodeSecret || options.jwtSecret;
+    }
+    async mint(email, realm, code) {
+        const id = (0, crypto_1.randomUUID)();
+        const claims = {
+            purpose: PURPOSE,
+            email,
+            ...(realm !== undefined ? { realm } : {}),
+            codeHash: this.hashCode(code),
+            jti: id,
+        };
+        const signupId = await this.jwtService.signAsync(claims, {
+            secret: this.key,
+            algorithm: 'HS256',
+            audience: AUDIENCE,
+            expiresIn: exports.PASSKEY_SIGNUP_TTL_MINUTES * 60,
+        });
+        return { signupId, id, expiresAt: new Date(Date.now() + exports.PASSKEY_SIGNUP_TTL_MINUTES * 60_000) };
+    }
+    async markVerified(pending) {
+        const claims = {
+            purpose: PURPOSE,
+            email: pending.email,
+            ...(pending.realm !== undefined ? { realm: pending.realm } : {}),
+            codeHash: pending.codeHash,
+            jti: pending.id,
+            verified: true,
+        };
+        return this.jwtService.signAsync(claims, {
+            secret: this.key,
+            algorithm: 'HS256',
+            audience: AUDIENCE,
+            expiresIn: Math.max(1, Math.ceil((pending.expiresAt.getTime() - Date.now()) / 1000)),
+        });
+    }
+    async read(signupId, realm) {
+        if (!signupId)
+            return null;
+        try {
+            const claims = await this.jwtService.verifyAsync(signupId, {
+                secret: this.key,
+                algorithms: ['HS256'],
+                audience: AUDIENCE,
+            });
+            if (claims.purpose !== PURPOSE || (claims.realm ?? undefined) !== realm)
+                return null;
+            return {
+                id: claims.jti,
+                email: claims.email,
+                ...(claims.realm !== undefined ? { realm: claims.realm } : {}),
+                codeHash: claims.codeHash,
+                verified: claims.verified === true,
+                expiresAt: new Date((claims.exp ?? 0) * 1000),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    codeMatches(pending, code) {
+        const expected = Buffer.from(pending.codeHash, 'hex');
+        const actual = Buffer.from(this.hashCode(code), 'hex');
+        return expected.length === actual.length && (0, crypto_1.timingSafeEqual)(expected, actual);
+    }
+    hashCode(code) {
+        return (0, crypto_1.createHmac)('sha256', this.codeSecret).update(`${PURPOSE}:${code}`).digest('hex');
+    }
+};
+exports.PasskeySignupTokenService = PasskeySignupTokenService;
+exports.PasskeySignupTokenService = PasskeySignupTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, jwt_1.JwtService])
+], PasskeySignupTokenService);
+//# sourceMappingURL=passkey-signup-token.service.js.map

package/dist/services/passkey-signup-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-signup-token.service.js","sourceRoot":"","sources":["../../src/services/passkey-signup-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAyC;AACzC,mCAA2E;AAC3E,4CAAmD;AAItC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,SAAS,GAAG,uCAAuC,CAAC;AA+CnD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAIpC,YAC+B,OAA0B,EACtC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QAEvC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CACpB,IAAA,iBAAQ,EAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CACtE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAa,EACb,KAAyB,EACzB,IAAY;QAEZ,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QACxB,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,GAAG,EAAE,EAAE;SACR,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,kCAA0B,GAAG,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAA0B,GAAG,MAAM,CAAC,EAAE,CAAC;IACjG,CAAC;IAWD,KAAK,CAAC,YAAY,CAAC,OAAoD;QACrE,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAA4B,EAAE,KAAyB;QAGhE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAe,QAAQ,EAAE;gBACvE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAClC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;aAC9C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGD,WAAW,CAAC,OAAoD,EAAE,IAAY;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAEO,QAAQ,CAAC,IAAY;QAC3B,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AAhGY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CACC,gBAAU;GAN9B,yBAAyB,CAgGrC"}

package/dist/services/passkey.service.d.ts

@@ -1,13 +1,16 @@
 import type { AuthModuleOptions } from '../auth.module';
 import { IAuthLogger } from '../interfaces/auth-logger.interface';
 import { IAuthLifecycleHooks } from '../interfaces/auth-lifecycle-hooks.interface';
+import { IAuthUser } from '../interfaces/auth-user.interface';
 import { IEmailService } from '../interfaces/email-service.interface';
+import { IUserRepository } from '../interfaces/user-repository.interface';
 import { IPasskeyRepository } from '../interfaces/passkey-repository.interface';
 import { IRateLimiter } from '../interfaces/rate-limiter.interface';
 import { PasskeyCeremonyOptions, PasskeySummary } from '../passkey/passkey-json.types';
 import { WebAuthnAdapter } from '../passkey/webauthn-adapter';
 import { AuthService } from './auth.service';
 import { StepUpTokenService } from './step-up-token.service';
+import { PasskeySignupTokenService } from './passkey-signup-token.service';
 type CookieResponse = {
     cookie: (name: string, value: string, options: Record<string, unknown>) => void;
 };
@@ -21,12 +24,14 @@ export declare class PasskeyService {
     private readonly authService;
     private readonly stepUpTokens;
     private readonly emailService;
+    private readonly userRepository;
+    private readonly signupTokens?;
     private readonly logger;
     private readonly realmsEnabled;
     private readonly ipHashSalt;
     private lastSweepAt;
     private warnedMissingIp;
-    constructor(repository: IPasskeyRepository | null, webauthn: WebAuthnAdapter | null, options: AuthModuleOptions, securityLogger: IAuthLogger, lifecycleHooks: IAuthLifecycleHooks, rateLimiter: IRateLimiter, authService: AuthService, stepUpTokens: StepUpTokenService, emailService?: IEmailService | null);
+    constructor(repository: IPasskeyRepository | null, webauthn: WebAuthnAdapter | null, options: AuthModuleOptions, securityLogger: IAuthLogger, lifecycleHooks: IAuthLifecycleHooks, rateLimiter: IRateLimiter, authService: AuthService, stepUpTokens: StepUpTokenService, emailService?: IEmailService | null, userRepository?: IUserRepository | null, signupTokens?: PasskeySignupTokenService | undefined);
     get enabled(): boolean;
     registrationOptions(userId: string, input: {
         stepUpToken?: string;
@@ -56,6 +61,8 @@ export declare class PasskeyService {
         accessToken: string;
         refreshToken: string;
         userId: string;
+        stepUpToken?: string;
+        stepUpExpiresAt?: Date;
     }>;
     stepUpOptions(userId: string, opts?: {
         realm?: string;
@@ -72,6 +79,51 @@ export declare class PasskeyService {
         reason: string;
     }>;
     hasActivePasskey(userId: string, realm?: string): Promise<boolean>;
+    get signupAvailable(): boolean;
+    startSignup(input: {
+        email: string;
+    }, opts?: {
+        realm?: string;
+        ipAddress?: string;
+    }): Promise<{
+        signupId: string;
+        expiresAt: Date;
+    }>;
+    verifySignupCode(input: {
+        signupId: string;
+        code: string;
+    }, opts?: {
+        realm?: string;
+        ipAddress?: string;
+    }): Promise<PasskeyCeremonyOptions & {
+        signupId: string;
+    }>;
+    signupOptions(input: {
+        signupId: string;
+    }, opts?: {
+        realm?: string;
+        ipAddress?: string;
+    }): Promise<PasskeyCeremonyOptions>;
+    private signupCreationOptions;
+    completeSignup(input: {
+        signupId: string;
+        challengeId: string;
+        responseJson: string;
+        name?: string;
+    }, opts?: {
+        realm?: string;
+        ipAddress?: string;
+    }): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        user: IAuthUser;
+        stepUpToken?: string;
+        stepUpExpiresAt?: Date;
+    }>;
+    private undoSignupUser;
+    private failSignup;
+    private requireSignup;
+    private enforceLimit;
     listPasskeys(userId: string, opts?: {
         realm?: string;
     }): Promise<PasskeySummary[]>;

package/dist/services/passkey.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EACL,kBAAkB,EAKnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EACL,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAY7D,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AAmCF,qBACa,cAAc;IASvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAtB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,eAAe,CAAS;gBAIb,UAAU,EAAE,kBAAkB,GAAG,IAAI,EAErC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAEhC,OAAO,EAAE,iBAAiB,EAE1B,cAAc,EAAE,WAAW,EAE3B,cAAc,EAAE,mBAAmB,EAEnC,WAAW,EAAE,YAAY,EACzB,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,kBAAkB,EAEhC,YAAY,GAAE,aAAa,GAAG,IAAW;IAO5D,IAAI,OAAO,IAAI,OAAO,CAErB;IAaK,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAwD5B,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,cAAc,CAAC;IAqGpB,qBAAqB,CACzB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;IAuC5B,oBAAoB,CACxB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GACtE,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA+CnE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+B7F,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBlD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAclE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAStF,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC7C,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,cAAc,CAAC;IAqBpB,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,IAAI,CAAC;YAmCF,SAAS;YAuET,aAAa;YAkBb,cAAc;YAmBd,KAAK;YAiBL,gBAAgB;IAS9B,OAAO,CAAC,YAAY;IAIpB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,4BAA4B,GAEvC;IAED,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,QAAQ;CAsBjB"}
+{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EACL,kBAAkB,EAKnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACvF,OAAO,EACL,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAsBrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,yBAAyB,EAE1B,MAAM,gCAAgC,CAAC;AAYxC,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AAmCF,qBACa,cAAc;IASvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA1BhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,eAAe,CAAS;gBAIb,UAAU,EAAE,kBAAkB,GAAG,IAAI,EAErC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAEhC,OAAO,EAAE,iBAAiB,EAE1B,cAAc,EAAE,WAAW,EAE3B,cAAc,EAAE,mBAAmB,EAEnC,WAAW,EAAE,YAAY,EACzB,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,kBAAkB,EAEhC,YAAY,GAAE,aAAa,GAAG,IAAW,EAEzC,cAAc,GAAE,eAAe,GAAG,IAAW,EAE7C,YAAY,CAAC,EAAE,yBAAyB,YAAA;IAO3D,IAAI,OAAO,IAAI,OAAO,CAErB;IAaK,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAwD5B,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,cAAc,CAAC;IAqGpB,qBAAqB,CACzB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;IAuC5B,oBAAoB,CACxB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GACtE,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;IAoDI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+B7F,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBlD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxE,IAAI,eAAe,IAAI,OAAO,CAO7B;IAiBK,WAAW,CACf,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACxB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAkD3C,gBAAgB,CACpB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACzC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCnD,aAAa,CACjB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAC3B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,sBAAsB,CAAC;YAiBpB,qBAAqB;IA4C7B,cAAc,CAClB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrF,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,SAAS,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,CAAC;YA0HY,cAAc;IAc5B,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,aAAa;YAeP,YAAY;IAgBpB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAStF,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC7C,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,cAAc,CAAC;IAqBpB,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,EAC/B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,IAAI,CAAC;YAmCF,SAAS;YAuET,aAAa;YAkBb,cAAc;YAmBd,KAAK;YAiBL,gBAAgB;IAY9B,OAAO,CAAC,YAAY;IAIpB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,4BAA4B,GAEvC;IAED,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,QAAQ;CAsBjB"}

package/dist/services/passkey.service.js

@@ -18,6 +18,7 @@ const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const constants_1 = require("../constants");
 const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
+const auth_user_interface_1 = require("../interfaces/auth-user.interface");
 const passkey_repository_interface_1 = require("../interfaces/passkey-repository.interface");
 const webauthn_adapter_1 = require("../passkey/webauthn-adapter");
 const passkey_exceptions_1 = require("../exceptions/passkey.exceptions");
@@ -27,6 +28,7 @@ const provider_helpers_1 = require("../utils/provider-helpers");
 const passkey_rp_1 = require("../utils/passkey-rp");
 const auth_service_1 = require("./auth.service");
 const step_up_token_service_1 = require("./step-up-token.service");
+const passkey_signup_token_service_1 = require("./passkey-signup-token.service");
 const CHALLENGE_BYTES = 32;
 const USER_HANDLE_BYTES = 32;
 const DEFAULT_REGISTRATION_TIMEOUT_SECONDS = 300;
@@ -36,7 +38,7 @@ const MAX_NAME_LENGTH = 64;
 const DEFAULT_NAME = 'Passkey';
 const SWEEP_THROTTLE_MS = 2 * 60_000;
 let PasskeyService = PasskeyService_1 = class PasskeyService {
-    constructor(repository, webauthn, options, securityLogger, lifecycleHooks, rateLimiter, authService, stepUpTokens, emailService = null) {
+    constructor(repository, webauthn, options, securityLogger, lifecycleHooks, rateLimiter, authService, stepUpTokens, emailService = null, userRepository = null, signupTokens) {
         this.repository = repository;
         this.webauthn = webauthn;
         this.options = options;
@@ -46,6 +48,8 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         this.authService = authService;
         this.stepUpTokens = stepUpTokens;
         this.emailService = emailService;
+        this.userRepository = userRepository;
+        this.signupTokens = signupTokens;
         this.logger = new common_1.Logger(PasskeyService_1.name);
         this.lastSweepAt = 0;
         this.warnedMissingIp = false;
@@ -221,7 +225,11 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
             realm: opts.realm,
             ipAddress: opts.ipAddress,
         });
-        return { ...session, userId: credential.userId };
+        return {
+            ...session,
+            userId: credential.userId,
+            ...(await this.authService.stepUpForLogin(credential.userId, opts.realm, 'passkey')),
+        };
     }
     async stepUpOptions(userId, opts = {}) {
         const { repository, webauthn } = this.require();
@@ -271,6 +279,243 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
         }
         return (await this.repository.listCredentials(userId, realm)).some((c) => c.isActive && (c.realm ?? undefined) === realm);
     }
+    get signupAvailable() {
+        return (this.enabled &&
+            this.userRepository !== null &&
+            this.signupTokens !== undefined &&
+            typeof this.emailService?.sendSignupCodeEmail === 'function');
+    }
+    async startSignup(input, opts = {}) {
+        const { users, tokens, email: mailer } = this.requireSignup();
+        this.requireRealm(opts.realm);
+        const email = normaliseEmail(input.email);
+        const where = scope(opts.realm);
+        if (opts.ipAddress) {
+            await this.enforceLimit(`auth:passkeySignupIp:${where}${(0, ip_hash_1.hashIp)(opts.ipAddress, this.ipHashSalt)}`, 5, 3_600_000);
+        }
+        const emailKey = (0, ip_hash_1.hashIp)(email, this.ipHashSalt);
+        await this.enforceLimit(`auth:passkeySignupEmail:${where}${emailKey}`, 1, 60_000);
+        await this.enforceLimit(`auth:passkeySignupEmailHour:${where}${emailKey}`, 5, 3_600_000);
+        const code = String((0, crypto_1.randomInt)(0, 1_000_000)).padStart(6, '0');
+        const { signupId, expiresAt } = await tokens.mint(email, opts.realm, code);
+        const existingAccount = (await users.findByEmail(email, opts.realm)) !== null;
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_SIGNUP_STARTED, {
+            email,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+            existingAccount,
+        });
+        if (!existingAccount) {
+            Promise.resolve()
+                .then(() => mailer.call(this.emailService, email, code, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES))
+                .catch((error) => {
+                this.securityLogger.error('Passkey sign-up code email failed', error instanceof Error ? error.stack : String(error), 'PasskeySignupService');
+            });
+        }
+        return { signupId, expiresAt };
+    }
+    async verifySignupCode(input, opts = {}) {
+        const { users, tokens } = this.requireSignup();
+        const { webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        const pending = await tokens.read(input.signupId, opts.realm);
+        if (!pending)
+            return this.failSignup('signup_expired', opts, new passkey_exceptions_1.PasskeySignupExpiredException());
+        const attemptsKey = `auth:passkeySignupCode:${pending.id}`;
+        const { allowed } = await this.rateLimiter.checkRateLimit(attemptsKey, 3, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000);
+        if (!allowed)
+            return this.failSignup('code_exhausted', opts, new passkey_exceptions_1.PasskeySignupCodeExhaustedException(), pending);
+        await this.rateLimiter.recordAttempt(attemptsKey, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000);
+        if (typeof input.code !== 'string' || !tokens.codeMatches(pending, input.code)) {
+            return this.failSignup('code_invalid', opts, new passkey_exceptions_1.PasskeySignupCodeInvalidException(), pending);
+        }
+        if (await users.findByEmail(pending.email, opts.realm)) {
+            return this.failSignup('email_taken', opts, new passkey_exceptions_1.PasskeySignupEmailTakenException(), pending);
+        }
+        const signupId = await tokens.markVerified(pending);
+        return { ...(await this.signupCreationOptions(webauthn, pending, opts.realm)), signupId };
+    }
+    async signupOptions(input, opts = {}) {
+        const { users, tokens } = this.requireSignup();
+        const { webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        const pending = await tokens.read(input.signupId, opts.realm);
+        if (!pending)
+            return this.failSignup('signup_expired', opts, new passkey_exceptions_1.PasskeySignupExpiredException());
+        if (!pending.verified) {
+            return this.failSignup('code_not_verified', opts, new passkey_exceptions_1.PasskeySignupCodeRequiredException(), pending);
+        }
+        await this.enforceLimit(`auth:passkeySignupOptions:${pending.id}`, 10, passkey_signup_token_service_1.PASSKEY_SIGNUP_TTL_MINUTES * 60_000);
+        if (await users.findByEmail(pending.email, opts.realm)) {
+            return this.failSignup('email_taken', opts, new passkey_exceptions_1.PasskeySignupEmailTakenException(), pending);
+        }
+        return this.signupCreationOptions(webauthn, pending, opts.realm);
+    }
+    async signupCreationOptions(webauthn, pending, realm) {
+        const userHandle = Buffer.from((0, crypto_1.randomBytes)(USER_HANDLE_BYTES)).toString('base64url');
+        const timeoutSeconds = this.options.passkey?.registrationTimeoutSeconds ?? DEFAULT_REGISTRATION_TIMEOUT_SECONDS;
+        const options = await webauthn.registrationOptions({
+            rp: this.relyingParty(realm),
+            challenge: freshBytes(CHALLENGE_BYTES),
+            userHandle: new Uint8Array(Buffer.from(userHandle, 'base64url')),
+            userName: pending.email,
+            userDisplayName: pending.email,
+            excludeCredentials: [],
+            userVerification: this.userVerification,
+            timeoutMs: timeoutSeconds * 1000,
+        });
+        const challengeId = await this.storeChallenge('signup', options.challenge, timeoutSeconds, {
+            userId: signupBinding(pending),
+            realm,
+            userHandle,
+        });
+        return { challengeId, options };
+    }
+    async completeSignup(input, opts = {}) {
+        const { users, tokens } = this.requireSignup();
+        const { repository, webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        const pending = await tokens.read(input.signupId, opts.realm);
+        if (!pending)
+            return this.failSignup('signup_expired', opts, new passkey_exceptions_1.PasskeySignupExpiredException());
+        if (!pending.verified) {
+            return this.failSignup('code_not_verified', opts, new passkey_exceptions_1.PasskeySignupCodeRequiredException(), pending);
+        }
+        const registrationFailed = (reason) => this.failSignup(reason, opts, new passkey_exceptions_1.PasskeySignupVerificationFailedException(), pending);
+        const challenge = await repository.consumeChallenge(input.challengeId);
+        if (!challenge) {
+            return this.failSignup('challenge_unavailable', opts, new passkey_exceptions_1.PasskeySignupChallengeExpiredException(), pending);
+        }
+        const mismatch = challengeMismatch(challenge, 'signup', opts.realm, signupBinding(pending));
+        if (mismatch)
+            return registrationFailed(mismatch);
+        if (!challenge.userHandle)
+            return registrationFailed('challenge_user_handle_missing');
+        const response = (0, webauthn_adapter_1.parseRegistrationResponse)(input.responseJson);
+        if (!response)
+            return registrationFailed('response_malformed');
+        const outcome = await webauthn.verifyRegistration({
+            response,
+            expectedChallenge: challenge.challenge,
+            rp: this.relyingParty(opts.realm),
+            requireUserVerification: this.userVerification === 'required',
+        });
+        if (!outcome.ok)
+            return registrationFailed(outcome.reason);
+        if (await users.findByEmail(pending.email, opts.realm)) {
+            return this.failSignup('email_taken', opts, new passkey_exceptions_1.PasskeySignupEmailTakenException(), pending);
+        }
+        let user;
+        try {
+            user = await users.create({
+                email: pending.email,
+                passwordHash: null,
+                emailVerified: true,
+                authProvider: auth_user_interface_1.AuthProvider.EMAIL,
+                ...(opts.realm !== undefined ? { realm: opts.realm } : {}),
+            });
+        }
+        catch (error) {
+            if (await users.findByEmail(pending.email, opts.realm)) {
+                return this.failSignup('email_taken', opts, new passkey_exceptions_1.PasskeySignupEmailTakenException(), pending);
+            }
+            throw error;
+        }
+        const now = new Date();
+        const record = {
+            credentialId: outcome.value.credentialId,
+            userId: user.id,
+            ...(opts.realm !== undefined ? { realm: opts.realm } : {}),
+            publicKey: outcome.value.publicKey,
+            counter: outcome.value.counter,
+            userHandle: challenge.userHandle,
+            ...(outcome.value.transports ? { transports: outcome.value.transports } : {}),
+            deviceType: outcome.value.deviceType,
+            backedUp: outcome.value.backedUp,
+            aaguid: outcome.value.aaguid,
+            name: normaliseName(input.name),
+            createdAt: now,
+            lastUsedAt: null,
+            isActive: true,
+        };
+        try {
+            await repository.createCredential(record);
+        }
+        catch (error) {
+            await this.undoSignupUser(user.id);
+            if (error instanceof passkey_repository_interface_1.PasskeyCredentialExistsError) {
+                return this.failSignup('credential_exists', opts, new passkey_exceptions_1.PasskeyAlreadyRegisteredException(), pending);
+            }
+            throw error;
+        }
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.SIGNUP_SUCCESS, {
+            userId: user.id,
+            email: user.email,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+            method: 'passkey',
+        });
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_REGISTERED, {
+            userId: user.id,
+            credentialId: record.credentialId,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+            deviceType: record.deviceType,
+            aaguid: record.aaguid,
+            signup: true,
+        });
+        if (this.lifecycleHooks?.onSignup) {
+            try {
+                await this.lifecycleHooks.onSignup(user);
+            }
+            catch (error) {
+                this.securityLogger.error(`Lifecycle hook onSignup failed for user ${user.id}`, error instanceof Error ? error.stack : String(error), 'PasskeyService');
+            }
+        }
+        this.fireHook('onPasskeyRegistered', user, summarise(record), opts.realm);
+        const session = await this.authService.issueAuthSession(user.id, undefined, opts.realm);
+        return {
+            ...session,
+            user,
+            ...(await this.authService.stepUpForLogin(user.id, opts.realm, 'passkey')),
+        };
+    }
+    async undoSignupUser(userId) {
+        try {
+            await this.userRepository.delete(userId);
+        }
+        catch (error) {
+            this.securityLogger.error(`Passkey sign-up could not remove user ${userId} after its passkey failed to save. ` +
+                'The account has no password and no passkey; its owner can get in by resetting ' +
+                'the password, or you can delete it.', error instanceof Error ? error.stack : String(error), 'PasskeyService');
+        }
+    }
+    failSignup(reason, opts, error, pending) {
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_SIGNUP_FAILURE, {
+            email: pending?.email,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+            reason,
+        });
+        throw error;
+    }
+    requireSignup() {
+        if (!this.signupAvailable) {
+            throw new passkey_exceptions_1.PasskeySignupUnavailableException();
+        }
+        return {
+            users: this.userRepository,
+            tokens: this.signupTokens,
+            email: this.emailService.sendSignupCodeEmail,
+        };
+    }
+    async enforceLimit(key, maxAttempts, windowMs) {
+        const { allowed, resetAt } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
+        if (!allowed) {
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many sign-up requests. Please try again later.', retryAfterSeconds(resetAt));
+        }
+        await this.rateLimiter.recordAttempt(key, windowMs);
+    }
     async listPasskeys(userId, opts = {}) {
         const { repository } = this.require();
         this.requireRealm(opts.realm);
@@ -405,9 +650,9 @@ let PasskeyService = PasskeyService_1 = class PasskeyService {
     }
     async enforceRateLimit(key) {
         const { maxAttempts, windowMs } = this.options.passkey?.rateLimit ?? DEFAULT_RATE_LIMIT;
-        const { allowed } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
+        const { allowed, resetAt } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
         if (!allowed) {
-            throw new step_up_exceptions_1.AuthRateLimitException('Too many passkey requests. Please try again later.');
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many passkey requests. Please try again later.', retryAfterSeconds(resetAt));
         }
         await this.rateLimiter.recordAttempt(key, windowMs);
     }
@@ -484,15 +729,30 @@ exports.PasskeyService = PasskeyService = PasskeyService_1 = __decorate([
     __param(4, (0, common_1.Inject)(constants_1.AUTH_LIFECYCLE_HOOKS)),
     __param(5, (0, common_1.Inject)(constants_1.RATE_LIMITER)),
     __param(8, (0, common_1.Inject)(constants_1.EMAIL_SERVICE)),
+    __param(9, (0, common_1.Inject)(constants_1.USER_REPOSITORY)),
+    __param(10, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, auth_service_1.AuthService,
-        step_up_token_service_1.StepUpTokenService, Object])
+        step_up_token_service_1.StepUpTokenService, Object, Object, passkey_signup_token_service_1.PasskeySignupTokenService])
 ], PasskeyService);
+function retryAfterSeconds(resetAt) {
+    return Math.max(1, Math.ceil((resetAt.getTime() - Date.now()) / 1000));
+}
 function scope(realm) {
     return realm ? `${realm}:` : '';
 }
 function freshBytes(length) {
     return new Uint8Array((0, crypto_1.randomBytes)(length));
 }
+function normaliseEmail(email) {
+    const normalised = typeof email === 'string' ? email.trim().toLowerCase() : '';
+    if (!/^[^\s@]+@[^\s@]+$/.test(normalised)) {
+        throw new common_1.BadRequestException('A valid email address is required');
+    }
+    return normalised;
+}
+function signupBinding(pending) {
+    return `signup:${pending.id}`;
+}
 function normaliseName(name) {
     const trimmed = (name ?? '').trim();
     return trimmed === '' ? DEFAULT_NAME : trimmed.slice(0, MAX_NAME_LENGTH);