@authhero/widget 0.29.1 → 0.30.0

package/dist/cjs/authhero-widget.cjs.entry.js

@@ -633,6 +633,11 @@ const AuthheroWidget = class {
      * Form data collected from inputs.
      */
     formData = {};
+    /**
+     * AbortController for an in-flight conditional mediation request.
+     * Aborted on screen change or component disconnect.
+     */
+    conditionalMediationAbort;
     /**
      * Emitted when the form is submitted.
      * The consuming application should handle the submission unless autoSubmit is true.
@@ -667,6 +672,9 @@ const AuthheroWidget = class {
      */
     screenChange;
     watchScreen(newValue) {
+        // Abort any in-flight conditional mediation when screen changes
+        this.conditionalMediationAbort?.abort();
+        this.conditionalMediationAbort = undefined;
         if (typeof newValue === "string") {
             try {
                 this._screen = JSON.parse(newValue);
@@ -900,6 +908,8 @@ const AuthheroWidget = class {
     }
     disconnectedCallback() {
         window.removeEventListener("popstate", this.handlePopState);
+        this.conditionalMediationAbort?.abort();
+        this.conditionalMediationAbort = undefined;
     }
     async componentWillLoad() {
         // Parse initial props - this prevents unnecessary state changes during hydration that cause flashes
@@ -988,6 +998,10 @@ const AuthheroWidget = class {
                     this.updateDataScreenAttribute();
                     this.persistState();
                     this.focusFirstInput();
+                    // Start WebAuthn ceremony if returned with the screen (e.g. conditional mediation)
+                    if (data.ceremony) {
+                        this.performWebAuthnCeremony(data.ceremony);
+                    }
                     return true;
                 }
             }
@@ -1179,9 +1193,19 @@ const AuthheroWidget = class {
             console.error("Invalid WebAuthn ceremony payload", ceremony);
             return;
         }
+        if (ceremony.type === "webauthn-authentication-conditional") {
+            // Conditional mediation runs in the background, no requestAnimationFrame needed
+            this.executeWebAuthnConditionalMediation(ceremony);
+            return;
+        }
         requestAnimationFrame(() => {
             this.overrideFormSubmit();
-            this.executeWebAuthnRegistration(ceremony);
+            if (ceremony.type === "webauthn-authentication") {
+                this.executeWebAuthnAuthentication(ceremony);
+            }
+            else {
+                this.executeWebAuthnRegistration(ceremony);
+            }
         });
     }
     /**
@@ -1192,8 +1216,6 @@ const AuthheroWidget = class {
         if (typeof data !== "object" || data === null)
             return false;
         const obj = data;
-        if (obj.type !== "webauthn-registration")
-            return false;
         if (typeof obj.successAction !== "string")
             return false;
         const opts = obj.options;
@@ -1202,23 +1224,30 @@ const AuthheroWidget = class {
         const o = opts;
         if (typeof o.challenge !== "string")
             return false;
-        const rp = o.rp;
-        if (typeof rp !== "object" || rp === null)
-            return false;
-        if (typeof rp.id !== "string" ||
-            typeof rp.name !== "string")
-            return false;
-        const user = o.user;
-        if (typeof user !== "object" || user === null)
-            return false;
-        const u = user;
-        if (typeof u.id !== "string" ||
-            typeof u.name !== "string" ||
-            typeof u.displayName !== "string")
-            return false;
-        if (!Array.isArray(o.pubKeyCredParams))
-            return false;
-        return true;
+        if (obj.type === "webauthn-registration") {
+            const rp = o.rp;
+            if (typeof rp !== "object" || rp === null)
+                return false;
+            if (typeof rp.id !== "string" ||
+                typeof rp.name !== "string")
+                return false;
+            const user = o.user;
+            if (typeof user !== "object" || user === null)
+                return false;
+            const u = user;
+            if (typeof u.id !== "string" ||
+                typeof u.name !== "string" ||
+                typeof u.displayName !== "string")
+                return false;
+            if (!Array.isArray(o.pubKeyCredParams))
+                return false;
+            return true;
+        }
+        if (obj.type === "webauthn-authentication" ||
+            obj.type === "webauthn-authentication-conditional") {
+            return true;
+        }
+        return false;
     }
     /**
      * Perform the WebAuthn navigator.credentials.create() ceremony and submit
@@ -1331,6 +1360,193 @@ const AuthheroWidget = class {
             }
         }
     }
+    /**
+     * Perform the WebAuthn navigator.credentials.get() ceremony (explicit modal)
+     * and submit the credential result via the form.
+     */
+    async executeWebAuthnAuthentication(ceremony) {
+        const opts = ceremony.options;
+        const b64uToBuf = (s) => {
+            s = s.replace(/-/g, "+").replace(/_/g, "/");
+            while (s.length % 4)
+                s += "=";
+            const b = atob(s);
+            const a = new Uint8Array(b.length);
+            for (let i = 0; i < b.length; i++)
+                a[i] = b.charCodeAt(i);
+            return a.buffer;
+        };
+        const bufToB64u = (b) => {
+            const a = new Uint8Array(b);
+            let s = "";
+            for (let i = 0; i < a.length; i++)
+                s += String.fromCharCode(a[i]);
+            return btoa(s)
+                .replace(/\+/g, "-")
+                .replace(/\//g, "_")
+                .replace(/=+$/, "");
+        };
+        const findForm = () => {
+            const shadowRoot = this.el?.shadowRoot;
+            if (shadowRoot) {
+                const f = shadowRoot.querySelector("form");
+                if (f)
+                    return f;
+            }
+            return document.querySelector("form");
+        };
+        try {
+            const publicKey = {
+                challenge: b64uToBuf(opts.challenge),
+                rpId: opts.rpId,
+                timeout: opts.timeout,
+                userVerification: opts.userVerification || "preferred",
+            };
+            if (opts.allowCredentials?.length) {
+                publicKey.allowCredentials = opts.allowCredentials.map((c) => ({
+                    id: b64uToBuf(c.id),
+                    type: c.type,
+                    transports: (c.transports || []),
+                }));
+            }
+            const cred = (await navigator.credentials.get({
+                publicKey,
+            }));
+            const response = cred.response;
+            const resp = {
+                id: cred.id,
+                rawId: bufToB64u(cred.rawId),
+                type: cred.type,
+                response: {
+                    authenticatorData: bufToB64u(response.authenticatorData),
+                    clientDataJSON: bufToB64u(response.clientDataJSON),
+                    signature: bufToB64u(response.signature),
+                },
+                clientExtensionResults: cred.getClientExtensionResults(),
+                authenticatorAttachment: cred.authenticatorAttachment || undefined,
+            };
+            if (response.userHandle) {
+                resp.response.userHandle = bufToB64u(response.userHandle);
+            }
+            const form = findForm();
+            if (form) {
+                const cf = form.querySelector('[name="credential-field"]') ||
+                    form.querySelector("#credential-field");
+                const af = form.querySelector('[name="action-field"]') ||
+                    form.querySelector("#action-field");
+                if (cf)
+                    cf.value = JSON.stringify(resp);
+                if (af)
+                    af.value = ceremony.successAction;
+                form.submit();
+            }
+        }
+        catch (e) {
+            console.error("WebAuthn authentication error:", e);
+            const form = findForm();
+            if (form) {
+                const af = form.querySelector('[name="action-field"]') ||
+                    form.querySelector("#action-field");
+                if (af)
+                    af.value = "error";
+                form.submit();
+            }
+        }
+    }
+    /**
+     * Execute WebAuthn conditional mediation (autofill-assisted passkeys).
+     * Runs in the background — the browser shows passkey suggestions in the
+     * username field's autofill dropdown. Silently ignored if unsupported.
+     */
+    async executeWebAuthnConditionalMediation(ceremony) {
+        // Feature detection
+        if (!window.PublicKeyCredential ||
+            !PublicKeyCredential.isConditionalMediationAvailable) {
+            return;
+        }
+        const available = await PublicKeyCredential.isConditionalMediationAvailable();
+        if (!available)
+            return;
+        // Abort any previous conditional mediation request
+        this.conditionalMediationAbort?.abort();
+        const abortController = new AbortController();
+        this.conditionalMediationAbort = abortController;
+        const opts = ceremony.options;
+        const b64uToBuf = (s) => {
+            s = s.replace(/-/g, "+").replace(/_/g, "/");
+            while (s.length % 4)
+                s += "=";
+            const b = atob(s);
+            const a = new Uint8Array(b.length);
+            for (let i = 0; i < b.length; i++)
+                a[i] = b.charCodeAt(i);
+            return a.buffer;
+        };
+        const bufToB64u = (b) => {
+            const a = new Uint8Array(b);
+            let s = "";
+            for (let i = 0; i < a.length; i++)
+                s += String.fromCharCode(a[i]);
+            return btoa(s)
+                .replace(/\+/g, "-")
+                .replace(/\//g, "_")
+                .replace(/=+$/, "");
+        };
+        try {
+            const cred = (await navigator.credentials.get({
+                mediation: "conditional",
+                signal: abortController.signal,
+                publicKey: {
+                    challenge: b64uToBuf(opts.challenge),
+                    rpId: opts.rpId,
+                    timeout: opts.timeout,
+                    userVerification: opts.userVerification ||
+                        "preferred",
+                },
+            }));
+            const response = cred.response;
+            const resp = {
+                id: cred.id,
+                rawId: bufToB64u(cred.rawId),
+                type: cred.type,
+                response: {
+                    authenticatorData: bufToB64u(response.authenticatorData),
+                    clientDataJSON: bufToB64u(response.clientDataJSON),
+                    signature: bufToB64u(response.signature),
+                },
+                clientExtensionResults: cred.getClientExtensionResults(),
+                authenticatorAttachment: cred.authenticatorAttachment || undefined,
+            };
+            if (response.userHandle) {
+                resp.response.userHandle = bufToB64u(response.userHandle);
+            }
+            // Submit via the widget's form handling
+            this.formData["credential-field"] = JSON.stringify(resp);
+            this.formData["action-field"] = ceremony.successAction;
+            // Ensure form submit override is set up, then submit
+            this.overrideFormSubmit();
+            const shadowRoot = this.el?.shadowRoot;
+            const form = shadowRoot?.querySelector("form");
+            if (form) {
+                // Set the hidden input values directly
+                const cf = form.querySelector('[name="credential-field"]') ||
+                    form.querySelector("#credential-field");
+                const af = form.querySelector('[name="action-field"]') ||
+                    form.querySelector("#action-field");
+                if (cf)
+                    cf.value = JSON.stringify(resp);
+                if (af)
+                    af.value = ceremony.successAction;
+                form.submit();
+            }
+        }
+        catch (e) {
+            // Silently ignore AbortError and NotAllowedError
+            if (e?.name === "AbortError" || e?.name === "NotAllowedError")
+                return;
+            console.error("Conditional mediation error:", e);
+        }
+    }
     handleButtonClick = (detail) => {
         // If this is a submit button click, trigger form submission
         if (detail.type === "submit") {
@@ -1572,7 +1788,7 @@ const AuthheroWidget = class {
         };
         // Get logo URL from theme.widget (takes precedence) or branding
         const logoUrl = this._theme?.widget?.logo_url || this._branding?.logo_url;
-        return (index.h("div", { class: "widget-container", part: "container", "data-authstack-container": true }, index.h("header", { class: "widget-header", part: "header" }, logoUrl && (index.h("div", { class: "logo-wrapper", part: "logo-wrapper" }, index.h("img", { class: "logo", part: "logo", src: logoUrl, alt: "Logo" }))), screen.title && (index.h("h1", { class: "title", part: "title", innerHTML: sanitizeHtml(screen.title) })), screen.description && (index.h("p", { class: "description", part: "description", innerHTML: sanitizeHtml(screen.description) }))), index.h("div", { class: "widget-body", part: "body" }, screenErrors.map((err) => (index.h("div", { class: "message message-error", part: "message message-error", key: err.id ?? err.text }, err.text))), screenSuccesses.map((msg) => (index.h("div", { class: "message message-success", part: "message message-success", key: msg.id ?? msg.text }, msg.text))), index.h("form", { onSubmit: this.handleSubmit, part: "form" }, hiddenComponents.map((c) => (index.h("input", { type: "hidden", name: c.id, id: c.id, key: c.id, value: this.formData[c.id] || "" }))), index.h("div", { class: "form-content" }, socialComponents.length > 0 && (index.h("div", { class: "social-section", part: "social-section" }, socialComponents.map((component) => (index.h("authhero-node", { key: component.id, component: component, value: this.formData[component.id], onFieldChange: (e) => this.handleInputChange(e.detail.id, e.detail.value), onButtonClick: (e) => this.handleButtonClick(e.detail), disabled: this.loading, exportparts: getExportParts(component) }))))), socialComponents.length > 0 &&
+        return (index.h("div", { class: "widget-container", part: "container", "data-authstack-container": true }, index.h("header", { class: "widget-header", part: "header" }, logoUrl && (index.h("div", { class: "logo-wrapper", part: "logo-wrapper" }, index.h("img", { class: "logo", part: "logo", src: logoUrl, alt: "Logo" }))), screen.title && (index.h("h1", { class: "title", part: "title", innerHTML: sanitizeHtml(screen.title) })), screen.description && (index.h("p", { class: "description", part: "description", innerHTML: sanitizeHtml(screen.description) }))), index.h("div", { class: "widget-body", part: "body" }, screenErrors.map((err) => (index.h("div", { class: "message message-error", part: "message message-error", key: err.id ?? err.text }, err.text))), screenSuccesses.map((msg) => (index.h("div", { class: "message message-success", part: "message message-success", key: msg.id ?? msg.text }, msg.text))), index.h("form", { onSubmit: this.handleSubmit, action: screen.action, method: screen.method || "POST", part: "form" }, hiddenComponents.map((c) => (index.h("input", { type: "hidden", name: c.id, id: c.id, key: c.id, value: this.formData[c.id] || "" }))), index.h("div", { class: "form-content" }, socialComponents.length > 0 && (index.h("div", { class: "social-section", part: "social-section" }, socialComponents.map((component) => (index.h("authhero-node", { key: component.id, component: component, value: this.formData[component.id], onFieldChange: (e) => this.handleInputChange(e.detail.id, e.detail.value), onButtonClick: (e) => this.handleButtonClick(e.detail), disabled: this.loading, exportparts: getExportParts(component) }))))), socialComponents.length > 0 &&
             fieldComponents.length > 0 &&
             hasDivider && (index.h("div", { class: "divider", part: "divider" }, index.h("span", { class: "divider-text" }, dividerText))), index.h("div", { class: "fields-section", part: "fields-section" }, fieldComponents.map((component) => (index.h("authhero-node", { key: component.id, component: component, value: this.formData[component.id], onFieldChange: (e) => this.handleInputChange(e.detail.id, e.detail.value), onButtonClick: (e) => this.handleButtonClick(e.detail), disabled: this.loading })))))), screen.links && screen.links.length > 0 && (index.h("div", { class: "links", part: "links" }, screen.links.map((link) => (index.h("span", { class: "link-wrapper", part: "link-wrapper", key: link.id ?? link.href }, link.linkText ? (index.h("span", null, link.text, " ", index.h("a", { href: link.href, class: "link", part: "link", onClick: (e) => this.handleLinkClick(e, {
                 id: link.id,