@bradford-tech/supabase-integrity-attest 0.3.2 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/assertion.d.ts +5 -2
- package/esm/assertion.d.ts.map +1 -1
- package/esm/assertion.js +5 -2
- package/esm/attestation.d.ts +6 -1
- package/esm/attestation.d.ts.map +1 -1
- package/esm/attestation.js +6 -1
- package/esm/mod.d.ts +84 -4
- package/esm/mod.d.ts.map +1 -1
- package/esm/mod.js +84 -4
- package/esm/src/attestation.d.ts +9 -1
- package/esm/src/attestation.d.ts.map +1 -1
- package/esm/src/attestation.js +14 -6
- package/esm/src/errors.d.ts +28 -3
- package/esm/src/errors.d.ts.map +1 -1
- package/esm/src/errors.js +25 -2
- package/esm/src/utils.d.ts.map +1 -1
- package/esm/src/utils.js +3 -5
- package/esm/src/with-assertion.d.ts +41 -3
- package/esm/src/with-assertion.d.ts.map +1 -1
- package/esm/src/with-assertion.js +31 -9
- package/esm/src/with-attestation.d.ts +79 -0
- package/esm/src/with-attestation.d.ts.map +1 -0
- package/esm/src/with-attestation.js +147 -0
- package/package.json +4 -7
- package/esm/_dnt.test_polyfills.d.ts.map +0 -1
- package/esm/_dnt.test_shims.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/almost_equals.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/array_includes.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/assert.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/assertion_error.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/equal.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/equals.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/exists.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/fail.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/false.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/greater.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/greater_or_equal.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/instance_of.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/is_error.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/less.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/less_or_equal.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/match.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/mod.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/not_equals.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/not_instance_of.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/not_match.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/not_strict_equals.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/object_match.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/rejects.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/strict_equals.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/string_includes.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/throws.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/unimplemented.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/assert/1.0.19/unreachable.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/build_message.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/diff.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/diff_str.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/format.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/styles.d.ts.map +0 -1
- package/esm/deps/jsr.io/@std/internal/1.0.12/types.d.ts.map +0 -1
- package/esm/src/cose.d.ts.map +0 -1
- package/esm/tests/assertion-entry.test.d.ts.map +0 -1
- package/esm/tests/assertion.test.d.ts.map +0 -1
- package/esm/tests/attestation-entry.test.d.ts.map +0 -1
- package/esm/tests/attestation.test.d.ts.map +0 -1
- package/esm/tests/authdata.test.d.ts.map +0 -1
- package/esm/tests/certificate.test.d.ts.map +0 -1
- package/esm/tests/cose.test.d.ts.map +0 -1
- package/esm/tests/der.test.d.ts.map +0 -1
- package/esm/tests/errors.test.d.ts.map +0 -1
- package/esm/tests/fixtures/apple-attestation.d.ts.map +0 -1
- package/esm/tests/fixtures/generate-assertion.d.ts.map +0 -1
- package/esm/tests/utils.test.d.ts.map +0 -1
- package/esm/tests/with-assertion.test.d.ts.map +0 -1
|
@@ -26,8 +26,13 @@ function defaultErrorResponse(error) {
|
|
|
26
26
|
* Request handler middleware that verifies App Attest assertions.
|
|
27
27
|
*
|
|
28
28
|
* Wraps a handler function with automatic assertion verification,
|
|
29
|
-
* device key lookup, and sign
|
|
29
|
+
* device key lookup, and atomic sign-count commit. Returns a new handler
|
|
30
30
|
* that rejects unauthenticated requests with appropriate HTTP error responses.
|
|
31
|
+
*
|
|
32
|
+
* The `commitSignCount` callback MUST implement compare-and-swap semantics
|
|
33
|
+
* (see {@linkcode WithAssertionOptions.commitSignCount}) — a non-atomic
|
|
34
|
+
* unconditional write will silently corrupt replay protection under
|
|
35
|
+
* concurrent load.
|
|
31
36
|
*/
|
|
32
37
|
export function withAssertion(options, handler) {
|
|
33
38
|
const appInfo = {
|
|
@@ -39,11 +44,20 @@ export function withAssertion(options, handler) {
|
|
|
39
44
|
let deviceId;
|
|
40
45
|
let clientData;
|
|
41
46
|
let newSignCount;
|
|
42
|
-
|
|
47
|
+
const timings = {
|
|
48
|
+
extractMs: 0,
|
|
49
|
+
getDeviceKeyMs: 0,
|
|
50
|
+
verifyMs: 0,
|
|
51
|
+
commitMs: 0,
|
|
52
|
+
};
|
|
53
|
+
// Steps 1-4: extract, verify, commit sign count
|
|
43
54
|
try {
|
|
55
|
+
const extractStart = performance.now();
|
|
44
56
|
const extracted = await extract(req);
|
|
57
|
+
timings.extractMs = performance.now() - extractStart;
|
|
45
58
|
deviceId = extracted.deviceId;
|
|
46
59
|
clientData = extracted.clientData;
|
|
60
|
+
const getKeyStart = performance.now();
|
|
47
61
|
let deviceKey;
|
|
48
62
|
try {
|
|
49
63
|
deviceKey = await options.getDeviceKey(deviceId);
|
|
@@ -51,24 +65,31 @@ export function withAssertion(options, handler) {
|
|
|
51
65
|
catch (err) {
|
|
52
66
|
throw new AssertionError(AssertionErrorCode.INTERNAL_ERROR, "Storage callback failed", { cause: err });
|
|
53
67
|
}
|
|
68
|
+
timings.getDeviceKeyMs = performance.now() - getKeyStart;
|
|
54
69
|
if (!deviceKey) {
|
|
55
70
|
throw new AssertionError(AssertionErrorCode.DEVICE_NOT_FOUND, "Device not found");
|
|
56
71
|
}
|
|
72
|
+
const verifyStart = performance.now();
|
|
57
73
|
const result = await verifyAssertion(appInfo, extracted.assertion, clientData, deviceKey.publicKeyPem, deviceKey.signCount);
|
|
74
|
+
timings.verifyMs = performance.now() - verifyStart;
|
|
75
|
+
const commitStart = performance.now();
|
|
76
|
+
let committed;
|
|
58
77
|
try {
|
|
59
|
-
await options.
|
|
78
|
+
committed = await options.commitSignCount(deviceId, result.signCount);
|
|
60
79
|
}
|
|
61
80
|
catch (err) {
|
|
62
|
-
throw new AssertionError(AssertionErrorCode.INTERNAL_ERROR, "Failed to
|
|
81
|
+
throw new AssertionError(AssertionErrorCode.INTERNAL_ERROR, "Failed to commit sign count", { cause: err });
|
|
82
|
+
}
|
|
83
|
+
timings.commitMs = performance.now() - commitStart;
|
|
84
|
+
if (!committed) {
|
|
85
|
+
throw new AssertionError(AssertionErrorCode.SIGN_COUNT_STALE, `Sign count ${result.signCount} is stale — another concurrent request already advanced past it`);
|
|
63
86
|
}
|
|
64
87
|
newSignCount = result.signCount;
|
|
65
88
|
}
|
|
66
89
|
catch (err) {
|
|
67
|
-
const error = err instanceof AssertionError
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
cause: err,
|
|
71
|
-
});
|
|
90
|
+
const error = err instanceof AssertionError ? err : new AssertionError(AssertionErrorCode.INTERNAL_ERROR, "Internal error", {
|
|
91
|
+
cause: err,
|
|
92
|
+
});
|
|
72
93
|
return options.onError?.(error, req) ?? defaultErrorResponse(error);
|
|
73
94
|
}
|
|
74
95
|
// Step 5: handler — outside try/catch, errors bubble up
|
|
@@ -76,6 +97,7 @@ export function withAssertion(options, handler) {
|
|
|
76
97
|
deviceId,
|
|
77
98
|
signCount: newSignCount,
|
|
78
99
|
rawBody: clientData,
|
|
100
|
+
timings,
|
|
79
101
|
});
|
|
80
102
|
};
|
|
81
103
|
}
|
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
import { AttestationError } from "./errors.js";
|
|
2
|
+
/**
|
|
3
|
+
* Library-internal timing spans for an attestation verification, in
|
|
4
|
+
* milliseconds. Exposed on {@linkcode AttestationContext.timings}.
|
|
5
|
+
*/
|
|
6
|
+
export type AttestationTimings = {
|
|
7
|
+
/** Parse request body + decode base64 fields. */
|
|
8
|
+
extractMs: number;
|
|
9
|
+
/** `consumeChallenge` callback wall-clock duration. */
|
|
10
|
+
consumeChallengeMs: number;
|
|
11
|
+
/** Cryptographic verification (CBOR decode, cert chain, nonce, key extract). */
|
|
12
|
+
verifyMs: number;
|
|
13
|
+
/** `storeDeviceKey` callback wall-clock duration. */
|
|
14
|
+
storeDeviceKeyMs: number;
|
|
15
|
+
};
|
|
16
|
+
/** Context passed to the inner handler after successful attestation verification. */
|
|
17
|
+
export type AttestationContext = {
|
|
18
|
+
/** Device identifier (Apple-issued `keyId`) from the request. */
|
|
19
|
+
deviceId: string;
|
|
20
|
+
/** PEM-encoded ECDSA P-256 public key extracted from the attestation. */
|
|
21
|
+
publicKeyPem: string;
|
|
22
|
+
/** Initial sign count from the attestation (always `0`). */
|
|
23
|
+
signCount: number;
|
|
24
|
+
/** Raw App Attest receipt bytes. */
|
|
25
|
+
receipt: Uint8Array;
|
|
26
|
+
/** Library-internal timings, ready to merge into Server-Timing. */
|
|
27
|
+
timings: AttestationTimings;
|
|
28
|
+
};
|
|
29
|
+
/** Custom function to extract attestation data from an incoming request. */
|
|
30
|
+
export type ExtractAttestationFn = (req: Request) => Promise<{
|
|
31
|
+
deviceId: string;
|
|
32
|
+
challenge: Uint8Array;
|
|
33
|
+
attestation: Uint8Array;
|
|
34
|
+
}>;
|
|
35
|
+
/** Configuration for the {@linkcode withAttestation} middleware. */
|
|
36
|
+
export type WithAttestationOptions = {
|
|
37
|
+
/** Apple App ID in the format `TEAMID.bundleId`. */
|
|
38
|
+
appId: string;
|
|
39
|
+
/** Set to `true` for development environment attestations. */
|
|
40
|
+
developmentEnv?: boolean;
|
|
41
|
+
/**
|
|
42
|
+
* Atomically consume a previously-issued challenge. Return `true` if the
|
|
43
|
+
* challenge was valid, unused, and unexpired (and is now consumed);
|
|
44
|
+
* `false` otherwise. Implementations should use `DELETE ... RETURNING`
|
|
45
|
+
* to guarantee single-use semantics.
|
|
46
|
+
*
|
|
47
|
+
* The library converts `false` into `AttestationError(CHALLENGE_INVALID)`.
|
|
48
|
+
*/
|
|
49
|
+
consumeChallenge: (challenge: Uint8Array) => Promise<boolean>;
|
|
50
|
+
/**
|
|
51
|
+
* Persist the verified device key row. Caller chooses INSERT vs UPSERT —
|
|
52
|
+
* re-attesting an existing deviceId is cryptographically safe (Apple has
|
|
53
|
+
* re-signed) so UPSERT is usually correct.
|
|
54
|
+
*/
|
|
55
|
+
storeDeviceKey: (row: {
|
|
56
|
+
deviceId: string;
|
|
57
|
+
publicKeyPem: string;
|
|
58
|
+
signCount: number;
|
|
59
|
+
receipt: Uint8Array;
|
|
60
|
+
}) => Promise<void>;
|
|
61
|
+
/** Override the default body-based attestation extraction. */
|
|
62
|
+
extractAttestation?: ExtractAttestationFn;
|
|
63
|
+
/** Custom error response handler. Defaults to JSON error responses. */
|
|
64
|
+
onError?: (error: AttestationError, req: Request) => Response | Promise<Response>;
|
|
65
|
+
};
|
|
66
|
+
/**
|
|
67
|
+
* Request handler middleware that verifies App Attest attestations.
|
|
68
|
+
*
|
|
69
|
+
* Wraps a handler with automatic challenge consumption, cryptographic
|
|
70
|
+
* attestation verification, and device key persistence. Returns a new
|
|
71
|
+
* handler that rejects invalid attestations with appropriate HTTP
|
|
72
|
+
* error responses.
|
|
73
|
+
*
|
|
74
|
+
* The symmetric pair of {@linkcode withAssertion} — use this on your
|
|
75
|
+
* one-time device registration endpoint, then use `withAssertion` on
|
|
76
|
+
* every protected business endpoint.
|
|
77
|
+
*/
|
|
78
|
+
export declare function withAttestation(options: WithAttestationOptions, handler: (req: Request, context: AttestationContext) => Response | Promise<Response>): (req: Request) => Promise<Response>;
|
|
79
|
+
//# sourceMappingURL=with-attestation.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"with-attestation.d.ts","sourceRoot":"","sources":["../../src/src/with-attestation.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAwB,MAAM,aAAa,CAAC;AAErE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,OAAO,EAAE,UAAU,CAAC;IACpB,mEAAmE;IACnE,OAAO,EAAE,kBAAkB,CAAC;CAC7B,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,MAAM,sBAAsB,GAAG;IACnC,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D;;;;OAIG;IACH,cAAc,EAAE,CAAC,GAAG,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC;KACrB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,uEAAuE;IACvE,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,OAAO,KACT,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnC,CAAC;AAwEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,CACP,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,kBAAkB,KACxB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAChC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAiHrC"}
|
|
@@ -0,0 +1,147 @@
|
|
|
1
|
+
// src/with-attestation.ts
|
|
2
|
+
import { decodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.10/base64.js";
|
|
3
|
+
import { verifyAttestation } from "./attestation.js";
|
|
4
|
+
import { AttestationError, AttestationErrorCode } from "./errors.js";
|
|
5
|
+
/**
|
|
6
|
+
* Default extractor: reads a JSON body of the shape
|
|
7
|
+
* `{ keyId: string, challenge: string, attestation: string }` where all
|
|
8
|
+
* three fields are base64-encoded per Apple's standard wire format.
|
|
9
|
+
*/
|
|
10
|
+
async function defaultExtractAttestation(req) {
|
|
11
|
+
let body;
|
|
12
|
+
try {
|
|
13
|
+
body = await req.json();
|
|
14
|
+
}
|
|
15
|
+
catch (err) {
|
|
16
|
+
throw new AttestationError(AttestationErrorCode.INVALID_FORMAT, `Failed to parse attestation request body as JSON: ${err instanceof Error ? err.message : String(err)}`);
|
|
17
|
+
}
|
|
18
|
+
if (typeof body !== "object" || body === null ||
|
|
19
|
+
typeof body.keyId !== "string" ||
|
|
20
|
+
typeof body.challenge !== "string" ||
|
|
21
|
+
typeof body.attestation !== "string") {
|
|
22
|
+
throw new AttestationError(AttestationErrorCode.INVALID_FORMAT, "Attestation request body must include { keyId, challenge, attestation } as base64 strings");
|
|
23
|
+
}
|
|
24
|
+
const typed = body;
|
|
25
|
+
let challenge;
|
|
26
|
+
let attestation;
|
|
27
|
+
try {
|
|
28
|
+
challenge = decodeBase64(typed.challenge);
|
|
29
|
+
}
|
|
30
|
+
catch {
|
|
31
|
+
throw new AttestationError(AttestationErrorCode.INVALID_FORMAT, "challenge is not valid base64");
|
|
32
|
+
}
|
|
33
|
+
try {
|
|
34
|
+
attestation = decodeBase64(typed.attestation);
|
|
35
|
+
}
|
|
36
|
+
catch {
|
|
37
|
+
throw new AttestationError(AttestationErrorCode.INVALID_FORMAT, "attestation is not valid base64");
|
|
38
|
+
}
|
|
39
|
+
return { deviceId: typed.keyId, challenge, attestation };
|
|
40
|
+
}
|
|
41
|
+
function defaultErrorResponse(error) {
|
|
42
|
+
const status = error.code === AttestationErrorCode.INTERNAL_ERROR
|
|
43
|
+
? 500
|
|
44
|
+
: error.code === AttestationErrorCode.INVALID_FORMAT
|
|
45
|
+
? 400
|
|
46
|
+
: 401;
|
|
47
|
+
return new Response(JSON.stringify({ error: error.message, code: error.code }), { status, headers: { "Content-Type": "application/json" } });
|
|
48
|
+
}
|
|
49
|
+
/**
|
|
50
|
+
* Request handler middleware that verifies App Attest attestations.
|
|
51
|
+
*
|
|
52
|
+
* Wraps a handler with automatic challenge consumption, cryptographic
|
|
53
|
+
* attestation verification, and device key persistence. Returns a new
|
|
54
|
+
* handler that rejects invalid attestations with appropriate HTTP
|
|
55
|
+
* error responses.
|
|
56
|
+
*
|
|
57
|
+
* The symmetric pair of {@linkcode withAssertion} — use this on your
|
|
58
|
+
* one-time device registration endpoint, then use `withAssertion` on
|
|
59
|
+
* every protected business endpoint.
|
|
60
|
+
*/
|
|
61
|
+
export function withAttestation(options, handler) {
|
|
62
|
+
const appInfo = {
|
|
63
|
+
appId: options.appId,
|
|
64
|
+
developmentEnv: options.developmentEnv ?? false,
|
|
65
|
+
};
|
|
66
|
+
const extract = options.extractAttestation ?? defaultExtractAttestation;
|
|
67
|
+
return async (req) => {
|
|
68
|
+
let deviceId;
|
|
69
|
+
let publicKeyPem;
|
|
70
|
+
let receipt;
|
|
71
|
+
const timings = {
|
|
72
|
+
extractMs: 0,
|
|
73
|
+
consumeChallengeMs: 0,
|
|
74
|
+
verifyMs: 0,
|
|
75
|
+
storeDeviceKeyMs: 0,
|
|
76
|
+
};
|
|
77
|
+
try {
|
|
78
|
+
const extractStart = performance.now();
|
|
79
|
+
const extracted = await extract(req);
|
|
80
|
+
timings.extractMs = performance.now() - extractStart;
|
|
81
|
+
deviceId = extracted.deviceId;
|
|
82
|
+
// Consume the challenge BEFORE verification to prevent a TOCTOU race:
|
|
83
|
+
// two concurrent requests with the same challenge could both pass
|
|
84
|
+
// verifyAttestation before either consumes. The trade-off is that a
|
|
85
|
+
// verification failure (malformed attestation, cert-chain error) burns
|
|
86
|
+
// the challenge, requiring the client to request a new one.
|
|
87
|
+
const consumeStart = performance.now();
|
|
88
|
+
let challengeOk;
|
|
89
|
+
try {
|
|
90
|
+
challengeOk = await options.consumeChallenge(extracted.challenge);
|
|
91
|
+
}
|
|
92
|
+
catch (err) {
|
|
93
|
+
// Static message — the original error is attached via `cause` and
|
|
94
|
+
// never reaches the wire. Callback errors from Postgres drivers
|
|
95
|
+
// routinely contain schema details, constraint names, and other
|
|
96
|
+
// info that must not leak to unauthenticated clients.
|
|
97
|
+
throw new AttestationError(AttestationErrorCode.INTERNAL_ERROR, "consumeChallenge callback failed", { cause: err });
|
|
98
|
+
}
|
|
99
|
+
timings.consumeChallengeMs = performance.now() - consumeStart;
|
|
100
|
+
if (!challengeOk) {
|
|
101
|
+
throw new AttestationError(AttestationErrorCode.CHALLENGE_INVALID, "Challenge is missing, expired, or already consumed");
|
|
102
|
+
}
|
|
103
|
+
// Hash the raw challenge to produce clientDataHash. Client SDKs
|
|
104
|
+
// (Expo's attestKeyAsync, native DCAppAttestService wrappers) hash
|
|
105
|
+
// the challenge with SHA-256 before passing to Apple's attestKey
|
|
106
|
+
// API, so the attestation certificate's nonce is computed over the
|
|
107
|
+
// hash, not the raw bytes. verifyAttestation expects clientDataHash
|
|
108
|
+
// (the hash), not the raw challenge.
|
|
109
|
+
const clientDataHash = new Uint8Array(await crypto.subtle.digest("SHA-256", extracted.challenge));
|
|
110
|
+
const verifyStart = performance.now();
|
|
111
|
+
const result = await verifyAttestation(appInfo, deviceId, clientDataHash, extracted.attestation);
|
|
112
|
+
timings.verifyMs = performance.now() - verifyStart;
|
|
113
|
+
publicKeyPem = result.publicKeyPem;
|
|
114
|
+
receipt = result.receipt;
|
|
115
|
+
const storeStart = performance.now();
|
|
116
|
+
try {
|
|
117
|
+
await options.storeDeviceKey({
|
|
118
|
+
deviceId,
|
|
119
|
+
publicKeyPem,
|
|
120
|
+
signCount: result.signCount,
|
|
121
|
+
receipt,
|
|
122
|
+
});
|
|
123
|
+
}
|
|
124
|
+
catch (err) {
|
|
125
|
+
// Static message — see consumeChallenge catch above.
|
|
126
|
+
throw new AttestationError(AttestationErrorCode.INTERNAL_ERROR, "storeDeviceKey callback failed", { cause: err });
|
|
127
|
+
}
|
|
128
|
+
timings.storeDeviceKeyMs = performance.now() - storeStart;
|
|
129
|
+
}
|
|
130
|
+
catch (err) {
|
|
131
|
+
// Non-AttestationError escapes (unexpected runtime errors, programmer
|
|
132
|
+
// bugs, etc.) are wrapped as INTERNAL_ERROR with a static message.
|
|
133
|
+
// The original is attached via `cause` and never reaches the wire.
|
|
134
|
+
const error = err instanceof AttestationError
|
|
135
|
+
? err
|
|
136
|
+
: new AttestationError(AttestationErrorCode.INTERNAL_ERROR, "Internal error", { cause: err });
|
|
137
|
+
return options.onError?.(error, req) ?? defaultErrorResponse(error);
|
|
138
|
+
}
|
|
139
|
+
return await handler(req, {
|
|
140
|
+
deviceId,
|
|
141
|
+
publicKeyPem,
|
|
142
|
+
signCount: 0,
|
|
143
|
+
receipt,
|
|
144
|
+
timings,
|
|
145
|
+
});
|
|
146
|
+
};
|
|
147
|
+
}
|
package/package.json
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@bradford-tech/supabase-integrity-attest",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"description": "Verify Apple App Attest attestations and assertions using WebCrypto.",
|
|
5
|
+
"homepage": "https://integrity-attest.bradford.tech",
|
|
5
6
|
"repository": {
|
|
6
7
|
"type": "git",
|
|
7
8
|
"url": "git+https://github.com/bradford-tech/supabase-integrity-attest.git"
|
|
@@ -22,18 +23,14 @@
|
|
|
22
23
|
"import": "./esm/attestation.js"
|
|
23
24
|
}
|
|
24
25
|
},
|
|
25
|
-
"scripts": {
|
|
26
|
-
"test": "node test_runner.js"
|
|
27
|
-
},
|
|
26
|
+
"scripts": {},
|
|
28
27
|
"dependencies": {
|
|
29
28
|
"@noble/curves": "^2.0.1",
|
|
30
29
|
"asn1js": "^3.0.7",
|
|
31
30
|
"cborg": "^4.5.8"
|
|
32
31
|
},
|
|
33
32
|
"devDependencies": {
|
|
34
|
-
"@types/node": "^20.9.0"
|
|
35
|
-
"picocolors": "^1.0.0",
|
|
36
|
-
"@deno/shim-deno-test": "~0.5.0"
|
|
33
|
+
"@types/node": "^20.9.0"
|
|
37
34
|
},
|
|
38
35
|
"_generatedBy": "dnt@dev"
|
|
39
36
|
}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"_dnt.test_polyfills.d.ts","sourceRoot":"","sources":["../src/_dnt.test_polyfills.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,KAAK;QACb,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CACF;AAED,OAAO,EAAE,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"_dnt.test_shims.d.ts","sourceRoot":"","sources":["../src/_dnt.test_shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAK5C,eAAO,MAAM,aAAa;;CAA2C,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"almost_equals.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/almost_equals.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,QAmBb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"array_includes.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/array_includes.ts"],"names":[],"mappings":"AAMA,0FAA0F;AAC1F,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAOpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,IAAI,CAgCN"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"assert.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/assert.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,SAAK,GAAG,OAAO,CAAC,IAAI,CAI5D"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"assertion_error.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/assertion_error.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC;;;;OAIG;gBACS,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"equal.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/equal.ts"],"names":[],"mappings":"AA0FA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAgHrD"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"equals.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/equals.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,CAAC,EACX,GAAG,CAAC,EAAE,MAAM,QAmBb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"exists.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/exists.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,CAAC,EACT,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAOlC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"fail.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/fail.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,wBAAgB,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAGxC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"false.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/false.ts"],"names":[],"mappings":"AAIA,uDAAuD;AACvD,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,SAAK,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAI1E"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"greater.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/greater.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,QAMpE"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"greater_or_equal.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/greater_or_equal.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,CAAC,EACX,GAAG,CAAC,EAAE,MAAM,QASb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"instance_of.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/instance_of.ts"],"names":[],"mappings":"AAIA,sBAAsB;AAEtB,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;AACzD,4BAA4B;AAC5B,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,cAAc,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAE9B,CAAC,SAAS,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAE9C,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,CAAC,EACf,GAAG,SAAK,GACP,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,CA6BnC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"is_error.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/is_error.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,EACnD,KAAK,EAAE,OAAO,EAEd,UAAU,CAAC,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAC/C,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAC5B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,IAAI,CAAC,CA8BpB"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"less.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/less.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,QAMjE"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"less_or_equal.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/less_or_equal.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,CAAC,EACX,GAAG,CAAC,EAAE,MAAM,QASb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"match.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/match.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,QAMb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/mod.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"not_equals.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/not_equals.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,QAUtE"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"not_instance_of.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/not_instance_of.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,CAAC,EACtC,MAAM,EAAE,CAAC,EAET,cAAc,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAClD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAKjC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"not_match.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/not_match.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,QAMb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"not_strict_equals.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/not_strict_equals.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,CAAC,EACX,GAAG,CAAC,EAAE,MAAM,QAYb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"object_match.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/object_match.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAE/B,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAChC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EACtC,GAAG,CAAC,EAAE,MAAM,GACX,IAAI,CAUN"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"rejects.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/rejects.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,EAC9B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAAC;AACpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,EACnD,EAAE,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,EAE9B,UAAU,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAC9C,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,CAAC,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"strict_equals.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/strict_equals.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,CAAC,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,IAAI,CAAC,CAgCrB"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"string_includes.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/string_includes.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,QAMb"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"throws.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/throws.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,OAAO,EACjB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;AACX;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,EAClD,EAAE,EAAE,MAAM,OAAO,EAEjB,UAAU,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAC9C,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACX,CAAC,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"unimplemented.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/unimplemented.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAGjD"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"unreachable.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/assert/1.0.19/unreachable.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAG/C"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"build_message.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/build_message.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,QAAQ;AAClB;;;GAGG;AACH,UAAU,UAAQ,GACjB,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAWvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CASrD;AAED,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAC7C,OAAO,GAAE,mBAAwB,EACjC,YAAY,CAAC,EAAE,CACb,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAC7C,UAAU,EAAE,OAAO,EACnB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,KAC1B,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GACrC,MAAM,EAAE,CA8BV"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/diff.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEvD,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAanD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAWvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,SAAS,CAAC,CAAC,EACzB,CAAC,EAAE,CAAC,EAAE,EACN,CAAC,EAAE,CAAC,EAAE,EACN,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,kBAAkB,EAAE,MAAM,GACzB,KAAK,CAAC;IACP,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,CAAC,CAAC;CACV,CAAC,CAgCD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,QAAQ,CACtB,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,WAAW,EACnB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,aAAa,EACrB,IAAI,CAAC,EAAE,aAAa,GACnB,aAAa,CAsBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAwEvD"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"diff_str.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/diff_str.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAGhE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAY/C;AAKD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,MAAM,EAAE,CAiBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EACxB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,GAC3B,UAAU,CAAC,MAAM,CAAC,EAAE,CAetB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAkDlE"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/format.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,CACtB,CAAC,EAAE,OAAO,EACV,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,KACE,MAAM,CAAC;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAmBzC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/styles.ts"],"names":[],"mappings":"AAqCA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@std/internal/1.0.12/types.ts"],"names":[],"mappings":"AAGA,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAChC,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC;CACV,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IACjC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC;IACT,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;CAC3B,CAAC"}
|
package/esm/src/cose.d.ts.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/src/cose.ts"],"names":[],"mappings":"AAGA,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAkBvE;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,SAAS,CAAC,CASpB"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"assertion-entry.test.d.ts","sourceRoot":"","sources":["../../src/tests/assertion-entry.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"assertion.test.d.ts","sourceRoot":"","sources":["../../src/tests/assertion.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"attestation-entry.test.d.ts","sourceRoot":"","sources":["../../src/tests/attestation-entry.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"attestation.test.d.ts","sourceRoot":"","sources":["../../src/tests/attestation.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"authdata.test.d.ts","sourceRoot":"","sources":["../../src/tests/authdata.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"certificate.test.d.ts","sourceRoot":"","sources":["../../src/tests/certificate.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"cose.test.d.ts","sourceRoot":"","sources":["../../src/tests/cose.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"der.test.d.ts","sourceRoot":"","sources":["../../src/tests/der.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../../src/tests/errors.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"apple-attestation.d.ts","sourceRoot":"","sources":["../../../src/tests/fixtures/apple-attestation.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,eAAO,MAAM,iBAAiB;;;;IAK5B,oDAAoD;;IAIpD,oDAAoD;;;;;;;;CAQrD,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"generate-assertion.d.ts","sourceRoot":"","sources":["../../../src/tests/fixtures/generate-assertion.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,UAAU,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAuDnC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"utils.test.d.ts","sourceRoot":"","sources":["../../src/tests/utils.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"with-assertion.test.d.ts","sourceRoot":"","sources":["../../src/tests/with-assertion.test.ts"],"names":[],"mappings":"AACA,OAAO,2BAA2B,CAAC"}
|