@byline/admin 6.7.2 → 6.9.0

package/dist/modules/auth/native-passkey-provider.js

@@ -0,0 +1,618 @@
+import { createHash, randomBytes } from "node:crypto";
+import { AuthError, AuthErrorCodes, ERR_FORBIDDEN, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_SESSION_CHANGED } from "@byline/auth";
+import { resolvePasskeyConfig } from "@byline/core";
+import { passwordSignInSchema } from "@byline/core/validation";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { v7, validate } from "uuid";
+import { ADMIN_USERS_ABILITIES } from "../admin-users/abilities.js";
+import { assertPasskeyBytes } from "./passkey-storage-validation.js";
+import { verifyPassword } from "./password.js";
+function _check_private_redeclaration(obj, privateCollection) {
+    if (privateCollection.has(obj)) throw new TypeError("Cannot initialize the same private elements twice on an object");
+}
+function _class_apply_descriptor_get(receiver, descriptor) {
+    if (descriptor.get) return descriptor.get.call(receiver);
+    return descriptor.value;
+}
+function _class_apply_descriptor_set(receiver, descriptor, value) {
+    if (descriptor.set) descriptor.set.call(receiver, value);
+    else {
+        if (!descriptor.writable) throw new TypeError("attempted to set read only private field");
+        descriptor.value = value;
+    }
+}
+function _class_extract_field_descriptor(receiver, privateMap, action) {
+    if (!privateMap.has(receiver)) throw new TypeError("attempted to " + action + " private field on non-instance");
+    return privateMap.get(receiver);
+}
+function _class_private_field_get(receiver, privateMap) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "get");
+    return _class_apply_descriptor_get(receiver, descriptor);
+}
+function _class_private_field_init(obj, privateMap, value) {
+    _check_private_redeclaration(obj, privateMap);
+    privateMap.set(obj, value);
+}
+function _class_private_field_set(receiver, privateMap, value) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "set");
+    _class_apply_descriptor_set(receiver, descriptor, value);
+    return value;
+}
+function _class_private_method_get(receiver, privateSet, fn) {
+    if (!privateSet.has(receiver)) throw new TypeError("attempted to get private field on non-instance");
+    return fn;
+}
+function _class_private_method_init(obj, privateSet) {
+    _check_private_redeclaration(obj, privateSet);
+    privateSet.add(obj);
+}
+const MAX_PENDING = 5;
+const MAX_CREDENTIALS = 10;
+const LIFETIME_MS = 300000;
+var _trust = /*#__PURE__*/ new WeakMap(), _run = /*#__PURE__*/ new WeakSet(), _authenticationOptions = /*#__PURE__*/ new WeakSet(), _newAttempt = /*#__PURE__*/ new WeakSet(), _claimAuthenticated = /*#__PURE__*/ new WeakSet(), _unexpired = /*#__PURE__*/ new WeakSet(), _recheckAuthority = /*#__PURE__*/ new WeakSet(), _authorizeTarget = /*#__PURE__*/ new WeakSet(), _authorizeAction = /*#__PURE__*/ new WeakSet(), _capacity = /*#__PURE__*/ new WeakSet(), _grant = /*#__PURE__*/ new WeakSet(), _verifyAuthentication = /*#__PURE__*/ new WeakSet(), _applyVerifiedKey = /*#__PURE__*/ new WeakSet();
+class NativePasskeyProvider {
+    recordAdmissionDenied(purpose, reason) {
+        this.deps.emit({
+            type: 'passkey_admission_denied',
+            purpose,
+            reason
+        });
+    }
+    signInOptions(_metadata) {
+        return _class_private_method_get(this, _run, run).call(this, 'sign-in-options', async ()=>{
+            const { raw, row } = _class_private_method_get(this, _newAttempt, newAttempt).call(this, 'sign-in');
+            const options = await _class_private_method_get(this, _authenticationOptions, authenticationOptions).call(this, row.challenge);
+            await this.deps.store.passkeys.createAttempt(row);
+            return {
+                ceremonyId: raw,
+                expiresAt: row.expires_at.toISOString(),
+                options
+            };
+        });
+    }
+    verifySignIn(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'sign-in', async ()=>{
+            const attempt = await this.deps.store.passkeys.claimAttempt({
+                tokenHash: hashBearer(args.ceremonyId),
+                purpose: 'sign-in',
+                binding: {
+                    actor_user_id: null,
+                    actor_login_id: null,
+                    actor_generation: null
+                },
+                now: this.deps.now()
+            });
+            if (!attempt) throw expired();
+            const response = parseResponse(args.response, 'webauthn.get');
+            const key = active(await this.deps.store.passkeys.findCredentialByCredentialId(response.id));
+            const user = await this.deps.store.adminUsers.getByIdForSignIn(key.admin_user_id);
+            if (!user?.is_enabled) throw invalidProof();
+            const verified = await _class_private_method_get(this, _verifyAuthentication, verifyAuthentication).call(this, response, key, attempt);
+            return this.deps.signIn(user, args, async (store)=>{
+                _class_private_method_get(this, _unexpired, unexpired).call(this, attempt);
+                await _class_private_method_get(this, _applyVerifiedKey, applyVerifiedKey).call(this, store, key, verified);
+            });
+        });
+    }
+    passwordProof(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'password-proof', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const parsed = passwordSignInSchema.safeParse({
+                email: observed.user.email,
+                password: args.password
+            });
+            if (!parsed.success || !await verifyPassword(parsed.data.password, observed.user.password_hash)) throw invalidProof();
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                if (current.user.password_hash !== observed.user.password_hash || current.user.session_version !== observed.user.session_version) throw invalidProof();
+                const action = await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, args.action, current, store);
+                return _class_private_method_get(this, _grant, native_passkey_provider_grant).call(this, store, current, action, null);
+            });
+        });
+    }
+    proofOptions(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'proof-options', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                const action = await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, args.action, current, store);
+                await _class_private_method_get(this, _capacity, capacity).call(this, store, current.sessionId);
+                const { raw, row } = _class_private_method_get(this, _newAttempt, newAttempt).call(this, 'fresh-authentication', current, action);
+                const options = await _class_private_method_get(this, _authenticationOptions, authenticationOptions).call(this, row.challenge);
+                await store.passkeys.createAttempt(row);
+                return {
+                    ceremonyId: raw,
+                    expiresAt: row.expires_at.toISOString(),
+                    options
+                };
+            });
+        });
+    }
+    verifyProof(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'proof', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const attempt = await _class_private_method_get(this, _claimAuthenticated, claimAuthenticated).call(this, args.ceremonyId, 'fresh-authentication', observed);
+            const response = parseResponse(args.response, 'webauthn.get');
+            const key = active(await this.deps.store.passkeys.findCredentialByCredentialId(response.id));
+            if (key.admin_user_id !== observed.user.id) throw invalidProof();
+            const verified = await _class_private_method_get(this, _verifyAuthentication, verifyAuthentication).call(this, response, key, attempt);
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                await _class_private_method_get(this, _recheckAuthority, recheckAuthority).call(this, store, attempt, current);
+                const action = await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, actionOf(attempt), current, store);
+                await _class_private_method_get(this, _applyVerifiedKey, applyVerifiedKey).call(this, store, key, verified);
+                return _class_private_method_get(this, _grant, native_passkey_provider_grant).call(this, store, current, action, key.id);
+            });
+        });
+    }
+    enrollmentOptions(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'enrollment-options', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const grant = await _class_private_method_get(this, _claimAuthenticated, claimAuthenticated).call(this, args.grantId, 'grant', observed, 'enroll');
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                await _class_private_method_get(this, _recheckAuthority, recheckAuthority).call(this, store, grant, current);
+                await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, actionOf(grant), current, store);
+                await _class_private_method_get(this, _capacity, capacity).call(this, store, current.sessionId);
+                const existing = await store.passkeys.listCredentials(current.user.id);
+                if (existing.length >= MAX_CREDENTIALS) throw limit();
+                const handle = await store.passkeys.ensureUserHandle(current.user.id, opaque());
+                const { raw, row } = _class_private_method_get(this, _newAttempt, newAttempt).call(this, 'enrollment', current, {
+                    action: 'enroll',
+                    target_user_id: current.user.id,
+                    credential_record_id: null
+                });
+                row.expires_at = grant.expires_at;
+                row.proof_credential_id = grant.proof_credential_id;
+                const generated = await generateRegistrationOptions({
+                    rpID: _class_private_field_get(this, _trust).rpId,
+                    rpName: _class_private_field_get(this, _trust).rpName,
+                    userName: current.user.email,
+                    userID: Buffer.from(handle, 'base64url'),
+                    userDisplayName: current.user.given_name || current.user.email,
+                    challenge: Buffer.from(row.challenge, 'base64url'),
+                    timeout: Math.max(1, grant.expires_at.getTime() - this.deps.now().getTime()),
+                    attestationType: 'none',
+                    authenticatorSelection: {
+                        residentKey: 'required',
+                        requireResidentKey: true,
+                        userVerification: 'required'
+                    },
+                    excludeCredentials: existing.map((key)=>({
+                            id: key.credential_id
+                        })),
+                    extensions: {
+                        credProps: true
+                    }
+                });
+                const options = {
+                    ...generated,
+                    excludeCredentials: existing.map((key)=>({
+                            id: key.credential_id,
+                            type: 'public-key'
+                        })),
+                    rp: {
+                        id: _class_private_field_get(this, _trust).rpId,
+                        name: _class_private_field_get(this, _trust).rpName
+                    },
+                    attestation: 'none',
+                    authenticatorSelection: {
+                        residentKey: 'required',
+                        requireResidentKey: true,
+                        userVerification: 'required'
+                    },
+                    extensions: {
+                        credProps: true
+                    }
+                };
+                _class_private_method_get(this, _unexpired, unexpired).call(this, row);
+                await store.passkeys.createAttempt(row);
+                return {
+                    ceremonyId: raw,
+                    expiresAt: row.expires_at.toISOString(),
+                    options
+                };
+            });
+        });
+    }
+    verifyEnrollment(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'enrollment', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const attempt = await _class_private_method_get(this, _claimAuthenticated, claimAuthenticated).call(this, args.ceremonyId, 'enrollment', observed, 'enroll');
+            const name = displayName(args.name);
+            const response = parseResponse(args.response, 'webauthn.create');
+            if (response.clientExtensionResults.credProps?.rk === false) throw invalidProof();
+            const verified = await verifyRegistrationResponse({
+                response,
+                expectedChallenge: attempt.challenge,
+                expectedOrigin: [
+                    ..._class_private_field_get(this, _trust).origins
+                ],
+                expectedRPID: _class_private_field_get(this, _trust).rpId,
+                expectedType: 'webauthn.create',
+                requireUserVerification: true,
+                requireUserPresence: true
+            }).catch(()=>{
+                throw invalidProof();
+            });
+            if (!verified.verified || !verified.registrationInfo.userVerified || verified.registrationInfo.credential.id !== response.id) throw invalidProof();
+            const info = verified.registrationInfo;
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                await _class_private_method_get(this, _recheckAuthority, recheckAuthority).call(this, store, attempt, current);
+                await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, actionOf(attempt), current, store);
+                if ((await store.passkeys.listCredentials(current.user.id)).length >= MAX_CREDENTIALS) throw limit();
+                if (await store.passkeys.findCredentialByCredentialId(info.credential.id)) throw invalidProof();
+                const row = {
+                    id: v7(),
+                    admin_user_id: current.user.id,
+                    credential_id: info.credential.id,
+                    public_key: Buffer.from(info.credential.publicKey).toString('base64url'),
+                    counter: info.credential.counter,
+                    transports: info.credential.transports ?? [],
+                    backup_eligible: 'multiDevice' === info.credentialDeviceType,
+                    backed_up: info.credentialBackedUp,
+                    name,
+                    created_at: this.deps.now(),
+                    last_used_at: null,
+                    revoked_at: null
+                };
+                await store.passkeys.createCredential(row);
+                return summary(row);
+            });
+        });
+    }
+    listCredentials(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'list', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const targetId = args.targetUserId ?? observed.user.id;
+            if (!validate(targetId)) throw forbidden();
+            return this.deps.store.withSessionLocks([
+                observed.user.id,
+                targetId
+            ], async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                await _class_private_method_get(this, _authorizeTarget, authorizeTarget).call(this, targetId, current, store);
+                return (await store.passkeys.listCredentials(targetId)).map(summary);
+            });
+        });
+    }
+    renameCredential(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'rename', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const name = displayName(args.name);
+            if (!validate(args.credentialRecordId)) throw forbidden();
+            return this.deps.store.withSessionLock(observed.user.id, async (store)=>{
+                const current = await this.deps.authenticate(args, store);
+                const key = active(await store.passkeys.findCredential(args.credentialRecordId));
+                if (key.admin_user_id !== current.user.id) throw forbidden();
+                await store.passkeys.updateCredential(key.id, {
+                    name
+                });
+                return summary({
+                    ...key,
+                    name
+                });
+            });
+        });
+    }
+    removeCredential(args) {
+        return _class_private_method_get(this, _run, run).call(this, 'remove', async ()=>{
+            const observed = await this.deps.authenticate(args);
+            const grant = await _class_private_method_get(this, _claimAuthenticated, claimAuthenticated).call(this, args.grantId, 'grant', observed, 'remove');
+            const action = actionOf(grant);
+            if ('remove' !== action.purpose) throw expired();
+            const audit = {
+                actorId: observed.user.id,
+                targetId: action.targetUserId,
+                credentialId: action.credentialRecordId
+            };
+            try {
+                return await this.deps.store.withSessionLocks([
+                    observed.user.id,
+                    action.targetUserId
+                ], async (store)=>{
+                    const current = await this.deps.authenticate(args, store);
+                    await _class_private_method_get(this, _recheckAuthority, recheckAuthority).call(this, store, grant, current);
+                    await _class_private_method_get(this, _authorizeAction, authorizeAction).call(this, action, current, store);
+                    await store.passkeys.revokeCredential(action.credentialRecordId, this.deps.now());
+                    await store.passkeys.invalidateAccountLogins(action.targetUserId, this.deps.now());
+                    if (current.user.id !== action.targetUserId) await store.passkeys.appendRemovalAudit({
+                        ...audit,
+                        outcome: 'success'
+                    });
+                    return {
+                        signedOut: current.user.id === action.targetUserId
+                    };
+                });
+            } catch (error) {
+                if (observed.user.id !== action.targetUserId) await this.deps.store.passkeys.appendRemovalAudit({
+                    ...audit,
+                    outcome: error instanceof AuthError && error.code === AuthErrorCodes.FORBIDDEN ? 'denied' : 'failed'
+                }).catch(()=>{});
+                throw error;
+            }
+        });
+    }
+    constructor(trust, deps){
+        _class_private_method_init(this, _run);
+        _class_private_method_init(this, _authenticationOptions);
+        _class_private_method_init(this, _newAttempt);
+        _class_private_method_init(this, _claimAuthenticated);
+        _class_private_method_init(this, _unexpired);
+        _class_private_method_init(this, _recheckAuthority);
+        _class_private_method_init(this, _authorizeTarget);
+        _class_private_method_init(this, _authorizeAction);
+        _class_private_method_init(this, _capacity);
+        _class_private_method_init(this, _grant);
+        _class_private_method_init(this, _verifyAuthentication);
+        _class_private_method_init(this, _applyVerifiedKey);
+        _class_private_field_init(this, _trust, {
+            writable: true,
+            value: void 0
+        });
+        this.deps = deps;
+        const resolved = resolvePasskeyConfig(trust, {
+            capabilities: {
+                passkeys: true,
+                passwordChange: true,
+                magicLink: false,
+                sso: false
+            },
+            passkeys: this
+        });
+        if (!resolved) throw new Error('Passkey trust configuration is required');
+        _class_private_field_set(this, _trust, resolved);
+    }
+}
+async function run(purpose, work) {
+    this.deps.emit({
+        type: 'passkey_attempted',
+        purpose
+    });
+    try {
+        const result = await work();
+        this.deps.emit({
+            type: 'passkey_completed',
+            purpose
+        });
+        return result;
+    } catch (error) {
+        const reason = error instanceof AuthError ? error.code === AuthErrorCodes.FORBIDDEN ? 'forbidden' : error.code === AuthErrorCodes.PASSKEY_LIMIT ? 'limit' : error.code === AuthErrorCodes.INVALID_CREDENTIALS ? 'invalid-proof' : 'stale-authority' : 'unavailable';
+        this.deps.emit({
+            type: 'passkey_failed',
+            purpose,
+            reason
+        });
+        if (error instanceof AuthError) throw new AuthError(error.code, {
+            message: error.message
+        });
+        throw new AuthError(AuthErrorCodes.PASSKEY_UNAVAILABLE, {
+            message: 'Passkey service unavailable'
+        });
+    }
+}
+async function authenticationOptions(challenge) {
+    const generated = await generateAuthenticationOptions({
+        rpID: _class_private_field_get(this, _trust).rpId,
+        challenge: Buffer.from(challenge, 'base64url'),
+        timeout: LIFETIME_MS,
+        userVerification: 'required'
+    });
+    return {
+        challenge: generated.challenge,
+        timeout: generated.timeout,
+        rpId: _class_private_field_get(this, _trust).rpId,
+        userVerification: 'required'
+    };
+}
+function newAttempt(purpose, actor, action) {
+    const raw = opaque();
+    const now = this.deps.now();
+    const row = {
+        token_hash: hashBearer(raw),
+        purpose,
+        challenge: 'grant' === purpose ? null : opaque(),
+        actor_user_id: actor?.user.id ?? null,
+        actor_login_id: actor?.sessionId ?? null,
+        actor_generation: actor?.user.session_version ?? null,
+        action: action?.action ?? null,
+        target_user_id: action?.target_user_id ?? null,
+        credential_record_id: action?.credential_record_id ?? null,
+        proof_credential_id: null,
+        created_at: now,
+        expires_at: new Date(now.getTime() + LIFETIME_MS)
+    };
+    return {
+        raw,
+        row
+    };
+}
+async function claimAuthenticated(raw, purpose, actor, requiredAction) {
+    const tokenHash = hashBearer(raw);
+    const observed = await this.deps.store.passkeys.findAttempt(tokenHash);
+    if (!observed?.action || observed.purpose !== purpose) throw expired();
+    const row = await this.deps.store.passkeys.claimAttempt({
+        tokenHash,
+        purpose,
+        action: requiredAction ?? observed.action,
+        binding: {
+            actor_user_id: actor.user.id,
+            actor_login_id: actor.sessionId,
+            actor_generation: actor.user.session_version
+        },
+        now: this.deps.now()
+    });
+    if (!row) throw expired();
+    return row;
+}
+function unexpired(row) {
+    if (row.expires_at.getTime() <= this.deps.now().getTime()) throw expired();
+}
+async function recheckAuthority(store, row, actor) {
+    _class_private_method_get(this, _unexpired, unexpired).call(this, row);
+    if (row.actor_user_id !== actor.user.id || row.actor_login_id !== actor.sessionId || row.actor_generation !== actor.user.session_version) throw ERR_SESSION_CHANGED({
+        message: 'Fresh proof authority changed; start again'
+    });
+    if (row.proof_credential_id) {
+        const key = active(await store.passkeys.findCredential(row.proof_credential_id));
+        if (key.admin_user_id !== actor.user.id) throw invalidProof();
+    }
+}
+async function authorizeTarget(targetId, actor, store) {
+    if (!validate(targetId)) throw forbidden();
+    const target = await store.adminUsers.getById(targetId);
+    if (!target) throw forbidden();
+    if (targetId !== actor.user.id) {
+        actor.actor.assertAbility(ADMIN_USERS_ABILITIES.managePasskeys);
+        if (target.is_super_admin && !actor.actor.isSuperAdmin) throw forbidden();
+    }
+    return target;
+}
+async function authorizeAction(action, actor, store) {
+    if (action?.purpose === 'enroll') return {
+        action: 'enroll',
+        target_user_id: actor.user.id,
+        credential_record_id: null
+    };
+    if (action?.purpose !== 'remove' || !validate(action.credentialRecordId)) throw forbidden();
+    await _class_private_method_get(this, _authorizeTarget, authorizeTarget).call(this, action.targetUserId, actor, store);
+    const key = active(await store.passkeys.findCredential(action.credentialRecordId));
+    if (key.admin_user_id !== action.targetUserId) throw forbidden();
+    return {
+        action: 'remove',
+        target_user_id: action.targetUserId,
+        credential_record_id: key.id
+    };
+}
+async function capacity(store, sessionId) {
+    if (await store.passkeys.countPendingForLogin(sessionId, this.deps.now()) >= MAX_PENDING) throw limit();
+}
+async function native_passkey_provider_grant(store, actor, action, proofCredential) {
+    await _class_private_method_get(this, _capacity, capacity).call(this, store, actor.sessionId);
+    const { raw, row } = _class_private_method_get(this, _newAttempt, newAttempt).call(this, 'grant', actor, action);
+    row.proof_credential_id = proofCredential;
+    await store.passkeys.createAttempt(row);
+    return {
+        grantId: raw,
+        expiresAt: row.expires_at.toISOString()
+    };
+}
+async function verifyAuthentication(response, key, attempt) {
+    const handle = await this.deps.store.passkeys.getUserHandle(key.admin_user_id);
+    if (!handle || response.response.userHandle !== handle) throw invalidProof();
+    const result = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge: attempt.challenge,
+        expectedOrigin: [
+            ..._class_private_field_get(this, _trust).origins
+        ],
+        expectedRPID: _class_private_field_get(this, _trust).rpId,
+        expectedType: 'webauthn.get',
+        requireUserVerification: true,
+        credential: {
+            id: key.credential_id,
+            publicKey: Buffer.from(key.public_key, 'base64url'),
+            counter: key.counter
+        }
+    }).catch(()=>{
+        throw invalidProof();
+    });
+    if (!result.verified || !result.authenticationInfo.userVerified || 'multiDevice' === result.authenticationInfo.credentialDeviceType !== key.backup_eligible) throw invalidProof();
+    return result.authenticationInfo;
+}
+async function applyVerifiedKey(store, snapshot, verified) {
+    const current = active(await store.passkeys.findCredential(snapshot.id));
+    for (const field of [
+        'admin_user_id',
+        'credential_id',
+        'public_key',
+        'counter',
+        'backup_eligible',
+        'backed_up'
+    ])if (current[field] !== snapshot[field]) throw invalidProof();
+    await store.passkeys.updateCredential(current.id, {
+        counter: verified.newCounter,
+        backed_up: verified.credentialBackedUp,
+        last_used_at: this.deps.now()
+    });
+}
+function opaque() {
+    return randomBytes(32).toString('base64url');
+}
+function hashBearer(raw) {
+    try {
+        assertPasskeyBytes(raw, 32, 32);
+    } catch  {
+        throw expired();
+    }
+    return createHash('sha256').update(raw).digest('hex');
+}
+function expired() {
+    return ERR_INVALID_TOKEN({
+        message: 'Passkey attempt expired or already used; start again'
+    });
+}
+function invalidProof() {
+    return ERR_INVALID_CREDENTIALS({
+        message: 'Passkey verification failed; start again'
+    });
+}
+function forbidden() {
+    return ERR_FORBIDDEN({
+        message: 'Passkey management is not permitted'
+    });
+}
+function limit() {
+    return new AuthError(AuthErrorCodes.PASSKEY_LIMIT, {
+        message: 'Passkey credential or pending-operation limit reached'
+    });
+}
+function active(row) {
+    if (!row || null !== row.revoked_at || null === row.admin_user_id) throw invalidProof();
+    return row;
+}
+function displayName(value) {
+    if ('string' != typeof value || !value.trim() || value.length > 80) throw forbidden();
+    return value;
+}
+function summary(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        createdAt: row.created_at.toISOString(),
+        lastUsedAt: row.last_used_at?.toISOString() ?? null
+    };
+}
+function actionOf(row) {
+    if ('enroll' === row.action) return {
+        purpose: 'enroll'
+    };
+    if ('remove' === row.action && row.target_user_id && row.credential_record_id) return {
+        purpose: 'remove',
+        targetUserId: row.target_user_id,
+        credentialRecordId: row.credential_record_id
+    };
+    throw expired();
+}
+function parseResponse(value, expectedType) {
+    try {
+        if (!value || 'object' != typeof value || Array.isArray(value) || Buffer.byteLength(JSON.stringify(value)) > 65536) throw invalidProof();
+        const response = value;
+        if ('public-key' !== response.type || response.id !== response.rawId || !response.response || 'object' != typeof response.response || !response.clientExtensionResults || 'object' != typeof response.clientExtensionResults) throw invalidProof();
+        assertPasskeyBytes(response.id, 1024);
+        assertPasskeyBytes(response.response.clientDataJSON, 16384);
+        const client = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString('utf8'));
+        if (!client || client.type !== expectedType || void 0 !== client.crossOrigin && false !== client.crossOrigin) throw invalidProof();
+        if ('webauthn.get' === expectedType) {
+            const auth = response;
+            assertPasskeyBytes(auth.response.authenticatorData, 16384);
+            assertPasskeyBytes(auth.response.signature, 16384);
+            assertPasskeyBytes(auth.response.userHandle ?? '', 32, 32);
+        } else assertPasskeyBytes(response.response.attestationObject, 49152);
+        return response;
+    } catch  {
+        throw invalidProof();
+    }
+}
+export { NativePasskeyProvider };

package/dist/modules/auth/passkey-rate-limiter.d.ts

@@ -0,0 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasskeyRequestLimiter } from '@byline/auth';
+import type { RecurringTaskDefinition } from '@byline/core';
+import { type SignInRateLimitStore } from './sign-in-rate-limiter.js';
+/** Separate WebAuthn capacity and key domain; counter storage and cleanup are shared. */
+export declare function createPasskeyRequestLimiter(store: SignInRateLimitStore, secret: string | Uint8Array, now?: () => number): PasskeyRequestLimiter & {
+    cleanupTask: RecurringTaskDefinition;
+};