@camstack/addon-auth 1.1.1 → 1.1.3

package/dist/webauthn/_stub.js

@@ -0,0 +1,568 @@
+import { n as e, r as t, t as n } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react__loadShare__.js-BIIa6vDX.mjs";
+import { n as r, t as i } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-CQ-aEQ9b.mjs";
+import { t as a } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-EnxrfqY5.mjs";
+import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
+//#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
+var l = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), u = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), d = (e) => {
+	let t = u(e);
+	return t.charAt(0).toUpperCase() + t.slice(1);
+}, f = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), p = (e) => {
+	for (let t in e) if (t.startsWith("aria-") || t === "role" || t === "title") return !0;
+}, m = {
+	xmlns: "http://www.w3.org/2000/svg",
+	width: 24,
+	height: 24,
+	viewBox: "0 0 24 24",
+	fill: "none",
+	stroke: "currentColor",
+	strokeWidth: 2,
+	strokeLinecap: "round",
+	strokeLinejoin: "round"
+}, h = e(({ color: e = "currentColor", size: t = 24, strokeWidth: r = 2, absoluteStrokeWidth: i, className: a = "", children: o, iconNode: s, ...c }, l) => n("svg", {
+	ref: l,
+	...m,
+	width: t,
+	height: t,
+	stroke: e,
+	strokeWidth: i ? Number(r) * 24 / Number(t) : r,
+	className: f("lucide", a),
+	...!o && !p(c) && { "aria-hidden": "true" },
+	...c
+}, [...s.map(([e, t]) => n(e, t)), ...Array.isArray(o) ? o : [o]])), g = (t, r) => {
+	let i = e(({ className: e, ...i }, a) => n(h, {
+		ref: a,
+		iconNode: r,
+		className: f(`lucide-${l(d(t))}`, `lucide-${t}`, e),
+		...i
+	}));
+	return i.displayName = d(t), i;
+}, _ = g("circle-alert", [
+	["circle", {
+		cx: "12",
+		cy: "12",
+		r: "10",
+		key: "1mglay"
+	}],
+	["line", {
+		x1: "12",
+		x2: "12",
+		y1: "8",
+		y2: "12",
+		key: "1pkeuh"
+	}],
+	["line", {
+		x1: "12",
+		x2: "12.01",
+		y1: "16",
+		y2: "16",
+		key: "4dfq90"
+	}]
+]), v = g("fingerprint", [
+	["path", {
+		d: "M12 10a2 2 0 0 0-2 2c0 1.02-.1 2.51-.26 4",
+		key: "1nerag"
+	}],
+	["path", {
+		d: "M14 13.12c0 2.38 0 6.38-1 8.88",
+		key: "o46ks0"
+	}],
+	["path", {
+		d: "M17.29 21.02c.12-.6.43-2.3.5-3.02",
+		key: "ptglia"
+	}],
+	["path", {
+		d: "M2 12a10 10 0 0 1 18-6",
+		key: "ydlgp0"
+	}],
+	["path", {
+		d: "M2 16h.01",
+		key: "1gqxmh"
+	}],
+	["path", {
+		d: "M21.8 16c.2-2 .131-5.354 0-6",
+		key: "drycrb"
+	}],
+	["path", {
+		d: "M5 19.5C5.5 18 6 15 6 12a6 6 0 0 1 .34-2",
+		key: "1tidbn"
+	}],
+	["path", {
+		d: "M8.65 22c.21-.66.45-1.32.57-2",
+		key: "13wd9y"
+	}],
+	["path", {
+		d: "M9 6.8a6 6 0 0 1 9 5.2v2",
+		key: "1fr1j5"
+	}]
+]), y = g("key-round", [["path", {
+	d: "M2.586 17.414A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814a6.5 6.5 0 1 0-4-4z",
+	key: "1s6t7t"
+}], ["circle", {
+	cx: "16.5",
+	cy: "7.5",
+	r: ".5",
+	fill: "currentColor",
+	key: "w0ekpg"
+}]]), b = g("loader-circle", [["path", {
+	d: "M21 12a9 9 0 1 1-6.219-8.56",
+	key: "13zald"
+}]]), x = g("trash-2", [
+	["path", {
+		d: "M3 6h18",
+		key: "d0wm0j"
+	}],
+	["path", {
+		d: "M19 6v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6",
+		key: "4alrt4"
+	}],
+	["path", {
+		d: "M8 6V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2",
+		key: "v07s0e"
+	}],
+	["line", {
+		x1: "10",
+		x2: "10",
+		y1: "11",
+		y2: "17",
+		key: "1uufr5"
+	}],
+	["line", {
+		x1: "14",
+		x2: "14",
+		y1: "11",
+		y2: "17",
+		key: "xtxkd"
+	}]
+]);
+//#endregion
+//#region ../../node_modules/@simplewebauthn/browser/dist/bundle/index.js
+function S(e) {
+	let t = new Uint8Array(e), n = "";
+	for (let e of t) n += String.fromCharCode(e);
+	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function C(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = (4 - t.length % 4) % 4, r = t.padEnd(t.length + n, "="), i = atob(r), a = new ArrayBuffer(i.length), o = new Uint8Array(a);
+	for (let e = 0; e < i.length; e++) o[e] = i.charCodeAt(e);
+	return a;
+}
+function w() {
+	return window?.PublicKeyCredential !== void 0 && typeof window.PublicKeyCredential == "function";
+}
+function T(e) {
+	let { id: t } = e;
+	return {
+		...e,
+		id: C(t),
+		transports: e.transports
+	};
+}
+function E(e) {
+	return e === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(e);
+}
+var D = class extends Error {
+	constructor({ message: e, code: t, cause: n, name: r }) {
+		super(e, { cause: n }), this.name = r ?? n.name, this.code = t;
+	}
+};
+function O({ error: e, options: t }) {
+	let { publicKey: n } = t;
+	if (!n) throw Error("options was missing required publicKey property");
+	if (e.name === "AbortError") {
+		if (t.signal instanceof AbortSignal) return new D({
+			message: "Registration ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: e
+		});
+	} else if (e.name === "ConstraintError") {
+		if (n.authenticatorSelection?.requireResidentKey === !0) return new D({
+			message: "Discoverable credentials were required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_DISCOVERABLE_CREDENTIAL_SUPPORT",
+			cause: e
+		});
+		if (t.mediation === "conditional" && n.authenticatorSelection?.userVerification === "required") return new D({
+			message: "User verification was required during automatic registration but it could not be performed",
+			code: "ERROR_AUTO_REGISTER_USER_VERIFICATION_FAILURE",
+			cause: e
+		});
+		if (n.authenticatorSelection?.userVerification === "required") return new D({
+			message: "User verification was required but no available authenticator supported it",
+			code: "ERROR_AUTHENTICATOR_MISSING_USER_VERIFICATION_SUPPORT",
+			cause: e
+		});
+	} else if (e.name === "InvalidStateError") return new D({
+		message: "The authenticator was previously registered",
+		code: "ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED",
+		cause: e
+	});
+	else if (e.name === "NotAllowedError") return new D({
+		message: e.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: e
+	});
+	else if (e.name === "NotSupportedError") return n.pubKeyCredParams.filter((e) => e.type === "public-key").length === 0 ? new D({
+		message: "No entry in pubKeyCredParams was of type \"public-key\"",
+		code: "ERROR_MALFORMED_PUBKEYCREDPARAMS",
+		cause: e
+	}) : new D({
+		message: "No available authenticator supported any of the specified pubKeyCredParams algorithms",
+		code: "ERROR_AUTHENTICATOR_NO_SUPPORTED_PUBKEYCREDPARAMS_ALG",
+		cause: e
+	});
+	else if (e.name === "SecurityError") {
+		let t = window.location.hostname;
+		if (!E(t)) return new D({
+			message: `${window.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: e
+		});
+		if (n.rp.id !== t) return new D({
+			message: `The RP ID "${n.rp.id}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: e
+		});
+	} else if (e.name === "TypeError") {
+		if (n.user.id.byteLength < 1 || n.user.id.byteLength > 64) return new D({
+			message: "User ID was not between 1 and 64 characters",
+			code: "ERROR_INVALID_USER_ID_LENGTH",
+			cause: e
+		});
+	} else if (e.name === "UnknownError") return new D({
+		message: "The authenticator was unable to process the specified options, or could not create a new credential",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: e
+	});
+	return e;
+}
+var k = new class {
+	createNewAbortSignal() {
+		if (this.controller) {
+			let e = /* @__PURE__ */ Error("Cancelling existing WebAuthn API call for new one");
+			e.name = "AbortError", this.controller.abort(e);
+		}
+		let e = new AbortController();
+		return this.controller = e, e.signal;
+	}
+	cancelCeremony() {
+		if (this.controller) {
+			let e = /* @__PURE__ */ Error("Manually cancelling existing WebAuthn API call");
+			e.name = "AbortError", this.controller.abort(e), this.controller = void 0;
+		}
+	}
+}(), A = ["cross-platform", "platform"];
+function j(e) {
+	if (e && !(A.indexOf(e) < 0)) return e;
+}
+async function M(e) {
+	let { optionsJSON: t, useAutoRegister: n = !1 } = e;
+	if (!w()) throw Error("WebAuthn is not supported in this browser");
+	let r = {
+		...t,
+		challenge: C(t.challenge),
+		user: {
+			...t.user,
+			id: C(t.user.id)
+		},
+		excludeCredentials: t.excludeCredentials?.map(T)
+	}, i = {};
+	n && (i.mediation = "conditional"), i.publicKey = r, i.signal = k.createNewAbortSignal();
+	let a;
+	try {
+		a = await navigator.credentials.create(i);
+	} catch (e) {
+		throw O({
+			error: e,
+			options: i
+		});
+	}
+	if (!a) throw Error("Registration was not completed");
+	let { id: o, rawId: s, response: c, type: l } = a, u;
+	typeof c.getTransports == "function" && (u = c.getTransports());
+	let d;
+	if (typeof c.getPublicKeyAlgorithm == "function") try {
+		d = c.getPublicKeyAlgorithm();
+	} catch (e) {
+		N("getPublicKeyAlgorithm()", e);
+	}
+	let f;
+	if (typeof c.getPublicKey == "function") try {
+		let e = c.getPublicKey();
+		e !== null && (f = S(e));
+	} catch (e) {
+		N("getPublicKey()", e);
+	}
+	let p;
+	if (typeof c.getAuthenticatorData == "function") try {
+		p = S(c.getAuthenticatorData());
+	} catch (e) {
+		N("getAuthenticatorData()", e);
+	}
+	return {
+		id: o,
+		rawId: S(s),
+		response: {
+			attestationObject: S(c.attestationObject),
+			clientDataJSON: S(c.clientDataJSON),
+			transports: u,
+			publicKeyAlgorithm: d,
+			publicKey: f,
+			authenticatorData: p
+		},
+		type: l,
+		clientExtensionResults: a.getClientExtensionResults(),
+		authenticatorAttachment: j(a.authenticatorAttachment)
+	};
+}
+function N(e, t) {
+	console.warn(`The browser extension that intercepted this WebAuthn API call incorrectly implemented ${e}. You should report this error to them.\n`, t);
+}
+function P() {
+	if (!w()) return new Promise((e) => e(!1));
+	let e = window.PublicKeyCredential;
+	return e.isConditionalMediationAvailable === void 0 ? new Promise((e) => e(!1)) : e.isConditionalMediationAvailable();
+}
+function F({ error: e, options: t }) {
+	let { publicKey: n } = t;
+	if (!n) throw Error("options was missing required publicKey property");
+	if (e.name === "AbortError") {
+		if (t.signal instanceof AbortSignal) return new D({
+			message: "Authentication ceremony was sent an abort signal",
+			code: "ERROR_CEREMONY_ABORTED",
+			cause: e
+		});
+	} else if (e.name === "NotAllowedError") return new D({
+		message: e.message,
+		code: "ERROR_PASSTHROUGH_SEE_CAUSE_PROPERTY",
+		cause: e
+	});
+	else if (e.name === "SecurityError") {
+		let t = window.location.hostname;
+		if (!E(t)) return new D({
+			message: `${window.location.hostname} is an invalid domain`,
+			code: "ERROR_INVALID_DOMAIN",
+			cause: e
+		});
+		if (n.rpId !== t) return new D({
+			message: `The RP ID "${n.rpId}" is invalid for this domain`,
+			code: "ERROR_INVALID_RP_ID",
+			cause: e
+		});
+	} else if (e.name === "UnknownError") return new D({
+		message: "The authenticator was unable to process the specified options, or could not create a new assertion signature",
+		code: "ERROR_AUTHENTICATOR_GENERAL_ERROR",
+		cause: e
+	});
+	return e;
+}
+async function I(e) {
+	let { optionsJSON: t, useBrowserAutofill: n = !1, verifyBrowserAutofillInput: r = !0 } = e;
+	if (!w()) throw Error("WebAuthn is not supported in this browser");
+	let i;
+	t.allowCredentials?.length !== 0 && (i = t.allowCredentials?.map(T));
+	let a = {
+		...t,
+		challenge: C(t.challenge),
+		allowCredentials: i
+	}, o = {};
+	if (n) {
+		if (!await P()) throw Error("Browser does not support WebAuthn autofill");
+		if (document.querySelectorAll("input[autocomplete$='webauthn']").length < 1 && r) throw Error("No <input> with \"webauthn\" as the only or last value in its `autocomplete` attribute was detected");
+		o.mediation = "conditional", a.allowCredentials = [];
+	}
+	o.publicKey = a, o.signal = k.createNewAbortSignal();
+	let s;
+	try {
+		s = await navigator.credentials.get(o);
+	} catch (e) {
+		throw F({
+			error: e,
+			options: o
+		});
+	}
+	if (!s) throw Error("Authentication was not completed");
+	let { id: c, rawId: l, response: u, type: d } = s, f;
+	return u.userHandle && (f = S(u.userHandle)), {
+		id: c,
+		rawId: S(l),
+		response: {
+			authenticatorData: S(u.authenticatorData),
+			clientDataJSON: S(u.clientDataJSON),
+			signature: S(u.signature),
+			userHandle: f
+		},
+		type: d,
+		clientExtensionResults: s.getClientExtensionResults(),
+		authenticatorAttachment: j(s.authenticatorAttachment)
+	};
+}
+//#endregion
+//#region src/webauthn/widgets/passkey-ceremony.ts
+function L() {
+	return w();
+}
+async function R(e) {
+	let t = await I({ optionsJSON: e });
+	return Object.fromEntries(Object.entries(t));
+}
+async function z(e) {
+	let t = await M({ optionsJSON: e });
+	return Object.fromEntries(Object.entries(t));
+}
+//#endregion
+//#region src/webauthn/widgets/PasskeyEnrollment.tsx
+function B(e) {
+	let n = a(), l = r({
+		queryKey: ["auth", "listOwnPasskeys"],
+		queryFn: () => n.listOwnPasskeys()
+	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = async () => {
+		g(null), m(!0);
+		try {
+			let e = await z((await n.beginOwnPasskeyRegistration()).optionsJSON);
+			await n.finishOwnPasskeyRegistration({
+				response: e,
+				label: d.trim() || "Unnamed device"
+			}), f(""), l.refetch();
+		} catch (e) {
+			g(e instanceof Error ? e.message : "Passkey enrollment failed");
+		} finally {
+			m(!1);
+		}
+	}, C = i({
+		mutationFn: (e) => n.removeOwnPasskey({ credentialId: e }),
+		onSuccess: () => {
+			g(null), l.refetch();
+		},
+		onError: (e) => g(e instanceof Error ? e.message : "Remove failed")
+	});
+	return /* @__PURE__ */ s("div", {
+		className: "rounded-lg border border-border bg-surface overflow-hidden",
+		children: [/* @__PURE__ */ s("div", {
+			className: "px-4 py-2.5 border-b border-border flex items-center gap-2",
+			children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5 text-foreground-subtle" }), /* @__PURE__ */ o("div", {
+				className: "text-xs font-semibold text-foreground",
+				children: "Passkeys"
+			})]
+		}), /* @__PURE__ */ s("div", {
+			className: "p-4 space-y-3",
+			children: [
+				/* @__PURE__ */ o("div", {
+					className: "text-xs text-foreground-subtle",
+					children: "Add a passkey (Touch ID, Windows Hello, or a security key) as a phishing-resistant second factor. You'll be prompted for it at every login."
+				}),
+				l.isLoading ? /* @__PURE__ */ s("div", {
+					className: "flex items-center gap-2 text-xs text-foreground-subtle",
+					children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Loading passkeys…"]
+				}) : u.length > 0 ? /* @__PURE__ */ o("ul", {
+					className: "divide-y divide-border rounded-md border border-border",
+					children: u.map((e) => /* @__PURE__ */ s("li", {
+						className: "flex items-center gap-3 px-3 py-2 text-xs",
+						children: [
+							/* @__PURE__ */ o(y, { className: "h-3.5 w-3.5 text-foreground-subtle shrink-0" }),
+							/* @__PURE__ */ s("div", {
+								className: "flex-1 min-w-0",
+								children: [/* @__PURE__ */ o("div", {
+									className: "font-medium text-foreground truncate",
+									children: e.label
+								}), /* @__PURE__ */ s("div", {
+									className: "text-[10px] text-foreground-subtle",
+									children: [
+										"Added ",
+										new Date(e.createdAt).toLocaleDateString(),
+										e.lastUsedAt ? ` · last used ${new Date(e.lastUsedAt).toLocaleDateString()}` : " · never used"
+									]
+								})]
+							}),
+							/* @__PURE__ */ s("button", {
+								onClick: () => C.mutate(e.credentialId),
+								disabled: C.isPending,
+								className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[11px] text-danger hover:bg-danger/10 disabled:opacity-50",
+								children: [/* @__PURE__ */ o(x, { className: "h-3 w-3" }), "Remove"]
+							})
+						]
+					}, e.credentialId))
+				}) : /* @__PURE__ */ o("div", {
+					className: "text-[11px] text-foreground-subtle",
+					children: "No passkeys enrolled yet."
+				}),
+				h && /* @__PURE__ */ s("div", {
+					className: "text-[11px] text-danger flex items-center gap-1",
+					children: [/* @__PURE__ */ o(_, { className: "h-3 w-3" }), h]
+				}),
+				/* @__PURE__ */ s("div", {
+					className: "flex items-end gap-2",
+					children: [/* @__PURE__ */ s("div", {
+						className: "flex-1 space-y-1",
+						children: [/* @__PURE__ */ o("label", {
+							className: "text-[10px] uppercase tracking-wide text-foreground-subtle",
+							children: "Passkey name"
+						}), /* @__PURE__ */ o("input", {
+							type: "text",
+							value: d,
+							onChange: (e) => f(e.target.value),
+							placeholder: "e.g. MacBook Touch ID",
+							className: "w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary"
+						})]
+					}), /* @__PURE__ */ o("button", {
+						onClick: S,
+						disabled: p,
+						className: "inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-2 text-xs font-semibold text-primary-foreground hover:opacity-90 disabled:opacity-50",
+						children: p ? /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Enrolling…"] }) : /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5" }), "Add passkey"] })
+					})]
+				})
+			]
+		})]
+	});
+}
+//#endregion
+//#region src/webauthn/widgets/PasskeyLogin.tsx
+function V(e) {
+	if (!e) return null;
+	let t = e.challengeToken, n = e.onComplete, r = e.onError;
+	return typeof t != "string" || typeof n != "function" ? null : {
+		challengeToken: t,
+		onComplete: n,
+		onError: typeof r == "function" ? r : void 0
+	};
+}
+function H(e) {
+	let n = a(), r = V(e.config), [i, c] = t(!1), [l, u] = t(null);
+	return r ? L() ? /* @__PURE__ */ s("div", {
+		className: "space-y-2",
+		children: [/* @__PURE__ */ s("button", {
+			type: "button",
+			"data-testid": "login-passkey",
+			onClick: async () => {
+				u(null), c(!0);
+				try {
+					let e = await R((await n.loginBeginPasskey(r.challengeToken)).optionsJSON), t = await n.loginVerifyPasskey(r.challengeToken, e);
+					r.onComplete(t.token);
+				} catch (e) {
+					let t = e instanceof Error ? e.message : "Passkey verification failed";
+					u(t), r.onError?.(t);
+				} finally {
+					c(!1);
+				}
+			},
+			disabled: i,
+			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-background px-4 py-2.5 text-sm font-semibold text-foreground hover:bg-surface-hover disabled:opacity-50 transition-all",
+			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), "Use a passkey"]
+		}), l && /* @__PURE__ */ o("div", {
+			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
+			children: l
+		})]
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
+		children: "This browser does not support passkeys."
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
+		children: "Passkey login widget requires a challengeToken + onComplete callback."
+	});
+}
+//#endregion
+//#region src/webauthn/widgets/index.tsx
+var U = {
+	"passkey-enrollment": B,
+	"passkey-login": H
+};
+//#endregion
+export { U as default };