@camstack/addon-auth 1.1.1 → 1.1.3

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as BaseAddon, r as userPasskeysCapability } from "../dist-JmuFs-U5.mjs";
+import { a as userPasskeysCapability, c as array, i as loginMethodCapability, l as object, n as addonWidgetsSourceCapability, s as BaseAddon, u as string } from "../dist-suALViLT.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12276,40 +12276,85 @@ var PasskeyStore = class {
 	}
 };
 //#endregion
-//#region src/webauthn/auth-webauthn.addon.ts
+//#region src/webauthn/widget-catalog.ts
+/** MF remote name — must match `vite.widgets.config.ts` `federation.name`. */
+var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
+/** MF entry filename served at `/api/addon-widgets/auth-webauthn/<bundle>`. */
+var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
+/** Manifest addon id — the public bundle namespace + login-method addonId. */
+var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
+var authWebauthnWidgets = [{
+	tab: "dashboard",
+	label: "Passkeys",
+	kind: "remote",
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-enrollment"
+	},
+	stableId: "passkey-enrollment",
+	description: "Enroll and manage passkeys (WebAuthn) for your account.",
+	icon: "fingerprint",
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	hosts: ["dashboard"],
+	requires: {
+		deviceContext: false,
+		integrationContext: false
+	},
+	defaultSize: "lg",
+	allowedSizes: [
+		"md",
+		"lg",
+		"xl"
+	],
+	defaultColumns: 12,
+	defaultRows: 3,
+	preAuth: false
+}, {
+	tab: "dashboard",
+	label: "Passkey login",
+	kind: "remote",
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-login"
+	},
+	stableId: "passkey-login",
+	description: "Login-page passkey second-factor ceremony.",
+	icon: "fingerprint",
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	hosts: ["dashboard"],
+	requires: {
+		deviceContext: false,
+		integrationContext: false
+	},
+	defaultSize: "sm",
+	allowedSizes: ["sm"],
+	defaultColumns: 4,
+	defaultRows: 1,
+	preAuth: true
+}];
 /**
-* WebAuthn / Passkey authentication addon.
-*
-* Implements the standard two-leg ceremonies for both enrollment
-* (registration) and authentication, backed by `@simplewebauthn/server`.
-*
-* Enrollment (admin or self):
-*   1. `beginRegistration` → server returns
-*      PublicKeyCredentialCreationOptions w/ a random challenge.
-*      Stored in-memory keyed by `(userId, challenge)` w/ 5min TTL.
-*   2. Browser calls `navigator.credentials.create(options)`.
-*   3. `finishRegistration` → server verifies the attestation against
-*      the stored challenge, persists the credential (publicKey +
-*      counter + transports + operator-chosen label).
-*
-* Authentication (during 2FA login leg):
-*   1. `beginAuthentication` → server returns
-*      PublicKeyCredentialRequestOptions, listing the user's enrolled
-*      credentials in `allowCredentials`.
-*   2. Browser calls `navigator.credentials.get(options)`.
-*   3. `finishAuthentication` → server verifies the assertion against
-*      the stored publicKey + counter, bumps the counter.
-*
-* Relying-Party id (RP ID) MUST match the hub's domain (or a parent
-* of it). Defaults to `process.env.CAMSTACK_PUBLIC_ORIGIN`'s hostname;
-* operator overrides via settings.
-*
-* Open follow-ups:
-*   - Login flow integration (today this addon only provides the
-*     cap; the auth router doesn't yet gate sessions on passkey
-*     verification — that's a separate piece tied to the TOTP gate).
-*   - Multi-device discovery (passkey-discovery flow w/ resident keys).
+* Login-method contribution — the `passkey-login` widget, second-factor
+* stage. Aggregated by the public `auth.listLoginMethods` procedure,
+* which stamps a public `bundleUrl` from `addonId` + `bundle`.
 */
+var authWebauthnLoginMethods = [{
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-login"
+	},
+	stage: "second-factor"
+}];
+var EndpointsSchema = array(object({
+	hostname: string(),
+	url: string()
+}));
 var DEFAULT_CONFIG = {
 	rpID: "",
 	rpName: "CamStack",
@@ -12335,14 +12380,26 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
 			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
 		};
+		const widgetsProvider = { listWidgets: async () => authWebauthnWidgets };
+		const loginMethodProvider = { getLoginMethods: async () => authWebauthnLoginMethods };
 		this.ctx.logger.info("WebAuthn passkey provider initialized", { meta: {
 			rpID: this.resolveRpID(),
 			rpName: this.config.rpName
 		} });
-		return [{
-			capability: userPasskeysCapability,
-			provider
-		}];
+		return [
+			{
+				capability: userPasskeysCapability,
+				provider
+			},
+			{
+				capability: addonWidgetsSourceCapability,
+				provider: widgetsProvider
+			},
+			{
+				capability: loginMethodCapability,
+				provider: loginMethodProvider
+			}
+		];
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
@@ -12382,6 +12439,48 @@ var AuthWebauthnAddon = class extends BaseAddon {
 			]
 		}] });
 	}
+	/**
+	* Surface the cluster's registered public endpoints as an RP ID /
+	* origin suggestion. Fed by the `network-access` CAPABILITY (via
+	* `ctx.api`) — cap-driven, never a hardcoded hostname or a specific
+	* ingress addon. Injected as a read-only info banner atop the settings
+	* form so the operator can pick the canonical login hostname. Degrades
+	* to the bare schema when no ingress provider is installed.
+	*/
+	async getGlobalSettings(overlay, cap, nodeId) {
+		const base = await super.getGlobalSettings(overlay, cap, nodeId);
+		if (!base) return base;
+		const hint = await this.buildEndpointHintField();
+		if (!hint) return base;
+		return {
+			...base,
+			sections: base.sections.map((s) => s.id === "webauthn" ? {
+				...s,
+				fields: [hint, ...s.fields]
+			} : s)
+		};
+	}
+	async buildEndpointHintField() {
+		try {
+			const api = this.ctx.api;
+			if (!api) return null;
+			const raw = await api.networkAccess.listEndpoints.query();
+			const parsed = EndpointsSchema.safeParse(raw);
+			if (!parsed.success || parsed.data.length === 0) return null;
+			const hosts = [...new Set(parsed.data.map((e) => e.hostname))].filter((h) => h.length > 0);
+			const origins = [...new Set(parsed.data.map((e) => e.url.replace(/\/+$/, "")))].filter((u) => u.length > 0);
+			if (hosts.length === 0) return null;
+			return {
+				type: "info",
+				key: "detectedEndpoints",
+				label: "Suggested RP ID / origin",
+				content: `Detected public endpoints (from the network-access capability). Set RP ID to one canonical hostname — ${hosts.join(", ")} — and Origin to its full origin${origins.length > 0 ? ` (e.g. ${origins[0]})` : ""}. Changing RP ID invalidates every already-enrolled passkey.`,
+				variant: "info"
+			};
+		} catch {
+			return null;
+		}
+	}
 	resolveRpID() {
 		if (this.config.rpID && this.config.rpID.trim()) return this.config.rpID.trim();
 		const origin = process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443";