@camstack/addon-auth 1.1.4 → 1.1.6

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");
@@ -12123,6 +12123,36 @@ async function verifyAuthenticationResponse(options) {
 * auth like Touch ID), `usb`, `nfc`, `ble`.
 */
 var COLLECTION = "user_passkeys";
+/**
+* Per-user passkey preferences — one row per userId, keyed upserts via
+* the settings-store `set` surface. Today a single flag: whether the
+* user OPTED IN to their passkey doubling as a mandatory second factor
+* after a password login (default OFF — enrolling a passkey only
+* enables passkey-first sign-in).
+*/
+var PREF_COLLECTION = "user_passkey_prefs";
+var PREF_COLUMNS = [
+	{
+		name: "userId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "secondFactorEnabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var StoredPreferenceSchema = require_dist.object({
+	secondFactorEnabled: require_dist.boolean(),
+	updatedAt: require_dist.number()
+});
 var COLUMNS = [
 	{
 		name: "credentialId",
@@ -12173,6 +12203,10 @@ async function declarePasskeySchema(store) {
 			columns: ["userId"]
 		}]
 	});
+	await store.declareCollection.mutate({
+		collection: PREF_COLLECTION,
+		columns: PREF_COLUMNS
+	});
 }
 function parseRow(data) {
 	const credentialId = data["credentialId"];
@@ -12248,6 +12282,31 @@ var PasskeyStore = class {
 			key: credentialId
 		});
 	}
+	/**
+	* Whether `userId` opted in to the passkey-as-second-factor gate.
+	* Fail-safe: a missing or malformed row reads as `false` — the
+	* password login flow must never demand a factor the user did not
+	* explicitly enable.
+	*/
+	async getSecondFactorPreference(userId) {
+		const raw = await this.store.get.query({
+			collection: PREF_COLLECTION,
+			key: userId
+		});
+		const parsed = StoredPreferenceSchema.safeParse(raw);
+		return parsed.success ? parsed.data.secondFactorEnabled : false;
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		const value = {
+			secondFactorEnabled: enabled,
+			updatedAt: Date.now()
+		};
+		await this.store.set.mutate({
+			collection: PREF_COLLECTION,
+			key: userId,
+			value
+		});
+	}
 };
 //#endregion
 //#region src/webauthn/widget-catalog.ts
@@ -12257,61 +12316,97 @@ var AUTH_WEBAUTHN_REMOTE_NAME = "addon_auth_webauthn_widgets";
 var AUTH_WEBAUTHN_BUNDLE = "remoteEntry.js";
 /** Manifest addon id — the public bundle namespace + login-method addonId. */
 var AUTH_WEBAUTHN_ADDON_ID = "auth-webauthn";
-var authWebauthnWidgets = [{
-	tab: "dashboard",
-	label: "Passkeys",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-enrollment"
-	},
-	stableId: "passkey-enrollment",
-	description: "Enroll and manage passkeys (WebAuthn) for your account.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
-	},
-	defaultSize: "lg",
-	allowedSizes: [
-		"md",
-		"lg",
-		"xl"
-	],
-	defaultColumns: 12,
-	defaultRows: 3,
-	preAuth: false
-}, {
-	tab: "dashboard",
-	label: "Passkey login",
-	kind: "remote",
-	remote: {
-		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
-		exposedModule: "./widgets",
-		componentKey: "passkey-login"
+var authWebauthnWidgets = [
+	{
+		tab: "dashboard",
+		label: "Passkeys",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-enrollment"
+		},
+		stableId: "passkey-enrollment",
+		description: "Enroll and manage passkeys (WebAuthn) for your account.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "lg",
+		allowedSizes: [
+			"md",
+			"lg",
+			"xl"
+		],
+		defaultColumns: 12,
+		defaultRows: 3,
+		preAuth: false
 	},
-	stableId: "passkey-login",
-	description: "Login-page passkey second-factor ceremony.",
-	icon: "fingerprint",
-	bundle: AUTH_WEBAUTHN_BUNDLE,
-	hosts: ["dashboard"],
-	requires: {
-		deviceContext: false,
-		integrationContext: false
+	{
+		tab: "dashboard",
+		label: "Passkey login",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-login"
+		},
+		stableId: "passkey-login",
+		description: "Login-page passkey second-factor ceremony.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
 	},
-	defaultSize: "sm",
-	allowedSizes: ["sm"],
-	defaultColumns: 4,
-	defaultRows: 1,
-	preAuth: true
-}];
+	{
+		tab: "dashboard",
+		label: "Passkey sign-in",
+		kind: "remote",
+		remote: {
+			remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+			exposedModule: "./widgets",
+			componentKey: "passkey-direct-login"
+		},
+		stableId: "passkey-direct-login",
+		description: "Login-page usernameless (discoverable-credential) passkey sign-in.",
+		icon: "fingerprint",
+		bundle: AUTH_WEBAUTHN_BUNDLE,
+		hosts: ["dashboard"],
+		requires: {
+			deviceContext: false,
+			integrationContext: false
+		},
+		defaultSize: "sm",
+		allowedSizes: ["sm"],
+		defaultColumns: 4,
+		defaultRows: 1,
+		preAuth: true
+	}
+];
 /**
-* Login-method contribution — the `passkey-login` widget, second-factor
-* stage. Aggregated by the public `auth.listLoginMethods` procedure,
-* which stamps a public `bundleUrl` from `addonId` + `bundle`.
+* Login-method contributions — aggregated by the public
+* `auth.listLoginMethods` procedure, which stamps a public `bundleUrl`
+* from `addonId` + `bundle`.
+*
+*   - `passkey-login` (second-factor) — the post-password 2FA ceremony,
+*     mounted only when the challenged user has the `passkey` factor.
+*   - `passkey-direct-login` (primary) — usernameless sign-in via the
+*     standard WebAuthn discoverable-credentials flow. Contributed
+*     unconditionally while the addon is registered: the browser's own
+*     passkey picker is the honest gate (it simply offers nothing when
+*     no resident credential matches the RP) — probing the server for
+*     "does anyone have a passkey" pre-auth would leak enrollment state.
 */
 var authWebauthnLoginMethods = [{
 	kind: "widget",
@@ -12324,6 +12419,17 @@ var authWebauthnLoginMethods = [{
 		componentKey: "passkey-login"
 	},
 	stage: "second-factor"
+}, {
+	kind: "widget",
+	id: `${AUTH_WEBAUTHN_ADDON_ID}/passkey-direct-login`,
+	addonId: AUTH_WEBAUTHN_ADDON_ID,
+	bundle: AUTH_WEBAUTHN_BUNDLE,
+	remote: {
+		remoteName: AUTH_WEBAUTHN_REMOTE_NAME,
+		exposedModule: "./widgets",
+		componentKey: "passkey-direct-login"
+	},
+	stage: "primary"
 }];
 //#endregion
 //#region src/webauthn/auth-webauthn.addon.ts
@@ -12388,8 +12494,12 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			finishRegistration: async ({ userId, response, label }) => this.finishRegistration(userId, response, label),
 			beginAuthentication: async ({ userId }) => this.beginAuthentication(userId),
 			finishAuthentication: async ({ userId, response }) => this.finishAuthentication(userId, response),
+			beginDiscoverableAuthentication: async () => this.beginDiscoverableAuthentication(),
+			finishDiscoverableAuthentication: async ({ response }) => this.finishDiscoverableAuthentication(response),
 			listPasskeys: async ({ userId }) => this.listPasskeys(userId),
-			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId)
+			removePasskey: async ({ userId, credentialId }) => this.removePasskey(userId, credentialId),
+			getSecondFactorPreference: async ({ userId }) => this.getSecondFactorPreference(userId),
+			setSecondFactorPreference: async ({ userId, enabled }) => this.setSecondFactorPreference(userId, enabled)
 		};
 		const widgetsProvider = { listWidgets: async () => authWebauthnWidgets };
 		const loginMethodProvider = { getLoginMethods: async () => authWebauthnLoginMethods };
@@ -12505,9 +12615,12 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		if (this.config.origin && this.config.origin.trim()) return this.config.origin.trim().replace(/\/+$/, "");
 		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "http://localhost:4443").replace(/\/+$/, "");
 	}
+	challengeTtlMs() {
+		return (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+	}
 	pruneExpiredChallenges() {
 		const now = Date.now();
-		const ttlMs = (this.config.challengeTtlSec || DEFAULT_CONFIG.challengeTtlSec) * 1e3;
+		const ttlMs = this.challengeTtlMs();
 		for (const [k, v] of this.pending.entries()) if (now - v.createdAt > ttlMs) this.pending.delete(k);
 	}
 	base64urlEncode(bytes) {
@@ -12633,6 +12746,105 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
 		return { verified: true };
 	}
+	/**
+	* Usernameless (discoverable-credential) login — leg 1. Issues
+	* assertion options with an EMPTY `allowCredentials` list so the
+	* browser offers every resident passkey it holds for this RP, and
+	* `userVerification: 'required'` because the passkey is the ONLY
+	* factor (it replaces both username/password and the 2FA leg).
+	* The challenge is stored server-side keyed by its own value and is
+	* NOT bound to any user — `finishDiscoverableAuthentication` resolves
+	* the owner from the asserted credential id.
+	*/
+	async beginDiscoverableAuthentication() {
+		if (!this.store) throw new Error("passkey store unavailable");
+		this.pruneExpiredChallenges();
+		const options = await generateAuthenticationOptions({
+			rpID: this.resolveRpID(),
+			allowCredentials: [],
+			userVerification: "required"
+		});
+		this.pending.set(options.challenge, {
+			challenge: options.challenge,
+			userId: "",
+			kind: "discoverable-authentication",
+			createdAt: Date.now()
+		});
+		return { optionsJSON: options };
+	}
+	/**
+	* Usernameless login — leg 2. Resolves the credential by the
+	* response's credential id, verifies the assertion against the stored
+	* challenge + that credential's public key/counter, and returns the
+	* OWNING userId. Fail-closed: every anomaly returns
+	* `{ verified: false, userId: null }`.
+	*
+	* Replay protection: the pending challenge is consumed (deleted)
+	* BEFORE verification, so an assertion can be spent exactly once.
+	* The TTL is enforced here too — pruning alone only runs on begin
+	* legs, which an attacker controls the timing of.
+	*/
+	async finishDiscoverableAuthentication(response) {
+		if (!this.store) return {
+			verified: false,
+			userId: null
+		};
+		const challenge = this.decodeClientData(response)?.challenge;
+		if (!challenge) return {
+			verified: false,
+			userId: null
+		};
+		const pending = this.pending.get(challenge);
+		if (!pending || pending.kind !== "discoverable-authentication") return {
+			verified: false,
+			userId: null
+		};
+		this.pending.delete(challenge);
+		if (Date.now() - pending.createdAt > this.challengeTtlMs()) return {
+			verified: false,
+			userId: null
+		};
+		const credentialId = typeof response["id"] === "string" ? response["id"] : "";
+		const stored = await this.store.findByCredentialId(credentialId);
+		if (!stored) return {
+			verified: false,
+			userId: null
+		};
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response,
+				expectedChallenge: challenge,
+				expectedRPID: this.resolveRpID(),
+				expectedOrigin: this.resolveOrigin(),
+				requireUserVerification: true,
+				credential: {
+					id: stored.credentialId,
+					publicKey: this.base64urlDecode(stored.publicKey),
+					counter: stored.counter,
+					transports: stored.transports
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Discoverable passkey verification threw", { meta: {
+				credentialId,
+				err: err instanceof Error ? err.message : String(err)
+			} });
+			return {
+				verified: false,
+				userId: null
+			};
+		}
+		if (!verification.verified || !verification.authenticationInfo) return {
+			verified: false,
+			userId: null
+		};
+		await this.store.updateCounter(credentialId, verification.authenticationInfo.newCounter);
+		return {
+			verified: true,
+			userId: stored.userId
+		};
+	}
 	async listPasskeys(userId) {
 		if (!this.store) return [];
 		return (await this.store.findByUserId(userId)).map((r) => ({
@@ -12643,6 +12855,20 @@ var AuthWebauthnAddon = class extends require_dist.BaseAddon {
 			transports: [...r.transports]
 		}));
 	}
+	/**
+	* Second-factor preference (opt-in, default OFF). Enrolling a passkey
+	* only enables passkey-first sign-in; the password login flow demands
+	* the passkey second leg ONLY when this flag is explicitly enabled.
+	*/
+	async getSecondFactorPreference(userId) {
+		if (!this.store) return { enabled: false };
+		return { enabled: await this.store.getSecondFactorPreference(userId) };
+	}
+	async setSecondFactorPreference(userId, enabled) {
+		if (!this.store) throw new Error("passkey store unavailable");
+		await this.store.setSecondFactorPreference(userId, enabled);
+		return { success: true };
+	}
 	async removePasskey(userId, credentialId) {
 		if (!this.store) throw new Error("passkey store unavailable");
 		const existing = await this.store.findByCredentialId(credentialId);