@casual-simulation/aux-records 3.2.16 → 3.2.17

package/RecordsServer.js

@@ -328,6 +328,30 @@ export class RecordsServer {
                 request.path === '/api/v2/register/privo') {
                 return formatResponse(request, yield this._registerPrivo(request), this._allowedAccountOrigins);
             }
+            else if (request.method === 'GET' &&
+                request.path === '/api/v2/webauthn/register/options') {
+                return formatResponse(request, yield this._webAuthnRegisterOptions(request), true);
+            }
+            else if (request.method === 'POST' &&
+                request.path === '/api/v2/webauthn/register') {
+                return formatResponse(request, yield this._webAuthnRegister(request), true);
+            }
+            else if (request.method === 'GET' &&
+                request.path === '/api/v2/webauthn/login/options') {
+                return formatResponse(request, yield this._webAuthnLoginOptions(request), true);
+            }
+            else if (request.method === 'POST' &&
+                request.path === '/api/v2/webauthn/login') {
+                return formatResponse(request, yield this._webAuthnLogin(request), true);
+            }
+            else if (request.method === 'GET' &&
+                request.path === '/api/v2/webauthn/authenticators') {
+                return formatResponse(request, yield this._listWebAuthnAuthenticators(request), this._allowedAccountOrigins);
+            }
+            else if (request.method === 'POST' &&
+                request.path === '/api/v2/webauthn/authenticators/delete') {
+                return formatResponse(request, yield this._deleteWebAuthnAuthenticator(request), this._allowedAccountOrigins);
+            }
             else if (request.method === 'POST' &&
                 request.path === '/api/v2/meet/token') {
                 return formatResponse(request, yield this._postMeetToken(request), this._allowedApiOrigins);
@@ -2756,6 +2780,196 @@ export class RecordsServer {
             return returnResult(result);
         });
     }
+    _webAuthnRegisterOptions(request) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            // We don't validate origin because the AuthController will validate it based on the allowed
+            // relying parties.
+            const validation = yield this._validateSessionKey(request);
+            if (validation.success === false) {
+                if (validation.errorCode === 'no_session_key') {
+                    return returnResult(NOT_LOGGED_IN_RESULT);
+                }
+                return returnResult(validation);
+            }
+            const result = yield this._auth.requestWebAuthnRegistration({
+                userId: validation.userId,
+                originOrHost: (_b = (_a = request.headers.origin) !== null && _a !== void 0 ? _a : request.headers['x-dev-proxy-host']) !== null && _b !== void 0 ? _b : request.headers.host,
+            });
+            return returnResult(result);
+        });
+    }
+    _webAuthnRegister(request) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            // We don't validate origin because the AuthController will validate it based on the allowed
+            // relying parties.
+            if (typeof request.body !== 'string') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const jsonResult = tryParseJson(request.body);
+            if (!jsonResult.success || typeof jsonResult.value !== 'object') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const schema = z.object({
+                response: z.object({
+                    id: z.string().nonempty(),
+                    rawId: z.string().nonempty(),
+                    response: z.object({
+                        clientDataJSON: z.string().nonempty(),
+                        attestationObject: z.string().nonempty(),
+                        authenticatorData: z.string().nonempty().optional(),
+                        transports: z.array(z.string().min(1).max(64)).optional(),
+                        publicKeyAlgorithm: z.number().optional(),
+                        publicKey: z.string().nonempty().optional(),
+                    }),
+                    authenticatorAttachment: z
+                        .enum(['cross-platform', 'platform'])
+                        .optional(),
+                    clientExtensionResults: z.object({
+                        appid: z.boolean().optional(),
+                        credProps: z
+                            .object({
+                            rk: z.boolean().optional(),
+                        })
+                            .optional(),
+                        hmacCreateSecret: z.boolean().optional(),
+                    }),
+                    type: z.literal('public-key'),
+                }),
+            });
+            const parseResult = schema.safeParse(jsonResult.value);
+            if (parseResult.success === false) {
+                return returnZodError(parseResult.error);
+            }
+            const { response } = parseResult.data;
+            const validation = yield this._validateSessionKey(request);
+            if (validation.success === false) {
+                if (validation.errorCode === 'no_session_key') {
+                    return returnResult(NOT_LOGGED_IN_RESULT);
+                }
+                return returnResult(validation);
+            }
+            const result = yield this._auth.completeWebAuthnRegistration({
+                userId: validation.userId,
+                response: response,
+                originOrHost: (_b = (_a = request.headers.origin) !== null && _a !== void 0 ? _a : request.headers['x-dev-proxy-host']) !== null && _b !== void 0 ? _b : request.headers.host,
+                userAgent: request.headers['user-agent'],
+            });
+            return returnResult(result);
+        });
+    }
+    _webAuthnLoginOptions(request) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            // We don't validate origin because the AuthController will validate it based on the allowed
+            // relying parties.
+            const result = yield this._auth.requestWebAuthnLogin({
+                ipAddress: request.ipAddress,
+                originOrHost: (_b = (_a = request.headers.origin) !== null && _a !== void 0 ? _a : request.headers['x-dev-proxy-host']) !== null && _b !== void 0 ? _b : request.headers.host,
+            });
+            return returnResult(result);
+        });
+    }
+    _webAuthnLogin(request) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            // We don't validate origin because the AuthController will validate it based on the allowed
+            // relying parties.
+            if (typeof request.body !== 'string') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const jsonResult = tryParseJson(request.body);
+            if (!jsonResult.success || typeof jsonResult.value !== 'object') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const schema = z.object({
+                requestId: z.string().nonempty(),
+                response: z.object({
+                    id: z.string().nonempty(),
+                    rawId: z.string().nonempty(),
+                    response: z.object({
+                        clientDataJSON: z.string().nonempty(),
+                        authenticatorData: z.string().nonempty(),
+                        signature: z.string().nonempty(),
+                        userHandle: z.string().nonempty().optional(),
+                    }),
+                    authenticatorAttachment: z
+                        .enum(['cross-platform', 'platform'])
+                        .optional(),
+                    clientExtensionResults: z.object({
+                        appid: z.boolean().optional(),
+                        credProps: z
+                            .object({
+                            rk: z.boolean().optional(),
+                        })
+                            .optional(),
+                        hmacCreateSecret: z.boolean().optional(),
+                    }),
+                    type: z.literal('public-key'),
+                }),
+            });
+            const parseResult = schema.safeParse(jsonResult.value);
+            if (parseResult.success === false) {
+                return returnZodError(parseResult.error);
+            }
+            const { response, requestId } = parseResult.data;
+            const result = yield this._auth.completeWebAuthnLogin({
+                requestId: requestId,
+                ipAddress: request.ipAddress,
+                response: response,
+                originOrHost: (_b = (_a = request.headers.origin) !== null && _a !== void 0 ? _a : request.headers['x-dev-proxy-host']) !== null && _b !== void 0 ? _b : request.headers.host,
+            });
+            return returnResult(result);
+        });
+    }
+    _listWebAuthnAuthenticators(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!validateOrigin(request, this._allowedAccountOrigins)) {
+                return returnResult(INVALID_ORIGIN_RESULT);
+            }
+            const validation = yield this._validateSessionKey(request);
+            if (validation.success === false) {
+                if (validation.errorCode === 'no_session_key') {
+                    return returnResult(NOT_LOGGED_IN_RESULT);
+                }
+                return returnResult(validation);
+            }
+            const result = yield this._auth.listUserAuthenticators(validation.userId);
+            return returnResult(result);
+        });
+    }
+    _deleteWebAuthnAuthenticator(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!validateOrigin(request, this._allowedAccountOrigins)) {
+                return returnResult(INVALID_ORIGIN_RESULT);
+            }
+            if (typeof request.body !== 'string') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const jsonResult = tryParseJson(request.body);
+            if (!jsonResult.success || typeof jsonResult.value !== 'object') {
+                return returnResult(UNACCEPTABLE_REQUEST_RESULT_MUST_BE_JSON);
+            }
+            const schema = z.object({
+                authenticatorId: z.string().nonempty(),
+            });
+            const parseResult = schema.safeParse(jsonResult.value);
+            if (parseResult.success === false) {
+                return returnZodError(parseResult.error);
+            }
+            const { authenticatorId } = parseResult.data;
+            const validation = yield this._validateSessionKey(request);
+            if (validation.success === false) {
+                if (validation.errorCode === 'no_session_key') {
+                    return returnResult(NOT_LOGGED_IN_RESULT);
+                }
+                return returnResult(validation);
+            }
+            const result = yield this._auth.deleteUserAuthenticator(validation.userId, authenticatorId);
+            return returnResult(result);
+        });
+    }
     _postCompleteLogin(request) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!validateOrigin(request, this._allowedAccountOrigins)) {