@ccmsg/protocol 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccmsg/protocol",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Wire contract (schema + types + op attribute table) shared by the ccmsg daemon and web UI",
   "license": "MIT",
   "author": "kawaz",

package/src/common/auth.ts

@@ -92,6 +92,13 @@ export const RegisterClaims = Type.Object(
     expires_at: Timestamp,
     /** Names this registration, so it can be spent once. */
     jti: Type.String({ minLength: 1 }),
+    /** The WebAuthn user handle for this subject: sixteen random bytes the
+     * issuing instance settles on once per `sub`. The page creates the
+     * credential against it, the record keeps it, and an assertion that names a
+     * handle is held to it. It is here rather than left to the page because the
+     * authenticator stores it beyond this instance's reach — a second value for
+     * one person would be a second account on their device. */
+    user_id: Base64Url,
     /** What the administrator who issued the URL wrote down about who it was
      * for. Their words, not the holder's — the label the person gives their
      * own device is `device_label` on the record, and the two are worth telling
@@ -131,6 +138,16 @@ export const AuthRegisterArgs = Type.Object({
   /** What the person calls the device they are registering, for their own use
    * when they later read back a list of several. Nothing is decided by it. */
   device_label: Type.Optional(Type.String({ maxLength: 128 })),
+  /** The challenge this registration answers, with the instance that can spend
+   * it — the same pairing an assertion carries, and for the same reason: the
+   * value also sits inside `client_data_json`, but who may consume it does not,
+   * and behind a load balancer the instance that issued it, the one that made
+   * the registration URL and the one receiving this may all be different.
+   *
+   * Omitting it leaves the receiver with a value and no issuer, so it can only
+   * be honoured where the receiver itself holds the challenge; anywhere else
+   * the registration is refused rather than guessed at. */
+  challenge: Type.Optional(AuthChallenge),
   credential: RegistrationCredential,
 });
 export type AuthRegisterArgs = Static<typeof AuthRegisterArgs>;
@@ -232,7 +249,16 @@ export const AuthRefreshResponse = response("auth_refresh", AuthRefreshResult);
  * verification, the record lookup — the receiving instance does itself. */
 export const AuthResolveArgs = Type.Union(
   [
-    Type.Object({ kind: Type.Literal("register"), token: Type.String({ minLength: 1 }) }),
+    Type.Object({
+      kind: Type.Literal("register"),
+      token: Type.String({ minLength: 1 }),
+      /** The digits the person typed, forwarded unchecked. The issuer holds
+       * both the code and the count of attempts against it, so it is the only
+       * one that can refuse a wrong one and retire the URL after enough of
+       * them; a receiver that judged the code itself would let an attacker
+       * spread guesses across instances without any of them counting. */
+      code: Type.String({ pattern: "^[0-9]{6}$" }),
+    }),
     Type.Object({ kind: Type.Literal("challenge"), challenge: Base64Url }),
   ],
   { $id: "AuthResolveArgs" },
@@ -290,8 +316,17 @@ export const CredentialRecord = Type.Object(
     credential_id: Base64Url,
     /** The public key, COSE-encoded. */
     public_key: Base64Url,
-    /** The `user.id` this credential was created against. */
+    /** The `user_id` of the registration's claims, which is what the credential
+     * was created against and what an assertion naming a handle is checked
+     * against. */
     user_handle: Base64Url,
+    /** The relying party this credential was created under, as the claims of
+     * the registration that made it stated. Written by the registration and not
+     * derived later: a passkey only answers for the domain it was made under,
+     * so an assertion's `rpIdHash` is checked against this and not against
+     * whatever the endpoint being reached happens to be. Absent only on a
+     * record written before the field existed. */
+    rp_id: Type.Optional(Type.String({ minLength: 1 })),
     /** The authenticator's counter, when it keeps one. Synced passkeys report
      * zero forever, so only a pair of non-zero readings says anything, and a
      * reading below the last one is a refusal. */

package/src/common/hello.ts

@@ -92,8 +92,10 @@ export const InstanceInfo = Type.Object(
     id: Type.Optional(InstanceId),
     /** Where it is dialed. An attribute of the instance like the host below:
      * it is what a peer connects to and authenticates against, and it may
-     * change under a fixed `id` when the instance moves. */
-    endpoint: Endpoint,
+     * change under a fixed `id` when the instance moves. Absent for the same
+     * reason it is absent from the reply's own `endpoint`: an instance in no
+     * mesh has no URL to be dialed at, including on its own line. */
+    endpoint: Type.Optional(Endpoint),
     /** The host it runs on. An attribute of the instance, not its identity —
      * one host may run several instances. */
     host: Type.String({ minLength: 1 }),