@cogenta/auth 0.1.0

package/dist/webauthn.d.ts

@@ -0,0 +1,40 @@
+import type { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { WebAuthnCredentialData } from './credentials.js';
+/**
+ * WebAuthn is a dependency and TOTP is not, for the same reason the GraphQL
+ * executor is a dependency and the render cache is not: attestation
+ * verification — COSE key parsing, signature checks per algorithm, origin and
+ * RP ID validation — is a large, security-relevant surface every authenticator
+ * and browser expects to behave exactly like the spec, and a homegrown subset
+ * is a liability wearing the shape of a feature. `@simplewebauthn/server` is
+ * MIT, pure JS (no native code, rule R10 is clean), and is what the ecosystem
+ * has converged on.
+ *
+ * The ceremony is two requests apart — options generated, then a response
+ * verified — and needs a challenge to survive the gap. Storage for that
+ * challenge is deliberately not this module's job: it is single-use and lives
+ * seconds, which is a session or an in-memory cache at the API layer, not a
+ * database table alongside credentials that live for years.
+ */
+export interface WebAuthnConfig {
+    readonly relyingPartyName: string;
+    /** The domain, no scheme and no port — `example.com`, not `https://example.com`. */
+    readonly relyingPartyId: string;
+    readonly origin: string;
+}
+export interface RegistrationOptions {
+    readonly options: PublicKeyCredentialCreationOptionsJSON;
+    readonly challenge: string;
+}
+export declare function beginWebAuthnRegistration(config: WebAuthnConfig, userId: string, userName: string, existing: readonly WebAuthnCredentialData[]): Promise<RegistrationOptions>;
+export declare function completeWebAuthnRegistration(config: WebAuthnConfig, response: RegistrationResponseJSON, expectedChallenge: string, label: string | undefined): Promise<WebAuthnCredentialData>;
+export interface AuthenticationOptions {
+    readonly options: PublicKeyCredentialRequestOptionsJSON;
+    readonly challenge: string;
+}
+export declare function beginWebAuthnAuthentication(config: WebAuthnConfig, allowed: readonly WebAuthnCredentialData[]): Promise<AuthenticationOptions>;
+export interface WebAuthnAuthenticationResult {
+    readonly newCounter: number;
+}
+export declare function completeWebAuthnAuthentication(config: WebAuthnConfig, response: AuthenticationResponseJSON, expectedChallenge: string, credential: WebAuthnCredentialData): Promise<WebAuthnAuthenticationResult>;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,0BAA0B,EAE1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAO/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9D;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,sBAAsB,CAAC,CA4BjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,SAAS,sBAAsB,EAAE,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAAC,4BAA4B,CAAC,CA0BvC"}

package/dist/webauthn.js

@@ -0,0 +1,81 @@
+import { CogentaError } from '@cogenta/core';
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
+export async function beginWebAuthnRegistration(config, userId, userName, existing) {
+    const options = await generateRegistrationOptions({
+        rpName: config.relyingPartyName,
+        rpID: config.relyingPartyId,
+        userID: new TextEncoder().encode(userId),
+        userName,
+        attestationType: 'none', // A site does not need to know *which* authenticator, only that one exists.
+        excludeCredentials: existing.map((credential) => ({
+            id: credential.credentialId,
+            transports: credential.transports,
+        })),
+        authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
+    });
+    return { options, challenge: options.challenge };
+}
+export async function completeWebAuthnRegistration(config, response, expectedChallenge, label) {
+    // A malformed or forged response does not always fail through `verified:
+    // false` — the library also throws on input it cannot even parse (wrong
+    // shape, bad CBOR). Both paths mean the same thing to a caller: this
+    // registration did not succeed, as a typed error rather than a raw one.
+    const result = await verifyRegistrationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: config.origin,
+        expectedRPID: config.relyingPartyId,
+    }).catch(() => null);
+    if (result === null || !result.verified) {
+        throw new CogentaError({
+            code: 'AUTH_WEBAUTHN_FAILED',
+            message: 'The authenticator response could not be verified.',
+            hint: 'Try registering the passkey again. If this keeps happening, the device clock or the site origin configuration may be wrong.',
+        });
+    }
+    const { credential } = result.registrationInfo;
+    return {
+        credentialId: credential.id,
+        publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+        counter: credential.counter,
+        transports: credential.transports ?? [],
+        label,
+    };
+}
+export async function beginWebAuthnAuthentication(config, allowed) {
+    const options = await generateAuthenticationOptions({
+        rpID: config.relyingPartyId,
+        userVerification: 'preferred',
+        allowCredentials: allowed.map((credential) => ({
+            id: credential.credentialId,
+            transports: credential.transports,
+        })),
+    });
+    return { options, challenge: options.challenge };
+}
+export async function completeWebAuthnAuthentication(config, response, expectedChallenge, credential) {
+    // A counter that has not advanced since the last successful use is what a
+    // cloned authenticator looks like: refusing it is what makes cloning
+    // pointless rather than merely detectable after the fact.
+    const result = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: config.origin,
+        expectedRPID: config.relyingPartyId,
+        credential: {
+            id: credential.credentialId,
+            publicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64url')),
+            counter: credential.counter,
+            transports: credential.transports,
+        },
+    }).catch(() => null);
+    if (result === null || !result.verified) {
+        throw new CogentaError({
+            code: 'AUTH_WEBAUTHN_FAILED',
+            message: 'The passkey response could not be verified.',
+            hint: 'Try again. If the passkey was moved to a new device or cloned, it will be refused on purpose — register a new one.',
+        });
+    }
+    return { newCounter: result.authenticationInfo.newCounter };
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAQ5C,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAA;AAgC/B,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,QAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC,gBAAgB;QAC/B,IAAI,EAAE,MAAM,CAAC,cAAc;QAC3B,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,QAAQ;QACR,eAAe,EAAE,MAAM,EAAE,4EAA4E;QACrG,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAChD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,UAAU,EAAE,UAAU,CAAC,UAA4C;SACpE,CAAC,CAAC;QACH,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE;KACpF,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAsB,EACtB,QAAkC,EAClC,iBAAyB,EACzB,KAAyB;IAEzB,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY,EAAE,MAAM,CAAC,cAAc;KACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEpB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,6HAA6H;SACpI,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAA;IAC9C,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE;QACvC,KAAK;KACN,CAAA;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAsB,EACtB,OAA0C;IAE1C,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,MAAM,CAAC,cAAc;QAC3B,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7C,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,UAAU,EAAE,UAAU,CAAC,UAA4C;SACpE,CAAC,CAAC;KACJ,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;AAClD,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAsB,EACtB,QAAoC,EACpC,iBAAyB,EACzB,UAAkC;IAElC,0EAA0E;IAC1E,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY,EAAE,MAAM,CAAC,cAAc;QACnC,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACzE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,UAAU,CAAC,UAA4C;SACpE;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEpB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6CAA6C;YACtD,IAAI,EAAE,oHAAoH;SAC3H,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAA;AAC7D,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@cogenta/auth",
+  "version": "0.1.0",
+  "description": "Identity, sessions and credentials: password, TOTP and WebAuthn, plus the append-only audit log.",
+  "license": "MPL-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.11.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cogenta-cms/cogenta.git",
+    "directory": "packages/auth"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.typecheck.json",
+    "test": "vitest run --passWithNoTests",
+    "test:integration": "vitest run --config vitest.integration.config.ts --passWithNoTests"
+  },
+  "dependencies": {
+    "@cogenta/core": "workspace:*",
+    "@cogenta/schema": "workspace:*",
+    "@simplewebauthn/server": "catalog:"
+  },
+  "devDependencies": {
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}