@constructive-io/graphql-server 5.28.9 → 5.29.0

package/middleware/graphile.js

@@ -7,7 +7,6 @@ exports.clearInFlightMap = clearInFlightMap;
 require("./types"); // for Request type
 const errors_1 = require("@constructive-io/errors");
 const express_context_1 = require("@constructive-io/express-context");
-const env_1 = require("@pgpmjs/env");
 const logger_1 = require("@pgpmjs/logger");
 const graphile_cache_1 = require("graphile-cache");
 const graphile_function_bindings_1 = require("graphile-function-bindings");
@@ -20,10 +19,10 @@ const graphql_response_1 = require("../errors/graphql-response");
 const auth_cookie_plugin_1 = require("../plugins/auth-cookie-plugin");
 const error_events_plugin_1 = require("../plugins/error-events-plugin");
 const request_protection_plugin_1 = require("../plugins/request-protection-plugin");
+const webauthn_plugin_1 = require("../plugins/webauthn-plugin");
+const format_error_1 = require("./format-error");
 const graphile_introspection_1 = require("./graphile-introspection");
-const mask_error_1 = require("./mask-error");
 const graphile_build_stats_1 = require("./observability/graphile-build-stats");
-const isDev = () => (0, env_1.getNodeEnv)() === 'development';
 // =============================================================================
 // Single-Flight Pattern: In-Flight Tracking
 // =============================================================================
@@ -63,7 +62,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await (0, graphile_introspection_1.makeIntrospectionWiring)(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = (0, graphile_settings_1.createGrafastCacheLimitsPreset)(graphileOptions?.grafastCache);
@@ -83,6 +82,9 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
             auth_cookie_plugin_1.AuthCookiePlugin,
             request_protection_plugin_1.RequestProtectionPlugin,
             (0, error_events_plugin_1.createErrorEventsPlugin)(pool),
+            // Only when the tenant provisioned the WebAuthn module; the policy
+            // itself is read per request from `req.api.webauthnSettings`.
+            ...(webauthn ? [webauthn_plugin_1.WebauthnPlugin] : []),
             // Only registered when the compute module is provisioned for this
             // database — all schema/table names come from the constructive
             // metaschema (express-context compute module loader); the plugin has
@@ -109,10 +111,10 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
             graphiqlPath: '/graphiql',
             graphiql: true,
             graphiqlOnGraphQLGET: false,
-            maskError: mask_error_1.maskError
+            maskError: format_error_1.formatError
         },
         grafast: {
-            explain: process.env.NODE_ENV === 'development',
+            explain: graphileOptions?.explain === true,
             context: (requestContext) => {
                 // In grafserv/express/v4, the request is available at requestContext.expressv4.req
                 const req = requestContext?.expressv4?.req;
@@ -315,7 +317,7 @@ const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute);
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return (0, graphile_build_stats_1.observeGraphileBuild)({
                     cacheKey: key,
                     serviceKey: key,
@@ -349,7 +351,7 @@ const graphile = (opts) => {
             log.error(`${label} PostGraphile middleware error`, e);
             if (!res.headersSent) {
                 (0, graphql_response_1.respondWithGraphQLError)(res, errors_1.errors.INTERNAL_FAILURE({
-                    details: isDev() ? e?.message ?? String(e) : 'An unexpected error occurred'
+                    details: e?.message ?? String(e)
                 }));
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.28.9",
+  "version": "5.29.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -30,8 +30,7 @@
     "debug:heap:capture": "node scripts/capture-heap-snapshot.mjs",
     "lint": "eslint . --fix",
     "test": "jest --passWithNoTests",
-    "test:watch": "jest --watch",
-    "bucket:create": "ts-node src/scripts/create-bucket.ts"
+    "test:watch": "jest --watch"
   },
   "keywords": [
     "server",
@@ -43,19 +42,21 @@
   "dependencies": {
     "@agentic-kit/ollama": "2.15.0",
     "@constructive-io/csrf": "^0.30.1",
-    "@constructive-io/errors": "^0.23.0",
-    "@constructive-io/express-context": "^0.33.6",
-    "@constructive-io/graphql-env": "^3.34.6",
-    "@constructive-io/graphql-types": "^3.33.6",
+    "@constructive-io/errors": "^0.24.0",
+    "@constructive-io/express-context": "^0.33.7",
+    "@constructive-io/graphql-env": "^3.35.0",
+    "@constructive-io/graphql-types": "^3.34.0",
     "@constructive-io/llm-env": "^0.15.0",
-    "@constructive-io/query-builder": "^3.16.7",
+    "@constructive-io/query-builder": "^3.16.8",
     "@constructive-io/s3-utils": "^2.34.0",
     "@constructive-io/url-domains": "^2.31.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.46.3",
+    "@pgpmjs/env": "^2.47.0",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.6",
-    "@pgpmjs/types": "^2.56.3",
+    "@pgpmjs/server-utils": "^3.29.7",
+    "@pgpmjs/types": "^2.57.0",
+    "@pgsql/quotes": "^18.2.4",
+    "@simplewebauthn/server": "13.3.2",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -64,17 +65,18 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.14.6",
+    "graphile-cache": "^4.14.7",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.17.7",
-    "graphile-scoped-introspection": "^0.4.7",
-    "graphile-settings": "^6.24.8",
+    "graphile-function-bindings": "^1.17.8",
+    "graphile-plugin-utils": "^1.13.0",
+    "graphile-scoped-introspection": "^0.4.8",
+    "graphile-settings": "^6.25.0",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.6",
+    "pg-cache": "^3.29.7",
     "pg-env": "^1.32.0",
     "pg-query-context": "^2.31.0",
     "pg-sql2": "5.0.1",
@@ -91,11 +93,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.17.7",
+    "graphile-test": "5.17.8",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "a95137c03998f4ef18aaba770bdeb598077e5b51"
+  "gitHead": "1f3501d518e175803a1a3372cf9249922d82bfe5"
 }

package/plugins/auth-cookie-plugin.js

@@ -70,6 +70,7 @@ const SIGN_IN_MUTATIONS = new Set([
     'completeMfaChallenge',
     'signInOneTimeToken',
     'signInCrossOrigin',
+    'webauthnSignInFinish',
 ]);
 /**
  * Auth mutations that should clear the session cookie.

package/plugins/error-events-plugin.js

@@ -6,17 +6,17 @@ const logger_1 = require("@pgpmjs/logger");
 const graphql_1 = require("graphql");
 const pg_1 = require("pg");
 const pg_query_context_1 = require("pg-query-context");
-const mask_error_1 = require("../middleware/mask-error");
+const format_error_1 = require("../middleware/format-error");
 const log = new logger_1.Logger('error-events');
 const getExpressRequest = (requestContext) => requestContext?.expressv4?.req;
 /**
  * The first structured, public-classified registry code among the errors.
- * Internal/unknown errors are bugs, not refusals: they are masked and logged
- * by `maskError` and never recorded as tenant events.
+ * Internal/unknown errors are bugs, not refusals: they are logged by
+ * `formatError` and never recorded as tenant events.
  */
 const refusalCode = (errors) => {
     for (const error of errors ?? []) {
-        const { code, class: errorClass } = (0, mask_error_1.normalizeError)(error);
+        const { code, class: errorClass } = (0, format_error_1.normalizeError)(error);
         if (code && errorClass === 'public')
             return code;
     }

package/plugins/webauthn-plugin.d.ts

@@ -0,0 +1,3 @@
+import '../middleware/types';
+import type { GraphileConfig } from 'graphile-config';
+export declare const WebauthnPlugin: GraphileConfig.Plugin;

package/plugins/webauthn-plugin.js

@@ -0,0 +1,395 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebauthnPlugin = void 0;
+require("../middleware/types");
+const quotes_1 = require("@pgsql/quotes");
+const server_1 = require("@simplewebauthn/server");
+const helpers_1 = require("@simplewebauthn/server/helpers");
+const grafast_1 = require("grafast");
+const graphile_plugin_utils_1 = require("graphile-plugin-utils");
+const graphile_utils_1 = require("graphile-utils");
+const CONTEXT_KEY = 'constructiveWebauthn';
+const REGISTER_CHALLENGE = 'webauthn_register_challenge';
+const SIGN_IN_CHALLENGE = 'webauthn_sign_in_challenge';
+const MAX_NAME_LENGTH = 256;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const getExpressRequest = (requestContext) => requestContext?.expressv4?.req;
+const fail = (code, message) => {
+    const err = new Error(message);
+    err.extensions = { code };
+    throw err;
+};
+/** Apply the request's settings transaction-locally, optionally overriding its role. */
+const applySettings = async (tx, pgSettings, role) => {
+    const entries = Object.entries(pgSettings ?? {}).filter(([key]) => !role || key !== 'role');
+    if (role)
+        entries.push(['role', role]);
+    if (entries.length === 0)
+        return;
+    await tx.query({
+        text: 'SELECT set_config(el->>0, el->>1, true) FROM json_array_elements($1::json) el',
+        values: [JSON.stringify(entries)]
+    });
+};
+const withRequestLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
+    await applySettings(tx, pgSettings);
+    return cb(tx);
+}));
+const withVerifierLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
+    await applySettings(tx, pgSettings, graphile_plugin_utils_1.SYSTEM_LANE_ROLE);
+    return cb(tx);
+}));
+const procedure = (settings, name) => quotes_1.QuoteUtils.quoteQualifiedIdentifier(settings.schema, name);
+const requireSettings = (ctx) => {
+    const settings = ctx?.settings;
+    if (!settings)
+        throw new Error('WebauthnPlugin is loaded but the request resolved no webauthnSettings');
+    return settings;
+};
+const requireUserId = (pgSettings) => {
+    const userId = pgSettings?.['jwt.claims.user_id'];
+    if (!userId)
+        fail('UNAUTHENTICATED', 'Passkey registration requires a signed-in user');
+    return userId;
+};
+const payloadObject = (operation, value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${operation} returned no payload`);
+    }
+    return value;
+};
+const payloadString = (operation, payload, key) => {
+    const value = payload[key];
+    if (typeof value !== 'string' || !value)
+        throw new Error(`${operation} returned no ${key}`);
+    return value;
+};
+const credentialDescriptors = (operation, value) => {
+    if (value === null || value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new Error(`${operation} returned invalid credentials`);
+    return value.map((entry) => {
+        const descriptor = payloadObject(operation, entry);
+        const transports = descriptor.transports ?? [];
+        if (!Array.isArray(transports) || !transports.every((t) => typeof t === 'string')) {
+            throw new Error(`${operation} returned invalid credential transports`);
+        }
+        return {
+            id: payloadString(operation, descriptor, 'id'),
+            transports: transports
+        };
+    });
+};
+const requireJsonObject = (value, field) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        fail('BAD_USER_INPUT', `${field} must be a WebAuthn credential JSON object`);
+    }
+    if (JSON.stringify(value).length > MAX_RESPONSE_BYTES) {
+        fail('BAD_USER_INPUT', `${field} is too large`);
+    }
+    return value;
+};
+const challengeMatches = async (tx, settings, challengeName, challenge, challengeId) => {
+    const { rows } = await tx.query({
+        text: `SELECT ${procedure(settings, 'webauthn_challenge_matches')}($1, $2, $3::uuid) AS matches`,
+        values: [challengeName, challenge, challengeId]
+    });
+    return rows[0]?.matches === true;
+};
+/**
+ * SimpleWebAuthn reports a response that fails verification by throwing; give
+ * that a public code. A database error from the challenge lookup inside it
+ * keeps its own.
+ */
+const verifying = async (verify) => {
+    try {
+        return await verify();
+    }
+    catch (err) {
+        if (typeof err?.code === 'string' && err.severity)
+            throw err;
+        return fail('WEBAUTHN_VERIFICATION_FAILED', err?.message ?? String(err));
+    }
+};
+const userVerification = (settings) => settings.requireUserVerification ? 'required' : 'preferred';
+const lookupCurrentUser = async (tx, req) => {
+    const surface = await req?.constructive?.useModule('authSurface');
+    if (!surface)
+        return { username: null, displayName: null };
+    const { rows } = await tx.query({
+        text: `SELECT username, display_name FROM ${quotes_1.QuoteUtils.quoteQualifiedIdentifier(surface.publicSchema, 'current_user')}()`
+    });
+    const row = rows[0];
+    return {
+        username: typeof row?.username === 'string' ? row.username : null,
+        displayName: typeof row?.display_name === 'string' ? row.display_name : null
+    };
+};
+const resolveArgs = (fieldArgs) => (0, grafast_1.object)({
+    input: fieldArgs.getRaw('input'),
+    withPgClient: (0, grafast_1.context)().get('withPgClient'),
+    pgSettings: (0, grafast_1.context)().get('pgSettings'),
+    webauthn: (0, grafast_1.context)().get(CONTEXT_KEY)
+});
+exports.WebauthnPlugin = {
+    ...(0, graphile_utils_1.extendSchema)(() => ({
+        typeDefs: (0, graphile_utils_1.gql) `
+      input WebauthnRegisterBeginInput {
+        clientMutationId: String
+      }
+
+      type WebauthnRegisterBeginPayload {
+        """PublicKeyCredentialCreationOptionsJSON for navigator.credentials.create()."""
+        options: JSON!
+        """The user handle to echo back to webauthnRegisterFinish."""
+        webauthnUserId: String!
+      }
+
+      input WebauthnRegisterFinishInput {
+        """The browser's RegistrationResponseJSON."""
+        response: JSON!
+        webauthnUserId: String!
+        """A label for the passkey."""
+        name: String
+      }
+
+      type WebauthnRegisterFinishPayload {
+        credentialId: String!
+      }
+
+      input WebauthnSignInBeginInput {
+        clientMutationId: String
+      }
+
+      type WebauthnSignInBeginPayload {
+        """PublicKeyCredentialRequestOptionsJSON for navigator.credentials.get()."""
+        options: JSON!
+        """Names the pending challenge; echo it back to webauthnSignInFinish."""
+        challengeId: UUID!
+      }
+
+      input WebauthnSignInFinishInput {
+        """The browser's AuthenticationResponseJSON."""
+        response: JSON!
+        challengeId: UUID!
+      }
+
+      type WebauthnSignInFinishPayload {
+        accessToken: String!
+        accessTokenExpiresAt: Datetime!
+        userId: UUID!
+      }
+
+      extend type Mutation {
+        """Begin registering a passkey for the signed-in user."""
+        webauthnRegisterBegin(input: WebauthnRegisterBeginInput): WebauthnRegisterBeginPayload
+        """Verify the browser's registration response and store the passkey."""
+        webauthnRegisterFinish(input: WebauthnRegisterFinishInput!): WebauthnRegisterFinishPayload
+        """Begin a passkey sign-in (discoverable when signed out)."""
+        webauthnSignInBegin(input: WebauthnSignInBeginInput): WebauthnSignInBeginPayload
+        """Verify the browser's assertion and mint a session."""
+        webauthnSignInFinish(input: WebauthnSignInFinishInput!): WebauthnSignInFinishPayload
+      }
+    `,
+        plans: {
+            Mutation: {
+                webauthnRegisterBegin(_$mutation, fieldArgs) {
+                    return (0, grafast_1.lambda)(resolveArgs(fieldArgs), async ({ withPgClient, pgSettings, webauthn }) => {
+                        const settings = requireSettings(webauthn);
+                        const userId = requireUserId(pgSettings);
+                        const { registration, user } = await withRequestLane(withPgClient, pgSettings, async (tx) => {
+                            const { rows } = await tx.query({
+                                text: `SELECT ${procedure(settings, 'webauthn_begin_registration')}($1::uuid) AS result`,
+                                values: [userId]
+                            });
+                            const payload = payloadObject('webauthn_begin_registration', rows[0]?.result);
+                            return {
+                                registration: {
+                                    challenge: payloadString('webauthn_begin_registration', payload, 'challenge'),
+                                    webauthnUserId: payloadString('webauthn_begin_registration', payload, 'webauthn_user_id'),
+                                    excludeCredentials: credentialDescriptors('webauthn_begin_registration', payload.excludeCredentials)
+                                },
+                                user: await lookupCurrentUser(tx, webauthn?.req)
+                            };
+                        });
+                        const authenticatorSelection = {
+                            residentKey: settings.residentKey,
+                            userVerification: userVerification(settings)
+                        };
+                        const options = await (0, server_1.generateRegistrationOptions)({
+                            // The tenant mints the challenge already base64url-encoded; a
+                            // string challenge would be re-encoded as UTF-8 and the browser
+                            // would echo a value the tenant never stored.
+                            challenge: helpers_1.isoBase64URL.toBuffer(registration.challenge),
+                            rpID: settings.rpId,
+                            rpName: settings.rpName,
+                            attestationType: settings.attestationType,
+                            authenticatorSelection,
+                            excludeCredentials: registration.excludeCredentials,
+                            timeout: settings.challengeExpirySeconds * 1000,
+                            userID: new TextEncoder().encode(registration.webauthnUserId),
+                            userName: user.username ?? userId,
+                            userDisplayName: user.displayName ?? user.username ?? userId
+                        });
+                        return { options, webauthnUserId: registration.webauthnUserId };
+                    });
+                },
+                webauthnRegisterFinish(_$mutation, fieldArgs) {
+                    return (0, grafast_1.lambda)(resolveArgs(fieldArgs), async ({ input, withPgClient, pgSettings, webauthn }) => {
+                        const settings = requireSettings(webauthn);
+                        const userId = requireUserId(pgSettings);
+                        const response = requireJsonObject(input?.response, 'response');
+                        const webauthnUserId = input?.webauthnUserId;
+                        const name = input?.name ?? null;
+                        if (name !== null && name.length > MAX_NAME_LENGTH) {
+                            fail('BAD_USER_INPUT', `name must be at most ${MAX_NAME_LENGTH} characters`);
+                        }
+                        const verified = await withVerifierLane(withPgClient, pgSettings, (tx) => verifying(() => (0, server_1.verifyRegistrationResponse)({
+                            response,
+                            expectedChallenge: (challenge) => challengeMatches(tx, settings, REGISTER_CHALLENGE, challenge, null),
+                            expectedOrigin: settings.originAllowlist,
+                            expectedRPID: settings.rpId,
+                            requireUserVerification: settings.requireUserVerification
+                        })));
+                        if (!verified.verified)
+                            fail('WEBAUTHN_VERIFICATION_FAILED', 'WebAuthn registration verification failed');
+                        const { credential, credentialDeviceType, credentialBackedUp } = verified.registrationInfo;
+                        const credentialId = await withVerifierLane(withPgClient, pgSettings, async (tx) => {
+                            const { rows } = await tx.query({
+                                text: `SELECT ${procedure(settings, 'webauthn_finish_registration')}(
+                  $1, $2, $3, $4, $5, $6, $7, $8, $9, $10
+                ) AS id`,
+                                values: [
+                                    credential.id,
+                                    Buffer.from(credential.publicKey),
+                                    credential.counter,
+                                    credential.transports ?? [],
+                                    credentialDeviceType,
+                                    // SimpleWebAuthn reports backup eligibility through the
+                                    // device type; backed-up is the separate current-state flag.
+                                    credentialDeviceType === 'multiDevice',
+                                    credentialBackedUp,
+                                    webauthnUserId,
+                                    userId,
+                                    name
+                                ]
+                            });
+                            return payloadString('webauthn_finish_registration', rows[0] ?? {}, 'id');
+                        });
+                        return { credentialId };
+                    });
+                },
+                webauthnSignInBegin(_$mutation, fieldArgs) {
+                    return (0, grafast_1.lambda)(resolveArgs(fieldArgs), async ({ withPgClient, pgSettings, webauthn }) => {
+                        const settings = requireSettings(webauthn);
+                        const signIn = await withRequestLane(withPgClient, pgSettings, async (tx) => {
+                            const { rows } = await tx.query({
+                                text: `SELECT ${procedure(settings, 'webauthn_begin_sign_in')}($1::uuid) AS result`,
+                                values: [pgSettings?.['jwt.claims.user_id'] ?? null]
+                            });
+                            const payload = payloadObject('webauthn_begin_sign_in', rows[0]?.result);
+                            return {
+                                challenge: payloadString('webauthn_begin_sign_in', payload, 'challenge'),
+                                challengeId: payloadString('webauthn_begin_sign_in', payload, 'challengeId'),
+                                allowCredentials: credentialDescriptors('webauthn_begin_sign_in', payload.allowCredentials)
+                            };
+                        });
+                        const options = await (0, server_1.generateAuthenticationOptions)({
+                            challenge: helpers_1.isoBase64URL.toBuffer(signIn.challenge),
+                            rpID: settings.rpId,
+                            allowCredentials: signIn.allowCredentials,
+                            userVerification: userVerification(settings),
+                            timeout: settings.challengeExpirySeconds * 1000
+                        });
+                        return { options, challengeId: signIn.challengeId };
+                    });
+                },
+                webauthnSignInFinish(_$mutation, fieldArgs) {
+                    return (0, grafast_1.lambda)(resolveArgs(fieldArgs), async ({ input, withPgClient, pgSettings, webauthn }) => {
+                        const settings = requireSettings(webauthn);
+                        const response = requireJsonObject(input?.response, 'response');
+                        const challengeId = input?.challengeId;
+                        const credentialId = response.id;
+                        if (typeof credentialId !== 'string' || !credentialId) {
+                            fail('BAD_USER_INPUT', 'response.id is required');
+                        }
+                        // One transaction: the challenge read, the counter check and the
+                        // session mint see the same state, and a refusal undoes them all.
+                        const row = await withVerifierLane(withPgClient, pgSettings, async (tx) => {
+                            const { rows: credentialRows } = await tx.query({
+                                text: `SELECT public_key, sign_count, transports
+                  FROM ${procedure(settings, 'webauthn_credential_for_assertion')}($1, $2::uuid)`,
+                                values: [credentialId, challengeId]
+                            });
+                            const stored = credentialRows[0];
+                            if (!stored || !(stored.public_key instanceof Uint8Array)) {
+                                throw new Error('webauthn_credential_for_assertion returned no public key');
+                            }
+                            const publicKey = Uint8Array.from(stored.public_key);
+                            const transports = stored.transports;
+                            if (!Array.isArray(transports) || !transports.every((t) => typeof t === 'string')) {
+                                throw new Error('webauthn_credential_for_assertion returned invalid transports');
+                            }
+                            const signCount = Number(stored.sign_count);
+                            if (!Number.isSafeInteger(signCount) || signCount < 0) {
+                                throw new Error('webauthn_credential_for_assertion returned invalid sign count');
+                            }
+                            const verified = await verifying(() => (0, server_1.verifyAuthenticationResponse)({
+                                response,
+                                expectedChallenge: (challenge) => challengeMatches(tx, settings, SIGN_IN_CHALLENGE, challenge, challengeId),
+                                expectedOrigin: settings.originAllowlist,
+                                expectedRPID: settings.rpId,
+                                credential: {
+                                    id: credentialId,
+                                    publicKey,
+                                    counter: signCount,
+                                    transports: transports
+                                },
+                                requireUserVerification: settings.requireUserVerification
+                            }));
+                            if (!verified.verified) {
+                                fail('WEBAUTHN_VERIFICATION_FAILED', 'WebAuthn authentication verification failed');
+                            }
+                            const { rows } = await tx.query({
+                                text: `SELECT user_id, access_token, access_token_expires_at
+                  FROM ${procedure(settings, 'webauthn_finish_sign_in')}($1, $2, $3, $4, $5::uuid)`,
+                                values: [
+                                    credentialId,
+                                    verified.authenticationInfo.newCounter,
+                                    verified.authenticationInfo.credentialBackedUp,
+                                    'bearer',
+                                    challengeId
+                                ]
+                            });
+                            return rows[0];
+                        });
+                        if (!row?.access_token || !row.user_id) {
+                            throw new Error('webauthn_finish_sign_in minted no session');
+                        }
+                        return {
+                            accessToken: row.access_token,
+                            accessTokenExpiresAt: row.access_token_expires_at,
+                            userId: row.user_id
+                        };
+                    });
+                }
+            }
+        }
+    })),
+    name: 'WebauthnPlugin',
+    version: '0.0.0',
+    description: 'WebAuthn passkey registration and sign-in mutations, verified in the server.',
+    grafast: {
+        middleware: {
+            prepareArgs(next, event) {
+                const req = getExpressRequest(event.args.requestContext);
+                // Read per request, not baked into the cached schema: a tenant
+                // changing its RP ID or origins takes effect with the next request.
+                const ctx = { settings: req?.api?.webauthnSettings, req };
+                event.args.contextValue[CONTEXT_KEY] = ctx;
+                return next();
+            }
+        }
+    }
+};

package/middleware/mask-error.d.ts

@@ -1,27 +0,0 @@
-import { type ErrorContext } from '@constructive-io/errors';
-import { type GraphQLError, type GraphQLFormattedError } from 'graphql';
-/**
- * Normalize any GraphQL/database error into a canonical Constructive shape.
- *
- * Database errors surface through Grafast without a populated `extensions.code`
- * (the semantic code lives in the message, and any SQLSTATE/DETAIL lives on the
- * underlying pg error at `originalError`). We parse `originalError` first so we
- * can recover the structured code, then fall back to the GraphQL error itself.
- */
-export declare const normalizeError: (error: GraphQLError) => {
-    code: string | null;
-    context: ErrorContext;
-    class: "public" | "internal";
-};
-/**
- * Production-aware error handling backed by `@constructive-io/errors`.
- *
- * 1. Enrich `extensions.code`/`class`/`context` from the parsed error so clients
- *    always receive a machine-readable code (fixing the gap where database
- *    errors reached clients as a bare message with empty `extensions`).
- * 2. Surface public (registered/allowlisted) errors as-is.
- * 3. In development, pass everything through (enriched) for debugging.
- * 4. In production, mask internal/unknown errors behind a reference ID and log
- *    the original.
- */
-export declare const maskError: (error: GraphQLError) => GraphQLError | GraphQLFormattedError;