@corbado/observe 1.14.0 → 1.15.0

package/dist/analysis/utils/webauthn-ceremony.mjs

@@ -0,0 +1,279 @@
+// src/utils/webauthn-ceremony.ts
+var TRANSPORTS = [1];
+var CREDENTIAL_DESCRIPTOR = { type: 1, id: "credentialId", transports: TRANSPORTS };
+var EXTENSION_OUTPUTS = {
+  appid: 1,
+  appidExclude: 1,
+  credProps: { rk: 1 },
+  hmacCreateSecret: 1,
+  hmacGetSecret: {},
+  largeBlob: { supported: 1, written: 1 },
+  prf: { enabled: 1 }
+};
+var REQUEST_OPTIONS = {
+  challenge: "zero",
+  timeout: 1,
+  rpId: 1,
+  allowCredentials: [CREDENTIAL_DESCRIPTOR],
+  userVerification: 1,
+  hints: [1],
+  extensions: "names"
+};
+var CREATION_OPTIONS = {
+  rp: { id: 1 },
+  user: { id: "userId" },
+  challenge: "zero",
+  pubKeyCredParams: [{ type: 1, alg: 1 }],
+  timeout: 1,
+  excludeCredentials: [CREDENTIAL_DESCRIPTOR],
+  authenticatorSelection: { authenticatorAttachment: 1, requireResidentKey: 1, residentKey: 1, userVerification: 1 },
+  attestation: 1,
+  attestationFormats: [1],
+  hints: [1],
+  extensions: "names"
+};
+var ASSERTION_RESPONSE = {
+  id: "credentialId",
+  rawId: "credentialId",
+  type: 1,
+  authenticatorAttachment: 1,
+  response: { clientDataJSON: "clientData", authenticatorData: "authData", userHandle: "userHandle" },
+  clientExtensionResults: EXTENSION_OUTPUTS
+};
+var CREATION_RESPONSE = {
+  id: "credentialId",
+  rawId: "credentialId",
+  type: 1,
+  authenticatorAttachment: 1,
+  response: {
+    clientDataJSON: "clientData",
+    attestationObject: "authData",
+    authenticatorData: "authData",
+    transports: TRANSPORTS,
+    publicKeyAlgorithm: 1
+  },
+  clientExtensionResults: EXTENSION_OUTPUTS
+};
+var METHODS = {
+  clientExtensionResults: "getClientExtensionResults",
+  transports: "getTransports",
+  authenticatorData: "getAuthenticatorData",
+  publicKeyAlgorithm: "getPublicKeyAlgorithm"
+};
+var CLIENT_DATA_KEYS = ["type", "challenge", "origin", "crossOrigin", "topOrigin"];
+var USER_HANDLE_PLACEHOLDER = "AAAAAAAAAAAAAAAAAAAAAA";
+var MIN_SWAP_BYTES = 16;
+var MAX_STAND_INS = 256;
+var MAX_LIST = 1e3;
+var standIns = /* @__PURE__ */ new Map();
+function ceremonyCreationOptions(value, options) {
+  return projectOptions(value, CREATION_OPTIONS, options);
+}
+function ceremonyRequestOptions(value, options) {
+  return projectOptions(value, REQUEST_OPTIONS, options);
+}
+function ceremonyCreationResponse(value, options) {
+  return projectCredential(value, CREATION_RESPONSE, options);
+}
+function ceremonyAssertionResponse(value, options) {
+  return projectCredential(value, ASSERTION_RESPONSE, options);
+}
+function context(options) {
+  return { passkeyReference: options?.passkeyReference === true, projectors: options ?? {} };
+}
+function projectOptions(input, rules, options) {
+  try {
+    const value = parse(input);
+    if (!value) return void 0;
+    const ctx = context(options);
+    const inner = value.challenge === void 0 ? asRecord(read(value, "publicKey")) : void 0;
+    if (inner) return JSON.stringify({ publicKey: project(inner, rules, ctx) });
+    return JSON.stringify(project(value, rules, ctx));
+  } catch {
+    return void 0;
+  }
+}
+function projectCredential(input, rules, options) {
+  try {
+    const value = parse(input);
+    if (!value) return void 0;
+    const ctx = context(options);
+    if (!ctx.passkeyReference) {
+      const from = decode(read(value, "rawId")) ?? decode(read(value, "id"));
+      if (from && from.length >= MIN_SWAP_BYTES) ctx.swap = { from, to: standIn(from) };
+    }
+    return JSON.stringify(project(value, rules, ctx));
+  } catch {
+    return void 0;
+  }
+}
+function project(value, rules, ctx, depth = 0) {
+  if (depth > 8) throw new TypeError("Invalid telemetry payload");
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.keys(rules)) {
+    let item = read(value, key);
+    const method = METHODS[key];
+    if (item === void 0 && method && typeof value[method] === "function") {
+      item = Reflect.apply(value[method], value, []);
+    }
+    if (item === void 0) continue;
+    const result = apply(item, rules[key], ctx, depth + 1);
+    if (result !== void 0) out[key] = result;
+  }
+  return out;
+}
+function apply(item, rule, ctx, depth) {
+  if (item === null) return rule === "userId" || rule === "userHandle" || rule === 1 ? null : void 0;
+  switch (rule) {
+    case 1:
+      if (typeof item === "string" || typeof item === "boolean") return item;
+      if (typeof item === "number") return Number.isFinite(item) ? item : null;
+      return isBinary(item) ? base64url(toBytes(item)) : void 0;
+    case "zero":
+      return zero(item);
+    case "credentialId":
+      return credentialId(item, ctx);
+    case "userHandle":
+    case "userId":
+      return userIdentifier(item, rule, ctx);
+    case "clientData":
+      return clientData(item);
+    case "authData":
+      return authData(item, ctx);
+    case "names": {
+      const record2 = asRecord(item);
+      if (!record2) return void 0;
+      const names = /* @__PURE__ */ Object.create(null);
+      for (const key of Object.keys(record2)) names[key] = true;
+      return names;
+    }
+  }
+  if (Array.isArray(rule)) {
+    return Array.isArray(item) ? item.slice(0, MAX_LIST).map((entry) => apply(entry, rule[0], ctx, depth) ?? null) : void 0;
+  }
+  const record = asRecord(item);
+  return record ? project(record, rule, ctx, depth) : void 0;
+}
+function zero(item) {
+  if (typeof item === "string") return item.replace(/[^=]/g, "A");
+  return isBinary(item) ? base64url(new Uint8Array(toBytes(item).length)) : void 0;
+}
+function credentialId(item, ctx) {
+  if (ctx.passkeyReference) {
+    if (typeof item === "string") return item;
+    return isBinary(item) ? base64url(toBytes(item)) : void 0;
+  }
+  const bytes = decode(item);
+  return bytes ? base64url(standIn(bytes)) : void 0;
+}
+function userIdentifier(item, rule, ctx) {
+  const identifier = typeof item === "string" ? item : isBinary(item) ? base64url(toBytes(item)) : void 0;
+  if (identifier === void 0) return void 0;
+  const projector = ctx.projectors.userId;
+  if (projector) {
+    try {
+      const output = projector(identifier);
+      return typeof output === "string" || output === null ? output : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  if (rule === "userId") return void 0;
+  return identifier === "" ? "" : USER_HANDLE_PLACEHOLDER;
+}
+function clientData(item) {
+  const bytes = decode(item);
+  if (!bytes) return void 0;
+  let parsed;
+  try {
+    parsed = asRecord(JSON.parse(new TextDecoder().decode(bytes)));
+  } catch {
+    return void 0;
+  }
+  if (!parsed) return void 0;
+  const out = {};
+  for (const key of CLIENT_DATA_KEYS) {
+    const member = parsed[key];
+    if (member === void 0) continue;
+    if (key === "challenge") {
+      if (typeof member === "string") out[key] = zero(member);
+    } else if (typeof member === "string" || typeof member === "boolean") {
+      out[key] = member;
+    }
+  }
+  return base64url(new TextEncoder().encode(JSON.stringify(out)));
+}
+function authData(item, ctx) {
+  const bytes = decode(item);
+  if (!bytes) return void 0;
+  if (!ctx.swap) return base64url(bytes);
+  const { from, to } = ctx.swap;
+  const out = bytes.slice();
+  for (let i = 0; i + from.length <= out.length; i++) {
+    let match = true;
+    for (let j = 0; j < from.length; j++) {
+      if (out[i + j] !== from[j]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) {
+      out.set(to, i);
+      i += from.length - 1;
+    }
+  }
+  return base64url(out);
+}
+function standIn(id) {
+  const key = base64url(id);
+  const known = standIns.get(key);
+  if (known) return known;
+  const fresh = new Uint8Array(id.length);
+  if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") {
+    crypto.getRandomValues(fresh);
+  } else {
+    for (let i = 0; i < fresh.length; i++) fresh[i] = Math.floor(Math.random() * 256);
+  }
+  if (standIns.size < MAX_STAND_INS) standIns.set(key, fresh);
+  return fresh;
+}
+function parse(input) {
+  return asRecord(typeof input === "string" ? JSON.parse(input) : input);
+}
+function read(value, key) {
+  return value[key];
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && !isBinary(value) ? value : void 0;
+}
+function isBinary(value) {
+  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
+}
+function toBytes(value) {
+  return value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+}
+function decode(value) {
+  if (isBinary(value)) return toBytes(value);
+  if (typeof value !== "string") return void 0;
+  try {
+    const normalized = value.replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
+    const binary = atob(normalized + "===".slice((normalized.length + 3) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  } catch {
+    return void 0;
+  }
+}
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export {
+  USER_HANDLE_PLACEHOLDER,
+  ceremonyAssertionResponse,
+  ceremonyCreationOptions,
+  ceremonyCreationResponse,
+  ceremonyRequestOptions
+};

package/dist/analysis/utils/webauthn-payloads.mjs

@@ -1,4 +1,10 @@
 // src/utils/webauthn-payloads.ts
+import {
+  ceremonyAssertionResponse,
+  ceremonyCreationOptions,
+  ceremonyCreationResponse,
+  ceremonyRequestOptions
+} from "./webauthn-ceremony.mjs";
 var BLACKLIST = {
   creationOptions: ["/user/name", "/user/displayName"],
   creationResponse: ["/clientExtensionResults/prf/results"],
@@ -6,16 +12,16 @@ var BLACKLIST = {
   assertionResponse: ["/response/signature", "/clientExtensionResults/prf/results"]
 };
 function sanitizeCreationOptions(value, projectors) {
-  return sanitize(value, "creationOptions", projectors);
+  return typeof __CBO_DATA_CEREMONY__ === "boolean" && __CBO_DATA_CEREMONY__ ? ceremonyCreationOptions(value, projectors) : sanitize(value, "creationOptions", projectors);
 }
 function sanitizeCreationResponse(value, projectors) {
-  return sanitize(value, "creationResponse", projectors);
+  return typeof __CBO_DATA_CEREMONY__ === "boolean" && __CBO_DATA_CEREMONY__ ? ceremonyCreationResponse(value, projectors) : sanitize(value, "creationResponse", projectors);
 }
-function sanitizeRequestOptions(value) {
-  return sanitize(value, "requestOptions");
+function sanitizeRequestOptions(value, options) {
+  return typeof __CBO_DATA_CEREMONY__ === "boolean" && __CBO_DATA_CEREMONY__ ? ceremonyRequestOptions(value, options) : sanitize(value, "requestOptions");
 }
 function sanitizeAssertionResponse(value, projectors) {
-  return sanitize(value, "assertionResponse", projectors);
+  return typeof __CBO_DATA_CEREMONY__ === "boolean" && __CBO_DATA_CEREMONY__ ? ceremonyAssertionResponse(value, projectors) : sanitize(value, "assertionResponse", projectors);
 }
 function sanitize(input, kind, projectors = {}) {
   try {

package/dist/analysis/version.mjs

@@ -1,6 +1,6 @@
 // src/version.ts
 var SDK_NAME = "@corbado/observe";
-var SDK_VERSION = true ? "1.14.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "1.15.0" : "0.0.0-dev";
 export {
   SDK_NAME,
   SDK_VERSION