@dfns/sdk-browser 0.4.0-alpha.1

package/index.d.ts

@@ -0,0 +1,27 @@
+import { AllowCredential, CredentialSigner, CredentialStore, Fido2Assertion, Fido2Attestation, KeyAssertion, KeyAttestation, UserRegistrationChallenge } from '@dfns/sdk';
+export declare const DEFAULT_WAIT_TIMEOUT = 60000;
+export declare class WebAuthn implements CredentialSigner<Fido2Assertion>, CredentialStore<Fido2Attestation> {
+    private options;
+    constructor(options: {
+        rpId: string;
+        timeout?: number;
+    });
+    sign(challenge: string, allowCredentials: {
+        key: AllowCredential[];
+        webauthn: AllowCredential[];
+    }): Promise<Fido2Assertion>;
+    create(challenge: UserRegistrationChallenge): Promise<Fido2Attestation>;
+}
+export declare class BrowserKeySigner implements CredentialSigner<KeyAssertion> {
+    private options;
+    constructor(options: {
+        keyPair: CryptoKeyPair;
+        credId?: string;
+        appOrigin: string;
+    });
+    create(challenge: UserRegistrationChallenge): Promise<KeyAttestation>;
+    sign(challenge: string, allowCredentials: {
+        key: AllowCredential[];
+        webauthn: AllowCredential[];
+    }): Promise<KeyAssertion>;
+}

package/index.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserKeySigner = exports.WebAuthn = exports.DEFAULT_WAIT_TIMEOUT = void 0;
+const utils_1 = require("@dfns/sdk/utils");
+const buffer_1 = require("buffer");
+exports.DEFAULT_WAIT_TIMEOUT = 60000;
+class WebAuthn {
+    constructor(options) {
+        this.options = options;
+    }
+    async sign(challenge, allowCredentials) {
+        const credential = (await navigator.credentials.get({
+            publicKey: {
+                challenge: buffer_1.Buffer.from(challenge),
+                allowCredentials: allowCredentials.webauthn.map(({ id, type, transports }) => ({
+                    id: (0, utils_1.fromBase64Url)(id),
+                    type,
+                    transports: transports ?? [],
+                })),
+                rpId: this.options.rpId,
+                userVerification: 'required',
+                timeout: this.options.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
+            },
+        }));
+        if (!credential) {
+            throw new Error('Failed to sign with WebAuthn credential');
+        }
+        const assertion = credential.response;
+        return {
+            kind: 'Fido2',
+            credentialAssertion: {
+                credId: credential.id,
+                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.clientDataJSON)),
+                authenticatorData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.authenticatorData)),
+                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.signature)),
+                userHandle: assertion.userHandle ? (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.userHandle)) : '',
+            },
+        };
+    }
+    async create(challenge) {
+        const options = {
+            publicKey: {
+                challenge: buffer_1.Buffer.from(challenge.challenge),
+                pubKeyCredParams: challenge.pubKeyCredParams,
+                rp: challenge.rp,
+                user: {
+                    displayName: challenge.user.displayName,
+                    id: buffer_1.Buffer.from(challenge.user.id),
+                    name: challenge.user.name,
+                },
+                attestation: challenge.attestation,
+                excludeCredentials: challenge.excludeCredentials.map((cred) => ({
+                    id: (0, utils_1.fromBase64Url)(cred.id),
+                    type: cred.type,
+                })),
+                authenticatorSelection: challenge.authenticatorSelection,
+                timeout: this.options.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
+            },
+        };
+        const response = await navigator.credentials.create(options);
+        if (response === null) {
+            throw Error(`Failed to create and sign with WebAuthn credential`);
+        }
+        const credential = response;
+        const attestation = credential.response;
+        return {
+            credentialKind: 'Fido2',
+            credentialInfo: {
+                credId: credential.id,
+                attestationData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.attestationObject)),
+                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.clientDataJSON)),
+            },
+        };
+    }
+}
+exports.WebAuthn = WebAuthn;
+class BrowserKeySigner {
+    constructor(options) {
+        this.options = options;
+    }
+    async create(challenge) {
+        let credId = this.options.credId;
+        if (credId === undefined || credId === '') {
+            credId = (0, utils_1.toBase64Url)(buffer_1.Buffer.from((0, utils_1.generateRandom)(32)));
+            this.options.credId = credId;
+        }
+        const publicKeyPem = await (0, utils_1.exportPublicKeyInPemFormatBrowser)(this.options.keyPair);
+        const clientData = JSON.stringify({
+            type: 'key.create',
+            challenge: challenge.challenge,
+            origin: this.options.appOrigin,
+        });
+        const clientDataHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(clientData));
+        const clientDataHashHex = (0, utils_1.toHex)(clientDataHash);
+        const credInfoFingerprint = JSON.stringify({
+            clientDataHash: clientDataHashHex,
+            publicKey: publicKeyPem,
+        });
+        let rawSignature;
+        const algorithm = this.options.keyPair.privateKey.algorithm.name;
+        if (algorithm == 'ECDSA') {
+            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(credInfoFingerprint));
+        }
+        else {
+            throw new Error(`${algorithm} is not supported`);
+        }
+        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
+        const attestationData = JSON.stringify({
+            publicKey: publicKeyPem,
+            signature: (0, utils_1.toHex)(signature)
+        });
+        return {
+            credentialKind: 'Key',
+            credentialInfo: {
+                credId: credId,
+                clientData: (0, utils_1.toBase64Url)(clientData),
+                attestationData: (0, utils_1.toBase64Url)(attestationData),
+            },
+        };
+    }
+    async sign(challenge, allowCredentials) {
+        const credId = this.options.credId;
+        if (credId === undefined || credId === '') {
+            throw new Error('credId is needed to sign');
+        }
+        const allowedCredId = allowCredentials.key.map(cred => cred.id);
+        if (!allowedCredId.includes(credId)) {
+            throw new Error(`CredId ${credId} does not exist for this account: ${allowedCredId}`);
+        }
+        const clientData = JSON.stringify({
+            type: 'key.get',
+            challenge,
+            origin: this.options.appOrigin,
+        });
+        let rawSignature;
+        const algorithm = this.options.keyPair.privateKey.algorithm.name;
+        if (algorithm == 'ECDSA') {
+            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(clientData));
+        }
+        else {
+            throw new Error(`${algorithm} is not supported`);
+        }
+        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
+        return {
+            kind: 'Key',
+            credentialAssertion: {
+                credId: this.options.credId ?? '',
+                clientData: (0, utils_1.toBase64Url)(clientData),
+                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(signature)),
+            },
+        };
+    }
+}
+exports.BrowserKeySigner = BrowserKeySigner;

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@dfns/sdk-browser",
+  "version": "0.4.0-alpha.1",
+  "dependencies": {
+    "buffer": "6.0.3",
+    "cross-fetch": "3.1.6",
+    "uuid": "9.0.0"
+  },
+  "peerDependencies": {
+    "@dfns/sdk": "0.4.0-alpha.1"
+  },
+  "main": "./index.js",
+  "type": "commonjs"
+}