@dfns/sdk-browser 0.4.0-alpha.1 → 0.4.1-alpha.1

package/index.d.ts

@@ -1,27 +1,2 @@
-import { AllowCredential, CredentialSigner, CredentialStore, Fido2Assertion, Fido2Attestation, KeyAssertion, KeyAttestation, UserRegistrationChallenge } from '@dfns/sdk';
-export declare const DEFAULT_WAIT_TIMEOUT = 60000;
-export declare class WebAuthn implements CredentialSigner<Fido2Assertion>, CredentialStore<Fido2Attestation> {
-    private options;
-    constructor(options: {
-        rpId: string;
-        timeout?: number;
-    });
-    sign(challenge: string, allowCredentials: {
-        key: AllowCredential[];
-        webauthn: AllowCredential[];
-    }): Promise<Fido2Assertion>;
-    create(challenge: UserRegistrationChallenge): Promise<Fido2Attestation>;
-}
-export declare class BrowserKeySigner implements CredentialSigner<KeyAssertion> {
-    private options;
-    constructor(options: {
-        keyPair: CryptoKeyPair;
-        credId?: string;
-        appOrigin: string;
-    });
-    create(challenge: UserRegistrationChallenge): Promise<KeyAttestation>;
-    sign(challenge: string, allowCredentials: {
-        key: AllowCredential[];
-        webauthn: AllowCredential[];
-    }): Promise<KeyAssertion>;
-}
+export { BrowserKeySigner } from './signers/key';
+export { WebAuthnSigner } from './signers/webauthn';

package/index.js

@@ -1,154 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserKeySigner = exports.WebAuthn = exports.DEFAULT_WAIT_TIMEOUT = void 0;
-const utils_1 = require("@dfns/sdk/utils");
-const buffer_1 = require("buffer");
-exports.DEFAULT_WAIT_TIMEOUT = 60000;
-class WebAuthn {
-    constructor(options) {
-        this.options = options;
-    }
-    async sign(challenge, allowCredentials) {
-        const credential = (await navigator.credentials.get({
-            publicKey: {
-                challenge: buffer_1.Buffer.from(challenge),
-                allowCredentials: allowCredentials.webauthn.map(({ id, type, transports }) => ({
-                    id: (0, utils_1.fromBase64Url)(id),
-                    type,
-                    transports: transports ?? [],
-                })),
-                rpId: this.options.rpId,
-                userVerification: 'required',
-                timeout: this.options.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
-            },
-        }));
-        if (!credential) {
-            throw new Error('Failed to sign with WebAuthn credential');
-        }
-        const assertion = credential.response;
-        return {
-            kind: 'Fido2',
-            credentialAssertion: {
-                credId: credential.id,
-                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.clientDataJSON)),
-                authenticatorData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.authenticatorData)),
-                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.signature)),
-                userHandle: assertion.userHandle ? (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.userHandle)) : '',
-            },
-        };
-    }
-    async create(challenge) {
-        const options = {
-            publicKey: {
-                challenge: buffer_1.Buffer.from(challenge.challenge),
-                pubKeyCredParams: challenge.pubKeyCredParams,
-                rp: challenge.rp,
-                user: {
-                    displayName: challenge.user.displayName,
-                    id: buffer_1.Buffer.from(challenge.user.id),
-                    name: challenge.user.name,
-                },
-                attestation: challenge.attestation,
-                excludeCredentials: challenge.excludeCredentials.map((cred) => ({
-                    id: (0, utils_1.fromBase64Url)(cred.id),
-                    type: cred.type,
-                })),
-                authenticatorSelection: challenge.authenticatorSelection,
-                timeout: this.options.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
-            },
-        };
-        const response = await navigator.credentials.create(options);
-        if (response === null) {
-            throw Error(`Failed to create and sign with WebAuthn credential`);
-        }
-        const credential = response;
-        const attestation = credential.response;
-        return {
-            credentialKind: 'Fido2',
-            credentialInfo: {
-                credId: credential.id,
-                attestationData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.attestationObject)),
-                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.clientDataJSON)),
-            },
-        };
-    }
-}
-exports.WebAuthn = WebAuthn;
-class BrowserKeySigner {
-    constructor(options) {
-        this.options = options;
-    }
-    async create(challenge) {
-        let credId = this.options.credId;
-        if (credId === undefined || credId === '') {
-            credId = (0, utils_1.toBase64Url)(buffer_1.Buffer.from((0, utils_1.generateRandom)(32)));
-            this.options.credId = credId;
-        }
-        const publicKeyPem = await (0, utils_1.exportPublicKeyInPemFormatBrowser)(this.options.keyPair);
-        const clientData = JSON.stringify({
-            type: 'key.create',
-            challenge: challenge.challenge,
-            origin: this.options.appOrigin,
-        });
-        const clientDataHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(clientData));
-        const clientDataHashHex = (0, utils_1.toHex)(clientDataHash);
-        const credInfoFingerprint = JSON.stringify({
-            clientDataHash: clientDataHashHex,
-            publicKey: publicKeyPem,
-        });
-        let rawSignature;
-        const algorithm = this.options.keyPair.privateKey.algorithm.name;
-        if (algorithm == 'ECDSA') {
-            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(credInfoFingerprint));
-        }
-        else {
-            throw new Error(`${algorithm} is not supported`);
-        }
-        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
-        const attestationData = JSON.stringify({
-            publicKey: publicKeyPem,
-            signature: (0, utils_1.toHex)(signature)
-        });
-        return {
-            credentialKind: 'Key',
-            credentialInfo: {
-                credId: credId,
-                clientData: (0, utils_1.toBase64Url)(clientData),
-                attestationData: (0, utils_1.toBase64Url)(attestationData),
-            },
-        };
-    }
-    async sign(challenge, allowCredentials) {
-        const credId = this.options.credId;
-        if (credId === undefined || credId === '') {
-            throw new Error('credId is needed to sign');
-        }
-        const allowedCredId = allowCredentials.key.map(cred => cred.id);
-        if (!allowedCredId.includes(credId)) {
-            throw new Error(`CredId ${credId} does not exist for this account: ${allowedCredId}`);
-        }
-        const clientData = JSON.stringify({
-            type: 'key.get',
-            challenge,
-            origin: this.options.appOrigin,
-        });
-        let rawSignature;
-        const algorithm = this.options.keyPair.privateKey.algorithm.name;
-        if (algorithm == 'ECDSA') {
-            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(clientData));
-        }
-        else {
-            throw new Error(`${algorithm} is not supported`);
-        }
-        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
-        return {
-            kind: 'Key',
-            credentialAssertion: {
-                credId: this.options.credId ?? '',
-                clientData: (0, utils_1.toBase64Url)(clientData),
-                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(signature)),
-            },
-        };
-    }
-}
-exports.BrowserKeySigner = BrowserKeySigner;
+exports.WebAuthnSigner = exports.BrowserKeySigner = void 0;
+var key_1 = require("./signers/key");
+Object.defineProperty(exports, "BrowserKeySigner", { enumerable: true, get: function () { return key_1.BrowserKeySigner; } });
+var webauthn_1 = require("./signers/webauthn");
+Object.defineProperty(exports, "WebAuthnSigner", { enumerable: true, get: function () { return webauthn_1.WebAuthnSigner; } });

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@dfns/sdk-browser",
-  "version": "0.4.0-alpha.1",
+  "version": "0.4.1-alpha.1",
   "dependencies": {
     "buffer": "6.0.3",
     "cross-fetch": "3.1.6",
     "uuid": "9.0.0"
   },
   "peerDependencies": {
-    "@dfns/sdk": "0.4.0-alpha.1"
+    "@dfns/sdk": "0.4.1-alpha.1"
   },
   "main": "./index.js",
   "type": "commonjs"

package/signers/key.d.ts

@@ -0,0 +1,10 @@
+import { CredentialSigner, CredentialStore, KeyAssertion, KeyAttestation, UserActionChallenge, UserRegistrationChallenge } from '@dfns/sdk';
+export declare class BrowserKeySigner implements CredentialSigner<KeyAssertion>, CredentialStore<KeyAttestation> {
+    private options;
+    constructor(options: {
+        credId?: string;
+        keyPair: CryptoKeyPair;
+    });
+    create(challenge: UserRegistrationChallenge): Promise<KeyAttestation>;
+    sign(challenge: UserActionChallenge): Promise<KeyAssertion>;
+}

package/signers/key.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserKeySigner = void 0;
+const sdk_1 = require("@dfns/sdk");
+const utils_1 = require("@dfns/sdk/utils");
+const buffer_1 = require("buffer");
+class BrowserKeySigner {
+    constructor(options) {
+        this.options = options;
+    }
+    async create(challenge) {
+        let credId = this.options.credId;
+        if (credId === undefined || credId === '') {
+            credId = (0, utils_1.toBase64Url)(buffer_1.Buffer.from((0, utils_1.generateRandom)(32)));
+            this.options.credId = credId;
+        }
+        const publicKeyPem = await (0, utils_1.exportPublicKeyInPemFormatBrowser)(this.options.keyPair);
+        const clientData = JSON.stringify({
+            type: 'key.create',
+            challenge: challenge.challenge,
+        });
+        const clientDataHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(clientData));
+        const clientDataHashHex = (0, utils_1.toHex)(clientDataHash);
+        const credInfoFingerprint = JSON.stringify({
+            clientDataHash: clientDataHashHex,
+            publicKey: publicKeyPem,
+        });
+        let rawSignature;
+        const algorithm = this.options.keyPair.privateKey.algorithm.name;
+        if (algorithm == 'ECDSA') {
+            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(credInfoFingerprint));
+        }
+        else {
+            throw new sdk_1.DfnsError(-1, `${algorithm} is not supported`);
+        }
+        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
+        const attestationData = JSON.stringify({
+            publicKey: publicKeyPem,
+            signature: (0, utils_1.toHex)(signature),
+        });
+        return {
+            credentialKind: 'Key',
+            credentialInfo: {
+                credId,
+                clientData: (0, utils_1.toBase64Url)(clientData),
+                attestationData: (0, utils_1.toBase64Url)(attestationData),
+            },
+        };
+    }
+    async sign(challenge) {
+        const credId = this.options.credId;
+        if (credId === undefined || credId === '') {
+            throw new sdk_1.DfnsError(-1, 'credId is needed to sign');
+        }
+        const allowedCredId = challenge.allowCredentials.key.map((cred) => cred.id);
+        if (!allowedCredId.includes(credId)) {
+            throw new sdk_1.DfnsError(-1, `${credId} does not match allowed credentials: ${allowedCredId}`);
+        }
+        const clientData = JSON.stringify({
+            type: 'key.get',
+            challenge: challenge.challenge,
+        });
+        let rawSignature;
+        const algorithm = this.options.keyPair.privateKey.algorithm.name;
+        if (algorithm == 'ECDSA') {
+            rawSignature = await crypto.subtle.sign({ name: 'ECDSA', hash: { name: 'SHA-256' } }, this.options.keyPair.privateKey, new TextEncoder().encode(clientData));
+        }
+        else {
+            throw new sdk_1.DfnsError(-1, `${algorithm} is not supported`);
+        }
+        const signature = (0, utils_1.rawSignatureToAns1)(new Uint8Array(rawSignature));
+        return {
+            kind: 'Key',
+            credentialAssertion: {
+                credId: this.options.credId ?? '',
+                clientData: (0, utils_1.toBase64Url)(clientData),
+                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(signature)),
+            },
+        };
+    }
+}
+exports.BrowserKeySigner = BrowserKeySigner;

package/signers/webauthn.d.ts

@@ -0,0 +1,10 @@
+import { CredentialSigner, CredentialStore, Fido2Assertion, Fido2Attestation, UserActionChallenge, UserRegistrationChallenge } from '@dfns/sdk';
+export declare const DEFAULT_WAIT_TIMEOUT = 60000;
+export declare class WebAuthnSigner implements CredentialSigner<Fido2Assertion>, CredentialStore<Fido2Attestation> {
+    private options?;
+    constructor(options?: {
+        timeout?: number | undefined;
+    } | undefined);
+    sign(challenge: UserActionChallenge): Promise<Fido2Assertion>;
+    create(challenge: UserRegistrationChallenge): Promise<Fido2Attestation>;
+}

package/signers/webauthn.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebAuthnSigner = exports.DEFAULT_WAIT_TIMEOUT = void 0;
+const sdk_1 = require("@dfns/sdk");
+const utils_1 = require("@dfns/sdk/utils");
+const buffer_1 = require("buffer");
+exports.DEFAULT_WAIT_TIMEOUT = 60000;
+class WebAuthnSigner {
+    constructor(options) {
+        this.options = options;
+    }
+    async sign(challenge) {
+        const response = await navigator.credentials.get({
+            publicKey: {
+                challenge: buffer_1.Buffer.from(challenge.challenge),
+                allowCredentials: challenge.allowCredentials.webauthn.map(({ id, type, transports }) => ({
+                    id: (0, utils_1.fromBase64Url)(id),
+                    type,
+                    transports: transports ?? [],
+                })),
+                rpId: challenge.rp.id,
+                userVerification: challenge.userVerification,
+                timeout: this.options?.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
+            },
+        });
+        if (response === null) {
+            throw new sdk_1.DfnsError(-1, 'Failed to sign with WebAuthn credential');
+        }
+        const credential = response;
+        const assertion = credential.response;
+        return {
+            kind: 'Fido2',
+            credentialAssertion: {
+                credId: credential.id,
+                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.clientDataJSON)),
+                authenticatorData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.authenticatorData)),
+                signature: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.signature)),
+                userHandle: assertion.userHandle ? (0, utils_1.toBase64Url)(buffer_1.Buffer.from(assertion.userHandle)) : '',
+            },
+        };
+    }
+    async create(challenge) {
+        const options = {
+            publicKey: {
+                challenge: buffer_1.Buffer.from(challenge.challenge),
+                pubKeyCredParams: challenge.pubKeyCredParams,
+                rp: challenge.rp,
+                user: {
+                    displayName: challenge.user.displayName,
+                    id: buffer_1.Buffer.from(challenge.user.id),
+                    name: challenge.user.name,
+                },
+                attestation: challenge.attestation,
+                excludeCredentials: challenge.excludeCredentials.map((cred) => ({
+                    id: (0, utils_1.fromBase64Url)(cred.id),
+                    type: cred.type,
+                })),
+                authenticatorSelection: challenge.authenticatorSelection,
+                timeout: this.options?.timeout ?? exports.DEFAULT_WAIT_TIMEOUT,
+            },
+        };
+        const response = await navigator.credentials.create(options);
+        if (response === null) {
+            throw new sdk_1.DfnsError(-1, `Failed to create and sign with WebAuthn credential`);
+        }
+        const credential = response;
+        const attestation = credential.response;
+        return {
+            credentialKind: 'Fido2',
+            credentialInfo: {
+                credId: credential.id,
+                attestationData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.attestationObject)),
+                clientData: (0, utils_1.toBase64Url)(buffer_1.Buffer.from(attestation.clientDataJSON)),
+            },
+        };
+    }
+}
+exports.WebAuthnSigner = WebAuthnSigner;