@firebase/auth 1.7.1-canary.ef3039ba8 → 1.7.1-passkey-preview.103ead202

package/dist/auth-public.d.ts

@@ -237,6 +237,7 @@ declare interface APIUserInfo {
     passwordHash?: string;
     providerUserInfo?: ProviderUserInfo[];
     mfaInfo?: MfaEnrollment[];
+    passkeyInfo?: PasskeyInfo_2[];
 }
 
 /**
@@ -1102,6 +1103,15 @@ declare const enum EnforcementState {
     OFF = "OFF",
     ENFORCEMENT_STATE_UNSPECIFIED = "ENFORCEMENT_STATE_UNSPECIFIED"
 }
+
+/**
+ * Enrolls a passkey for the user account.
+ * @param user - The user to enroll the passkey for.
+ * @param name - The name associated with the passkey.
+ * @returns A promise that resolves with a `UserCredential` object.
+ * @public
+ */
+export declare function enrollPasskey(user: User, name: string): Promise<UserCredential>;
 export { ErrorFn }
 
 /* Excluded from this release type: EventManager */
@@ -2275,6 +2285,25 @@ export declare interface ParsedToken {
     [key: string]: unknown;
 }
 
+/**
+ * Represents information about a passkey.
+ */
+export declare interface PasskeyInfo {
+    /**
+     * The credential ID of the passkey.
+     */
+    readonly credentialId: string;
+    /**
+     * The name associated with the passkey.
+     */
+    readonly name?: string;
+}
+
+declare interface PasskeyInfo_2 {
+    credentialId: string;
+    name?: string;
+}
+
 /**
  * A structure specifying password policy requirements.
  *
@@ -3292,6 +3321,15 @@ export declare function signInWithEmailLink(auth: Auth, email: string, emailLink
 
 /* Excluded from this release type: SignInWithIdpResponse */
 
+/**
+ * Signs in a user with a passkey. Use enrollPasskey to enroll a passkey credential for the current user.
+ * @param auth - The Firebase Auth instance.
+ * @param name - The user's name for passkey.
+ * @param manualSignUp - When false, automatically creates an anonymous user if a passkey credential does not exist. Defaults to false.
+ * @returns A promise that resolves with a `UserCredential` object.
+ */
+export declare function signInWithPasskey(auth: Auth, name: string, manualSignUp?: boolean): Promise<UserCredential>;
+
 /**
  * Asynchronously signs in using a phone number.
  *
@@ -3624,6 +3662,15 @@ export declare class TwitterAuthProvider extends BaseOAuthProvider {
     private static credentialFromTaggedObject;
 }
 
+/**
+ * Unenrolls the passkey corresponding to the specified credentialId.
+ * @param user - The user to unenroll the passkey for.
+ * @param credentialId - The ID of the passkey to unenroll.
+ * @returns A promise that resolves when the passkey is successfully unenrolled.
+ * @public
+ */
+export declare function unenrollPasskey(user: User, credentialId: string): Promise<void>;
+
 /**
  * Unlinks a provider from a user account.
  *
@@ -3767,6 +3814,10 @@ export declare interface User extends UserInfo {
      * Additional per provider such as displayName and profile information.
      */
     readonly providerData: UserInfo[];
+    /**
+     * An array of PasskeyInfo objects representing the passkeys that the user has enrolled.
+     */
+    readonly enrolledPasskeys: PasskeyInfo[];
     /**
      * Refresh token used to reauthenticate the user. Avoid using this directly and prefer
      * {@link User.getIdToken} to refresh the ID token instead.

package/dist/auth.d.ts

@@ -243,6 +243,7 @@ declare interface APIUserInfo {
     passwordHash?: string;
     providerUserInfo?: ProviderUserInfo[];
     mfaInfo?: MfaEnrollment[];
+    passkeyInfo?: PasskeyInfo_2[];
 }
 
 /**
@@ -1384,6 +1385,15 @@ declare const enum EnforcementState {
     OFF = "OFF",
     ENFORCEMENT_STATE_UNSPECIFIED = "ENFORCEMENT_STATE_UNSPECIFIED"
 }
+
+/**
+ * Enrolls a passkey for the user account.
+ * @param user - The user to enroll the passkey for.
+ * @param name - The name associated with the passkey.
+ * @returns A promise that resolves with a `UserCredential` object.
+ * @public
+ */
+export declare function enrollPasskey(user: User, name: string): Promise<UserCredential>;
 export { ErrorFn }
 
 /**
@@ -2622,6 +2632,25 @@ export declare interface ParsedToken {
     [key: string]: unknown;
 }
 
+/**
+ * Represents information about a passkey.
+ */
+export declare interface PasskeyInfo {
+    /**
+     * The credential ID of the passkey.
+     */
+    readonly credentialId: string;
+    /**
+     * The name associated with the passkey.
+     */
+    readonly name?: string;
+}
+
+declare interface PasskeyInfo_2 {
+    credentialId: string;
+    name?: string;
+}
+
 /**
  * A structure specifying password policy requirements.
  *
@@ -3148,7 +3177,9 @@ declare const enum ProviderId_2 {
     /** Phone provider */
     PHONE = "phone",
     /** Twitter provider ID */
-    TWITTER = "twitter.com"
+    TWITTER = "twitter.com",
+    /** Passkey provider */
+    PASSKEY = "passkey"
 }
 
 declare interface ProviderUserInfo {
@@ -3775,6 +3806,15 @@ declare interface SignInWithIdpResponse extends IdTokenResponse {
     pendingToken?: string;
 }
 
+/**
+ * Signs in a user with a passkey. Use enrollPasskey to enroll a passkey credential for the current user.
+ * @param auth - The Firebase Auth instance.
+ * @param name - The user's name for passkey.
+ * @param manualSignUp - When false, automatically creates an anonymous user if a passkey credential does not exist. Defaults to false.
+ * @returns A promise that resolves with a `UserCredential` object.
+ */
+export declare function signInWithPasskey(auth: Auth, name: string, manualSignUp?: boolean): Promise<UserCredential>;
+
 /**
  * Asynchronously signs in using a phone number.
  *
@@ -4151,6 +4191,15 @@ export declare class TwitterAuthProvider extends BaseOAuthProvider {
     private static credentialFromTaggedObject;
 }
 
+/**
+ * Unenrolls the passkey corresponding to the specified credentialId.
+ * @param user - The user to unenroll the passkey for.
+ * @param credentialId - The ID of the passkey to unenroll.
+ * @returns A promise that resolves when the passkey is successfully unenrolled.
+ * @public
+ */
+export declare function unenrollPasskey(user: User, credentialId: string): Promise<void>;
+
 /**
  * Unlinks a provider from a user account.
  *
@@ -4294,6 +4343,10 @@ export declare interface User extends UserInfo {
      * Additional per provider such as displayName and profile information.
      */
     readonly providerData: UserInfo[];
+    /**
+     * An array of PasskeyInfo objects representing the passkeys that the user has enrolled.
+     */
+    readonly enrolledPasskeys: PasskeyInfo[];
     /**
      * Refresh token used to reauthenticate the user. Avoid using this directly and prefer
      * {@link User.getIdToken} to refresh the ID token instead.
@@ -4448,6 +4501,7 @@ declare interface UserInternal extends User {
     tenantId: string | null;
     providerData: MutableUserInfo[];
     metadata: UserMetadata_2;
+    enrolledPasskeys: PasskeyInfo_2[];
     stsTokenManager: StsTokenManager;
     _redirectEventId?: string;
     _updateTokensIfNecessary(response: IdTokenResponse | FinalizeMfaResponse, reload?: boolean): Promise<void>;

package/dist/browser-cjs/{index-1478424f.js → index-763ce1de.js}

@@ -1471,7 +1471,8 @@ async function _reloadWithoutSaving(user) {
         tenantId: coreAccount.tenantId || null,
         providerData,
         metadata: new UserMetadata(coreAccount.createdAt, coreAccount.lastLoginAt),
-        isAnonymous
+        isAnonymous,
+        enrolledPasskeys: coreAccount.passkeyInfo || []
     };
     Object.assign(user, updates);
 }
@@ -1703,6 +1704,9 @@ class UserImpl {
         this.isAnonymous = opt.isAnonymous || false;
         this.tenantId = opt.tenantId || null;
         this.providerData = opt.providerData ? [...opt.providerData] : [];
+        this.enrolledPasskeys = opt.enrolledPasskeys
+            ? [...opt.enrolledPasskeys]
+            : [];
         this.metadata = new UserMetadata(opt.createdAt || undefined, opt.lastLoginAt || undefined);
     }
     async getIdToken(forceRefresh) {
@@ -1734,6 +1738,7 @@ class UserImpl {
         this.isAnonymous = user.isAnonymous;
         this.tenantId = user.tenantId;
         this.providerData = user.providerData.map(userInfo => (Object.assign({}, userInfo)));
+        this.enrolledPasskeys = user.enrolledPasskeys.map(passkeyInfo => (Object.assign({}, passkeyInfo)));
         this.metadata._copy(user.metadata);
         this.stsTokenManager._assign(user.stsTokenManager);
     }
@@ -6259,6 +6264,248 @@ async function verifyBeforeUpdateEmail(user, newEmail, actionCodeSettings) {
     }
 }
 
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+function publicKeyCredentialToJSON(pubKeyCred) {
+    // Convert ArrayBuffer to Base64
+    function bufferToBase64(buffer) {
+        const byteArray = Array.from(new Uint8Array(buffer));
+        return btoa(String.fromCharCode.apply(null, byteArray));
+    }
+    const clientDataJSON = bufferToBase64(pubKeyCred.response.clientDataJSON);
+    let result = {};
+    // Handle Attestation Response (Registration)
+    if (pubKeyCred.response instanceof AuthenticatorAttestationResponse) {
+        const attestationObject = bufferToBase64(pubKeyCred.response.attestationObject);
+        result = {
+            id: pubKeyCred.id,
+            type: pubKeyCred.type,
+            rawId: bufferToBase64(pubKeyCred.rawId),
+            response: {
+                clientDataJSON,
+                attestationObject
+            }
+        };
+    }
+    // Handle Assertion Response (Authentication)
+    if (pubKeyCred.response instanceof AuthenticatorAssertionResponse) {
+        const authenticatorData = bufferToBase64(pubKeyCred.response.authenticatorData);
+        const signature = bufferToBase64(pubKeyCred.response.signature);
+        const userHandle = pubKeyCred.response.userHandle
+            ? bufferToBase64(pubKeyCred.response.userHandle)
+            : undefined;
+        result = {
+            id: pubKeyCred.id,
+            type: pubKeyCred.type,
+            rawId: bufferToBase64(pubKeyCred.rawId),
+            response: {
+                clientDataJSON,
+                authenticatorData,
+                signature,
+                userHandle
+            }
+        };
+    }
+    return result;
+}
+async function startPasskeyEnrollment(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeyEnrollment:start" /* Endpoint.START_PASSKEY_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+async function finalizePasskeyEnrollment(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeyEnrollment:finalize" /* Endpoint.FINALIZE_PASSKEY_ENROLLMENT */, _addTidIfNecessary(auth, request));
+}
+async function startPasskeySignIn(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeySignIn:start" /* Endpoint.START_PASSKEY_SIGNIN */, _addTidIfNecessary(auth, request));
+}
+async function finalizePasskeySignIn(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v2/accounts/passkeySignIn:finalize" /* Endpoint.FINALIZE_PASSKEY_SIGNIN */, _addTidIfNecessary(auth, request));
+}
+async function passkeyUnenroll(auth, request) {
+    return _performApiRequest(auth, "POST" /* HttpMethod.POST */, "/v1/accounts:update" /* Endpoint.SET_ACCOUNT_INFO */, request);
+}
+
+/**
+ * @license
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const DEFAULT_PASSKEY_ACCOUNT_NAME = 'Unnamed account (Web)';
+const PASSKEY_LOOK_UP_ERROR_MESSAGE = 'The operation either timed out or was not allowed.';
+/**
+ * Signs in a user with a passkey. Use enrollPasskey to enroll a passkey credential for the current user.
+ * @param auth - The Firebase Auth instance.
+ * @param name - The user's name for passkey.
+ * @param manualSignUp - When false, automatically creates an anonymous user if a passkey credential does not exist. Defaults to false.
+ * @returns A promise that resolves with a `UserCredential` object.
+ */
+async function signInWithPasskey(auth, name, manualSignUp = false) {
+    const authInternal = _castAuth(auth);
+    // Start Passkey Sign in
+    const startSignInRequest = {};
+    const startSignInResponse = await startPasskeySignIn(authInternal, startSignInRequest);
+    const options = getPasskeyCredentialRequestOptions(startSignInResponse, name);
+    // Get the credential
+    let credential;
+    try {
+        credential = (await navigator.credentials.get({
+            publicKey: options
+        }));
+        const finalizeSignInRequest = {
+            authenticatorAuthenticationResponse: publicKeyCredentialToJSON(credential),
+            name,
+            displayName: name
+        };
+        const finalizeSignInResponse = await finalizePasskeySignIn(authInternal, finalizeSignInRequest);
+        const operationType = "signIn" /* OperationType.SIGN_IN */;
+        const userCredential = await UserCredentialImpl._fromIdTokenResponse(authInternal, operationType, finalizeSignInResponse);
+        await auth.updateCurrentUser(userCredential.user);
+        return userCredential;
+    }
+    catch (error) {
+        if (error.message.includes(PASSKEY_LOOK_UP_ERROR_MESSAGE) &&
+            !manualSignUp) {
+            // If the user is not signed up, sign them up anonymously
+            const userCredential = await signInAnonymously(authInternal);
+            const user = userCredential.user;
+            return enrollPasskey(user, name);
+        }
+        return Promise.reject(error);
+    }
+}
+/**
+ * Enrolls a passkey for the user account.
+ * @param user - The user to enroll the passkey for.
+ * @param name - The name associated with the passkey.
+ * @returns A promise that resolves with a `UserCredential` object.
+ * @public
+ */
+async function enrollPasskey(user, name) {
+    const userInternal = util.getModularInstance(user);
+    const authInternal = _castAuth(userInternal.auth);
+    if (name === '') {
+        name = DEFAULT_PASSKEY_ACCOUNT_NAME;
+    }
+    // Start Passkey Enrollment
+    const idToken = await userInternal.getIdToken();
+    const startEnrollmentRequest = {
+        idToken
+    };
+    const startEnrollmentResponse = await startPasskeyEnrollment(authInternal, startEnrollmentRequest);
+    // Create the crendential
+    try {
+        const options = getPasskeyCredentialCreationOptions(startEnrollmentResponse, name);
+        const credential = (await navigator.credentials.create({
+            publicKey: options
+        }));
+        const idToken = await userInternal.getIdToken();
+        const finalizeEnrollmentRequest = {
+            idToken,
+            authenticatorRegistrationResponse: publicKeyCredentialToJSON(credential),
+            name,
+            displayName: name
+        };
+        const finalizeEnrollmentResponse = await finalizePasskeyEnrollment(authInternal, finalizeEnrollmentRequest);
+        // The passkey provider is linked with the user's current providers.
+        const operationType = "link" /* OperationType.LINK */;
+        const userCredential = await UserCredentialImpl._fromIdTokenResponse(userInternal.auth, operationType, finalizeEnrollmentResponse);
+        return userCredential;
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+}
+/**
+ * Unenrolls the passkey corresponding to the specified credentialId.
+ * @param user - The user to unenroll the passkey for.
+ * @param credentialId - The ID of the passkey to unenroll.
+ * @returns A promise that resolves when the passkey is successfully unenrolled.
+ * @public
+ */
+async function unenrollPasskey(user, credentialId) {
+    const userInternal = util.getModularInstance(user);
+    const authInternal = _castAuth(userInternal.auth);
+    const idToken = await userInternal.getIdToken();
+    const request = {
+        idToken,
+        deletePasskey: [credentialId]
+    };
+    await passkeyUnenroll(authInternal, request);
+}
+// Converts an array of credential IDs of `excludeCredentials` field to an array of `PublicKeyCredentialDescriptor` objects.
+function convertExcludeCredentials(options) {
+    function base64ToBuffer(base64) {
+        const binaryStr = atob(base64);
+        const len = binaryStr.length;
+        const bytes = new Uint8Array(len);
+        for (let i = 0; i < len; i++) {
+            bytes[i] = binaryStr.charCodeAt(i);
+        }
+        return bytes.buffer;
+    }
+    if ('excludeCredentials' in options && options.excludeCredentials) {
+        for (const cred of options.excludeCredentials) {
+            if (typeof cred.id === 'string') {
+                // Assuming Base64 encoded strings
+                cred.id = base64ToBuffer(cred.id);
+            }
+        }
+    }
+}
+function getPasskeyCredentialCreationOptions(response, name = '') {
+    const options = response.credentialCreationOptions;
+    if (name === '') {
+        name = 'Unnamed account (Web)';
+    }
+    options.user.name = name;
+    options.user.displayName = name;
+    const userId = options.user.id;
+    options.user.id = Uint8Array.from(atob(userId), c => c.charCodeAt(0));
+    const rpId = window.location.hostname;
+    options.rp.id = rpId;
+    options.rp.name = rpId;
+    const challengeBase64 = options.challenge;
+    options.challenge = Uint8Array.from(atob(challengeBase64), c => c.charCodeAt(0));
+    convertExcludeCredentials(options);
+    return options;
+}
+function getPasskeyCredentialRequestOptions(response, name = '') {
+    const options = response.credentialRequestOptions;
+    if (name === '') {
+        name = 'Unnamed account (Web)';
+    }
+    const rpId = window.location.hostname;
+    options.rpId = rpId;
+    const challengeBase64 = options.challenge;
+    options.challenge = Uint8Array.from(atob(challengeBase64), c => c.charCodeAt(0));
+    convertExcludeCredentials(options);
+    return options;
+}
+
 /**
  * @license
  * Copyright 2020 Google LLC
@@ -10464,7 +10711,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "1.7.1-canary.ef3039ba8";
+var version = "1.7.1-passkey-preview.103ead202";
 
 /**
  * @license
@@ -10775,6 +11022,7 @@ exports.createUserWithEmailAndPassword = createUserWithEmailAndPassword;
 exports.debugAssert = debugAssert;
 exports.debugErrorMap = debugErrorMap;
 exports.deleteUser = deleteUser;
+exports.enrollPasskey = enrollPasskey;
 exports.fetchSignInMethodsForEmail = fetchSignInMethodsForEmail;
 exports.getAdditionalUserInfo = getAdditionalUserInfo;
 exports.getAuth = getAuth;
@@ -10811,10 +11059,12 @@ exports.signInWithCredential = signInWithCredential;
 exports.signInWithCustomToken = signInWithCustomToken;
 exports.signInWithEmailAndPassword = signInWithEmailAndPassword;
 exports.signInWithEmailLink = signInWithEmailLink;
+exports.signInWithPasskey = signInWithPasskey;
 exports.signInWithPhoneNumber = signInWithPhoneNumber;
 exports.signInWithPopup = signInWithPopup;
 exports.signInWithRedirect = signInWithRedirect;
 exports.signOut = signOut;
+exports.unenrollPasskey = unenrollPasskey;
 exports.unlink = unlink;
 exports.updateCurrentUser = updateCurrentUser;
 exports.updateEmail = updateEmail;
@@ -10825,4 +11075,4 @@ exports.useDeviceLanguage = useDeviceLanguage;
 exports.validatePassword = validatePassword;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-1478424f.js.map
+//# sourceMappingURL=index-763ce1de.js.map