@flickfyi/flkr 0.0.153 → 0.0.156

package/node_modules/@flickfyi/attestation/.turbo/turbo-build.log

@@ -5,18 +5,18 @@ transforming...
 rendering chunks...
 
 [unplugin:dts] Start generate declaration files...
-[unplugin:dts] Declaration files built in 5485ms.
+[unplugin:dts] Declaration files built in 7196ms.
 
 computing gzip size...
 dist/assertion.js                  0.09 kB │ gzip: 0.08 kB
 dist/testing.js                    0.88 kB │ gzip: 0.47 kB
 dist/verify-assertion-BgFGK36e.js  5.64 kB │ gzip: 2.01 kB
-dist/index.js                      8.06 kB │ gzip: 3.30 kB
+dist/index.js                      8.09 kB │ gzip: 3.31 kB
 
-✓ built in 5.57s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 5.5s of this 5.6s build (99%).
+✓ built in 7.29s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 7.2s of this 7.3s build (99%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin unplugin-dts buildStart (97%, 5.4s, 1 call)
+  - plugin unplugin-dts buildStart (97%, 7.1s, 1 call)
 Additional callback time came from callbacks under 1s.
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.
 

package/node_modules/@flickfyi/attestation/dist/index.js

@@ -116,11 +116,11 @@ async function verifyAttestation(options) {
 async function verifyCertChain(x5c, trustedRootCerts) {
 	const certs = x5c.map((der) => new x509.X509Certificate(toArrayBuffer(der)));
 	const trustedRoots = trustedRootCerts.map((pem) => new x509.X509Certificate(pem));
-	const chain = new x509.X509ChainBuilder({ certificates: certs.slice(1) });
+	const chain = new x509.X509ChainBuilder({ certificates: [...certs.slice(1), ...trustedRoots] });
 	const leafCert = certs[0];
 	const lastCert = (await chain.build(leafCert)).at(-1);
 	if (!lastCert) throw new Error("Empty certificate chain");
-	if (!trustedRoots.some((root) => root.subject === lastCert.issuer || root.subject === lastCert.subject)) throw new Error("Certificate chain does not terminate at a trusted root");
+	if (!trustedRoots.some((root) => equalBytes(new Uint8Array(root.rawData), new Uint8Array(lastCert.rawData)))) throw new Error("Certificate chain does not terminate at a trusted root");
 }
 /**
 * Extract the nonce from the Apple attestation credential certificate.

package/node_modules/@flickfyi/attestation/src/verify-attestation.ts

@@ -137,7 +137,9 @@ async function verifyCertChain(
 	const trustedRoots = trustedRootCerts.map(pem => new x509.X509Certificate(pem))
 
 	// Create certificate chain
-	const chain = new x509.X509ChainBuilder({ certificates: certs.slice(1) })
+	const chain = new x509.X509ChainBuilder({
+		certificates: [...certs.slice(1), ...trustedRoots],
+	})
 
 	// Build and verify chain from leaf to root
 	const leafCert = certs[0]
@@ -149,8 +151,8 @@ async function verifyCertChain(
 		throw new Error('Empty certificate chain')
 	}
 
-	const isTrusted = trustedRoots.some(
-		root => root.subject === lastCert.issuer || root.subject === lastCert.subject
+	const isTrusted = trustedRoots.some(root =>
+		equalBytes(new Uint8Array(root.rawData), new Uint8Array(lastCert.rawData))
 	)
 
 	if (!isTrusted) {

package/node_modules/@flickfyi/attestation/tests/verify-attestation.test.ts

@@ -1,7 +1,14 @@
+// eslint-disable-next-line eslint-plugin-import/no-unassigned-import
+import 'reflect-metadata'
+
 import { Buffer } from 'node:buffer'
 
-import { describe, expect, it } from 'vitest'
+import { X509Certificate, X509CertificateGenerator } from '@peculiar/x509'
+import is from '@sindresorhus/is'
+import { decode, encode } from 'cborg'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
+import { APPLE_APP_ATTESTATION_ROOT_CA_PEM } from '~/internal/apple-root-certs'
 import { verifyAttestation } from '~/verify-attestation'
 
 import fixtures from './fixtures/real-device-attestations.json'
@@ -12,6 +19,7 @@ const swiftAttestationFixture = Buffer.from(
 )
 
 describe('verifyAttestation', () => {
+	afterEach(() => vi.useRealTimers())
 	it.each(fixtures)('verifies a real Apple attestation: $name', async fixture => {
 		await expect(
 			verifyAttestation({
@@ -23,6 +31,64 @@ describe('verifyAttestation', () => {
 		).resolves.toMatchObject({ keyId: fixture.attestation.keyId })
 	})
 
+	it.each(fixtures)('accepts expired Apple leaf certificates: $name', async fixture => {
+		vi.useFakeTimers({ toFake: ['Date'] })
+		vi.setSystemTime(new Date('2030-01-01T00:00:00Z'))
+		await expect(
+			verifyAttestation({
+				appId: fixture.appId,
+				attestation: Buffer.from(fixture.attestation.data, 'base64'),
+				challenge: Buffer.from(fixture.attestationChallenge, 'base64'),
+				expectedKeyId: fixture.attestation.keyId,
+			})
+		).resolves.toMatchObject({ keyId: fixture.attestation.keyId })
+	})
+
+	it.each([
+		'missing intermediate',
+		'invalid intermediate signature',
+		'forged Apple name',
+	])('rejects an untrusted chain: %s', async mutation => {
+		const fixture = fixtures[0]
+		const attestation: unknown = decode(Buffer.from(fixture.attestation.data, 'base64'))
+		if (
+			!is.plainObject(attestation) ||
+			!is.plainObject(attestation.attStmt) ||
+			!is.array(attestation.attStmt.x5c) ||
+			!attestation.attStmt.x5c.every(is.uint8Array)
+		) {
+			throw new Error('Invalid test fixture')
+		}
+		const certificates = attestation.attStmt.x5c
+		if (mutation === 'missing intermediate') {
+			attestation.attStmt.x5c = certificates.slice(0, 1)
+		} else if (mutation === 'invalid intermediate signature') {
+			const intermediate = certificates[1]
+			intermediate[intermediate.length - 1] =
+				(intermediate[intermediate.length - 1] + 1) % 256
+		} else {
+			const root = new X509Certificate(APPLE_APP_ATTESTATION_ROOT_CA_PEM)
+			const keys = await crypto.subtle.generateKey(
+				{ name: 'ECDSA', namedCurve: 'P-256' },
+				true,
+				['sign', 'verify']
+			)
+			const impostor = await X509CertificateGenerator.createSelfSigned({
+				keys,
+				name: root.subject,
+				signingAlgorithm: { hash: 'SHA-256', name: 'ECDSA' },
+			})
+			attestation.attStmt.x5c = [new Uint8Array(impostor.rawData)]
+		}
+		await expect(
+			verifyAttestation({
+				appId: fixture.appId,
+				attestation: encode(attestation),
+				challenge: Buffer.from(fixture.attestationChallenge, 'base64'),
+			})
+		).rejects.toThrow('Certificate chain does not terminate at a trusted root')
+	})
+
 	it('verifies a Swift App Attest attestation bound to the identity key ID', async () => {
 		await expect(
 			verifyAttestation({

package/node_modules/@flickfyi/biscuit/.turbo/turbo-build.log

@@ -5,15 +5,15 @@ transforming...
 rendering chunks...
 
 [unplugin:dts] Start generate declaration files...
-[unplugin:dts] Declaration files built in 4460ms.
+[unplugin:dts] Declaration files built in 5665ms.
 
 computing gzip size...
 dist/index.js  173.72 kB │ gzip: 29.36 kB
 
-✓ built in 4.57s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 4.5s of this 4.6s build (98%).
+✓ built in 5.91s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 5.7s of this 5.9s build (97%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin unplugin-dts buildStart (93%, 4.2s, 1 call)
+  - plugin unplugin-dts buildStart (90%, 5.3s, 1 call)
 Additional callback time came from callbacks under 1s.
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.