@hollware/server 0.10.0 → 0.11.0

package/dist/{ceremonies-DDoGdUD7.mjs → ceremonies-CI3DkOEL.mjs}

@@ -1,4 +1,4 @@
-import { a as findInvitation, c as invitationById, d as redeemInvitation, f as saveChallenge, h as userHandle, i as createUser, m as touchPasskey, o as findPasskey, p as takeChallenge, r as createSession, t as addPasskey, u as passkeysOf } from "./store-BPr9-wKy.mjs";
+import { _ as saveChallenge, b as userHandle, c as findInvitation, d as invitationById, h as redeemInvitation, i as createUser, l as findPasskey, m as passkeysOf, r as createSession, t as addPasskey, v as takeChallenge, y as touchPasskey } from "./store-DjA9s95l.mjs";
 import { HollwareError, newId } from "@hollware/core";
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
 import { isoBase64URL } from "@simplewebauthn/server/helpers";
@@ -15,6 +15,18 @@ function relyingParty(ceremony) {
 function refused(message, fix) {
 	return new HollwareError("invalid_input", message, fix);
 }
+/**
+* A verification of the library, or `{ verified: false }` when it throws: it throws for a response
+* from another origin, without user verification, or with a counter that went back, and each of
+* those is a passkey that could not be verified, not a failure of the server.
+*/
+async function unlessThrown(verify) {
+	try {
+		return await verify();
+	} catch {
+		return { verified: false };
+	}
+}
 /** The options of `navigator.credentials.create` for the person of an invitation. */
 async function registrationOptions(ceremony, invitationSecret) {
 	const invitation = await findInvitation(ceremony.db, invitationSecret, ceremony.now);
@@ -57,12 +69,13 @@ async function verifyRegistration(ceremony, input) {
 	});
 	if (challenge === null || challenge.invitationId === null || challenge.userId === null) throw refused("The registration expired.", "Start again from the link.");
 	const rp = relyingParty(ceremony);
-	const verified = await verifyRegistrationResponse({
+	const verified = await unlessThrown(() => verifyRegistrationResponse({
 		response: input.response,
 		expectedChallenge: challenge.challenge,
 		expectedOrigin: rp.origin,
-		expectedRPID: rp.id
-	});
+		expectedRPID: rp.id,
+		requireUserVerification: true
+	}));
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
 	const invitation = await invitationById(ceremony.db, challenge.invitationId);
 	if (invitation === null || !await redeemInvitation(ceremony.db, invitation.id, ceremony.now)) throw refused("This link is not valid: it was used already, or it expired.", "Ask the owner of this Hollware for a new invitation.");
@@ -122,18 +135,19 @@ async function verifyAuthentication(ceremony, input) {
 	const passkey = await findPasskey(ceremony.db, input.response.id);
 	if (passkey === null) throw refused("This passkey is not one of this Hollware.", "Use a passkey you registered here.");
 	const rp = relyingParty(ceremony);
-	const verified = await verifyAuthenticationResponse({
+	const verified = await unlessThrown(() => verifyAuthenticationResponse({
 		response: input.response,
 		expectedChallenge: challenge.challenge,
 		expectedOrigin: rp.origin,
 		expectedRPID: rp.id,
+		requireUserVerification: true,
 		credential: {
 			id: passkey.credentialId,
 			publicKey: isoBase64URL.toBuffer(passkey.publicKey),
 			counter: passkey.counter,
 			transports: JSON.parse(passkey.transports)
 		}
-	});
+	}));
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
 	await touchPasskey(ceremony.db, passkey.id, verified.authenticationInfo.newCounter, ceremony.now);
 	const session = await createSession(ceremony.db, {

package/dist/index.d.mts

@@ -663,6 +663,13 @@ export interface HollwareEnv {
    * Personal tokens work without it; OAuth does not.
    */
   readonly OAUTH_KV: KVNamespace;
+  /**
+   * A Workers Rate Limiting binding (`ratelimits` in wrangler.jsonc): with it, the routes anyone
+   * may call without a token (sign-in and passkeys, OAuth's token and registration, the beacon)
+   * answer 429 past its limit, per address and route (T-10 of docs/security/threat-model.md).
+   * Without it, nothing is limited.
+   */
+  readonly HOLLWARE_RATE_LIMIT?: RateLimiter;
   /** The static assets of the Worker, which hold the admin at `/admin/`; without them, no admin. */
   readonly ASSETS?: Fetcher;
   /** The Queue of publication events (ADR-025); without it, the cron trigger delivers them. */
@@ -706,6 +713,12 @@ export interface HollwareRpc {
     readonly formats?: readonly ('markdown' | 'document' | 'html')[];
     /** Also the published entries closest by meaning (ADR-030). */
     readonly related?: boolean;
+    /**
+     * A preview token (`hw_prv_…`, made in the admin): the entry it names is read in its latest
+     * revision, a draft included. A token that does not hold (expired, of another site or
+     * entry, forged) is an `invalid_input` error, never the published version in its place.
+     */
+    readonly preview?: string;
   }): Promise<Output<typeof getEntry>>;
   listEntries(site: string, collection: string, options?: {
     readonly locale?: string;
@@ -750,5 +763,13 @@ export type CreateHollware = (config?: HollwareConfig) => HollwareWorker;
  * The config is resolved once, here; a broken one throws its `ConfigError`.
  */
 export declare const createHollware: CreateHollware;
+/** What a Workers Rate Limiting binding answers: whether one more request for `key` fits. */
+export interface RateLimiter {
+  limit(options: {
+    readonly key: string;
+  }): Promise<{
+    readonly success: boolean;
+  }>;
+}
 //#endregion
 export type { Actor, AnalyticsReader, AnalyticsWriter, Clock, ContentStore, Embedder, EntrySummaryView, EntryView, EventMessage, Handlers, InTrash, ListQuery, NewRevision, OperationContext, OperationHandler, OutboxEvent, PageCount, PageView, Principal, PublishWrite, RelatedEntry, ReviewStatus, RevisionSummary, SearchHit, SearchQuery, Semantic, StoredEntry, StoredPublication, StoredReview, StoredReviewComment, StoredRevision, StoredSchedule, StoredStructure, StoredVector, Structure, StructureActor, StructureStore, VectorIndex, VectorMatch, VectorMetadata, View, WriteRefusal };