@ibgib/web-gib 0.0.60 → 0.0.62

package/src/ui/component/identity/remove-device/remove-device.mts

@@ -220,6 +220,7 @@ export class RemoveDeviceComponentInstance
                 parentKeystone: this.activePrimaryKeystone,
                 delegateTjpAddr,
                 masterSecret,
+                signingPoolId: 'manage',
                 metaspace,
                 space
             });

package/src/ui/ui-constants.mts

@@ -107,6 +107,7 @@ export const EVENT_IBGIB_UI_MESSAGE = 'ibgib-ui-message';
 export const EVENT_IBGIB_IDENTITY_REQUEST_CHANGE = 'ibgib-identity-request-change';
 export const EVENT_IBGIB_IDENTITY_CHANGED = 'ibgib-identity-changed';
 export const EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE = 'ibgib-identity-update-available';
+export const EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED = 'ibgib-identity-renewal-required';
 // #endregion Custom Events
 
 

package/src/ui/ui-helpers.mts

@@ -49,6 +49,9 @@ export interface ShowFullscreenDialogOpts {
     isPassword?: boolean;
     isBusy?: boolean;
     animationEmoji?: string;
+    passkeys?: Record<string, any>;
+    passkeyButtonTitle?: string;
+    onPasskeyAuth?: (passkeyEntry?: any) => Promise<string | undefined>;
 }
 
 export async function showFullscreenDialog(opts: ShowFullscreenDialogOpts & { isBusy: true }): Promise<FullscreenDialogController>;
@@ -64,6 +67,9 @@ export async function showFullscreenDialog({
     isPassword,
     isBusy,
     animationEmoji,
+    passkeys,
+    passkeyButtonTitle,
+    onPasskeyAuth,
 }: ShowFullscreenDialogOpts): Promise<string | undefined | FullscreenDialogController> {
     const lc = `[${showFullscreenDialog.name}]`;
     try {
@@ -112,6 +118,75 @@ export async function showFullscreenDialog({
             messageElement.appendChild(animDiv);
         }
 
+        // Clean up any previous passkey container
+        let prevPasskeyContainer = document.getElementById('fullscreen-dialog-passkey-container');
+        if (prevPasskeyContainer) { prevPasskeyContainer.remove(); }
+
+        let passkeyContainer: HTMLDivElement | null = null;
+        let btnPasskey: HTMLButtonElement | null = null;
+        let selectPasskey: HTMLSelectElement | null = null;
+        const validPasskeys = Object.values(passkeys || {}).filter(p => p !== null && p !== undefined);
+
+        if (validPasskeys.length > 0 && onPasskeyAuth && !isBusy) {
+            passkeyContainer = document.createElement('div');
+            passkeyContainer.id = 'fullscreen-dialog-passkey-container';
+            passkeyContainer.style.margin = '1rem 0';
+            passkeyContainer.style.textAlign = 'center';
+
+            btnPasskey = document.createElement('button');
+            btnPasskey.id = 'fullscreen-dialog-btn-passkey';
+            btnPasskey.type = 'button';
+            btnPasskey.className = 'action-btn';
+            btnPasskey.style.width = '100%';
+            btnPasskey.style.padding = '0.75rem 1rem';
+            btnPasskey.style.background = 'linear-gradient(135deg, #1b5e20, #2e7d32)';
+            btnPasskey.style.color = '#ffffff';
+            btnPasskey.style.fontWeight = 'bold';
+            btnPasskey.style.borderRadius = '8px';
+            btnPasskey.style.border = '1px solid rgba(255,255,255,0.2)';
+            btnPasskey.style.cursor = 'pointer';
+            btnPasskey.style.fontSize = '0.95rem';
+            btnPasskey.style.marginBottom = '0.75rem';
+            btnPasskey.textContent = passkeyButtonTitle || '🛡️ Touch ID / Security Key';
+
+            if (validPasskeys.length > 1) {
+                selectPasskey = document.createElement('select');
+                selectPasskey.style.width = '100%';
+                selectPasskey.style.padding = '0.4rem';
+                selectPasskey.style.marginBottom = '0.5rem';
+                selectPasskey.style.borderRadius = '4px';
+                selectPasskey.style.background = 'rgba(0,0,0,0.3)';
+                selectPasskey.style.color = 'inherit';
+                selectPasskey.style.border = '1px solid rgba(255,255,255,0.2)';
+                validPasskeys.forEach((p: any, idx: number) => {
+                    const opt = document.createElement('option');
+                    opt.value = idx.toString();
+                    opt.textContent = `${p.name || 'Key'} (${p.credentialId?.substring(0, 8)}...)`;
+                    selectPasskey!.appendChild(opt);
+                });
+                passkeyContainer.appendChild(selectPasskey);
+            }
+
+            passkeyContainer.appendChild(btnPasskey);
+
+            const divider = document.createElement('div');
+            divider.style.display = 'flex';
+            divider.style.alignItems = 'center';
+            divider.style.justifyContent = 'center';
+            divider.style.gap = '0.5rem';
+            divider.style.fontSize = '0.8rem';
+            divider.style.color = 'var(--clr-text-secondary, #b3b3b3)';
+            divider.style.margin = '0.5rem 0';
+            divider.innerHTML = `
+                <span style="flex: 1; height: 1px; background: rgba(255,255,255,0.15);"></span>
+                <span>OR enter Password below</span>
+                <span style="flex: 1; height: 1px; background: rgba(255,255,255,0.15);"></span>
+            `;
+            passkeyContainer.appendChild(divider);
+
+            promptInput.parentElement?.insertBefore(passkeyContainer, promptInput);
+        }
+
         // reset the input classList and button displays
         promptInput.classList.remove('collapsed');
         cancelButton.classList.remove('collapsed');
@@ -241,6 +316,12 @@ export async function showFullscreenDialog({
                 if (prompt || showInput) {
                     promptInput.removeEventListener('keypress', onKeypress);
                 }
+                if (btnPasskey) {
+                    btnPasskey.removeEventListener('click', onPasskeyClick);
+                }
+                if (passkeyContainer) {
+                    passkeyContainer.remove();
+                }
                 okButton.removeEventListener('click', onOK);
                 cancelButton.removeEventListener('click', onCancel);
                 dialog.removeEventListener('close', onClose); // Remove dialog-level listener too
@@ -256,6 +337,38 @@ export async function showFullscreenDialog({
                 resolve(result);
             };
 
+            /** user clicks Passkey button */
+            const onPasskeyClick = async () => {
+                try {
+                    if (!onPasskeyAuth) return;
+                    btnPasskey!.disabled = true;
+                    btnPasskey!.textContent = 'Waiting for biometrics / security key...';
+                    let selectedPasskey = validPasskeys[0];
+                    if (selectPasskey) {
+                        const selectedIdx = parseInt(selectPasskey.value, 10);
+                        selectedPasskey = validPasskeys[selectedIdx] || validPasskeys[0];
+                    }
+                    const passkeySecret = await onPasskeyAuth(selectedPasskey);
+                    if (passkeySecret) {
+                        removeEventListeners();
+                        if (promptInput) { promptInput.value = ''; }
+                        dialog.close(passkeySecret);
+                        resolve(passkeySecret);
+                    } else {
+                        btnPasskey!.disabled = false;
+                        btnPasskey!.textContent = passkeyButtonTitle || '🛡️ Touch ID / Security Key';
+                    }
+                } catch (err) {
+                    console.warn('Passkey assertion in dialog failed/cancelled:', err);
+                    btnPasskey!.disabled = false;
+                    btnPasskey!.textContent = passkeyButtonTitle || '🛡️ Touch ID / Security Key';
+                }
+            };
+
+            if (btnPasskey) {
+                btnPasskey.addEventListener('click', onPasskeyClick);
+            }
+
             /** user actively clicks Cancel */
             const onCancel = () => {
                 removeEventListeners();
@@ -264,11 +377,11 @@ export async function showFullscreenDialog({
                 resolve(undefined);
             };
             /**
-             * Handle dialog.close() without button click (e.g., Esc key)
-             *
-             * NOTE: this does not trigger when dialog.close() is executed. This
-             * is only firing when esc is pressed.
-             */
+              * Handle dialog.close() without button click (e.g., Esc key)
+              *
+              * NOTE: this does not trigger when dialog.close() is executed. This
+              * is only firing when esc is pressed.
+              */
             const onClose = () => {
                 removeEventListeners();
                 if (promptInput) { promptInput.value = ''; } // Clear input for next time

package/src/ui/ui-types.mts

@@ -17,3 +17,9 @@ export interface EventIbGibIdentityUpdateAvailableDetail {
     localN: number;
     serverLatestAddr: string;
 }
+
+export interface EventIbGibIdentityRenewalRequiredDetail {
+    activePrimaryAddr: string;
+    primaryTjpAddr: string;
+    reason: 'expired' | 'missing_secret';
+}

package/dist/identity/custodian-delegate-helper.d.mts

@@ -1,22 +0,0 @@
-/**
- * @module identity/custodian-delegate-helper
- *
- * Client-side helper functions for deriving and storing local cryptographic delegate secrets
- * for full-custodian / passwordless identities.
- */
-/**
- * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
- * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
- *
- * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
- */
-export declare function deriveLocalCustodianDelegateSecret({ primaryTjpAddr, }: {
-    primaryTjpAddr: string;
-}): Promise<string>;
-/**
- * Removes the stored local delegate secret for a custodian identity.
- */
-export declare function clearLocalCustodianDelegateSecret({ primaryTjpAddr, }: {
-    primaryTjpAddr: string;
-}): void;
-//# sourceMappingURL=custodian-delegate-helper.d.mts.map

package/dist/identity/custodian-delegate-helper.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"custodian-delegate-helper.d.mts","sourceRoot":"","sources":["../../src/identity/custodian-delegate-helper.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;GAKG;AACH,wBAAsB,kCAAkC,CAAC,EACrD,cAAc,GACjB,EAAE;IACC,cAAc,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDlB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAC9C,cAAc,GACjB,EAAE;IACC,cAAc,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CAIP"}

package/dist/identity/custodian-delegate-helper.mjs

@@ -1,67 +0,0 @@
-/**
- * @module identity/custodian-delegate-helper
- *
- * Client-side helper functions for deriving and storing local cryptographic delegate secrets
- * for full-custodian / passwordless identities.
- */
-import { getUUID, hash, HashAlgorithm, extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
-import { storageGet, storagePut } from "../storage/storage-helpers.web.mjs";
-import { getGlobalDbName, getGlobalStoreName } from "../helpers.web.mjs";
-const LOCAL_STORAGE_PREFIX = 'ibgib_custodian_delegate_secret_';
-/**
- * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
- * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
- *
- * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
- */
-export async function deriveLocalCustodianDelegateSecret({ primaryTjpAddr, }) {
-    const lc = `[${deriveLocalCustodianDelegateSecret.name}]`;
-    try {
-        if (!primaryTjpAddr) {
-            throw new Error('primaryTjpAddr is required to derive local custodian delegate secret (E: a1b2c3d4e5f67890123456789a000101)');
-        }
-        const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-        const dbName = getGlobalDbName();
-        const storeName = getGlobalStoreName();
-        // debugger; // what are the dbName and storeName?
-        const existingSecret = await storageGet({ dbName, storeName, key });
-        if (existingSecret) {
-            return existingSecret;
-        }
-        // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        const rawEntropy = await getUUID(32);
-        const newSecret = await hash({
-            s: rawEntropy,
-            algorithm: HashAlgorithm.sha_512
-        });
-        await storagePut({ dbName, storeName, key, value: newSecret });
-        return newSecret;
-        // const existingSecret = localStorage.getItem(key);
-        // if (existingSecret) {
-        //     return existingSecret;
-        // }
-        // // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        // const rawEntropy = `${await getUUID()}-${await getUUID()}-${await getUUID()}-${Date.now()}`;
-        // const newSecret = await hash({
-        //     s: rawEntropy,
-        //     algorithm: HashAlgorithm.sha_512
-        // });
-        // localStorage.setItem(key, newSecret);
-        // return newSecret;
-    }
-    catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    }
-}
-/**
- * Removes the stored local delegate secret for a custodian identity.
- */
-export function clearLocalCustodianDelegateSecret({ primaryTjpAddr, }) {
-    if (!primaryTjpAddr) {
-        return;
-    }
-    const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-    localStorage.removeItem(key);
-}
-//# sourceMappingURL=custodian-delegate-helper.mjs.map

package/dist/identity/custodian-delegate-helper.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"custodian-delegate-helper.mjs","sourceRoot":"","sources":["../../src/identity/custodian-delegate-helper.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,EACrD,cAAc,GAGjB;IACG,MAAM,EAAE,GAAG,IAAI,kCAAkC,CAAC,IAAI,GAAG,CAAC;IAC1D,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,cAAc,EAAE,CAAC;QAEvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QAEvC,kDAAkD;QAGlD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QAED,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;YACzB,CAAC,EAAE,UAAU;YACb,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/D,OAAO,SAAS,CAAC;QAGjB,oDAAoD;QACpD,wBAAwB;QACxB,6BAA6B;QAC7B,IAAI;QAEJ,oEAAoE;QACpE,+FAA+F;QAC/F,iCAAiC;QACjC,qBAAqB;QACrB,uCAAuC;QACvC,MAAM;QAEN,wCAAwC;QACxC,oBAAoB;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,EAC9C,cAAc,GAGjB;IACG,IAAI,CAAC,cAAc,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,cAAc,EAAE,CAAC;IACvD,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/src/identity/custodian-delegate-helper.mts

@@ -1,86 +0,0 @@
-/**
- * @module identity/custodian-delegate-helper
- *
- * Client-side helper functions for deriving and storing local cryptographic delegate secrets
- * for full-custodian / passwordless identities.
- */
-
-import { getUUID, hash, HashAlgorithm, extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
-import { storageGet, storagePut } from "../storage/storage-helpers.web.mjs";
-import { getGlobalDbName, getGlobalStoreName } from "../helpers.web.mjs";
-
-const LOCAL_STORAGE_PREFIX = 'ibgib_custodian_delegate_secret_';
-
-/**
- * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
- * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
- *
- * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
- */
-export async function deriveLocalCustodianDelegateSecret({
-    primaryTjpAddr,
-}: {
-    primaryTjpAddr: string;
-}): Promise<string> {
-    const lc = `[${deriveLocalCustodianDelegateSecret.name}]`;
-    try {
-        if (!primaryTjpAddr) {
-            throw new Error('primaryTjpAddr is required to derive local custodian delegate secret (E: a1b2c3d4e5f67890123456789a000101)');
-        }
-
-        const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-
-        const dbName = getGlobalDbName();
-        const storeName = getGlobalStoreName();
-
-        // debugger; // what are the dbName and storeName?
-
-
-        const existingSecret = await storageGet({ dbName, storeName, key });
-        if (existingSecret) {
-            return existingSecret;
-        }
-
-        // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        const rawEntropy = await getUUID(32);
-        const newSecret = await hash({
-            s: rawEntropy,
-            algorithm: HashAlgorithm.sha_512
-        });
-        await storagePut({ dbName, storeName, key, value: newSecret });
-
-        return newSecret;
-
-
-        // const existingSecret = localStorage.getItem(key);
-        // if (existingSecret) {
-        //     return existingSecret;
-        // }
-
-        // // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        // const rawEntropy = `${await getUUID()}-${await getUUID()}-${await getUUID()}-${Date.now()}`;
-        // const newSecret = await hash({
-        //     s: rawEntropy,
-        //     algorithm: HashAlgorithm.sha_512
-        // });
-
-        // localStorage.setItem(key, newSecret);
-        // return newSecret;
-    } catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    }
-}
-
-/**
- * Removes the stored local delegate secret for a custodian identity.
- */
-export function clearLocalCustodianDelegateSecret({
-    primaryTjpAddr,
-}: {
-    primaryTjpAddr: string;
-}): void {
-    if (!primaryTjpAddr) { return; }
-    const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-    localStorage.removeItem(key);
-}