@ideem/zsm-client-sdk 2.5.0 → 2.5.1

package/UMFAClientBase.js

@@ -8,7 +8,6 @@ class UMFAClientBase  {
      * @param {Object} config - The configuration for ZSM initialization (ref: ./zsm_app_config.json)
     */
    constructor(config) {
-        if(eventCoordinator.done) eventCoordinator.reset();
         eventCoordinator.update('UMFAClientBase');
         this.config           = config;
         const WebAuthnClient  = zsmPluginManager.classes('WEBAUTHNCLIENT');
@@ -24,6 +23,16 @@ class UMFAClientBase  {
     get userIdentifier()    { return this.zsmAPI.userIdentifier; }
     get credentialID()      { return this.zsmAPI.credentialID;   }
 
+    /**
+     * @name            checkIdentity
+     * @description     Pass-through method to call WebAuthnClient's checkIdentity
+     * @param           {string}                    userIdentifier      The identifier for the user
+     * @param           {boolean}                   primeEnroll         Whether to create a new identity if it doesn't exist
+     * @returns         {Promise<Object>}                               Returns the results of zsmAPI.checkIdentity
+     * @memberOf        FIDO2ClientBase, WebAuthnClient
+     */
+    async checkIdentity    (userIdentifier, primeEnroll) { return this.zsmAPI.checkIdentity(userIdentifier, primeEnroll); }
+
     /**
      * @name            checkEnrollment
      * @description     Checks if a ZSM credential is enrolled on the device for the specified user
@@ -57,14 +66,10 @@ class UMFAClientBase  {
         try {
             if(userIdentifier == null 
                 || userIdentifier === '')     throw new Error(`[UMFAClient] :: enroll :: A userIdentifier String is required! Received: ${userIdentifier}.`);
-            
-            const userIsEnrolled              = await this.checkEnrollment(userIdentifier);
-            if(userIsEnrolled !== false)      return false;
-
-            const createResult                = await this.zsmAPI.webauthnCreateThenPartialGet(userIdentifier);
+            await this.zsmAPI.checkIdentity(userIdentifier, true);
+            const createResult                = await this.zsmAPI.webauthnCreate(userIdentifier); 
             if(createResult instanceof Error) throw(`[UMFAClient] :: enroll :: Unable to associate ${userIdentifier}'s identity with device profile.\nDetails:\n${createResult}`);
-            if(!createResult?.credential)     throw(`[UMFAClient] :: enroll :: Unable to acquire authentication token for ${userIdentifier}!`);
-            return createResult.credential;
+            return createResult;
         }catch(e) {
             return new Error(e.message || e || '[UMFAClient] :: enroll :: An error occurred during enrollment.');
         }

package/WebAuthnClientBase.js

@@ -89,7 +89,7 @@ class WebAuthnClientBase {
      * @param           {Object}                config              The configuration object for ZSM initialization.
      * @returns         {Promise<ZSMAPI>}                           Resolves with the initialized ZSM API.
      */
-    async getZsmApi (config) {}
+    getZsmApi = async (config) => {}
 
     /**
      * @name            primeZsmApi
@@ -105,7 +105,7 @@ class WebAuthnClientBase {
      * @description     Reconfigures the ZSM API, should the consumer_id change (as after an identity_id is obtained)
      * @returns         {Promise<ZSMAPI>}                           Resolves when the ZSM API is reconfigured.
      */
-    async initializeZsm () {
+    initializeZsm = async () => {
         if(GLOBAL.mpcConfig.consumer_id !== this.MPCConfig.consumer_id) {
             // console.log('GLOBAL.mpcConfig :', Object.assign({},GLOBAL.mpcConfig));
             await this.zsmApi.configure(GLOBAL.mpcConfig);
@@ -135,7 +135,7 @@ class WebAuthnClientBase {
             uid2iid(userIdentifier, identityID);
             GLOBAL.mpcConfig.consumer_id = identityID;
             this.status         = 'CHECKING_IDENTITY_FINISHED';
-            return Promise.resolve(identityID);
+            return identityID;
         } catch(err) {
             this.status         = 'CHECKING_IDENTITY_FAILED';
             return Promise.reject(err);
@@ -158,6 +158,8 @@ class WebAuthnClientBase {
         this.status = 'ENROLLMENT_STARTING';
         await this.initializeZsm('webauthnCreate');
 
+        // await this.checkIdentity(userIdentifier, true);
+
         const publicKey = await this.relyingParty.registrationStart();
         if(!publicKey)   throw new Error('[WebAuthnClient] :: webauthnCreate :: Unable to retrieve public key from Relying Party Server!');
 
@@ -190,7 +192,7 @@ class WebAuthnClientBase {
      * @throws          {Error}                                     Throws an error if unable to verify the credential with the Relying Party Server.
      * @throws          {Error}                                     Throws an error if the user ID or token is missing from the response body.
      */
-    async webauthnGet (userIdentifier) {
+    webauthnGet = async (userIdentifier) => {
         this.status = 'AUTHENTICATION_STARTING';
 
         await this.initializeZsm('webauthnGet');
@@ -247,14 +249,14 @@ class WebAuthnClientBase {
      * @returns         {Promise<Boolean>}                          Resolves with the credential ID or `false` if retrieval fails.
      * @returns         {Promise<String>}                           Resolves with the retrieved rawID for the specified user.
      */
-    async webauthnRetrieve (userIdentifier, silent=false) {
+    webauthnRetrieve = async (userIdentifier, silent=false) => {
         this.credentialID = null;
         if (!silent) {
             this.status = 'CREDENTIAL_RETRIEVING';
         }
 
         try {
-            await this.initializeZsm('webauthnRetrieve');
+            this.initializeZsm('webauthnRetrieve');
             let credentialIdentifier     = await iid4uid(userIdentifier);
             GLOBAL.mpcConfig.consumer_id = credentialIdentifier;
 
@@ -275,67 +277,6 @@ class WebAuthnClientBase {
         }
     };
 
-    /**
-     * @name            webauthnCreateThenPartialGet
-     * @description     UMFA-OPTIMIZED FLOW: Creates a new WebAuthn credential and then performs a partial get operation.
-     * @description     This is used to create a new credential and then immediately retrieve it for authentication.
-     * @param           {string}                  userIdentifier    The user identifier.
-     * @returns         {Promise<Object>}                           Resolves with the created credential.
-     * @throws          {Error}                                     Throws an error if unable to retieve public key/regFinishAuthStart from the Relying Party Server.
-     * @throws          {Error}                                     Throws an error if unable to obtain the createResponse/credential from the Crypto Server.
-     */
-    async webauthnCreateThenPartialGet (userIdentifier) {
-        this.status = 'ENROLLMENT_STARTING';
-
-        const returnObj    = await this.relyingParty.createIdentityThenRegistrationStart();
-        if (!returnObj)     throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve public key from Relying Party Server!');
-
-        const {publicKey, identity_id} = returnObj;
-        await this.initializeZsm('webauthnCreateThenPartialGet');
-
-        let createResponse = await this.zsmApi.webauthn_create(publicKey, tracePrimer());
-        if (!createResponse) throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreateThenPartialGet :: Unable to obtain response from Crypto Server!');
-
-        createResponse = toObject(createResponse);
-
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: createResponse }));
-
-        if(!createResponse?.result)            throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreateThenPartialGet :: Unable to obtain credential from Crypto Server!');
-
-        const createCredential = createResponse.result;
-
-        let regFinishAuthStartResponse =  await this.relyingParty.registrationFinishAuthenticationStart(createCredential);
-        if (!regFinishAuthStartResponse) throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve response from Relying Party Server!');
-
-        regFinishAuthStartResponse = toObject(regFinishAuthStartResponse);
-
-        if(!regFinishAuthStartResponse?.rcr || !regFinishAuthStartResponse?.rcr?.publicKey) throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve public key from Relying Party Server!');
-
-        const getChallenge = regFinishAuthStartResponse.rcr.publicKey;
-
-        let getResponse = await this.zsmApi.webauthn_get(getChallenge, tracePrimer());
-        if(!getResponse)                   throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain response from Crypto Server!');
-
-        getResponse = toObject(getResponse);
-
-        if(!getResponse?.result)           throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain credential from Crypto Server!');
-
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: getResponse }));
-
-
-        const getCredential = getResponse.result;
-        let op = {
-            user_id         : userIdentifier,
-            credential      : getCredential,
-            signature       : getCredential.response.signature,
-            signedChallenge : getCredential.response.clientDataJSON,
-            challenge       : getChallenge.challenge,
-        };
-
-        return op;
-
-    };
-
     /**
      * @name            webauthnPartialGet
      * @description     UMFA-OPTIMIZED FLOW: Performs a partial get operation for WebAuthn authentication.
@@ -347,7 +288,7 @@ class WebAuthnClientBase {
      * @throws          {Error}                                    Throws an error if unable to obtain the getResponse/credential from the Crypto Server.
      * @emits           {CustomEvent}                              Emits a "MPCResponse" event with the getResponse data.
      */
-    async webauthnPartialGet (userIdentifier) {
+    webauthnPartialGet = async (userIdentifier) => {
         this.status = 'AUTHENTICATION_STARTING';
         await this.initializeZsm('webauthnPartialGet');
 
@@ -389,7 +330,7 @@ class WebAuthnClientBase {
      * @throws          {Error<CredentialError>}                   Throws an CredentialError if the credential is missing for the userIdentifier provided
      * @throws          {Error<UnenrollError>}                     Throws an UnenrollError if a credential matching userIdentifier IS stored on the device, but was unable to be removed.
      */
-    async unbindFromDevice (userIdentifier) {
+    unbindFromDevice = async (userIdentifier) => {
         this.status = 'UNENROLL_STARTING';
         if(userIdentifier !== this.userIdentifier) return false;
         await this.initializeZsm('unbindFromDevice');

package/package.json

@@ -1,6 +1,6 @@
 {
     "name"            : "@ideem/zsm-client-sdk",
-    "version"         : "2.5.0",
+    "version"         : "2.5.1",
     "description"     : "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
     "author"          : "@JJ (Jason Jurusz) <jj@useideem.com>/<nerdy.deeds@done.cheap>",
     "keywords"        : ["ideem", "zsm", "zsm-client-sdk", "UMFAClient", "FIDO2Client", "library", "UMFA", "FIDO2", "client", "authentication", "javascript", "multi-factor", "webauthn", "authentication", "security", "cryptography", "MPC", "FIPS", "NIST", "FIDO2-ready", "Modules In Progress", "MIP"],

package/shims/VanillaJSLoader.js

@@ -1,96 +0,0 @@
-// @ideem/zsm-client-sdk/shims/VanillaJSLoader.js  (ESM; single-tag, passive loader)
-
-/* ---------- tiny helpers ---------- */
-const $tag = () =>
-    document.querySelector('script[type="module"][src$="shims/VanillaJSLoader.js"]') ||
-document.currentScript ||
-null;
-
-const join = (base, rel) => new URL(String(rel).replace(/^\.\//, ""), base).href;
-
-function computeNodeModulesBase({ allowGuessAtRoot = true } = {}) {
-    const el = $tag();
-    
-    // 1) Explicit overrides (absolute or relative to page)
-    const override = el?.dataset?.nodeModules || window.IDEEM_NODE_MODULES;
-    if (override) return new URL(override, document.baseURI).href.replace(/\/+$/, "/");
-    
-    // 2) Infer from the actual URL this loader was fetched from (or its tag src)
-    const candidates = [
-        (typeof import.meta !== "undefined" && import.meta && import.meta.url) ? import.meta.url : null,
-        el?.src || null,
-    ];
-    
-    for (const c of candidates) {
-        if (!c) continue;
-        try {
-            const href = new URL(c, document.baseURI).href;
-            const m = href.match(/^(.*\/node_modules\/)/i);
-            if (m) return m[1];
-        } catch { /* ignore */ }
-    }
-    
-    // 3) Optional last-ditch guess at site root
-    if (allowGuessAtRoot) return new URL("/node_modules/", document.baseURI).href;
-    
-    throw new TypeError(
-        '[VanillaJSLoader] :: Could not determine the `/node_modules/` base path.\n' +
-        'Pass the path to your `node_modules/` folder via either a `data-node-modules="<URL>"` attribute on the loader <script> ' +
-        'or set window.IDEEM_NODE_MODULES="<URL>" before including the shim <script>.'
-    );
-}
-
-function injectImportMap(imports) {
-    const el = document.createElement("script");
-    el.type = "importmap";
-    el.textContent = JSON.stringify({ imports }, null, 2);
-    document.head.appendChild(el);
-}
-
-async function ensureImportMapSupport() {
-    const hasNative =
-    typeof HTMLScriptElement !== "undefined" &&
-    "supports" in HTMLScriptElement &&
-    HTMLScriptElement.supports?.("importmap");
-    
-    if (hasNative) return; // synchronous path on modern browsers
-    
-    // Load shim from the same shims/ folder as this file, then proceed
-    const s = document.createElement("script");
-    s.defer = true;
-    s.src = new URL("./es-module-shims.js", import.meta.url).href;
-    document.head.appendChild(s);
-    await new Promise((res, rej) => {
-        s.addEventListener("load", res, { once: true });
-        s.addEventListener("error", () => rej(new Error("Failed to load es-module-shims")));
-    });
-}
-
-/* ---------- first-party plugin registry ---------- */
-const PLUGINS = [
-    { pkg: "@ideem/plugins.passkeys-plus",  entry: "PasskeysPlus.js" },
-    { pkg: "@ideem/plugins.perf-logger",    entry: "index.js" },
-    { pkg: "@ideem/plugins.worker-thread",  entry: "WorkerThread.js" },
-];
-
-/* ---------- main ---------- */
-(async function main() {
-    // Only async if we need to load the shim; users never touch promises.
-    await ensureImportMapSupport();
-    
-    const base = computeNodeModulesBase(); // or { allowGuessAtRoot: true } if you prefer
-    
-    // Core SDK (adjust entry filename if different)
-    const imports = {
-        "@ideem/zsm-client-sdk":  join(base, "@ideem/zsm-client-sdk/ZSMClientSDK.js"),
-        "@ideem/zsm-client-sdk/": join(base, "@ideem/zsm-client-sdk/"),
-    };
-    
-    // Map all official plugins (harmless unless actually imported)
-    for (const { pkg, entry } of PLUGINS) {
-        imports[pkg]       = join(base, `${pkg}/${entry}`);
-        imports[`${pkg}/`] = join(base, `${pkg}/`);
-    }
-    
-    injectImportMap(imports);
-})();