@ideem/zsm-client-sdk 2.8.0 → 2.9.0

package/WebAuthnClientBase.js

@@ -74,6 +74,21 @@ class WebAuthnClientBase {
         if(!config?.zsm_host_url)           config.zsm_host_url       = config.zsm_host = config.host_url.replace("zsm-authenticator", "zsm");
         config.host_url = config.zsm_host_url;
 
+        // [J] API key is not strictly required for the client to function, as long as the KVP exists and is in the format of a UUID.
+        // The line below ensures that if an API key is not provided, but an application_id is (which IS required), it will use the 
+        // application_id in place of the absent api_key. If it - application_id - ALSO isn't provided, we DO want the calls to fail - 
+        // and to do so conspicuously (as this indicates a misconfiguration) – so the default string below will be clearly visible inside
+        // of any server-side log outputs and in DevTools Network Panel requests for easy debugging (for both us and for our customers).
+        config.api_key ??= (config?.application_id??"NO APPLICATION_ID PROVIDED! CHECK YOUR zsm_app_config.json!");
+
+        // Once we are certain there's nothing else looking for api_key in the WASM/back-end/Rust code, we can delete the above line and 
+        // uncomment the line below, which will remove the api_key from the config object passed to the WASM module entirely in the event
+        // it is omitted or is not in a valid UUID format. Presently, the ability to do so is contingent upon a specific column's value
+        // inside the Authenticator database: if sdk_authorization_type != "none", then an api_key remains required. Once we've updated all
+        // database records and verified the WASM/Rust code compliance, we can just delete config?.api_key here without any conditions.
+        
+        // if(!config?.api_key || !/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(config.api_key)) delete config.api_key;
+
         this.config      = GLOBAL.zsmAppConfig = config;
 
         iid4uid(this.config.consumer_id)
@@ -210,9 +225,7 @@ class WebAuthnClientBase {
 
         let passkeySupported = false;                                                                                                                                                              // [J] Best-effort detection of platform authenticator support
         try {
-            passkeySupported = !!(typeof window !== 'undefined' && window.PublicKeyCredential
-                                   && navigator?.credentials
-                                   && await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable());
+            passkeySupported = !!(navigator?.credentials);
         } catch { /* unsupported environment */ }
 
         this.credentialID = localData['zsm_credential_id']??null;
@@ -425,7 +438,26 @@ class WebAuthnClientBase {
 
     /**
      * @name            unbindFromDevice
-     * @description     Removes the device binding and stored account data for userIdentifier
+     * @description     Removes the device binding and stored account data for userIdentifier.
+     *
+     *                  Enrollment writes several "ideem"/"zsm" IDB entries for a single user:
+     *                  the uid→iid mapping (key = user identifier), iid-valued string entries
+     *                  (key = "", key = "<hash>/equivalence"), and a credential object
+     *                  (key = "<hash>", value with `zsm_credential` as a Map of WebAuthn
+     *                  fields). The cursor walk below matches each shape: condition (a) for
+     *                  uid-keyed entries, condition (b) for iid-valued strings, condition
+     *                  (c) for the credential Map. Missing any one leaves zombie entries
+     *                  that subsequent checkEnrollment finds.
+     *
+     *                  The IDB operations are wrapped in an awaited Promise so the function
+     *                  returns only after the transaction commits — without this, callers
+     *                  that immediately call checkEnrollment race the cursor's deletes and
+     *                  read stale entries. The zombie-then-stale-read pattern was invisible
+     *                  when install_id was stable per device (the survivors stayed
+     *                  self-consistent across sessions) but becomes a silent failure when
+     *                  install_id varies per session, because the WASM's webauthn_retrieve
+     *                  lookup keys depend on it and finds the prior session's residue.
+     *
      * @param           {String}                  userIdentifier   The Customer-Defined Identifier of the user whose account is to be removed
      * @returns         {Promise<Boolean>}                         Returns true if the user's account was present (and subsequently removed from the device)
      * @returns         {Promise<Boolean>}                         Returns false if there is no credential matching userIdentifier stored on the device
@@ -442,27 +474,39 @@ class WebAuthnClientBase {
 
         const rawID = await this.webauthnRetrieve(userIdentifier);
         if (!rawID) return false;
-
-        const request = indexedDB.open("ideem", 1);
-        request.onsuccess = function(event) {
-            const store = event.target.result.transaction("zsm", "readwrite").objectStore("zsm");
-            const cursorRequest = store.openCursor();
-            cursorRequest.onsuccess = function(event) {
-                const cursor = event.target.result;
-                if (cursor) {
-                    const { key, value } = cursor;
-                    if(
-                        key.includes(userIdentifier) ||
-                        (typeof value === 'string' && value.includes(userIdentifier)) ||
-                        typeof value === 'object' && value?.zsmCredential?.get('rawId') === rawID
-                    )  (store.delete(key), true);
-                    cursor.continue();
-                }
+        const userIid = await iid4uid(userIdentifier);
+
+        await new Promise((resolve, reject) => {
+            const request = indexedDB.open("ideem", 1);
+            request.onerror   = () => reject(new Error(`[WebAuthnClient] :: unbindFromDevice :: Unable to open indexedDB for ${userIdentifier}`));
+            request.onsuccess = (event) => {
+                const db    = event.target.result;
+                const tx    = db.transaction("zsm", "readwrite");
+                const store = tx.objectStore("zsm");
+                tx.oncomplete = () => resolve();
+                tx.onerror    = () => reject(new Error(`[WebAuthnClient] :: unbindFromDevice :: transaction failed for ${userIdentifier}`));
+                tx.onabort    = () => reject(new Error(`[WebAuthnClient] :: unbindFromDevice :: transaction aborted for ${userIdentifier}`));
+                const cursorRequest = store.openCursor();
+                cursorRequest.onerror   = () => reject(new Error(`[WebAuthnClient] :: unbindFromDevice :: cursor failed for ${userIdentifier}`));
+                cursorRequest.onsuccess = (event) => {
+                    const cursor = event.target.result;
+                    if (cursor) {
+                        const { key, value } = cursor;
+                        const matchesStringValue = typeof value === 'string'
+                            && (value.includes(userIdentifier) || value === userIid);
+                        const matchesCredential = typeof value === 'object'
+                            && value !== null
+                            && value.zsm_credential instanceof Map
+                            && value.zsm_credential.get('rawId') === rawID;
+                        if (key.includes(userIdentifier) || matchesStringValue || matchesCredential) {
+                            store.delete(key);
+                        }
+                        cursor.continue();
+                    }
+                };
             };
-            cursorRequest.onerror = (err) => { throw new Error(`[WebAuthnClient] :: unbindFromDevice :: Unable to unbind the device for ${userIdentifier}\n${err}`); };
-        };
-        request.onerror = (err) => { throw new Error(`[WebAuthnClient] :: unbindFromDevice :: Unable to open indexedDB for ${userIdentifier}\n${err}`); };
-        this.webauthnRetrieve(userIdentifier);
+        });
+
         this.status = 'UNENROLL_COMPLETE';
         return true;
     }

package/ZSMClientSDK.js

@@ -37,7 +37,7 @@ zsmPluginManager.registerPlugin('Core', {
     mode: 'OVERRIDE'
 });
 
-const ZSMClientSDKVersion = '2.8.0';
+const ZSMClientSDKVersion = '2.9.0';
 const ZSMVersions = GLOBAL.ZSMVersions = (GLOBAL.ZSMVersions) ? {...GLOBAL.ZSMVersions,  CORE: ZSMClientSDKVersion} : { CORE: ZSMClientSDKVersion }
 
 export { UMFAClient, FIDO2Client, ZSMVersions };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name"          : "@ideem/zsm-client-sdk",
-    "version"       : "2.8.0",
+    "version"       : "2.9.0",
     "description"   : "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
     "keywords"      : [ "ideem", "zsm", "zsm-client-sdk", "umfaclient", "fido2client", "library", "umfa", "fido", "fido2", "client", "javascript", "multifactor", "multi-factor", "webauthn", "authentication", "security", "cryptography", "mpc", "fips", "nist", "mip", "passkeys" ],
     "author"        : "Jason Jurusz <jj@useideem.com>",