@keetanetwork/keetanet-client 0.18.0 → 0.18.2

package/lib/utils/external-keys/passkey-prf.js

@@ -134,6 +134,60 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
     }
     return true;
   }
+
+  /**
+   * Normalize a PRF result value into a Buffer.
+   *
+   * The PRF extension spec types `results.first` as an ArrayBuffer, but in
+   * practice it is a BufferSource and credential providers disagree on the
+   * concrete type they return (see https://github.com/w3c/webauthn/issues/1851).
+   * Notably the 1Password browser extension returns a plain Array of byte
+   * numbers after serializing the WebAuthn response across its content-script
+   * bridge, and some authenticators return an ArrayBufferView (e.g. a
+   * DataView, which has no `slice` method).  Every accepted shape is copied
+   * byte-for-byte so that the derived account is identical regardless of how
+   * the provider encoded the result.
+   */
+  function prfResultToBuffer(value) {
+    /*
+     * Real ArrayBuffer (same realm)
+     */
+    if (value instanceof ArrayBuffer) {
+      return Buffer.from(new Uint8Array(value));
+    }
+
+    /*
+     * TypedArray or DataView: honor byteOffset/byteLength. This check
+     * inspects the internal slot, so it works across realms.
+     */
+    if (ArrayBuffer.isView(value)) {
+      return Buffer.from(new Uint8Array(value.buffer, value.byteOffset, value.byteLength));
+    }
+
+    /*
+     * Cross-realm ArrayBuffer: instanceof fails but it is duck-typed
+     */
+    if (isArrayBufferLike(value)) {
+      return Buffer.from(new Uint8Array(value));
+    }
+
+    /*
+     * Array of byte numbers. 1Password's browser extension returns the PRF
+     * result this way. Each entry must be an integer in [0, 255]: iterate
+     * every position (not Array.prototype.every(), which skips sparse holes)
+     * so that out-of-range, fractional, or missing values are rejected
+     * rather than silently truncated by Buffer.from() into a wrong byte.
+     */
+    if (Array.isArray(value)) {
+      for (const entry of value) {
+        if (!Number.isInteger(entry) || entry < 0 || entry > 255) {
+          throw new Error('PRF extension result value is an array but contains a non-byte entry');
+        }
+      }
+      return Buffer.from(value);
+    }
+    throw new Error(`PRF extension result value is of an unsupported type: ${Object.prototype.toString.call(value)}`);
+  }
   function credentialToEntropy(credential) {
     if (typeof credential !== 'object' || credential === null) {
       throw new Error('Credential is not an object');
@@ -153,16 +207,13 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
       throw new Error('PRF extension does not indicate PRF is enabled');
     }
     if (!('results' in prfExtension) || typeof prfExtension.results !== 'object' || prfExtension.results === null) {
-      throw new Error('PRF extension results do not contain a valid result');
+      return null;
     }
     const prfResults = prfExtension.results;
-    if (!('first' in prfResults) || typeof prfResults.first !== 'object' || prfResults.first === null) {
-      throw new Error('PRF extension results do not contain a "first" value');
+    if (!('first' in prfResults) || prfResults.first === null || prfResults.first === undefined) {
+      return null;
     }
-    if (!isArrayBufferLike(prfResults.first)) {
-      throw new Error('PRF extension "first" value is not an ArrayBuffer');
-    }
-    return Buffer.from(prfResults.first);
+    return prfResultToBuffer(prfResults.first);
   }
   async function entropyToAccount(entropy, index, keyType) {
     const passphrase = bip39.entropyToMnemonic(new Uint8Array(entropy));
@@ -294,14 +345,6 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
       if (syncable) {
         syncableExtraAttributes = {
           authenticatorSelection: {
-            /**
-             * Restricts to the device's built-in authenticator (Touch ID, Face ID,
-             * Windows Hello) backed by the OS keychain. Required for cross-device
-             * sync — only platform authenticators sync passkeys via iCloud Keychain
-             * / Google Password Manager, which is what lets the same passkey work
-             * on web and iOS. Excludes roaming security keys (e.g., YubiKey).
-             */
-            authenticatorAttachment: 'platform',
             /**
              * Required for cross-device sync and usernameless sign-in.
              */
@@ -350,13 +393,33 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
       if (!credentialHasRawId(credential)) {
         throw new Error('Created credential does not have a raw ID');
       }
-      const entropy = credentialToEntropy(credential);
-      const {
-        rawPublicKey
-      } = await entropyToAccount(entropy, index, keyType);
       const keyID = Buffer.from(credential.rawId).toString('base64');
       const rpID = options.rp.id;
-      return new KeetaPasskeyPRFKeyPair({
+      const entropy = credentialToEntropy(credential);
+      let rawPublicKey;
+      /*
+       * If the fallback get() below derives an account, hold onto it so we
+       * can seed the cache and avoid a redundant ceremony.  The non-fallback
+       * path intentionally leaves this undefined: no assertion (get) ceremony was
+       * performed there, so the first sign/decrypt should drive one.
+       */
+      let fallbackAccount;
+      /*
+       * The "credentials.create" may not return the entropy,
+       * so we may need to fetch the credential to get it
+       * (e.g. if the authenticator does not return the PRF
+       * result in the create response, but does return it in
+       * the get response).
+       */
+      if (entropy === null) {
+        const lookupResult = await _lookupByKeyIDWithSalt.call(KeetaPasskeyPRFKeyPair, keyID, salt, index, keyType, rpID);
+        rawPublicKey = lookupResult.rawPublicKey;
+        fallbackAccount = lookupResult.account;
+      } else {
+        const accountInfo = await entropyToAccount(entropy, index, keyType);
+        rawPublicKey = accountInfo.rawPublicKey;
+      }
+      const keyPair = new KeetaPasskeyPRFKeyPair({
         rawPublicKey,
         keyID,
         salt,
@@ -365,6 +428,18 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
         rpID,
         cachedAccountTimeout
       });
+
+      /*
+       * The fallback path already performed a get() to derive the account.
+       * If the caller opted into caching, seed the cache with it so the
+       * first sign/decrypt/export does not trigger a second, redundant
+       * credential ceremony.  #setCachedAccount is a no-op when caching is
+       * disabled.
+       */
+      if (fallbackAccount !== undefined) {
+        _assertClassBrand(_KeetaPasskeyPRFKeyPair_brand, keyPair, _setCachedAccount).call(keyPair, fallbackAccount);
+      }
+      return keyPair;
     }
     removeCachedAccountTimeout() {
       _classPrivateFieldSet(_cachedAccountTimeout, this, undefined);
@@ -428,6 +503,9 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
       keyID = checkKeyID.toString('base64');
     }
     const entropy = credentialToEntropy(credential);
+    if (entropy === null) {
+      throw new Error('PRF extension results do not contain a valid result or result does not have a valid "first" value');
+    }
     const convertedData = await entropyToAccount(entropy, index, keyType);
 
     /* Should we check the challenge is correctly signed ? */
@@ -469,7 +547,8 @@ function KeetaPasskeyPRFKeyPairFactory(packages) {
   }
   /** @internal */
   _defineProperty(KeetaPasskeyPRFKeyPair, "_Testing", {
-    entropyToAccount: entropyToAccount
+    entropyToAccount: entropyToAccount,
+    prfResultToBuffer: prfResultToBuffer
   });
   if (!includeTesting) {
     /**

package/lib/utils/helper_testing.d.ts

@@ -2,6 +2,8 @@ import Account from '../account';
 import LocalNode from '../node/local';
 import { VoteStaple } from '../vote';
 import type { Block } from '../block';
+import { CertificateBuilder } from './certificate';
+import type { Certificate } from './certificate';
 export declare const testingNetworkId = 0n;
 type NodeConfig = ConstructorParameters<typeof LocalNode>[0];
 export declare function canListenOn(ip: string): Promise<boolean>;
@@ -26,6 +28,14 @@ export interface LocalNodeWithPrivateKey extends LocalNode {
 }
 export declare function createTestNode(account: Account, options?: CreateTestNodeOptions): Promise<LocalNodeWithPrivateKey>;
 export declare function getVotesFromSingleNode(node: LocalNode, fromAccount: Account, toAccount: Account, headBlock: Block | null): Promise<VoteStaple>;
+/**
+ * Build a Certificate with defaults for tests.
+ */
+export declare function buildTestCertificate(params: NonNullable<ConstructorParameters<typeof CertificateBuilder>[0]> & {
+    serial: bigint | number;
+    issuer: Account;
+    subjectPublicKey: Account;
+}): Promise<Certificate>;
 /**
  * Run a command and get its output
  */

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
 	"name": "@keetanetwork/keetanet-client",
-	"version": "0.18.0",
+	"version": "0.18.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@keetanetwork/keetanet-client",
-			"version": "0.18.0",
+			"version": "0.18.2",
 			"license": "see LICENSE",
 			"dependencies": {
 				"secp256k1": "5.0.1"
@@ -20,7 +20,7 @@
 			},
 			"optionalDependencies": {
 				"@google-cloud/logging": "11.2.0",
-				"@keetanetwork/asn1-napi-rs": "1.2.2"
+				"@keetanetwork/asn1-napi-rs": "1.2.3"
 			}
 		},
 		"node_modules/@google-cloud/common": {
@@ -182,8 +182,8 @@
 			}
 		},
 		"node_modules/@keetanetwork/asn1-napi-rs": {
-			"version": "1.2.2",
-			"integrity": "sha512-kwxPBWHJv/VYKYpElhwWTbAlxAxFIQzyJmDxOEApKtqf2r4Lpiuq2RXd2lDkojGPLYVZfXrGTalm4e0b4DaYzA==",
+			"version": "1.2.3",
+			"integrity": "sha512-3Uao9FFrzAl6SEMHMiTTF2IGqd1c7N9ZAkKECV0g9jrrqxg75yDYsFhbO2X/uYsZaAuGp0cYVoC6JJCTvp/z4A==",
 			"license": "SEE LICENSE IN LICENSE",
 			"optional": true,
 			"engines": {
@@ -218,8 +218,8 @@
 			"optional": true
 		},
 		"node_modules/@protobufjs/eventemitter": {
-			"version": "1.1.0",
-			"integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
+			"version": "1.1.1",
+			"integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
 			"license": "BSD-3-Clause",
 			"optional": true
 		},
@@ -238,12 +238,6 @@
 			"license": "BSD-3-Clause",
 			"optional": true
 		},
-		"node_modules/@protobufjs/inquire": {
-			"version": "1.1.2",
-			"integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
-			"license": "BSD-3-Clause",
-			"optional": true
-		},
 		"node_modules/@protobufjs/path": {
 			"version": "1.1.2",
 			"integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
@@ -1121,8 +1115,8 @@
 			}
 		},
 		"node_modules/protobufjs": {
-			"version": "7.6.0",
-			"integrity": "sha512-LtESOsMPTZgyYtwxhvdgdjGL0HmXEaRA/hVD6sol4zA60hVXXXP/SGmxnqDbgGE8gy7pYex7cym+5vYPcmaXBQ==",
+			"version": "7.6.4",
+			"integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==",
 			"hasInstallScript": true,
 			"license": "BSD-3-Clause",
 			"optional": true,
@@ -1130,10 +1124,9 @@
 				"@protobufjs/aspromise": "^1.1.2",
 				"@protobufjs/base64": "^1.1.2",
 				"@protobufjs/codegen": "^2.0.5",
-				"@protobufjs/eventemitter": "^1.1.0",
+				"@protobufjs/eventemitter": "^1.1.1",
 				"@protobufjs/fetch": "^1.1.1",
 				"@protobufjs/float": "^1.0.2",
-				"@protobufjs/inquire": "^1.1.2",
 				"@protobufjs/path": "^1.1.2",
 				"@protobufjs/pool": "^1.1.0",
 				"@protobufjs/utf8": "^1.1.1",

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@keetanetwork/keetanet-client",
 	"repository": "https://github.com/keetanetwork/node.git",
-	"version": "0.18.0",
+	"version": "0.18.2",
 	"description": "KeetaNet Client TypeScript Reference Implementation",
 	"files": [
 		"**/*.js",
@@ -24,7 +24,7 @@
 		"secp256k1": "5.0.1"
 	},
 	"optionalDependencies": {
-		"@keetanetwork/asn1-napi-rs": "1.2.2",
+		"@keetanetwork/asn1-napi-rs": "1.2.3",
 		"@google-cloud/logging": "11.2.0"
 	},
 	"browser": "./client/index-browser.js",

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.18.0+g5417d9af948be899fcebb75694edb492ff971891";
+export declare const version = "0.18.2+gac0baac4139da80613edd4a1ebc7532f37fc834a";
 export default version;