@le-space/orbitdb-identity-provider-webauthn-did 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -2,6 +2,58 @@
 
 ## Unreleased
 
+## 0.4.2
+
+### Fixed
+
+- Restore debug logging in the browser. `weald`, which `@libp2p/logger` uses,
+  does `import { ms as humanize } from 'ms'` — a named export that only exists
+  in `ms@3`+. All three demos pinned `ms` to `2.1.3`, which is CommonJS with no
+  named export, so the import resolved to `undefined` and the first debug call
+  threw `TypeError: (0, import_ms2.ms) is not a function`. Enabling `DEBUG` in a
+  browser therefore crashed credential creation outright. Dropping the pin lets
+  `weald` resolve the version it declares.
+
+  This is why `webauthn-logging-e2e` had been failing continuously: it is the
+  only suite that sets `localStorage.debug`, so it was the only one to reach the
+  broken path.
+
+- Clear the production dependency advisories. `iso-web > iso-kv > conf > ajv`
+  carried four high `fast-uri` advisories and one moderate `ajv` one; the scoped
+  overrides `conf>ajv` and `ajv>fast-uri` resolve it. Scoped deliberately: a
+  blanket `ajv` override also hits ESLint, which needs ajv 6 and dies on the
+  removed `missingRefs` option.
+  `pnpm audit --prod` now reports nothing, so the enforced CI gate moves from
+  `critical` to `moderate`.
+- Stop writing WebAuthn credentials to the console. `logWebAuthnResponse()` dumped
+  the whole credential — `rawId`, `attestationObject`, `clientDataJSON`,
+  `signature`, `getPublicKey()` and `getClientExtensionResults()` — on every
+  `navigator.credentials.create()` and `.get()`, unconditionally and in
+  production code paths. Two things made that more than noise: extension results
+  can carry the PRF output, which is what both the keystore encryption and (since
+  0.4.1) the OrbitDB signing key derive from, and `rawId` is a stable per-user,
+  per-RP identifier that landed in any console capture or session replay the
+  embedding app happened to run. Replaced by a single shared helper that logs
+  shape only — byte lengths, presence flags and the names of the extensions that
+  returned results — behind the package debug logger, so it is silent unless
+  `DEBUG=orbitdb-identity-provider-webauthn-did*` is set. Closes #22.
+- Keep the demos' P2P component out of the server render. Turning on `ssr`
+  so prerendering emitted real content also meant `+page.svelte` was evaluated
+  in Node, and it imported the libp2p stack at module scope — reaching
+  `@libp2p/webrtc` and its native `node-datachannel` binding, which the demos
+  do not build. The dev server returned 500 for every request. The component is
+  loaded in the browser only now; the shared shell still renders server-side, so
+  prerendering keeps producing a real title and description.
+
+### Changed
+
+- Route the remaining informational `console.log` output through the debug
+  logger. A library should not print unconditionally; `console.error` and
+  `console.warn` stay as they are, so genuine failures remain visible. `src/`
+  went from 61 `console.*` calls to 16, none of them `console.log`.
+- Deduplicate three byte-identical copies of the WebAuthn debug helper into
+  `src/webauthn/debug-log.js`.
+
 ## 0.4.1
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",
@@ -143,7 +143,9 @@
       "iso-base": "npm:@le-space/iso-base",
       "iso-did": "npm:@le-space/iso-did@2.1.2",
       "iso-web": "^3.1.2",
-      "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig@^0.2.0"
+      "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig@^0.2.0",
+      "conf>ajv": "^8.18.0",
+      "ajv>fast-uri": "^3.1.4"
     },
     "onlyBuiltDependencies": [
       "@ipshipyard/node-datachannel",

package/src/keystore/provider.js

@@ -77,10 +77,6 @@ export class OrbitDBWebAuthnIdentityProvider {
     return IDENTITY_TYPES.WEBAUTHN;
   }
 
-  /**
-   * Resolve the identity DID.
-   * @returns {Promise<string>} DID string.
-   */
   /**
    * Resolve the identity DID.
    *
@@ -352,11 +348,11 @@ export class OrbitDBWebAuthnIdentityProvider {
    */
   async createEncryptedKeystore() {
     if (!this.encryptKeystore) {
-      console.log('ℹ️ Keystore encryption not enabled, skipping');
+      identityLog('ℹ️ Keystore encryption not enabled, skipping');
       return;
     }
 
-    console.log(
+    identityLog(
       '🔐 Creating encrypted keystore with method:',
       this.keystoreEncryptionMethod
     );
@@ -448,7 +444,7 @@ export class OrbitDBWebAuthnIdentityProvider {
       }
 
       // Store encrypted keystore
-      console.log(
+      identityLog(
         '💾 Storing encrypted keystore with credentialId:',
         this.credential.credentialId?.substring(0, 16) + '...'
       );
@@ -461,7 +457,7 @@ export class OrbitDBWebAuthnIdentityProvider {
         publicKey: publicKeyBytes,
         keyType,
       };
-      console.log('✅ Encrypted keystore stored successfully');
+      identityLog('✅ Encrypted keystore stored successfully');
 
       identityLog('Encrypted keystore created and stored successfully');
     } catch (error) {
@@ -649,15 +645,15 @@ export class OrbitDBWebAuthnIdentityProvider {
     // If encryption is enabled, create and unlock encrypted keystore
     if (encryptKeystore && keystore) {
       try {
-        console.log(
+        identityLog(
           '🔐 Creating encrypted keystore with',
           keystoreEncryptionMethod,
           '...'
         );
         await provider.createEncryptedKeystore();
-        console.log('🔓 Unlocking encrypted keystore...');
+        identityLog('🔓 Unlocking encrypted keystore...');
         await provider.unlockEncryptedKeystore();
-        console.log('✅ Encrypted keystore created and unlocked successfully');
+        identityLog('✅ Encrypted keystore created and unlocked successfully');
         identityLog('Encrypted keystore created and unlocked');
       } catch (error) {
         // Log error visibly so users know encryption failed

package/src/varsig/assertion.js

@@ -19,40 +19,11 @@ import {
   VarsigVerificationError,
   WebAuthnAuthenticationError,
 } from '../errors.js';
+import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
 const isTestMode = () =>
   typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
 
-function logWebAuthnResponse(label, credential) {
-  const response = credential?.response;
-  const getPublicKeyResult =
-    typeof response?.getPublicKey === 'function'
-      ? response.getPublicKey()
-      : null;
-
-  console.group(`[WebAuthn Debug] ${label}`);
-  console.log('credential', credential);
-  console.log('credential.id', credential?.id);
-  console.log('credential.type', credential?.type);
-  console.log('credential.rawId', credential?.rawId);
-  console.log('credential.response', response);
-  console.log('response.clientDataJSON', response?.clientDataJSON);
-  console.log('response.attestationObject', response?.attestationObject);
-  console.log('response.authenticatorData', response?.authenticatorData);
-  console.log('response.signature', response?.signature);
-  console.log('response.userHandle', response?.userHandle);
-  console.log(
-    'response.getPublicKey exists',
-    typeof response?.getPublicKey === 'function'
-  );
-  console.log('response.getPublicKey()', getPublicKeyResult);
-  console.log(
-    'client extension results',
-    credential?.getClientExtensionResults?.() || null
-  );
-  console.groupEnd();
-}
-
 /**
  * Run a WebAuthn assertion for a payload.
  * @param {Object} credential - WebAuthn credential info.

package/src/varsig/credential.js

@@ -5,40 +5,11 @@ import { DIDKey } from 'iso-did';
 import { parseAttestationObject } from 'iso-passkeys';
 import { toArrayBuffer } from './utils.js';
 import { buildAuthenticatorSelection } from '../webauthn/config.js';
+import { logWebAuthnResponse } from '../webauthn/debug-log.js';
 
 const isTestMode = () =>
   typeof window !== 'undefined' && window.__PLAYWRIGHT__ === true;
 
-function logWebAuthnResponse(label, credential) {
-  const response = credential?.response;
-  const getPublicKeyResult =
-    typeof response?.getPublicKey === 'function'
-      ? response.getPublicKey()
-      : null;
-
-  console.group(`[WebAuthn Debug] ${label}`);
-  console.log('credential', credential);
-  console.log('credential.id', credential?.id);
-  console.log('credential.type', credential?.type);
-  console.log('credential.rawId', credential?.rawId);
-  console.log('credential.response', response);
-  console.log('response.clientDataJSON', response?.clientDataJSON);
-  console.log('response.attestationObject', response?.attestationObject);
-  console.log('response.authenticatorData', response?.authenticatorData);
-  console.log('response.signature', response?.signature);
-  console.log('response.userHandle', response?.userHandle);
-  console.log(
-    'response.getPublicKey exists',
-    typeof response?.getPublicKey === 'function'
-  );
-  console.log('response.getPublicKey()', getPublicKeyResult);
-  console.log(
-    'client extension results',
-    credential?.getClientExtensionResults?.() || null
-  );
-  console.groupEnd();
-}
-
 /**
  * Extract public key info from a WebAuthn attestation object.
  * @param {Uint8Array} attestationObject - Raw attestation object bytes.

package/src/verification.js

@@ -7,6 +7,10 @@
  * without relying on external network calls or IPFS gateway timeouts.
  */
 
+import { logger } from '@libp2p/logger';
+
+const log = logger('orbitdb-identity-provider-webauthn-did:verification');
+
 /**
  * Verify database update events using pragmatic approach
  * @param {Object} database - The OrbitDB database instance
@@ -19,7 +23,7 @@ export async function verifyDatabaseUpdate(
   identityHash,
   expectedWebAuthnDID
 ) {
-  console.log('🔄 Verifying database update event');
+  log('🔄 Verifying database update event');
 
   // Simple logic: if an update is happening in our database and our database
   // identity matches the expected WebAuthn DID, then the update is from us
@@ -72,7 +76,7 @@ export async function verifyIdentityStorage(
   identity,
   timeoutMs = 5000
 ) {
-  console.log('🔍 Verifying identity storage...');
+  log('🔍 Verifying identity storage...');
 
   try {
     // Try to retrieve the identity from the store with a timeout
@@ -131,10 +135,8 @@ export async function verifyDataEntries(
   const { matchFn, checkLog = true } = options;
   const verificationResults = new Map();
 
-  console.log(
-    `🔍 Starting verification of ${dataEntries.length} data entries...`
-  );
-  console.log(`🎯 Expected WebAuthn DID: ${expectedWebAuthnDID}`);
+  log(`🔍 Starting verification of ${dataEntries.length} data entries...`);
+  log(`🎯 Expected WebAuthn DID: ${expectedWebAuthnDID}`);
 
   try {
     // Check if our database identity matches the expected WebAuthn DID
@@ -142,7 +144,7 @@ export async function verifyDataEntries(
     const databaseIdentityMatches =
       databaseIdentity?.id === expectedWebAuthnDID;
 
-    console.log('🔑 Database identity check:', {
+    log('🔑 Database identity check:', {
       databaseDID: databaseIdentity?.id,
       expectedDID: expectedWebAuthnDID,
       matches: databaseIdentityMatches,
@@ -150,7 +152,7 @@ export async function verifyDataEntries(
 
     for (const entry of dataEntries) {
       try {
-        console.log(`📝 Verifying entry: ${entry.id}`);
+        log(`📝 Verifying entry: ${entry.id}`);
 
         // Method 1: Check if we can access the entry in our database
         const entryInDb = await database.get(entry.id);
@@ -204,7 +206,7 @@ export async function verifyDataEntries(
 
         verificationResults.set(entry.id, result);
 
-        console.log(
+        log(
           `${verificationSuccess ? '✅' : '❌'} Entry ${entry.id}: ${verificationSuccess ? 'VERIFIED' : 'FAILED'}`
         );
       } catch (error) {
@@ -232,7 +234,7 @@ export async function verifyDataEntries(
     }
   }
 
-  console.log(
+  log(
     `✅ Verification completed: ${verificationResults.size} entries processed`
   );
   return verificationResults;

package/src/webauthn/debug-log.js

@@ -0,0 +1,101 @@
+/**
+ * @module WebAuthnDebugLog
+ * @description
+ * Describes a WebAuthn credential or assertion for debugging without putting
+ * its contents anywhere.
+ *
+ * This replaces three copies of a helper that wrote the whole credential to
+ * `console` on every `navigator.credentials.create()` and `.get()` —
+ * unconditionally, in production code paths. Two reasons that mattered:
+ *
+ * - `getClientExtensionResults()` was logged verbatim. Since 0.4.1 the PRF
+ *   extension is requested on every credential, so that object can carry the
+ *   PRF output, which is the material both the keystore encryption and the
+ *   OrbitDB signing key are derived from.
+ * - `rawId` is a stable per-user, per-RP identifier. Emitting it on every call
+ *   put it into any console capture, error reporter or session replay the
+ *   embedding app happens to run.
+ *
+ * What is logged here is shape, not content: byte lengths, presence flags, and
+ * which extensions came back. Enough to tell "the authenticator returned no PRF
+ * result" from "the assertion never happened", which is what these logs were
+ * ever used for.
+ *
+ * See issue #22.
+ */
+import { logger } from '@libp2p/logger';
+
+const log = logger('orbitdb-identity-provider-webauthn-did:webauthn');
+
+/**
+ * Byte length of an ArrayBuffer or view, or null when absent.
+ * @param {ArrayBuffer|ArrayBufferView|null|undefined} value - Buffer-ish value.
+ * @returns {number|null} Length in bytes, or null.
+ */
+function byteLength(value) {
+  if (!value) return null;
+  if (typeof value.byteLength === 'number') return value.byteLength;
+  if (typeof value.length === 'number') return value.length;
+  return null;
+}
+
+/**
+ * Names of the extensions that returned results, without their values.
+ *
+ * The names alone are diagnostic — they say whether PRF engaged. The values are
+ * key material and never belong in a log.
+ *
+ * @param {PublicKeyCredential} credential - Credential or assertion.
+ * @returns {string[]|null} Extension names, or null if unavailable.
+ */
+function extensionNames(credential) {
+  try {
+    const results = credential?.getClientExtensionResults?.();
+    return results ? Object.keys(results) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Describe a WebAuthn response by shape alone.
+ *
+ * Every value here is a length, a boolean or an extension name. Nothing
+ * derived from credential bytes, and no extension values. Exported so the
+ * redaction can be asserted in tests rather than assumed.
+ *
+ * @param {PublicKeyCredential} credential - Credential or assertion.
+ * @returns {Object} Redacted description.
+ */
+export function describeWebAuthnResponse(credential) {
+  const response = credential?.response;
+
+  return {
+    type: credential?.type ?? null,
+    rawIdBytes: byteLength(credential?.rawId),
+    clientDataJSONBytes: byteLength(response?.clientDataJSON),
+    // Registration only.
+    attestationObjectBytes: byteLength(response?.attestationObject),
+    hasGetPublicKey: typeof response?.getPublicKey === 'function',
+    // Assertion only.
+    authenticatorDataBytes: byteLength(response?.authenticatorData),
+    signatureBytes: byteLength(response?.signature),
+    hasUserHandle: Boolean(response?.userHandle),
+    extensions: extensionNames(credential),
+  };
+}
+
+/**
+ * Log the shape of a WebAuthn response.
+ *
+ * Goes through the package debug logger, so it is off unless
+ * `DEBUG=orbitdb-identity-provider-webauthn-did*` is set, and it never writes
+ * credential contents.
+ *
+ * @param {string} label - What produced the response.
+ * @param {PublicKeyCredential} credential - Credential or assertion.
+ */
+export function logWebAuthnResponse(label, credential) {
+  if (!log.enabled) return;
+  log('%s returned: %o', label, describeWebAuthnResponse(credential));
+}

package/src/webauthn/provider.js

@@ -27,39 +27,10 @@ import {
   buildAuthenticatorSelection,
   buildCredentialRequestOptions,
 } from './config.js';
+import { logWebAuthnResponse } from './debug-log.js';
 
 const webauthnLog = logger('orbitdb-identity-provider-webauthn-did:webauthn');
 
-function logWebAuthnResponse(label, credential) {
-  const response = credential?.response;
-  const getPublicKeyResult =
-    typeof response?.getPublicKey === 'function'
-      ? response.getPublicKey()
-      : null;
-
-  console.group(`[WebAuthn Debug] ${label}`);
-  console.log('credential', credential);
-  console.log('credential.id', credential?.id);
-  console.log('credential.type', credential?.type);
-  console.log('credential.rawId', credential?.rawId);
-  console.log('credential.response', response);
-  console.log('response.clientDataJSON', response?.clientDataJSON);
-  console.log('response.attestationObject', response?.attestationObject);
-  console.log('response.authenticatorData', response?.authenticatorData);
-  console.log('response.signature', response?.signature);
-  console.log('response.userHandle', response?.userHandle);
-  console.log(
-    'response.getPublicKey exists',
-    typeof response?.getPublicKey === 'function'
-  );
-  console.log('response.getPublicKey()', getPublicKeyResult);
-  console.log(
-    'client extension results',
-    credential?.getClientExtensionResults?.() || null
-  );
-  console.groupEnd();
-}
-
 /**
  * WebAuthn DID Provider Core Implementation
  */