@le-space/orbitdb-identity-provider-webauthn-did 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changes
 
+## 0.9.1
+
+`createCredential` honours the choice of authenticator that its options, its types and
+`docs/API.md` have offered all along.
+
+### Fixed
+
+- `authenticatorType` (`'platform'`, `'cross-platform'` or `'any'`) and its WebAuthn name
+  `authenticatorAttachment` reach the browser. Since 0.2.8 neither did: `buildAuthenticatorSelection`
+  dropped them, so the request named no attachment and the browser offered every kind of
+  authenticator, a security key as much as the device's own — though the code asked for
+  `'platform'`. That stays the default, so nothing changes for a caller that passes neither.
+- An unknown value, or the two disagreeing, is a `TypeError` before anyone is asked, instead of
+  being ignored.
+
+Tested in Chromium with a virtual authenticator on the USB transport: offered by default, asked for
+with `'cross-platform'`, never asked with `'platform'`. The vault test from 0.9.0 now also runs with
+two such security keys.
+
 ## 0.9.0
 
 What applications kept writing for themselves, once and here: one read of the PRF output for every

package/README.md

@@ -19,6 +19,7 @@ This package provides:
 - Authentication/assertion requests omit `allowCredentials` by default, so the browser/authenticator can resolve the credential discoverably.
 - You can switch this centrally with `configureWebAuthn({ discoverableCredentials: true|false })`.
 - Registration is still the point where this package extracts the credential public key from attestation.
+- Registration offers every kind of authenticator — the device's own, a security key such as a YubiKey, a phone — unless `createCredential({ authenticatorType: 'platform' | 'cross-platform' })` narrows it (honoured since 0.9.1).
 - Later `navigator.credentials.get()` assertions do not reliably return the public key again, so identity reconstruction still needs metadata from somewhere else.
 
 Since **0.6.0** the passkey alone is enough, and stored metadata is a convenience rather than a requirement:

package/docs/API.md

@@ -61,7 +61,17 @@ Options:
 - `encryptKeystore?: boolean`
 - `keystoreEncryptionMethod?: 'prf' | 'largeBlob' | 'hmac-secret'`
 - `discoverableCredentials?: boolean`
-- `authenticatorType?: 'platform' | 'cross-platform' | 'any'`
+- `authenticatorType?: 'platform' | 'cross-platform' | 'any'` — which
+  authenticators the browser offers: the device's own (Touch ID, Windows
+  Hello, a phone's screen lock), a security key or another phone, or every
+  kind. `'any'` is the default and names none in the request.
+- `authenticatorAttachment?: 'platform' | 'cross-platform'` — the WebAuthn name
+  for the same choice. Giving both with different values, or a value neither
+  knows, throws a `TypeError` before anyone is asked.
+
+Before 0.9.1 both were listed here and neither reached the browser: the request
+named no attachment, so every kind of authenticator was offered — a YubiKey as
+much as the device's own. That is still the default.
 
 ```js
 const credential = await WebAuthnDIDProvider.createCredential({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "types": "types/index.d.ts",

package/src/webauthn/config.js

@@ -44,6 +44,65 @@ export function resolveWebAuthnConfig(options = {}) {
   };
 }
 
+const AUTHENTICATOR_TYPES = ['platform', 'cross-platform', 'any'];
+const AUTHENTICATOR_ATTACHMENTS = ['platform', 'cross-platform'];
+
+/**
+ * The attachment a registration asks for: `authenticatorType` —
+ * `'platform'` (the device's own authenticator), `'cross-platform'` (a
+ * security key or a phone) or `'any'` — or its WebAuthn name
+ * `authenticatorAttachment`, which has no word for "any".
+ *
+ * A value this does not know is refused rather than ignored: a typo would
+ * otherwise quietly offer every authenticator, or none the caller meant.
+ *
+ * @param {Object} [options]
+ * @param {'platform'|'cross-platform'|'any'} [options.authenticatorType]
+ * @param {'platform'|'cross-platform'} [options.authenticatorAttachment]
+ * @param {'platform'|'cross-platform'|'any'} [fallback='any'] - When neither
+ *   is given.
+ * @returns {'platform'|'cross-platform'|undefined} `undefined` for any
+ *   authenticator: the request then names none.
+ */
+export function resolveAuthenticatorAttachment(
+  { authenticatorType, authenticatorAttachment } = {},
+  fallback = 'any'
+) {
+  if (
+    authenticatorType != null &&
+    !AUTHENTICATOR_TYPES.includes(authenticatorType)
+  ) {
+    throw new TypeError(
+      `authenticatorType must be one of ${AUTHENTICATOR_TYPES.join(', ')}, not '${authenticatorType}'`
+    );
+  }
+  if (
+    authenticatorAttachment != null &&
+    !AUTHENTICATOR_ATTACHMENTS.includes(authenticatorAttachment)
+  ) {
+    throw new TypeError(
+      `authenticatorAttachment must be one of ${AUTHENTICATOR_ATTACHMENTS.join(', ')}, not '${authenticatorAttachment}'`
+    );
+  }
+  if (
+    authenticatorType != null &&
+    authenticatorAttachment != null &&
+    authenticatorType !== authenticatorAttachment
+  ) {
+    throw new TypeError(
+      `authenticatorType '${authenticatorType}' and authenticatorAttachment '${authenticatorAttachment}' disagree; give one`
+    );
+  }
+  const choice = authenticatorType ?? authenticatorAttachment ?? fallback;
+  return choice === 'any' ? undefined : choice;
+}
+
+/**
+ * `authenticatorSelection` for a registration. Only the discoverable-credential
+ * policy comes from `options` and `configureWebAuthn`; an `authenticatorAttachment`
+ * or `userVerification` in `options` is not read here. A registration that
+ * wants an attachment adds it itself — see `resolveAuthenticatorAttachment`.
+ */
 export function buildAuthenticatorSelection(options = {}) {
   const {
     discoverableCredentials,

package/src/webauthn/provider.js

@@ -24,6 +24,7 @@ import {
 } from '../errors.js';
 import {
   buildAuthenticatorSelection,
+  resolveAuthenticatorAttachment,
   buildCredentialRequestOptions,
 } from './config.js';
 import { logWebAuthnResponse } from './debug-log.js';
@@ -115,6 +116,13 @@ export class WebAuthnDIDProvider {
    * @param {boolean} options.encryptKeystore - Enable keystore encryption
    * @param {string} options.keystoreEncryptionMethod - 'prf' (default), 'hmac-secret', or 'largeBlob'
    * @param {boolean} [options.discoverableCredentials] - Override global discoverable credential policy
+   * @param {'platform'|'cross-platform'|'any'} [options.authenticatorType='any'] -
+   *   Which authenticators the browser offers: the device's own, a security
+   *   key or phone, or every kind. `'any'` names none in the request, which is
+   *   what this has sent since 0.2.8.
+   * @param {'platform'|'cross-platform'} [options.authenticatorAttachment] -
+   *   The WebAuthn name for the same choice; refused if it disagrees with
+   *   `authenticatorType`.
    * @returns {Promise<Object>} Credential info with public key and metadata.
    */
   static async createCredential(options = {}) {
@@ -131,10 +139,14 @@ export class WebAuthnDIDProvider {
       ...options,
     };
 
+    // Before any prompt: a choice this cannot honour is the caller's mistake.
+    const authenticatorAttachment = resolveAuthenticatorAttachment(options);
+
     webauthnLog('createCredential() called with options: %o', {
       userId,
       displayName,
       domain,
+      authenticatorAttachment: authenticatorAttachment ?? 'any',
     });
 
     if (!this.isSupported()) {
@@ -177,11 +189,14 @@ export class WebAuthnDIDProvider {
           { alg: -7, type: 'public-key' }, // ES256 (P-256 curve)
           { alg: -257, type: 'public-key' }, // RS256 fallback
         ],
-        authenticatorSelection: buildAuthenticatorSelection({
-          ...options,
-          authenticatorAttachment: 'platform',
-          userVerification: 'required',
-        }),
+        // This named 'platform' from March to October 2026 without effect:
+        // buildAuthenticatorSelection never passed it on, so every kind of
+        // authenticator was offered, security keys included. That stays the
+        // default; `authenticatorType` narrows it.
+        authenticatorSelection: {
+          ...buildAuthenticatorSelection(options),
+          ...(authenticatorAttachment && { authenticatorAttachment }),
+        },
         timeout: 60000,
         attestation: 'none', // Don't need attestation for DID creation
       },

package/types/index.d.ts

@@ -131,8 +131,14 @@ export interface CreateCredentialOptions {
   encryptKeystore?: boolean;
   keystoreEncryptionMethod?: KeystoreEncryptionMethod;
   discoverableCredentials?: boolean;
+  /**
+   * Which authenticators the browser offers: the device's own, a security key
+   * or phone, or every kind. Default `'any'`: the request names none.
+   */
   authenticatorType?: AuthenticatorType;
+  /** The WebAuthn name for `authenticatorType`; the two must not disagree. */
   authenticatorAttachment?: AuthenticatorAttachment;
+  /** Not read: a registration always requires user verification. */
   userVerification?: UserVerificationRequirement;
   [key: string]: unknown;
 }
@@ -140,6 +146,7 @@ export interface CreateCredentialOptions {
 export interface WebAuthnConfig {
   discoverableCredentials?: boolean;
   userVerification?: UserVerificationRequirement;
+  /** Not read by `configureWebAuthn`; give `createCredential` an `authenticatorType`. */
   authenticatorAttachment?: AuthenticatorAttachment;
   residentKey?: ResidentKeyRequirement;
   requireResidentKey?: boolean;