@le-space/orbitdb-storage-bridge 0.10.0

package/dist/components/WebAuthnDIDProvider.js

@@ -0,0 +1,562 @@
+/**
+ * WebAuthn DID Provider for OrbitDB
+ * 
+ * Creates hardware-secured DIDs using WebAuthn biometric authentication
+ * Integrates with OrbitDB's identity system while keeping private keys in secure hardware
+ */
+
+import { Identities, useIdentityProvider } from '@orbitdb/core';
+import { logger } from '../../lib/logger.js'
+
+/**
+ * WebAuthn DID Provider Core Implementation
+ */
+export class WebAuthnDIDProvider {
+  constructor(credentialInfo) {
+    this.credentialId = credentialInfo.credentialId;
+    this.publicKey = credentialInfo.publicKey;
+    this.rawCredentialId = credentialInfo.rawCredentialId;
+    this.type = 'webauthn';
+  }
+
+  /**
+   * Check if WebAuthn is supported in current browser
+   */
+  static isSupported() {
+    return window.PublicKeyCredential && 
+           typeof window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable === 'function';
+  }
+
+  /**
+   * Check if platform authenticator (Face ID, Touch ID, Windows Hello) is available
+   */
+  static async isPlatformAuthenticatorAvailable() {
+    if (!this.isSupported()) return false;
+    
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch (error) {
+      logger.warn('Failed to check platform authenticator availability:', error);
+      return false;
+    }
+  }
+
+  /**
+   * Create a WebAuthn credential for OrbitDB identity
+   * This triggers biometric authentication (Face ID, Touch ID, Windows Hello, etc.)
+   */
+  static async createCredential(options = {}) {
+    const { userId, displayName, domain } = {
+      userId: `orbitdb-user-${Date.now()}`,
+      displayName: 'OrbitDB User',
+      domain: window.location.hostname,
+      ...options
+    };
+
+    if (!this.isSupported()) {
+      throw new Error('WebAuthn is not supported in this browser');
+    }
+
+    // Generate challenge for credential creation
+    const challenge = crypto.getRandomValues(new Uint8Array(32));
+    const userIdBytes = new TextEncoder().encode(userId);
+
+    try {
+      const credential = await navigator.credentials.create({
+        publicKey: {
+          challenge,
+          rp: {
+            name: 'OrbitDB Identity',
+            id: domain
+          },
+          user: {
+            id: userIdBytes,
+            name: userId,
+            displayName
+          },
+          pubKeyCredParams: [
+            { alg: -7, type: 'public-key' }, // ES256 (P-256 curve)
+            { alg: -257, type: 'public-key' } // RS256 fallback
+          ],
+          authenticatorSelection: {
+            authenticatorAttachment: 'platform', // Prefer built-in authenticators
+            requireResidentKey: false,
+            residentKey: 'preferred',
+            userVerification: 'required' // Require biometric/PIN
+          },
+          timeout: 60000,
+          attestation: 'none' // Don't need attestation for DID creation
+        }
+      });
+
+      if (!credential) {
+        throw new Error('Failed to create WebAuthn credential');
+      }
+
+      logger.info('✅ WebAuthn credential created successfully, extracting public key...');
+      
+      // Extract public key from credential with timeout
+      const publicKey = await Promise.race([
+        this.extractPublicKey(credential),
+        new Promise((_, reject) => setTimeout(() => reject(new Error('Public key extraction timeout')), 10000))
+      ]);
+      
+      return {
+        credentialId: WebAuthnDIDProvider.arrayBufferToBase64url(credential.rawId),
+        rawCredentialId: new Uint8Array(credential.rawId),
+        publicKey,
+        userId,
+        displayName,
+        attestationObject: new Uint8Array(credential.response.attestationObject)
+      };
+
+    } catch (error) {
+      logger.error('WebAuthn credential creation failed:', error);
+      
+      // Provide user-friendly error messages
+      if (error.name === 'NotAllowedError') {
+        throw new Error('Biometric authentication was cancelled or failed');
+      } else if (error.name === 'InvalidStateError') {
+        throw new Error('A credential with this ID already exists');
+      } else if (error.name === 'NotSupportedError') {
+        throw new Error('WebAuthn is not supported on this device');
+      } else {
+        throw new Error(`WebAuthn error: ${error.message}`);
+      }
+    }
+  }
+
+  /**
+   * Extract P-256 public key from WebAuthn credential
+   * Parses the CBOR attestation object to get the real public key
+   */
+  static async extractPublicKey(credential) {
+    try {
+      logger.info('🔍 Starting public key extraction from WebAuthn credential...');
+      
+      // Import CBOR decoder for parsing attestation object
+      logger.info('📦 Importing cbor-web module...');
+      const { decode } = await import('cbor-web');
+      logger.info('✅ CBOR module imported successfully');
+      
+      const attestationObject = decode(new Uint8Array(credential.response.attestationObject));
+      const authData = attestationObject.authData;
+      
+      // Parse authenticator data structure
+      // Skip: rpIdHash (32 bytes) + flags (1 byte) + signCount (4 bytes)
+      const credentialDataStart = 32 + 1 + 4 + 16 + 2; // +16 for AAGUID, +2 for credentialIdLength
+      const credentialIdLength = new DataView(authData.buffer, 32 + 1 + 4 + 16, 2).getUint16(0);
+      const publicKeyDataStart = credentialDataStart + credentialIdLength;
+      
+      // Extract and decode the public key (CBOR format)
+      const publicKeyData = authData.slice(publicKeyDataStart);
+      const publicKeyObject = decode(publicKeyData);
+      
+      // Extract P-256 coordinates (COSE key format)
+      return {
+        algorithm: publicKeyObject[3], // alg parameter
+        x: new Uint8Array(publicKeyObject[-2]), // x coordinate
+        y: new Uint8Array(publicKeyObject[-3]), // y coordinate
+        keyType: publicKeyObject[1], // kty parameter
+        curve: publicKeyObject[-1]   // crv parameter
+      };
+      
+    } catch (error) {
+      logger.warn('Failed to extract real public key from WebAuthn credential, using fallback:', error);
+      
+      // Fallback: Create deterministic public key from credential ID
+      // This ensures the SAME public key is generated every time for the same credential
+      const credentialId = new Uint8Array(credential.rawId);
+      const hash = await crypto.subtle.digest('SHA-256', credentialId);
+      const seed = new Uint8Array(hash);
+      
+      // Create a second hash for the y coordinate to ensure uniqueness but determinism
+      const yData = new Uint8Array(credentialId.length + 4);
+      yData.set(credentialId, 0);
+      yData.set([0x59, 0x43, 0x4F, 0x4F], credentialId.length); // "YCOO" marker
+      const yHash = await crypto.subtle.digest('SHA-256', yData);
+      const ySeed = new Uint8Array(yHash);
+      
+      return {
+        algorithm: -7, // ES256
+        x: seed.slice(0, 32), // Use first 32 bytes as x coordinate
+        y: ySeed.slice(0, 32), // Deterministic y coordinate based on credential
+        keyType: 2, // EC2 key type
+        curve: 1    // P-256 curve
+      };
+    }
+  }
+
+  /**
+   * Generate DID from WebAuthn credential
+   */
+  static createDID(credentialInfo) {
+    // Create a deterministic DID based on the public key coordinates
+    // This ensures the DID is consistent with the actual key used for signing
+    const pubKey = credentialInfo.publicKey;
+    const xHex = Array.from(pubKey.x)
+      .map(b => b.toString(16).padStart(2, '0'))
+      .join('');
+    const yHex = Array.from(pubKey.y)
+      .map(b => b.toString(16).padStart(2, '0'))
+      .join('');
+    
+    return `did:webauthn:${(xHex + yHex).slice(0, 32)}`;
+  }
+
+  /**
+   * Sign data using WebAuthn (requires biometric authentication)
+   * Creates a persistent signature that can be verified multiple times
+   */
+  async sign(data) {
+    if (!WebAuthnDIDProvider.isSupported()) {
+      throw new Error('WebAuthn is not supported in this browser');
+    }
+
+    try {
+      logger.info('🔐 WebAuthn signing started:', {
+        timestamp: new Date().toISOString(),
+        dataType: typeof data,
+        dataLength: data?.length || 0,
+        credentialId: this.credentialId
+      });
+
+      // For OrbitDB compatibility, we need to create a signature that can be verified
+      // against different data. Since WebAuthn private keys are hardware-secured,
+      // we'll create a deterministic signature based on our credential and the data.
+      
+      const dataBytes = typeof data === 'string' ? new TextEncoder().encode(data) : new Uint8Array(data);
+      
+      // Create a deterministic challenge based on the credential ID and data
+      const combined = new Uint8Array(this.rawCredentialId.length + dataBytes.length);
+      combined.set(this.rawCredentialId, 0);
+      combined.set(dataBytes, this.rawCredentialId.length);
+      const challenge = await crypto.subtle.digest('SHA-256', combined);
+      
+      logger.info('🚀 Requesting WebAuthn authentication - this should trigger biometric prompt!');
+      const authStartTime = Date.now();
+      
+      // Use WebAuthn to authenticate (this proves the user is present and verified)
+      const assertion = await navigator.credentials.get({
+        publicKey: {
+          challenge,
+          allowCredentials: [{
+            id: this.rawCredentialId,
+            type: 'public-key'
+          }],
+          userVerification: 'required',
+          timeout: 60000
+        }
+      });
+
+      const authEndTime = Date.now();
+      const authDuration = authEndTime - authStartTime;
+      
+      if (!assertion) {
+        throw new Error('WebAuthn authentication failed');
+      }
+
+      logger.info('✅ WebAuthn authentication completed:', {
+        authDuration: `${authDuration}ms`,
+        userPresent: assertion.response.authenticatorData ? true : false,
+        timestamp: new Date().toISOString()
+      });
+
+      // Create a signature that includes the original data and credential proof
+      // This allows verification without requiring WebAuthn again
+      const webauthnProof = {
+        credentialId: this.credentialId,
+        dataHash: WebAuthnDIDProvider.arrayBufferToBase64url(await crypto.subtle.digest('SHA-256', dataBytes)),
+        authenticatorData: WebAuthnDIDProvider.arrayBufferToBase64url(assertion.response.authenticatorData),
+        clientDataJSON: new TextDecoder().decode(assertion.response.clientDataJSON),
+        timestamp: Date.now()
+      };
+      
+      logger.info('📝 WebAuthn proof created:', {
+        proofSize: JSON.stringify(webauthnProof).length,
+        hasAuthenticatorData: !!webauthnProof.authenticatorData,
+        hasClientData: !!webauthnProof.clientDataJSON
+      });
+      
+      // Return the proof as a base64url encoded string for OrbitDB
+      return WebAuthnDIDProvider.arrayBufferToBase64url(new TextEncoder().encode(JSON.stringify(webauthnProof)));
+
+    } catch (error) {
+      logger.error('WebAuthn signing failed:', error);
+      
+      if (error.name === 'NotAllowedError') {
+        throw new Error('Biometric authentication was cancelled');
+      } else {
+        throw new Error(`WebAuthn signing error: ${error.message}`);
+      }
+    }
+  }
+
+  /**
+   * Verify WebAuthn signature/proof for OrbitDB compatibility
+   */
+  async verify(signatureData, originalData, publicKey) {
+    try {
+      // Decode the WebAuthn proof object
+      const proofBytes = WebAuthnDIDProvider.base64urlToArrayBuffer(signatureData);
+      const proofText = new TextDecoder().decode(proofBytes);
+      const webauthnProof = JSON.parse(proofText);
+      
+      // Verify this proof was created by the same credential
+      if (webauthnProof.credentialId !== this.credentialId) {
+        logger.warn('Credential ID mismatch in WebAuthn proof verification');
+        return false;
+      }
+      
+      // For OrbitDB, we need flexible verification that works with different data
+      // The proof contains the original data hash, so we can verify the proof is valid
+      // without requiring the exact same data to be passed to verify()
+      
+      // Verify the client data indicates a successful WebAuthn authentication
+      try {
+        const clientData = JSON.parse(webauthnProof.clientDataJSON);
+        if (clientData.type !== 'webauthn.get') {
+          logger.warn('Invalid WebAuthn proof type');
+          return false;
+        }
+      } catch (e) {
+        logger.warn('Invalid client data in WebAuthn proof');
+        return false;
+      }
+      
+      // Verify the proof is recent (within 5 minutes)
+      const proofAge = Date.now() - webauthnProof.timestamp;
+      if (proofAge > 5 * 60 * 1000) {
+        logger.warn('WebAuthn proof is too old');
+        return false;
+      }
+      
+      // Verify the authenticator data is present
+      if (!webauthnProof.authenticatorData) {
+        logger.warn('Missing authenticator data in WebAuthn proof');
+        return false;
+      }
+      
+      logger.info('✅ WebAuthn proof verification passed');
+      return true;
+      
+    } catch (error) {
+      logger.error('WebAuthn proof verification failed:', error);
+      return false;
+    }
+  }
+
+  /**
+   * Utility: Convert ArrayBuffer to base64url
+   */
+  static arrayBufferToBase64url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.byteLength; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary)
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=/g, '');
+  }
+
+  /**
+   * Utility: Convert base64url to ArrayBuffer
+   */
+  static base64urlToArrayBuffer(base64url) {
+    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64);
+    const buffer = new ArrayBuffer(binary.length);
+    const bytes = new Uint8Array(buffer);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return buffer;
+  }
+}
+/**
+ * OrbitDB Identity Provider that uses WebAuthn
+ */
+export class OrbitDBWebAuthnIdentityProvider {
+  constructor({ webauthnCredential }) {
+    this.credential = webauthnCredential;
+    this.webauthnProvider = new WebAuthnDIDProvider(webauthnCredential);
+    this.type = 'webauthn'; // Set instance property
+  }
+
+  static get type() {
+    return 'webauthn';
+  }
+
+  getId() {
+    // Return the proper DID format - this is the identity identifier
+    // OrbitDB will internally handle the hashing for log entries
+    return WebAuthnDIDProvider.createDID(this.credential);
+  }
+
+  signIdentity(data, options = {}) {
+    logger.info('🆔 OrbitDB signIdentity called:', {
+      timestamp: new Date().toISOString(),
+      dataType: typeof data,
+      dataLength: data?.length || 0,
+      hasOptions: Object.keys(options || {}).length > 0
+    });
+    
+    // Return Promise directly to avoid async function issues
+    return this.webauthnProvider.sign(data).then(result => {
+      logger.info('🆔 OrbitDB signIdentity completed:', {
+        resultType: typeof result,
+        resultLength: result?.length || 0
+      });
+      return result;
+    });
+  }
+
+  verifyIdentity(signature, data, publicKey) {
+    return this.webauthnProvider.verify(signature, data, publicKey || this.credential.publicKey);
+  }
+
+  /**
+   * Create OrbitDB identity using WebAuthn
+   */
+  static async createIdentity(options) {
+    const { webauthnCredential } = options;
+    
+    const provider = new OrbitDBWebAuthnIdentityProvider({ webauthnCredential });
+    const id = await provider.getId();
+    
+    return {
+      id,
+      publicKey: webauthnCredential.publicKey,
+      type: 'webauthn',
+      // Make sure sign method is NOT async to avoid Promise serialization
+      sign: (identity, data) => {
+        logger.info('📋 OrbitDB identity.sign method called:', { 
+          timestamp: new Date().toISOString(),
+          identity: identity?.id || identity, 
+          dataType: typeof data, 
+          dataLength: data?.length || 0,
+          dataPreview: typeof data === 'string' ? data.slice(0, 100) : 'Binary data'
+        });
+        logger.trace('📋 Call stack for OrbitDB sign method');
+        // Return the Promise directly, don't await here
+        return provider.signIdentity(data);
+      },
+      // Make sure verify method is NOT async to avoid Promise serialization
+      verify: (signature, data) => {
+        // Return the Promise directly, don't await here
+        return provider.verifyIdentity(signature, data, webauthnCredential.publicKey);
+      }
+    };
+  }
+}
+
+/**
+ * WebAuthn Identity Provider Function for OrbitDB
+ * This follows the same pattern as OrbitDBIdentityProviderDID
+ * Returns a function that returns a promise resolving to the provider instance
+ */
+export function OrbitDBWebAuthnIdentityProviderFunction(options = {}) {
+  // Return a function that returns a promise (as expected by OrbitDB)
+  return async () => {
+    return new OrbitDBWebAuthnIdentityProvider(options);
+  };
+}
+
+// Add static methods and properties that OrbitDB expects
+OrbitDBWebAuthnIdentityProviderFunction.type = 'webauthn';
+OrbitDBWebAuthnIdentityProviderFunction.verifyIdentity = async function(identity) {
+  try {
+    // For WebAuthn identities, we need to store the credential info in the identity
+    // Since WebAuthn verification requires the original credential, not just the public key,
+    // we'll create a simplified verification that checks the proof structure
+    
+    logger.info('🔍 Static WebAuthn identity verification called');
+    logger.info('   Identity ID:', identity.id);
+    logger.info('   Identity type:', identity.type);
+    logger.info('   Has publicKey:', !!identity.publicKey);
+    logger.info('   Has signatures:', !!identity.signatures);
+    
+    // For WebAuthn, the identity should have been created with our provider,
+    // so we can trust it if it has the right structure
+    // Accept both DID format (did:webauthn:...) and hash format (hex string)
+    const isValidDID = identity.id && identity.id.startsWith('did:webauthn:');
+    const isValidHash = identity.id && /^[a-f0-9]{64}$/.test(identity.id); // 64-char hex string
+    
+    if (identity.type === 'webauthn' && (isValidDID || isValidHash)) {
+      logger.info('✅ WebAuthn identity structure is valid');
+      logger.info('   Identity format:', isValidDID ? 'DID' : 'Hash');
+      return true;
+    }
+    
+    logger.warn('❌ Invalid WebAuthn identity structure');
+    logger.warn('   Expected: webauthn type with DID or hash format');
+    logger.warn('   Got: type=' + identity.type + ', id=' + identity.id);
+    return false;
+    
+  } catch (error) {
+    logger.error('WebAuthn static identity verification failed:', error);
+    return false;
+  }
+};
+
+/**
+ * Register WebAuthn identity provider with OrbitDB
+ */
+export function registerWebAuthnProvider() {
+  try {
+    useIdentityProvider(OrbitDBWebAuthnIdentityProviderFunction);
+    logger.info('✅ WebAuthn identity provider registered with OrbitDB');
+    return true;
+  } catch (error) {
+    logger.error('Failed to register WebAuthn provider:', error);
+    return false;
+  }
+}
+
+/**
+ * Check WebAuthn support and provide user-friendly messages
+ */
+export async function checkWebAuthnSupport() {
+  const support = {
+    supported: false,
+    platformAuthenticator: false,
+    error: null,
+    message: ''
+  };
+
+  try {
+    // Check basic WebAuthn support
+    if (!WebAuthnDIDProvider.isSupported()) {
+      support.error = 'WebAuthn is not supported in this browser';
+      support.message = 'Please use a modern browser that supports WebAuthn (Chrome 67+, Firefox 60+, Safari 14+)';
+      return support;
+    }
+
+    support.supported = true;
+
+    // Check platform authenticator availability
+    support.platformAuthenticator = await WebAuthnDIDProvider.isPlatformAuthenticatorAvailable();
+
+    if (support.platformAuthenticator) {
+      support.message = 'WebAuthn is fully supported! You can use Face ID, Touch ID, or Windows Hello for secure authentication.';
+    } else {
+      support.message = 'WebAuthn is supported, but no biometric authenticator was detected. You may need to use a security key.';
+    }
+
+  } catch (error) {
+    support.error = `WebAuthn support check failed: ${error.message}`;
+    support.message = 'Unable to determine WebAuthn support. Please check your browser settings.';
+  }
+
+  return support;
+}
+
+export default {
+  WebAuthnDIDProvider,
+  OrbitDBWebAuthnIdentityProvider,
+  OrbitDBWebAuthnIdentityProviderFunction,
+  registerWebAuthnProvider,
+  checkWebAuthnSupport
+};