@le-space/p2pass 0.1.0 → 0.2.0

package/dist/identity/identity-service.d.ts

@@ -24,12 +24,13 @@ export class IdentityService {
      * If no credentials, creates new passkey.
      *
      * @param {'platform'|'cross-platform'} [authenticatorType]
-     * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference }} [options]
+     * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference, webauthnUserLabel?: string }} [options]
      * @returns {Promise<{ mode: string, did: string, algorithm: string }>}
      */
     initialize(authenticatorType?: "platform" | "cross-platform", options?: {
         preferWorkerMode?: boolean;
         signingPreference?: import("./signing-preference.js").SigningPreference;
+        webauthnUserLabel?: string;
     }): Promise<{
         mode: string;
         did: string;
@@ -38,12 +39,13 @@ export class IdentityService {
     /**
      * Force create a new identity (discards existing).
      * @param {'platform'|'cross-platform'} [authenticatorType]
-     * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference }} [options]
+     * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference, webauthnUserLabel?: string }} [options]
      * @returns {Promise<{ mode: string, did: string, algorithm: string }>}
      */
     createNewIdentity(authenticatorType?: "platform" | "cross-platform", options?: {
         preferWorkerMode?: boolean;
         signingPreference?: import("./signing-preference.js").SigningPreference;
+        webauthnUserLabel?: string;
     }): Promise<{
         mode: string;
         did: string;

package/dist/identity/identity-service.js

@@ -20,7 +20,6 @@ import {
 
 import {
   storeKeypairEntry,
-  getKeypairEntry,
   storeArchiveEntry,
   getArchiveEntry,
   listKeypairs,
@@ -36,6 +35,38 @@ import { resolveSigningPreference } from './signing-preference.js';
 
 const ARCHIVE_CACHE_KEY = 'p2p_passkeys_worker_archive';
 
+/** WebAuthn user.id must be at most 64 bytes (UTF-8). */
+const WEBAUTHN_USER_ID_MAX_BYTES = 64;
+
+/**
+ * Build {@link https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialuserentity PublicKeyCredentialUserEntity}.
+ * Empty label keeps prior defaults (random opaque user.id).
+ *
+ * @param {string} label
+ * @returns {Promise<{ id: Uint8Array, name: string, displayName: string }>}
+ */
+async function publicKeyCredentialUserFromLabel(label) {
+  const trimmed = (typeof label === 'string' ? label : '').trim();
+  if (!trimmed) {
+    return {
+      id: crypto.getRandomValues(new Uint8Array(16)),
+      name: 'p2p-user',
+      displayName: 'P2P User',
+    };
+  }
+  const encoder = new TextEncoder();
+  let idBytes = encoder.encode(trimmed);
+  if (idBytes.length > WEBAUTHN_USER_ID_MAX_BYTES) {
+    const digest = await crypto.subtle.digest('SHA-256', idBytes);
+    idBytes = new Uint8Array(digest);
+  }
+  return {
+    id: idBytes,
+    name: trimmed,
+    displayName: trimmed,
+  };
+}
+
 /**
  * Best-effort: this origin likely already has passkey / identity material (no WebAuthn prompt).
  * Uses the same signals as restore paths — false negatives are OK (same handlers still apply).
@@ -118,11 +149,11 @@ export class IdentityService {
    * If no credentials, creates new passkey.
    *
    * @param {'platform'|'cross-platform'} [authenticatorType]
-   * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference }} [options]
+   * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference, webauthnUserLabel?: string }} [options]
    * @returns {Promise<{ mode: string, did: string, algorithm: string }>}
    */
   async initialize(authenticatorType, options = {}) {
-    const { preferWorkerMode = false, signingPreference = null } = options;
+    const { preferWorkerMode = false, signingPreference = null, webauthnUserLabel = '' } = options;
     const pref = resolveSigningPreference({ preferWorkerMode, signingPreference });
     const preferWorker = pref === 'worker';
     const forceP256Hardware = pref === 'hardware-p256';
@@ -135,10 +166,16 @@ export class IdentityService {
     // Try hardware mode first (unless worker mode is selected)
     if (!preferWorker) {
       try {
-        const signer = await this.#hardwareService.initialize({
+        const trimmedLabel = webauthnUserLabel.trim();
+        const hwOpts = {
           authenticatorType,
           forceP256: forceP256Hardware,
-        });
+        };
+        if (trimmedLabel) {
+          hwOpts.userId = trimmedLabel;
+          hwOpts.displayName = trimmedLabel;
+        }
+        const signer = await this.#hardwareService.initialize(hwOpts);
 
         if (signer) {
           this.#mode = 'hardware';
@@ -161,7 +198,7 @@ export class IdentityService {
     }
 
     // No existing identity — create new worker identity
-    await this.#createWorkerIdentity(authenticatorType);
+    await this.#createWorkerIdentity(authenticatorType, webauthnUserLabel);
     console.log(`[identity] Created new worker identity, DID: ${this.#did}`);
     return this.getSigningMode();
   }
@@ -169,7 +206,7 @@ export class IdentityService {
   /**
    * Force create a new identity (discards existing).
    * @param {'platform'|'cross-platform'} [authenticatorType]
-   * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference }} [options]
+   * @param {{ preferWorkerMode?: boolean, signingPreference?: import('./signing-preference.js').SigningPreference, webauthnUserLabel?: string }} [options]
    * @returns {Promise<{ mode: string, did: string, algorithm: string }>}
    */
   async createNewIdentity(authenticatorType, options = {}) {
@@ -190,7 +227,7 @@ export class IdentityService {
    */
   async initializeFromRecovery() {
     console.log('[identity] Starting recovery via discoverable credential...');
-    const { prfSeed, rawCredentialId, credential } = await recoverPrfSeed();
+    const { prfSeed, rawCredentialId } = await recoverPrfSeed();
 
     this.#prfSeed = prfSeed;
     this.#ipnsKeyPair = await deriveIPNSKeyPair(prfSeed);
@@ -415,9 +452,9 @@ export class IdentityService {
   /**
    * Create a new worker-mode Ed25519 identity.
    */
-  async #createWorkerIdentity(authenticatorType) {
+  async #createWorkerIdentity(authenticatorType, webauthnUserLabel) {
     // Create WebAuthn credential with PRF
-    const credential = await this.#createWebAuthnCredential(authenticatorType);
+    const credential = await this.#createWebAuthnCredential(authenticatorType, webauthnUserLabel);
 
     // Extract PRF seed
     const { seed: prfSeed } = await extractPrfSeedFromCredential(credential);
@@ -468,9 +505,10 @@ export class IdentityService {
   /**
    * Create a WebAuthn credential with PRF extension.
    */
-  async #createWebAuthnCredential(authenticatorType) {
+  async #createWebAuthnCredential(authenticatorType, webauthnUserLabel) {
     const challenge = crypto.getRandomValues(new Uint8Array(32));
     const prfSalt = await computeDeterministicPrfSalt();
+    const userEntity = await publicKeyCredentialUserFromLabel(webauthnUserLabel);
 
     const createOptions = {
       publicKey: {
@@ -479,9 +517,9 @@ export class IdentityService {
           id: globalThis.location?.hostname || 'localhost',
         },
         user: {
-          id: crypto.getRandomValues(new Uint8Array(16)),
-          name: 'p2p-user',
-          displayName: 'P2P User',
+          id: userEntity.id,
+          name: userEntity.name,
+          displayName: userEntity.displayName,
         },
         challenge,
         pubKeyCredParams: [

package/dist/ui/StorachaIntegration.svelte

@@ -5,7 +5,7 @@
     writeSigningPreferenceToStorage,
   } from '../identity/signing-preference.js';
   import { Upload, LogOut, Loader2, AlertCircle, CheckCircle, Download } from 'lucide-svelte';
-  import { listSpaces, getSpaceUsage } from './storacha-backup.js';
+  import { getSpaceUsage } from './storacha-backup.js';
   import { OrbitDBStorachaBridge } from 'orbitdb-storacha-bridge';
   import { IdentityService, hasLocalPasskeyHint } from '../identity/identity-service.js';
   import { getStoredSigningMode } from '../identity/mode-detector.js';
@@ -28,7 +28,6 @@
     listDelegations,
     storeDelegationEntry,
   } from '../registry/device-registry.js';
-  import { deriveIPNSKeyPair } from '../recovery/ipns-key.js';
   import {
     createManifest,
     publishManifest,
@@ -36,7 +35,7 @@
     uploadArchiveToIPFS,
     fetchArchiveFromIPFS,
   } from '../recovery/manifest.js';
-  import { backupRegistryDb, restoreRegistryDb } from '../backup/registry-backup.js';
+  import { backupRegistryDb } from '../backup/registry-backup.js';
   import { MultiDeviceManager } from '../registry/manager.js';
   import { detectDeviceLabel, pairingFlow } from '../registry/pairing-protocol.js';
   import { loadWebAuthnCredentialSafe } from '@le-space/orbitdb-identity-provider-webauthn-did/standalone';
@@ -90,7 +89,6 @@
   // Component state
   let showStoracha = $state(true);
   let isLoading = $state(false);
-  let status = $state('');
   let error = $state(null);
   let success = $state(null);
 
@@ -116,7 +114,8 @@
   let signingMode = $state(null); // { mode, did, algorithm, secure }
   let delegationText = $state(''); // textarea for pasting delegation
   let isAuthenticating = $state(false);
-  let spaces = $state([]);
+  /** Shown when creating a new passkey; sent as WebAuthn user.id / name / displayName (worker path). */
+  let passkeyUserLabel = $state('');
   let spaceUsage = $state(null);
 
   // Registry DB state
@@ -299,16 +298,13 @@
     }, 5000);
   }
 
-  function clearForms() {
-    delegationText = '';
-  }
-
   async function handleAuthenticate() {
     isAuthenticating = true;
     try {
       signingMode = await identityService.initialize(undefined, {
         preferWorkerMode,
         signingPreference: signingPreferenceOverride ?? selectedSigningPreference,
+        ...(localPasskeyDetected ? {} : { webauthnUserLabel: passkeyUserLabel }),
       });
       showMessage(`Authenticated! Mode: ${signingMode.algorithm} (${signingMode.mode})`);
 
@@ -890,7 +886,6 @@
     isLoggedIn = false;
     client = null;
     currentSpace = null;
-    spaces = [];
     spaceUsage = null;
     signingMode = null;
     await clearStoredDelegation(registryDb);
@@ -912,21 +907,6 @@
     }
   }
 
-  async function loadSpaces() {
-    if (!client) return;
-    isLoading = true;
-    status = 'Loading spaces...';
-    try {
-      spaces = await listSpaces(client);
-      await loadSpaceUsage();
-    } catch (err) {
-      showMessage(`Failed to load spaces: ${err.message}`, 'error');
-    } finally {
-      isLoading = false;
-      status = '';
-    }
-  }
-
   async function handleBackup() {
     if (!bridge) {
       showMessage('Please log in first', 'error');
@@ -943,7 +923,6 @@
 
     isLoading = true;
     resetProgress();
-    status = 'Preparing backup...';
 
     try {
       // Backup user database if available
@@ -979,7 +958,6 @@
       showMessage(`Backup failed: ${err.message}`, 'error');
     } finally {
       isLoading = false;
-      status = '';
       resetProgress();
     }
   }
@@ -992,12 +970,10 @@
 
     isLoading = true;
     resetProgress();
-    status = 'Preparing restore...';
 
     try {
       // Close existing database if provided
       if (database) {
-        status = 'Closing existing database...';
         try {
           await database.close();
         } catch {
@@ -1005,8 +981,6 @@
         }
       }
 
-      status = 'Starting restore...';
-
       if (!bridge) {
         throw new Error('Bridge not initialized. Please connect to Storacha first.');
       }
@@ -1028,7 +1002,6 @@
       showMessage(`Restore failed: ${err.message}`, 'error');
     } finally {
       isLoading = false;
-      status = '';
       resetProgress();
     }
   }
@@ -1158,7 +1131,7 @@
       </div>
     {:else}
       <div style="display: flex; flex-direction: column; gap: 0.375rem;">
-        {#each devices as device}
+        {#each devices as device, i (device.credential_id || device.ed25519_did || device.device_label || i)}
           <div
             data-testid="storacha-linked-device-row"
             data-device-label={device.device_label || ''}
@@ -1516,6 +1489,33 @@
               </div>
             </fieldset>
 
+            {#if !localPasskeyDetected}
+              <label
+                style="display: flex; width: 100%; max-width: 22rem; flex-direction: column; align-items: stretch; gap: 0.35rem; text-align: left; box-sizing: border-box;"
+              >
+                <span
+                  style="font-size: 0.7rem; font-weight: 600; color: #374151; font-family: 'Epilogue', sans-serif;"
+                >
+                  Passkey name (WebAuthn user ID)
+                </span>
+                <input
+                  type="text"
+                  data-testid="storacha-passkey-user-label"
+                  bind:value={passkeyUserLabel}
+                  disabled={isAuthenticating || signingPreferenceOverride != null}
+                  placeholder="e.g. Work laptop"
+                  autocomplete="username"
+                  style="width: 100%; box-sizing: border-box; border-radius: 0.375rem; border: 1px solid rgba(233, 19, 21, 0.25); padding: 0.5rem 0.625rem; font-size: 0.8rem; font-family: 'DM Sans', sans-serif; color: #111827; background: rgba(255, 255, 255, 0.9);"
+                />
+                <span
+                  style="font-size: 0.65rem; color: #6b7280; font-family: 'DM Sans', sans-serif; line-height: 1.35;"
+                >
+                  Optional. Used for user.id (and display name) when creating a new passkey. Leave blank for an
+                  anonymous default.
+                </span>
+              </label>
+            {/if}
+
             <button
               data-testid="storacha-passkey-primary"
               class="storacha-btn-primary"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/p2pass",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "P2Pass — peer-to-peer passkeys, UCANs, OrbitDB registry sync, and Storacha backup (Svelte)",
   "license": "MIT",