@magland/mochi 0.3.1 → 0.4.0

package/dist/webauthn.js

@@ -0,0 +1,347 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPPORTED_ALGS = exports.COSE_RS256 = exports.COSE_EDDSA = exports.COSE_ES256 = exports.WebAuthnError = void 0;
+exports.b64url = b64url;
+exports.fromB64url = fromB64url;
+exports.mintChallenge = mintChallenge;
+exports.claimedChallenge = claimedChallenge;
+exports.verifyRegistration = verifyRegistration;
+exports.verifyAssertion = verifyAssertion;
+const crypto = __importStar(require("crypto"));
+// WebAuthn (passkey) verification, on node's own crypto and nothing else.
+//
+// A passkey is a public-key credential the browser keeps: registration hands
+// the vault a public key, and signing in proves possession of the private one
+// by signing a server-minted challenge. What a server has to implement is
+// small and precisely specified -- parse the authenticator's CBOR, check the
+// challenge, the origin, and the RP ID hash, and verify one signature -- so it
+// is implemented here rather than through a dependency, the way the multipart
+// parser and the cookie parser are. The subset is deliberate:
+//
+//   - Attestation is not verified. Attestation says which make of
+//     authenticator minted the key, which matters to a bank with a hardware
+//     policy and not to a vault whose user is registering a key on their own
+//     account. Browsers send fmt "none" unless asked; whatever arrives, only
+//     authData is read.
+//   - Three algorithms: ES256 (-7) and EdDSA (-8), which are what passkeys
+//     are minted with today, and RS256 (-257) for older platform
+//     authenticators. The COSE key is converted to a DER SPKI once, at
+//     registration, so signing in is a single crypto.verify.
+//
+// Nothing here touches the vault or the request: callers hand in the expected
+// challenge, origin, and RP ID, and get back parsed facts or a thrown
+// WebAuthnError whose message is safe to show.
+class WebAuthnError extends Error {
+}
+exports.WebAuthnError = WebAuthnError;
+// COSE algorithm identifiers, the only ones offered at registration.
+exports.COSE_ES256 = -7;
+exports.COSE_EDDSA = -8;
+exports.COSE_RS256 = -257;
+exports.SUPPORTED_ALGS = [exports.COSE_ES256, exports.COSE_EDDSA, exports.COSE_RS256];
+function b64url(buf) {
+    return buf.toString('base64url');
+}
+function fromB64url(s) {
+    if (!/^[A-Za-z0-9_-]*$/.test(s))
+        throw new WebAuthnError('not base64url');
+    return Buffer.from(s, 'base64url');
+}
+/** A fresh challenge, base64url, as the client APIs expect to echo it back. */
+function mintChallenge() {
+    return b64url(crypto.randomBytes(32));
+}
+function cborItem(buf, at) {
+    if (at >= buf.length)
+        throw new WebAuthnError('truncated CBOR');
+    const initial = buf[at];
+    const major = initial >> 5;
+    const info = initial & 0x1f;
+    let length = 0;
+    let next = at + 1;
+    if (info < 24) {
+        length = info;
+    }
+    else if (info === 24 || info === 25 || info === 26) {
+        const bytes = info === 24 ? 1 : info === 25 ? 2 : 4;
+        if (next + bytes > buf.length)
+            throw new WebAuthnError('truncated CBOR');
+        length = info === 24 ? buf[next] : info === 25 ? buf.readUInt16BE(next) : buf.readUInt32BE(next);
+        next += bytes;
+    }
+    else {
+        // 27 is a 64-bit length and 31 an indefinite one; neither appears in the
+        // structures this parses, and a credential id or key that claimed to need
+        // one would not be worth believing.
+        throw new WebAuthnError('unsupported CBOR length');
+    }
+    switch (major) {
+        case 0:
+            return { value: length, next };
+        case 1:
+            return { value: -1 - length, next };
+        case 2: {
+            if (next + length > buf.length)
+                throw new WebAuthnError('truncated CBOR');
+            return { value: buf.subarray(next, next + length), next: next + length };
+        }
+        case 3: {
+            if (next + length > buf.length)
+                throw new WebAuthnError('truncated CBOR');
+            return { value: buf.subarray(next, next + length).toString('utf8'), next: next + length };
+        }
+        case 4: {
+            const arr = [];
+            for (let i = 0; i < length; i++) {
+                const item = cborItem(buf, next);
+                arr.push(item.value);
+                next = item.next;
+            }
+            return { value: arr, next };
+        }
+        case 5: {
+            const map = new Map();
+            for (let i = 0; i < length; i++) {
+                const key = cborItem(buf, next);
+                const val = cborItem(buf, key.next);
+                map.set(key.value, val.value);
+                next = val.next;
+            }
+            return { value: map, next };
+        }
+        case 7: {
+            if (info === 20)
+                return { value: false, next };
+            if (info === 21)
+                return { value: true, next };
+            if (info === 22)
+                return { value: null, next };
+            throw new WebAuthnError('unsupported CBOR simple value');
+        }
+        default:
+            throw new WebAuthnError('unsupported CBOR type');
+    }
+}
+function cborDecode(buf) {
+    return cborItem(buf, 0).value;
+}
+// ---- COSE keys ----
+function coseField(key, label) {
+    const v = key.get(label);
+    if (v === undefined)
+        throw new WebAuthnError('COSE key is missing a field');
+    return v;
+}
+function coseBytes(key, label) {
+    const v = coseField(key, label);
+    if (!Buffer.isBuffer(v))
+        throw new WebAuthnError('COSE key field is not bytes');
+    return v;
+}
+/**
+ * A COSE public key as a node KeyObject, via JWK import so no ASN.1 is built
+ * by hand. Returns the key with the algorithm it signs under, checked against
+ * the key's own type: a mismatched pair is refused here rather than trusted
+ * into vault.json.
+ */
+function coseToKey(cose) {
+    const kty = coseField(cose, 1);
+    const alg = coseField(cose, 3);
+    if (typeof alg !== 'number' || !exports.SUPPORTED_ALGS.includes(alg)) {
+        throw new WebAuthnError('the authenticator chose an algorithm this vault does not accept');
+    }
+    if (kty === 2 && alg === exports.COSE_ES256) {
+        if (coseField(cose, -1) !== 1)
+            throw new WebAuthnError('ES256 key is not on P-256');
+        const x = coseBytes(cose, -2);
+        const y = coseBytes(cose, -3);
+        if (x.length !== 32 || y.length !== 32)
+            throw new WebAuthnError('P-256 coordinates have the wrong length');
+        const jwk = { kty: 'EC', crv: 'P-256', x: b64url(x), y: b64url(y) };
+        return { key: crypto.createPublicKey({ key: jwk, format: 'jwk' }), alg };
+    }
+    if (kty === 1 && alg === exports.COSE_EDDSA) {
+        if (coseField(cose, -1) !== 6)
+            throw new WebAuthnError('EdDSA key is not Ed25519');
+        const jwk = { kty: 'OKP', crv: 'Ed25519', x: b64url(coseBytes(cose, -2)) };
+        return { key: crypto.createPublicKey({ key: jwk, format: 'jwk' }), alg };
+    }
+    if (kty === 3 && alg === exports.COSE_RS256) {
+        const jwk = { kty: 'RSA', n: b64url(coseBytes(cose, -1)), e: b64url(coseBytes(cose, -2)) };
+        return { key: crypto.createPublicKey({ key: jwk, format: 'jwk' }), alg };
+    }
+    throw new WebAuthnError('unsupported COSE key type');
+}
+// ---- authenticator data ----
+const FLAG_UP = 0x01;
+const FLAG_UV = 0x04;
+const FLAG_AT = 0x40;
+function parseAuthData(data) {
+    if (data.length < 37)
+        throw new WebAuthnError('authenticator data is too short');
+    const flags = data[32];
+    const counter = data.readUInt32BE(33);
+    let credential = null;
+    if (flags & FLAG_AT) {
+        if (data.length < 55)
+            throw new WebAuthnError('attested credential data is too short');
+        const idLen = data.readUInt16BE(53);
+        if (55 + idLen > data.length)
+            throw new WebAuthnError('credential id is truncated');
+        const id = data.subarray(55, 55 + idLen);
+        const cose = cborItem(data, 55 + idLen).value;
+        if (!(cose instanceof Map))
+            throw new WebAuthnError('credential public key is not a COSE map');
+        credential = { id, cose };
+    }
+    return {
+        rpIdHash: data.subarray(0, 32),
+        userPresent: (flags & FLAG_UP) !== 0,
+        userVerified: (flags & FLAG_UV) !== 0,
+        counter,
+        credential,
+    };
+}
+// ---- client data ----
+function checkClientData(clientDataJSON, expect) {
+    let parsed;
+    try {
+        parsed = JSON.parse(clientDataJSON.toString('utf8'));
+    }
+    catch {
+        throw new WebAuthnError('clientDataJSON is not JSON');
+    }
+    const c = (typeof parsed === 'object' && parsed !== null ? parsed : {});
+    if (c.type !== expect.type)
+        throw new WebAuthnError('wrong WebAuthn ceremony type');
+    if (typeof c.challenge !== 'string' || c.challenge !== expect.challenge) {
+        throw new WebAuthnError('the challenge does not match');
+    }
+    if (typeof c.origin !== 'string' || c.origin !== expect.origin) {
+        throw new WebAuthnError(`the origin does not match this vault (${String(c.origin)})`);
+    }
+}
+/**
+ * The challenge a client data blob claims to answer, read before anything is
+ * verified. It is how the server finds the pending challenge to check the rest
+ * against; nothing is trusted from it until checkClientData has run.
+ */
+function claimedChallenge(clientDataJSON) {
+    try {
+        const parsed = JSON.parse(clientDataJSON.toString('utf8'));
+        return typeof parsed.challenge === 'string' ? parsed.challenge : null;
+    }
+    catch {
+        return null;
+    }
+}
+function rpIdHashOk(authData, rpId) {
+    const expected = crypto.createHash('sha256').update(rpId).digest();
+    return authData.rpIdHash.length === expected.length && crypto.timingSafeEqual(authData.rpIdHash, expected);
+}
+/**
+ * Verify a navigator.credentials.create() response. The challenge must be one
+ * this server minted (the caller's business to have checked, via a one-time
+ * store); everything else is checked here.
+ */
+function verifyRegistration(input) {
+    checkClientData(input.clientDataJSON, {
+        type: 'webauthn.create',
+        challenge: input.challenge,
+        origin: input.origin,
+    });
+    const att = cborDecode(input.attestationObject);
+    if (!(att instanceof Map))
+        throw new WebAuthnError('attestation object is not a CBOR map');
+    const rawAuthData = att.get('authData');
+    if (!Buffer.isBuffer(rawAuthData))
+        throw new WebAuthnError('attestation object has no authData');
+    const authData = parseAuthData(rawAuthData);
+    if (!rpIdHashOk(authData, input.rpId)) {
+        throw new WebAuthnError('the credential was made for a different hostname');
+    }
+    if (!authData.userPresent)
+        throw new WebAuthnError('the authenticator did not report user presence');
+    if (!authData.credential)
+        throw new WebAuthnError('no credential in the registration');
+    if (authData.credential.id.length < 8 || authData.credential.id.length > 1023) {
+        throw new WebAuthnError('credential id has an unreasonable length');
+    }
+    const { key, alg } = coseToKey(authData.credential.cose);
+    return {
+        id: b64url(authData.credential.id),
+        publicKey: b64url(key.export({ type: 'spki', format: 'der' })),
+        alg,
+        counter: authData.counter,
+    };
+}
+/**
+ * Verify a navigator.credentials.get() response against a stored public key.
+ * The signature covers authenticatorData plus the hash of clientDataJSON,
+ * which is what binds the challenge and the origin to the key.
+ */
+function verifyAssertion(input) {
+    checkClientData(input.clientDataJSON, {
+        type: 'webauthn.get',
+        challenge: input.challenge,
+        origin: input.origin,
+    });
+    const authData = parseAuthData(input.authenticatorData);
+    if (!rpIdHashOk(authData, input.rpId)) {
+        throw new WebAuthnError('the assertion was made for a different hostname');
+    }
+    if (!authData.userPresent)
+        throw new WebAuthnError('the authenticator did not report user presence');
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: fromB64url(input.publicKey), format: 'der', type: 'spki' });
+    }
+    catch {
+        throw new WebAuthnError('the stored public key could not be read');
+    }
+    const signed = Buffer.concat([
+        input.authenticatorData,
+        crypto.createHash('sha256').update(input.clientDataJSON).digest(),
+    ]);
+    // ES256 and RS256 hash before signing and their WebAuthn signatures are
+    // ASN.1 DER, which is node's default; Ed25519 signs the message itself.
+    const ok = input.alg === exports.COSE_EDDSA
+        ? crypto.verify(null, signed, key, input.signature)
+        : crypto.verify('sha256', signed, key, input.signature);
+    if (!ok)
+        throw new WebAuthnError('the signature does not verify');
+    return { counter: authData.counter, userVerified: authData.userVerified };
+}