@mrgnw/anahtar 0.0.8 → 0.0.10

package/dist/kit/handlers.js

@@ -119,9 +119,11 @@ export function createHandlers(config) {
                     return json({ error: 'Invalid input' }, { status: 400 });
                 const { name, ...response } = body;
                 const passkeyName = typeof name === 'string' && name.trim() ? name.trim() : null;
-                const success = await verifyRegistrationResponse(config.db, user.id, response, event.url, passkeyName);
-                if (!success)
-                    return json({ error: 'Passkey registration failed' }, { status: 400 });
+                const result = await verifyRegistrationResponse(config.db, user.id, response, event.url, passkeyName);
+                if (!result.ok) {
+                    console.error('register-finish failed:', result.reason);
+                    return json({ error: 'Passkey registration failed', reason: result.reason }, { status: 400 });
+                }
                 return json({ success: true });
             }
         },

package/dist/passkey.d.ts

@@ -8,7 +8,12 @@ export declare function generateRegistrationChallenge(db: AuthDB, user: {
     id: string;
     email: string;
 }, requestUrl: URL, config: ResolvedConfig): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
-export declare function verifyRegistrationResponse(db: AuthDB, userId: string, response: RegistrationResponseJSON, requestUrl: URL, name?: string | null): Promise<boolean>;
+export declare function verifyRegistrationResponse(db: AuthDB, userId: string, response: RegistrationResponseJSON, requestUrl: URL, name?: string | null): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
 export declare function generateAuthenticationChallenge(db: AuthDB, requestUrl: URL): Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
 export declare function verifyAuthenticationResponse(db: AuthDB, response: AuthenticationResponseJSON, requestUrl: URL): Promise<{
     user: {

package/dist/passkey.js

@@ -32,19 +32,31 @@ export async function generateRegistrationChallenge(db, user, requestUrl, config
 }
 export async function verifyRegistrationResponse(db, userId, response, requestUrl, name = null) {
     const { rpID, origin } = getWebAuthnConfig(requestUrl);
-    const challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString()).challenge;
+    let challenge;
+    try {
+        const clientData = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString());
+        challenge = clientData.challenge;
+    }
+    catch (e) {
+        return { ok: false, reason: `clientDataJSON parse failed: ${e}` };
+    }
     const stored = await db.consumeChallenge(challenge);
-    if (!stored || stored.userId !== userId)
-        return false;
+    if (!stored)
+        return { ok: false, reason: 'challenge not found or expired' };
+    if (stored.userId !== userId)
+        return { ok: false, reason: `userId mismatch: challenge=${stored.userId} session=${userId}` };
     try {
         const verification = await verifyRegResponse({
             response,
             expectedChallenge: challenge,
             expectedOrigin: origin,
-            expectedRPID: rpID
+            expectedRPID: rpID,
+            requireUserVerification: false
         });
-        if (!verification.verified || !verification.registrationInfo)
-            return false;
+        if (!verification.verified)
+            return { ok: false, reason: 'verification not verified' };
+        if (!verification.registrationInfo)
+            return { ok: false, reason: 'no registrationInfo' };
         const { credential } = verification.registrationInfo;
         await db.storePasskey({
             id: randomUUID(),
@@ -55,10 +67,10 @@ export async function verifyRegistrationResponse(db, userId, response, requestUr
             transports: response.response.transports ? JSON.stringify(response.response.transports) : null,
             name
         });
-        return true;
+        return { ok: true };
     }
-    catch {
-        return false;
+    catch (e) {
+        return { ok: false, reason: `verification threw: ${e}` };
     }
 }
 export async function generateAuthenticationChallenge(db, requestUrl) {
@@ -86,6 +98,7 @@ export async function verifyAuthenticationResponse(db, response, requestUrl) {
             expectedChallenge: challenge,
             expectedOrigin: origin,
             expectedRPID: rpID,
+            requireUserVerification: false,
             credential: {
                 id: passkey.credentialId,
                 publicKey: new Uint8Array(passkey.publicKey),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mrgnw/anahtar",
-	"version": "0.0.8",
+	"version": "0.0.10",
 	"description": "Opinionated, reusable auth for SvelteKit. Email+OTP + passkeys.",
 	"license": "MIT",
 	"type": "module",