@mrgnw/anahtar 0.0.9 → 0.0.11

package/dist/passkey.d.ts

@@ -1,5 +1,5 @@
-import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
-import type { AuthDB, ResolvedConfig } from './types.js';
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from "@simplewebauthn/server";
+import type { AuthDB, ResolvedConfig } from "./types.js";
 export declare function getWebAuthnConfig(requestUrl: URL): {
     rpID: string;
     origin: string;

package/dist/passkey.js

@@ -1,5 +1,5 @@
-import { randomUUID } from 'node:crypto';
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse as verifyAuthResponse, verifyRegistrationResponse as verifyRegResponse } from '@simplewebauthn/server';
+import { randomUUID } from "node:crypto";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse as verifyAuthResponse, verifyRegistrationResponse as verifyRegResponse, } from "@simplewebauthn/server";
 const CHALLENGE_EXPIRY_MS = 5 * 60 * 1000;
 export function getWebAuthnConfig(requestUrl) {
     const envOrigin = process.env.ORIGIN;
@@ -14,18 +14,21 @@ export async function generateRegistrationChallenge(db, user, requestUrl, config
     const existingPasskeys = await db.getUserPasskeys(user.id);
     const excludeCredentials = existingPasskeys.map((pk) => ({
         id: pk.credentialId,
-        transports: pk.transports ? JSON.parse(pk.transports) : undefined
+        transports: pk.transports
+            ? JSON.parse(pk.transports)
+            : undefined,
     }));
     const options = await generateRegistrationOptions({
         rpName: config.rpName,
         rpID,
         userName: user.email,
+        userDisplayName: user.email,
         userID: new TextEncoder().encode(user.id),
         authenticatorSelection: {
-            residentKey: 'required',
-            userVerification: 'preferred'
+            residentKey: "required",
+            userVerification: "preferred",
         },
-        excludeCredentials
+        excludeCredentials,
     });
     await db.storeChallenge(options.challenge, user.id, Date.now() + CHALLENGE_EXPIRY_MS);
     return options;
@@ -34,7 +37,7 @@ export async function verifyRegistrationResponse(db, userId, response, requestUr
     const { rpID, origin } = getWebAuthnConfig(requestUrl);
     let challenge;
     try {
-        const clientData = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString());
+        const clientData = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString());
         challenge = clientData.challenge;
     }
     catch (e) {
@@ -42,20 +45,24 @@ export async function verifyRegistrationResponse(db, userId, response, requestUr
     }
     const stored = await db.consumeChallenge(challenge);
     if (!stored)
-        return { ok: false, reason: 'challenge not found or expired' };
+        return { ok: false, reason: "challenge not found or expired" };
     if (stored.userId !== userId)
-        return { ok: false, reason: `userId mismatch: challenge=${stored.userId} session=${userId}` };
+        return {
+            ok: false,
+            reason: `userId mismatch: challenge=${stored.userId} session=${userId}`,
+        };
     try {
         const verification = await verifyRegResponse({
             response,
             expectedChallenge: challenge,
             expectedOrigin: origin,
-            expectedRPID: rpID
+            expectedRPID: rpID,
+            requireUserVerification: false,
         });
         if (!verification.verified)
-            return { ok: false, reason: 'verification not verified' };
+            return { ok: false, reason: "verification not verified" };
         if (!verification.registrationInfo)
-            return { ok: false, reason: 'no registrationInfo' };
+            return { ok: false, reason: "no registrationInfo" };
         const { credential } = verification.registrationInfo;
         await db.storePasskey({
             id: randomUUID(),
@@ -63,8 +70,10 @@ export async function verifyRegistrationResponse(db, userId, response, requestUr
             credentialId: credential.id,
             publicKey: new Uint8Array(credential.publicKey),
             counter: credential.counter,
-            transports: response.response.transports ? JSON.stringify(response.response.transports) : null,
-            name
+            transports: response.response.transports
+                ? JSON.stringify(response.response.transports)
+                : null,
+            name,
         });
         return { ok: true };
     }
@@ -77,9 +86,9 @@ export async function generateAuthenticationChallenge(db, requestUrl) {
     const options = await generateAuthenticationOptions({
         rpID,
         allowCredentials: [],
-        userVerification: 'preferred'
+        userVerification: "preferred",
     });
-    await db.storeChallenge(options.challenge, 'anonymous', Date.now() + CHALLENGE_EXPIRY_MS);
+    await db.storeChallenge(options.challenge, "anonymous", Date.now() + CHALLENGE_EXPIRY_MS);
     return options;
 }
 export async function verifyAuthenticationResponse(db, response, requestUrl) {
@@ -87,7 +96,7 @@ export async function verifyAuthenticationResponse(db, response, requestUrl) {
     const passkey = await db.getPasskeyByCredentialId(response.id);
     if (!passkey)
         return null;
-    const challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString()).challenge;
+    const challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString()).challenge;
     const stored = await db.consumeChallenge(challenge);
     if (!stored)
         return null;
@@ -97,18 +106,21 @@ export async function verifyAuthenticationResponse(db, response, requestUrl) {
             expectedChallenge: challenge,
             expectedOrigin: origin,
             expectedRPID: rpID,
+            requireUserVerification: false,
             credential: {
                 id: passkey.credentialId,
                 publicKey: new Uint8Array(passkey.publicKey),
                 counter: passkey.counter,
-                transports: passkey.transports ? JSON.parse(passkey.transports) : undefined
-            }
+                transports: passkey.transports
+                    ? JSON.parse(passkey.transports)
+                    : undefined,
+            },
         });
         if (!verification.verified)
             return null;
         await db.updatePasskeyCounter(passkey.id, verification.authenticationInfo.newCounter);
         return {
-            user: { id: passkey.userId, email: passkey.email }
+            user: { id: passkey.userId, email: passkey.email },
         };
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mrgnw/anahtar",
-	"version": "0.0.9",
+	"version": "0.0.11",
 	"description": "Opinionated, reusable auth for SvelteKit. Email+OTP + passkeys.",
 	"license": "MIT",
 	"type": "module",