@mulverse/mulguard-core 1.0.0

package/lib/utils/webauthn-client.js

@@ -0,0 +1,197 @@
+//@ts-check
+// Declare a SimpleWebAuthnBrowser variable as part of "window"
+/** @typedef {"authenticate"} WebAuthnAuthenticate */
+/** @typedef {"register"} WebAuthnRegister */
+/** @typedef {WebAuthnRegister | WebAuthnAuthenticate} WebAuthnOptionsAction */
+/**
+ * @template {WebAuthnOptionsAction} T
+ * @typedef {T extends WebAuthnAuthenticate ?
+ *  { options: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON; action: "authenticate" } :
+ *  T extends WebAuthnRegister ?
+ *  { options: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON; action: "register" } :
+ * never
+ * } WebAuthnOptionsReturn
+ */
+/**
+ * webauthnScript is the client-side script that handles the webauthn form
+ *
+ * @param {string} authURL is the URL of the auth API
+ * @param {string} providerID is the ID of the webauthn provider
+ */
+export async function webauthnScript(authURL, providerID) {
+    /** @type {typeof import("@simplewebauthn/browser")} */
+    // @ts-ignore
+    const WebAuthnBrowser = window.SimpleWebAuthnBrowser;
+    /**
+     * Fetch webauthn options from the server
+     *
+     * @template {WebAuthnOptionsAction} T
+     * @param {T | undefined} action action to fetch options for
+     * @returns {Promise<WebAuthnOptionsReturn<T> | undefined>}
+     */
+    async function fetchOptions(action) {
+        // Create the options URL with the action and query parameters
+        const url = new URL(`${authURL}/webauthn-options/${providerID}`);
+        if (action)
+            url.searchParams.append("action", action);
+        const formFields = getFormFields();
+        formFields.forEach((field) => {
+            url.searchParams.append(field.name, field.value);
+        });
+        const res = await fetch(url);
+        if (!res.ok) {
+            console.error("Failed to fetch options", res);
+            return;
+        }
+        return res.json();
+    }
+    /**
+     * Get the webauthn form from the page
+     *
+     * @returns {HTMLFormElement}
+     */
+    function getForm() {
+        const formID = `#${providerID}-form`;
+        /** @type {HTMLFormElement | null} */
+        const form = document.querySelector(formID);
+        if (!form)
+            throw new Error(`Form '${formID}' not found`);
+        return form;
+    }
+    /**
+     * Get formFields from the form
+     *
+     * @returns {HTMLInputElement[]}
+     */
+    function getFormFields() {
+        const form = getForm();
+        /** @type {HTMLInputElement[]} */
+        const formFields = Array.from(form.querySelectorAll("input[data-form-field]"));
+        return formFields;
+    }
+    /**
+     * Passkey form submission handler.
+     * Takes the input from the form and a few other parameters and submits it to the server.
+     *
+     * @param {WebAuthnOptionsAction} action action to submit
+     * @param {unknown | undefined} data optional data to submit
+     * @returns {Promise<void>}
+     */
+    async function submitForm(action, data) {
+        const form = getForm();
+        // If a POST request, create hidden fields in the form
+        // and submit it so the browser redirects on login
+        if (action) {
+            const actionInput = document.createElement("input");
+            actionInput.type = "hidden";
+            actionInput.name = "action";
+            actionInput.value = action;
+            form.appendChild(actionInput);
+        }
+        if (data) {
+            const dataInput = document.createElement("input");
+            dataInput.type = "hidden";
+            dataInput.name = "data";
+            dataInput.value = JSON.stringify(data);
+            form.appendChild(dataInput);
+        }
+        return form.submit();
+    }
+    /**
+     * Executes the authentication flow by fetching options from the server,
+     * starting the authentication, and submitting the response to the server.
+     *
+     * @param {WebAuthnOptionsReturn<WebAuthnAuthenticate>['options']} options
+     * @param {boolean} autofill Whether or not to use the browser's autofill
+     * @returns {Promise<void>}
+     */
+    async function authenticationFlow(options, autofill) {
+        // Start authentication
+        const authResp = await WebAuthnBrowser.startAuthentication(options, autofill);
+        // Submit authentication response to server
+        return await submitForm("authenticate", authResp);
+    }
+    /**
+     * @param {WebAuthnOptionsReturn<WebAuthnRegister>['options']} options
+     */
+    async function registrationFlow(options) {
+        // Check if all required formFields are set
+        const formFields = getFormFields();
+        formFields.forEach((field) => {
+            if (field.required && !field.value) {
+                throw new Error(`Missing required field: ${field.name}`);
+            }
+        });
+        // Start registration
+        const regResp = await WebAuthnBrowser.startRegistration(options);
+        // Submit registration response to server
+        return await submitForm("register", regResp);
+    }
+    /**
+     * Attempts to authenticate the user when the page loads
+     * using the browser's autofill popup.
+     *
+     * @returns {Promise<void>}
+     */
+    async function autofillAuthentication() {
+        // if the browser can't handle autofill, don't try
+        if (!WebAuthnBrowser.browserSupportsWebAuthnAutofill())
+            return;
+        const res = await fetchOptions("authenticate");
+        if (!res) {
+            console.error("Failed to fetch option for autofill authentication");
+            return;
+        }
+        try {
+            await authenticationFlow(res.options, true);
+        }
+        catch (e) {
+            console.error(e);
+        }
+    }
+    /**
+     * Sets up the passkey form by overriding the form submission handler
+     * so that it attempts to authenticate the user when the form is submitted.
+     * If the user is not registered, it will attempt to register them instead.
+     */
+    async function setupForm() {
+        const form = getForm();
+        // If the browser can't do WebAuthn, hide the form
+        if (!WebAuthnBrowser.browserSupportsWebAuthn()) {
+            form.style.display = "none";
+            return;
+        }
+        if (form) {
+            form.addEventListener("submit", async (e) => {
+                e.preventDefault();
+                // Fetch options from the server without assuming that
+                // the user is registered
+                const res = await fetchOptions(undefined);
+                if (!res) {
+                    console.error("Failed to fetch options for form submission");
+                    return;
+                }
+                // Then execute the appropriate flow
+                if (res.action === "authenticate") {
+                    try {
+                        await authenticationFlow(res.options, false);
+                    }
+                    catch (e) {
+                        console.error(e);
+                    }
+                }
+                else if (res.action === "register") {
+                    try {
+                        await registrationFlow(res.options);
+                    }
+                    catch (e) {
+                        console.error(e);
+                    }
+                }
+            });
+        }
+    }
+    // On page load, setup the form and attempt to authenticate the user.
+    setupForm();
+    autofillAuthentication();
+}

package/lib/utils/webauthn-utils.d.ts

@@ -0,0 +1,81 @@
+import type { WebAuthnProviderType } from "../../providers/webauthn.js";
+import type { Account, Authenticator, Awaited, InternalOptions, RequestInternal, ResponseInternal, User } from "../../types.js";
+import type { Cookie } from "./cookie.js";
+import { type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON } from "@simplewebauthn/types";
+import type { Adapter, AdapterAccount } from "../../adapters.js";
+import type { GetUserInfo } from "../../providers/webauthn.js";
+export type WebAuthnRegister = "register";
+export type WebAuthnAuthenticate = "authenticate";
+export type WebAuthnAction = WebAuthnRegister | WebAuthnAuthenticate;
+type InternalOptionsWebAuthn = InternalOptions<WebAuthnProviderType> & {
+    adapter: Required<Adapter>;
+};
+export type WebAuthnOptionsResponseBody = {
+    action: WebAuthnAuthenticate;
+    options: PublicKeyCredentialRequestOptionsJSON;
+} | {
+    action: WebAuthnRegister;
+    options: PublicKeyCredentialCreationOptionsJSON;
+};
+type WebAuthnOptionsResponse = ResponseInternal & {
+    body: WebAuthnOptionsResponseBody;
+};
+export type CredentialDeviceType = "singleDevice" | "multiDevice";
+interface InternalAuthenticator {
+    providerAccountId: string;
+    credentialID: Uint8Array;
+    credentialPublicKey: Uint8Array;
+    counter: number;
+    credentialDeviceType: CredentialDeviceType;
+    credentialBackedUp: boolean;
+    transports?: AuthenticatorTransport[];
+}
+type RGetUserInfo = Awaited<ReturnType<GetUserInfo>>;
+/**
+ * Infers the WebAuthn options based on the provided parameters.
+ *
+ * @param action - The WebAuthn action to perform (optional).
+ * @param loggedInUser - The logged-in user (optional).
+ * @param userInfoResponse - The response containing user information (optional).
+ *
+ * @returns The WebAuthn action to perform, or null if no inference could be made.
+ */
+export declare function inferWebAuthnOptions(action: WebAuthnAction | undefined, loggedIn: boolean, userInfoResponse: RGetUserInfo): WebAuthnAction | null;
+/**
+ * Retrieves the registration response for WebAuthn options request.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - The user information.
+ * @param resCookies - Optional cookies to be included in the response.
+ * @returns A promise that resolves to the WebAuthnOptionsResponse.
+ */
+export declare function getRegistrationResponse(options: InternalOptionsWebAuthn, request: RequestInternal, user: User & {
+    email: string;
+}, resCookies?: Cookie[]): Promise<WebAuthnOptionsResponse>;
+/**
+ * Retrieves the authentication response for WebAuthn options request.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - Optional user information.
+ * @param resCookies - Optional array of cookies to be included in the response.
+ * @returns A promise that resolves to a WebAuthnOptionsResponse object.
+ */
+export declare function getAuthenticationResponse(options: InternalOptionsWebAuthn, request: RequestInternal, user?: User, resCookies?: Cookie[]): Promise<WebAuthnOptionsResponse>;
+export declare function verifyAuthenticate(options: InternalOptionsWebAuthn, request: RequestInternal, resCookies: Cookie[]): Promise<{
+    account: AdapterAccount;
+    user: User;
+}>;
+export declare function verifyRegister(options: InternalOptions<WebAuthnProviderType>, request: RequestInternal, resCookies: Cookie[]): Promise<{
+    account: Account;
+    user: User;
+    authenticator: Authenticator;
+}>;
+export declare function assertInternalOptionsWebAuthn(options: InternalOptions): InternalOptionsWebAuthn;
+export declare function fromBase64(base64: string): Uint8Array;
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function transportsToString(transports: InternalAuthenticator["transports"]): string | undefined;
+export declare function stringToTransports(tstring: string | undefined | null): InternalAuthenticator["transports"];
+export {};
+//# sourceMappingURL=webauthn-utils.d.ts.map

package/lib/utils/webauthn-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-utils.d.ts","sourceRoot":"","sources":["../../src/lib/utils/webauthn-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,KAAK,EACV,OAAO,EACP,aAAa,EACb,OAAO,EACP,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,IAAI,EACL,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AASzC,OAAO,EAEL,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAE3C,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EAEf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAO9D,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAA;AACzC,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAA;AACjD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAEpE,KAAK,uBAAuB,GAAG,eAAe,CAAC,oBAAoB,CAAC,GAAG;IACrE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAA;AACD,MAAM,MAAM,2BAA2B,GACnC;IACE,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,qCAAqC,CAAA;CAC/C,GACD;IACE,MAAM,EAAE,gBAAgB,CAAA;IACxB,OAAO,EAAE,sCAAsC,CAAA;CAChD,CAAA;AACL,KAAK,uBAAuB,GAAG,gBAAgB,GAAG;IAChD,IAAI,EAAE,2BAA2B,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,CAAA;AACjE,UAAU,qBAAqB;IAC7B,iBAAiB,EAAE,MAAM,CAAA;IACzB,YAAY,EAAE,UAAU,CAAA;IACxB,mBAAmB,EAAE,UAAU,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,kBAAkB,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAA;CACtC;AAED,KAAK,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,QAAQ,EAAE,OAAO,EACjB,gBAAgB,EAAE,YAAY,GAC7B,cAAc,GAAG,IAAI,CA4CvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAC9B,UAAU,CAAC,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAqBlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE,IAAI,EACX,UAAU,CAAC,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAoBlC;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CA+GlD;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,CAAC,oBAAoB,CAAC,EAC9C,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,aAAa,CAAA;CAAE,CAAC,CA6EzE;AAiFD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,eAAe,GACvB,uBAAuB,CAYzB;AAeD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAErD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAElD;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,sBAGhD;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,qBAAqB,CAAC,YAAY,CAAC,CAIrC"}

package/lib/utils/webauthn-utils.js

@@ -0,0 +1,343 @@
+import { AdapterError, AuthError, InvalidProvider, MissingAdapter, WebAuthnVerificationError, } from "../../errors.js";
+import { webauthnChallenge } from "../actions/callback/oauth/checks.js";
+import { randomString } from "./web.js";
+/**
+ * Infers the WebAuthn options based on the provided parameters.
+ *
+ * @param action - The WebAuthn action to perform (optional).
+ * @param loggedInUser - The logged-in user (optional).
+ * @param userInfoResponse - The response containing user information (optional).
+ *
+ * @returns The WebAuthn action to perform, or null if no inference could be made.
+ */
+export function inferWebAuthnOptions(action, loggedIn, userInfoResponse) {
+    const { user, exists = false } = userInfoResponse ?? {};
+    switch (action) {
+        case "authenticate": {
+            /**
+             * Always allow explicit authentication requests.
+             */
+            return "authenticate";
+        }
+        case "register": {
+            /**
+             * Registration is only allowed if:
+             * - The user is logged in, meaning the user wants to register a new authenticator.
+             * - The user is not logged in and provided user info that does NOT exist, meaning the user wants to register a new account.
+             */
+            if (user && loggedIn === exists)
+                return "register";
+            break;
+        }
+        case undefined: {
+            /**
+             * When no explicit action is provided, we try to infer it based on the user info provided. These are the possible cases:
+             * - Logged in users must always send an explit action, so we bail out in this case.
+             * - Otherwise, if no user info is provided, the desired action is authentication without pre-defined authenticators.
+             * - Otherwise, if the user info provided is of an existing user, the desired action is authentication with their pre-defined authenticators.
+             * - Finally, if the user info provided is of a non-existing user, the desired action is registration.
+             */
+            if (!loggedIn) {
+                if (user) {
+                    if (exists) {
+                        return "authenticate";
+                    }
+                    else {
+                        return "register";
+                    }
+                }
+                else {
+                    return "authenticate";
+                }
+            }
+            break;
+        }
+    }
+    // No decision could be made
+    return null;
+}
+/**
+ * Retrieves the registration response for WebAuthn options request.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - The user information.
+ * @param resCookies - Optional cookies to be included in the response.
+ * @returns A promise that resolves to the WebAuthnOptionsResponse.
+ */
+export async function getRegistrationResponse(options, request, user, resCookies) {
+    // Get registration options
+    const regOptions = await getRegistrationOptions(options, request, user);
+    // Get signed cookie
+    const { cookie } = await webauthnChallenge.create(options, regOptions.challenge, user);
+    return {
+        status: 200,
+        cookies: [...(resCookies ?? []), cookie],
+        body: {
+            action: "register",
+            options: regOptions,
+        },
+        headers: {
+            "Content-Type": "application/json",
+        },
+    };
+}
+/**
+ * Retrieves the authentication response for WebAuthn options request.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - Optional user information.
+ * @param resCookies - Optional array of cookies to be included in the response.
+ * @returns A promise that resolves to a WebAuthnOptionsResponse object.
+ */
+export async function getAuthenticationResponse(options, request, user, resCookies) {
+    // Get authentication options
+    const authOptions = await getAuthenticationOptions(options, request, user);
+    // Get signed cookie
+    const { cookie } = await webauthnChallenge.create(options, authOptions.challenge);
+    return {
+        status: 200,
+        cookies: [...(resCookies ?? []), cookie],
+        body: {
+            action: "authenticate",
+            options: authOptions,
+        },
+        headers: {
+            "Content-Type": "application/json",
+        },
+    };
+}
+export async function verifyAuthenticate(options, request, resCookies) {
+    const { adapter, provider } = options;
+    // Get WebAuthn response from request body
+    const data = request.body && typeof request.body.data === "string"
+        ? JSON.parse(request.body.data)
+        : undefined;
+    if (!data ||
+        typeof data !== "object" ||
+        !("id" in data) ||
+        typeof data.id !== "string") {
+        throw new AuthError("Invalid WebAuthn Authentication response");
+    }
+    // Reset the ID so we smooth out implementation differences
+    const credentialID = toBase64(fromBase64(data.id));
+    // Get authenticator from database
+    const authenticator = await adapter.getAuthenticator(credentialID);
+    if (!authenticator) {
+        throw new AuthError(`WebAuthn authenticator not found in database: ${JSON.stringify({
+            credentialID,
+        })}`);
+    }
+    // Get challenge from request cookies
+    const { challenge: expectedChallenge } = await webauthnChallenge.use(options, request.cookies, resCookies);
+    // Verify the response
+    let verification;
+    try {
+        const relayingParty = provider.getRelayingParty(options, request);
+        verification = await provider.simpleWebAuthn.verifyAuthenticationResponse({
+            ...provider.verifyAuthenticationOptions,
+            expectedChallenge,
+            response: data,
+            authenticator: fromAdapterAuthenticator(authenticator),
+            expectedOrigin: relayingParty.origin,
+            expectedRPID: relayingParty.id,
+        });
+    }
+    catch (e) {
+        throw new WebAuthnVerificationError(e);
+    }
+    const { verified, authenticationInfo } = verification;
+    // Make sure the response was verified
+    if (!verified) {
+        throw new WebAuthnVerificationError("WebAuthn authentication response could not be verified");
+    }
+    // Update authenticator counter
+    try {
+        const { newCounter } = authenticationInfo;
+        await adapter.updateAuthenticatorCounter(authenticator.credentialID, newCounter);
+    }
+    catch (e) {
+        throw new AdapterError(`Failed to update authenticator counter. This may cause future authentication attempts to fail. ${JSON.stringify({
+            credentialID,
+            oldCounter: authenticator.counter,
+            newCounter: authenticationInfo.newCounter,
+        })}`, e);
+    }
+    // Get the account and user
+    const account = await adapter.getAccount(authenticator.providerAccountId, provider.id);
+    if (!account) {
+        throw new AuthError(`WebAuthn account not found in database: ${JSON.stringify({
+            credentialID,
+            providerAccountId: authenticator.providerAccountId,
+        })}`);
+    }
+    const user = await adapter.getUser(account.userId);
+    if (!user) {
+        throw new AuthError(`WebAuthn user not found in database: ${JSON.stringify({
+            credentialID,
+            providerAccountId: authenticator.providerAccountId,
+            userID: account.userId,
+        })}`);
+    }
+    return {
+        account,
+        user,
+    };
+}
+export async function verifyRegister(options, request, resCookies) {
+    const { provider } = options;
+    // Get WebAuthn response from request body
+    const data = request.body && typeof request.body.data === "string"
+        ? JSON.parse(request.body.data)
+        : undefined;
+    if (!data ||
+        typeof data !== "object" ||
+        !("id" in data) ||
+        typeof data.id !== "string") {
+        throw new AuthError("Invalid WebAuthn Registration response");
+    }
+    // Get challenge from request cookies
+    const { challenge: expectedChallenge, registerData: user } = await webauthnChallenge.use(options, request.cookies, resCookies);
+    if (!user) {
+        throw new AuthError("Missing user registration data in WebAuthn challenge cookie");
+    }
+    // Verify the response
+    let verification;
+    try {
+        const relayingParty = provider.getRelayingParty(options, request);
+        verification = await provider.simpleWebAuthn.verifyRegistrationResponse({
+            ...provider.verifyRegistrationOptions,
+            expectedChallenge,
+            response: data,
+            expectedOrigin: relayingParty.origin,
+            expectedRPID: relayingParty.id,
+        });
+    }
+    catch (e) {
+        throw new WebAuthnVerificationError(e);
+    }
+    // Make sure the response was verified
+    if (!verification.verified || !verification.registrationInfo) {
+        throw new WebAuthnVerificationError("WebAuthn registration response could not be verified");
+    }
+    // Build a new account
+    const account = {
+        providerAccountId: toBase64(verification.registrationInfo.credentialID),
+        provider: options.provider.id,
+        type: provider.type,
+    };
+    // Build a new authenticator
+    const authenticator = {
+        providerAccountId: account.providerAccountId,
+        counter: verification.registrationInfo.counter,
+        credentialID: toBase64(verification.registrationInfo.credentialID),
+        credentialPublicKey: toBase64(verification.registrationInfo.credentialPublicKey),
+        credentialBackedUp: verification.registrationInfo.credentialBackedUp,
+        credentialDeviceType: verification.registrationInfo.credentialDeviceType,
+        transports: transportsToString(data.response
+            .transports),
+    };
+    // Return created stuff
+    return {
+        user,
+        account,
+        authenticator,
+    };
+}
+/**
+ * Generates WebAuthn authentication options.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - Optional user information.
+ * @returns The authentication options.
+ */
+async function getAuthenticationOptions(options, request, user) {
+    const { provider, adapter } = options;
+    // Get the user's authenticators.
+    const authenticators = user && user["id"]
+        ? await adapter.listAuthenticatorsByUserId(user.id)
+        : null;
+    const relayingParty = provider.getRelayingParty(options, request);
+    // Return the authentication options.
+    return await provider.simpleWebAuthn.generateAuthenticationOptions({
+        ...provider.authenticationOptions,
+        rpID: relayingParty.id,
+        allowCredentials: authenticators?.map((a) => ({
+            id: fromBase64(a.credentialID),
+            type: "public-key",
+            transports: stringToTransports(a.transports),
+        })),
+    });
+}
+/**
+ * Generates WebAuthn registration options.
+ *
+ * @param options - The internal options for WebAuthn.
+ * @param request - The request object.
+ * @param user - The user information.
+ * @returns The registration options.
+ */
+async function getRegistrationOptions(options, request, user) {
+    const { provider, adapter } = options;
+    // Get the user's authenticators.
+    const authenticators = user["id"]
+        ? await adapter.listAuthenticatorsByUserId(user.id)
+        : null;
+    // Generate a random user ID for the credential.
+    // We can do this because we don't use this user ID to link the
+    // credential to the user. Instead, we store actual userID in the
+    // Authenticator object and fetch it via it's credential ID.
+    const userID = randomString(32);
+    const relayingParty = provider.getRelayingParty(options, request);
+    // Return the registration options.
+    return await provider.simpleWebAuthn.generateRegistrationOptions({
+        ...provider.registrationOptions,
+        userID,
+        userName: user.email,
+        userDisplayName: user.name ?? undefined,
+        rpID: relayingParty.id,
+        rpName: relayingParty.name,
+        excludeCredentials: authenticators?.map((a) => ({
+            id: fromBase64(a.credentialID),
+            type: "public-key",
+            transports: stringToTransports(a.transports),
+        })),
+    });
+}
+export function assertInternalOptionsWebAuthn(options) {
+    const { provider, adapter } = options;
+    // Adapter is required for WebAuthn
+    if (!adapter)
+        throw new MissingAdapter("An adapter is required for the WebAuthn provider");
+    // Provider must be WebAuthn
+    if (!provider || provider.type !== "webauthn") {
+        throw new InvalidProvider("Provider must be WebAuthn");
+    }
+    // Narrow the options type for typed usage later
+    return { ...options, provider, adapter };
+}
+function fromAdapterAuthenticator(authenticator) {
+    return {
+        ...authenticator,
+        credentialDeviceType: authenticator.credentialDeviceType,
+        transports: stringToTransports(authenticator.transports),
+        credentialID: fromBase64(authenticator.credentialID),
+        credentialPublicKey: fromBase64(authenticator.credentialPublicKey),
+    };
+}
+export function fromBase64(base64) {
+    return new Uint8Array(Buffer.from(base64, "base64"));
+}
+export function toBase64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+export function transportsToString(transports) {
+    return transports?.join(",");
+}
+export function stringToTransports(tstring) {
+    return tstring
+        ? tstring.split(",")
+        : undefined;
+}