@o3co/auth-provider-passkey 0.0.0 → 0.18.0-rc.1

package/webauthn/src/testing.js

@@ -0,0 +1,354 @@
+import { createHash, generateKeyPairSync, randomBytes, sign } from "node:crypto";
+import { isUnavailable } from "@o3co/auth-provider-foundation/kernel";
+import { describe, expect, it } from "vitest";
+import { keptPasskeys } from "./records.js";
+export const testOrigin = "https://rp.example";
+/** The webauthn part of a test's configuration: a relying party at `rp.example`. */
+export function webauthnConfig(settings = {}) {
+    return {
+        webauthn: { "rp-id": "rp.example", "rp-name": "RP", origins: [testOrigin], ...settings },
+    };
+}
+/** CBOR for the few kinds WebAuthn uses: integers, text, bytes and maps. */
+function cbor(value) {
+    const head = (major, n) => n < 24
+        ? [(major << 5) | n]
+        : n < 256
+            ? [(major << 5) | 24, n]
+            : [(major << 5) | 25, n >> 8, n & 255];
+    if (typeof value === "number")
+        return value >= 0 ? head(0, value) : head(1, -1 - value);
+    if (typeof value === "string") {
+        const bytes = Buffer.from(value);
+        return [...head(3, bytes.length), ...bytes];
+    }
+    if (value instanceof Uint8Array)
+        return [...head(2, value.length), ...value];
+    return [...head(5, value.size), ...[...value].flatMap(([k, v]) => [...cbor(k), ...cbor(v)])];
+}
+const b64 = (bytes) => Buffer.from(bytes).toString("base64url");
+/** Authenticator data flags: user present, user verified, backup eligible, backed up, attested data. */
+const [UP, UV, BE, BS, AT] = [1, 4, 8, 16, 64];
+/** A browser's refusal, named as `navigator.credentials` names it. */
+const refused = (name, message) => new DOMException(message, name);
+/** Whether a browser on `host` takes `rpId`: the host, or a domain above it but no single label. */
+const servesHost = (rpId, host) => host === rpId || (host.endsWith(`.${rpId}`) && rpId.includes("."));
+/**
+ * A software WebAuthn authenticator behind a browser: it makes ES256 (or ES384) credentials,
+ * attests with `none`, asserts with a count that goes up unless it keeps none, and checks the
+ * options as a browser does unless a twist says to overlook them.
+ */
+export function softwareAuthenticator(settings = {}) {
+    const kept = new Map();
+    const alg = settings.algorithm === "ES384" ? -35 : -7;
+    const canVerify = settings.userVerified !== false;
+    const canDiscover = settings.discoverable !== false;
+    const flags = (attested, verified) => UP | (verified ? UV : 0) | (settings.backupEligible ? BE | BS : 0) | (attested ? AT : 0);
+    /** Verifies the user unless told it is discouraged, and only when it can; required and unable is refused. */
+    const verifies = (asked, twist) => {
+        check(twist, asked === "required" && !canVerify, "NotAllowedError", "cannot verify the user");
+        return canVerify && asked !== "discouraged";
+    };
+    const authData = (rp, attested, verified, count, rest = []) => {
+        const counter = Buffer.alloc(4);
+        counter.writeUInt32BE(count);
+        const rpHash = createHash("sha256").update(rp).digest();
+        return Buffer.from([...rpHash, flags(attested, verified), ...counter, ...rest]);
+    };
+    const clientData = (type, challenge, client, twist) => {
+        // A browser names a top origin only for a page in a cross-origin frame.
+        if (client.topOrigin !== undefined && client.crossOrigin !== true && !twist.overlook) {
+            throw new Error("a top origin is reported only in a cross-origin frame");
+        }
+        const json = JSON.stringify({
+            type,
+            challenge,
+            origin: client.origin,
+            crossOrigin: client.crossOrigin ?? false,
+            ...(client.topOrigin ? { topOrigin: client.topOrigin } : {}),
+        });
+        return twist.clientDataJSON ? twist.clientDataJSON(json) : b64(json);
+    };
+    /** The relying party a browser on the client's page takes, or its refusal. */
+    const rpFor = (asked, client, twist) => {
+        const host = new URL(client.origin).hostname;
+        const rpId = asked ?? host;
+        if (!twist.overlook && !servesHost(rpId, host)) {
+            throw refused("SecurityError", `${rpId} is not a domain of ${host}`);
+        }
+        return rpId;
+    };
+    /** Throws the refusal a browser answers where `broken`, unless told to overlook it. */
+    const check = (twist, broken, name, message) => {
+        if (broken && !twist.overlook)
+            throw refused(name, message);
+    };
+    const create = (options, client, twist = {}) => {
+        const rpId = rpFor(options.rp.id, client, twist);
+        const clientDataJSON = clientData("webauthn.create", options.challenge, client, twist);
+        const handleBytes = Buffer.from(options.user.id, "base64url").length;
+        check(twist, handleBytes < 1 || handleBytes > 64, "TypeError", "user.id is 1 to 64 bytes");
+        const offered = options.pubKeyCredParams.some((p) => p.type === "public-key" && p.alg === alg);
+        check(twist, !offered, "NotSupportedError", "no algorithm it has is offered");
+        const excluded = (options.excludeCredentials ?? []).some((c) => kept.get(c.id)?.rpId === rpId);
+        check(twist, excluded, "InvalidStateError", "it holds an excluded credential");
+        const selection = options.authenticatorSelection ?? {};
+        const residentKey = selection.residentKey ?? (selection.requireResidentKey ? "required" : "discouraged");
+        check(twist, residentKey === "required" && !canDiscover, "NotAllowedError", "not discoverable");
+        const verified = verifies(selection.userVerification, twist);
+        const { privateKey, publicKey } = generateKeyPairSync("ec", {
+            namedCurve: alg === -35 ? "P-384" : "P-256",
+        });
+        const jwk = publicKey.export({ format: "jwk" });
+        const cose = new Map([
+            [1, 2],
+            [3, alg],
+            [-1, alg === -35 ? 2 : 1],
+            [-2, Buffer.from(jwk.x ?? "", "base64url")],
+            [-3, Buffer.from(jwk.y ?? "", "base64url")],
+        ]);
+        const id = twist.credentialId ? Buffer.from(twist.credentialId, "base64url") : randomBytes(16);
+        const attested = [...Buffer.alloc(16), id.length >> 8, id.length & 255, ...id, ...cbor(cose)];
+        const data = authData(twist.rpId ?? rpId, true, verified, 0, attested);
+        const discoverable = canDiscover && residentKey !== "discouraged";
+        kept.set(b64(id), { key: privateKey, handle: options.user.id, rpId, discoverable, count: 0 });
+        const attestationObject = cbor(new Map([
+            ["fmt", "none"],
+            ["attStmt", new Map()],
+            ["authData", data],
+        ]));
+        return {
+            id: b64(id),
+            rawId: b64(id),
+            type: "public-key",
+            response: {
+                clientDataJSON,
+                attestationObject: b64(Buffer.from(attestationObject)),
+                transports: ["internal"],
+            },
+            clientExtensionResults: {},
+        };
+    };
+    const get = (options, client, twist = {}, pick) => {
+        const rpId = rpFor(options.rpId, client, twist);
+        const clientDataJSON = clientData("webauthn.get", options.challenge, client, twist);
+        const listed = (options.allowCredentials ?? []).map((c) => c.id);
+        // With none listed, a browser offers the discoverable credentials it holds for the party.
+        const offered = [...kept].filter(([id, c]) => twist.overlook
+            ? true
+            : c.rpId === rpId && (listed.length ? listed.includes(id) : c.discoverable));
+        const chosen = offered.find(([id]) => id === pick) ?? (pick ? undefined : offered.at(-1));
+        if (!chosen)
+            throw refused("NotAllowedError", "no credential it holds is asked for");
+        const verified = verifies(options.userVerification, twist);
+        const [id, credential] = chosen;
+        if (!settings.countless)
+            credential.count += 1;
+        const count = twist.counter ?? credential.count;
+        const data = authData(twist.rpId ?? credential.rpId, false, verified, count);
+        const signed = Buffer.concat([
+            data,
+            createHash("sha256").update(Buffer.from(clientDataJSON, "base64url")).digest(),
+        ]);
+        // An authenticator answers the handle only of a credential it keeps discoverable.
+        const own = credential.discoverable ? credential.handle : null;
+        const handle = twist.userHandle === undefined ? own : twist.userHandle;
+        return {
+            id,
+            rawId: id,
+            type: "public-key",
+            response: {
+                clientDataJSON,
+                authenticatorData: b64(data),
+                signature: b64(sign(alg === -35 ? "sha384" : "sha256", signed, credential.key)),
+                ...(handle === null ? {} : { userHandle: handle }),
+            },
+            clientExtensionResults: {},
+        };
+    };
+    return {
+        /** Answers creation options as `navigator.credentials.create` does. */
+        create,
+        /** Answers request options as `navigator.credentials.get` does, with `pick` if the user picks one. */
+        get,
+    };
+}
+const handleOf = () => randomBytes(32).toString("base64url");
+/** What webauthn needs from any implementation: records kept whole and apart, without end, written by webauthn in one shape. */
+export function passkeyStoreContract(name, open) {
+    let n = 0;
+    const fresh = () => `k-${++n}-${randomBytes(6).toString("hex")}`;
+    const held = (value) => value;
+    const counted = (record) => record.n;
+    const plus = (by) => (record) => ({
+        value: held({ n: counted(record) + by }),
+    });
+    describe(`webauthn's passkey store interface: ${name}`, () => {
+        it("keeps a record whole and once per key in each space, the two apart", async () => {
+            const { passkeys } = await open();
+            const key = fresh();
+            const odd = held({ state: "unheard-of", nested: { list: [1, "two"] } });
+            expect(await passkeys.credentials.save(key, odd)).toBe("created");
+            expect(await passkeys.credentials.save(key, held({ n: 1 }))).toBe("exists");
+            expect(await passkeys.subjects.read(key)).toBeUndefined();
+            expect(await passkeys.subjects.save(key, held({ n: 1 }))).toBe("created");
+            expect(await passkeys.credentials.read(key)).toEqual(odd);
+            expect(await passkeys.subjects.update(key, plus(1))).toEqual({
+                before: held({ n: 1 }),
+                after: held({ n: 2 }),
+            });
+            expect(await passkeys.credentials.update(fresh(), plus(1))).toBeUndefined();
+        });
+        it("changes a record only from what it holds, again after a racing writer", async () => {
+            const place = await open();
+            const key = fresh();
+            await place.passkeys.subjects.save(key, held({ n: 1 }));
+            place.raceNextUpdate(key, (record) => held({ n: counted(record) * 10 }));
+            expect((await place.passkeys.subjects.update(key, plus(1)))?.after).toEqual(held({ n: 11 }));
+        });
+        it("keeps records without end, through a restart and through memory pressure", async () => {
+            const place = await open();
+            const key = fresh();
+            await place.passkeys.credentials.save(key, held({ n: 1 }));
+            place.advance(10 * 365 * 86_400_000);
+            await place.restart?.();
+            await place.pressMemory?.();
+            expect(await place.passkeys.credentials.read(key)).toEqual(held({ n: 1 }));
+        });
+        it("settles writes whose answers were lost, and keeps them through a failover", async (context) => {
+            const place = await open();
+            const { loseNextAnswer: lose, failover } = place;
+            if (!lose || !failover)
+                return context.skip();
+            const key = fresh();
+            lose();
+            expect(await place.passkeys.subjects.save(key, held({ n: 1 }))).toBe("created");
+            lose();
+            expect((await place.passkeys.subjects.update(key, plus(1)))?.after).toEqual(held({ n: 2 }));
+            await failover();
+            expect(await place.passkeys.subjects.read(key)).toEqual(held({ n: 2 }));
+        });
+        // The writer gives up once the clock passes its patience, so only the read could have kept it.
+        it("reads a record another request wrote only as a failover keeps it", async (context) => {
+            const place = await open();
+            const { duringNextSave, failover } = place;
+            if (!duringNextSave || !failover)
+                return context.skip();
+            const key = fresh();
+            let seen;
+            duringNextSave(async () => {
+                seen = await place.passkeys.credentials.read(key);
+                await failover();
+                place.advance(60_000);
+            });
+            await place.passkeys.credentials.save(key, held({ n: 1 })).catch(() => undefined);
+            expect(await place.passkeys.credentials.read(key)).toEqual(seen);
+        });
+        it("is never given a handle or a credential id webauthn would not write", async () => {
+            const { passkeys } = await open();
+            const records = keptPasskeys(passkeys);
+            const subject = fresh();
+            const padded = `${handleOf()}=`;
+            await expect(records.handleFor(subject, padded)).rejects.toThrow("a handle must be canonical");
+            expect(await records.holder(subject)).toBeUndefined();
+            const handle = await records.handleFor(subject, handleOf());
+            const credential = {
+                id: "AAAA",
+                publicKey: "pQ",
+                signCount: 0,
+                userHandle: handle,
+                backupEligible: false,
+                backedUp: false,
+            };
+            for (const [name, twisted] of Object.entries({
+                "id not canonical": { ...credential, id: "AAB" },
+                "id padded": { ...credential, id: "AAAA==" },
+                "handle padded": { ...credential, userHandle: `${handle}=` },
+            })) {
+                expect(await records.register(subject, twisted, 10), name).toBe("malformed");
+            }
+            expect(await records.passkey("AAB")).toBeUndefined();
+            expect((await records.holder(subject))?.credentials).toEqual([]);
+            expect(await records.register(subject, credential, 10)).toBe("registered");
+            expect((await records.passkey("AAAA"))?.subject).toBe(subject);
+        });
+        it("answers unavailable for a record not in the shape webauthn writes", async () => {
+            const { passkeys } = await open();
+            const keys = [];
+            const spied = (records) => ({
+                ...records,
+                save: (key, record) => {
+                    keys.push(key);
+                    return records.save(key, record);
+                },
+            });
+            const [subject, id] = [fresh(), randomBytes(16).toString("base64url")];
+            const watched = {
+                credentials: spied(passkeys.credentials),
+                subjects: spied(passkeys.subjects),
+            };
+            const records = keptPasskeys(watched);
+            const userHandle = await records.handleFor(subject, handleOf());
+            const kept = {
+                id,
+                publicKey: "pQ",
+                signCount: 0,
+                userHandle,
+                backupEligible: false,
+                backedUp: false,
+            };
+            expect(await records.register(subject, kept, 10)).toBe("registered");
+            const [holderKey = "", credentialKey = ""] = keys;
+            const twist = (record) => ({ value: held({ ...record, v: 2 }) });
+            await passkeys.subjects.update(holderKey, twist);
+            await passkeys.credentials.update(credentialKey, twist);
+            for (const read of [() => records.holder(subject), () => records.passkey(id)]) {
+                await expect(read()).rejects.toSatisfy(isUnavailable);
+            }
+        });
+    });
+}
+/** What webauthn needs from any implementation: a challenge kept once for its lifetime, taken once, never in clear. */
+export function challengeStoreContract(name, open) {
+    const fresh = () => randomBytes(32).toString("base64url");
+    const held = (value) => value;
+    const mark = held({ taken: true });
+    describe(`webauthn's challenge store interface: ${name}`, () => {
+        it("keeps a challenge once, and puts the mark in its place for the rest of its lifetime", async () => {
+            const place = await open();
+            const challenge = fresh();
+            const record = held({ kind: "assertion", nested: [1, "two"] });
+            expect(await place.challenges.open(challenge, record, 1000)).toBe("created");
+            expect(await place.challenges.open(challenge, held({ n: 1 }), 1000)).toBe("exists");
+            place.advance(500);
+            expect(await place.challenges.take(challenge, mark)).toEqual({ before: record, after: mark });
+            expect(await place.challenges.take(challenge, mark)).toEqual({ before: mark, after: mark });
+            place.advance(500);
+            expect(await place.challenges.take(challenge, mark)).toBeUndefined();
+            expect(await place.challenges.take(fresh(), mark)).toBeUndefined();
+        });
+        it("never gives a challenge to what the place holds, in clear", async (context) => {
+            const place = await open();
+            const { holds } = place;
+            if (!holds)
+                return context.skip();
+            const [challenge, kept] = [fresh(), fresh()];
+            await place.challenges.open(challenge, held({ kept }), 60_000);
+            await place.challenges.take(challenge, mark);
+            expect([holds(kept), holds(challenge)]).toEqual([true, false]);
+        });
+        it("keeps a taken mark through a restart, a lost answer and a failover", async (context) => {
+            const place = await open();
+            const { restart, loseNextAnswer: lose, failover } = place;
+            if (!restart || !lose || !failover)
+                return context.skip();
+            const challenge = fresh();
+            await place.challenges.open(challenge, held({ n: 1 }), 60_000);
+            lose();
+            expect((await place.challenges.take(challenge, mark))?.before).toEqual(held({ n: 1 }));
+            await restart();
+            await failover();
+            expect((await place.challenges.take(challenge, mark))?.before).toEqual(mark);
+        });
+    });
+}

package/webauthn-login/README.md

@@ -0,0 +1,39 @@
+# webauthn-login
+
+## Responsibilities
+- Contributes the passkey login grant `urn:o3co:oauth:grant-type:webauthn` to `grants`' grant extension point.
+- Answers request options for a passkey login: the same for everyone, the challenge made for the client that asks.
+- Declares the amr this login gives: `hwk`, which means only possession of the key and includes no user verification.
+
+## Not here
+- Checking a ceremony, and keeping credentials and challenges: `webauthn`.
+- Client authentication, the body a grant takes, and whether it is allowed: `token-endpoint`.
+- Refresh families: `refresh`. The token format: `tokens`.
+- A browser login: there is none, so no session opens.
+
+## Offers
+- Composition definition, and `passkeyAmr` (`["hwk"]`).
+- The grant takes a JSON body only: `assertion` (the authenticator's response, an object) and `scope`.
+- Route `POST /oauth/webauthn/authentication/options`: takes JSON, a form or no body, and reads only `client_id`.
+  - It answers `passkeys`' options with `no-store`, their challenge made for that client.
+  - A missing `client_id`, or one that is not one non-empty string, is `400 invalid_request`.
+- Audit event `passkey.login.refused`, with `client` and `reason`: a kind from a fixed list, one per refusal of `passkeys`, and `authentication_revoked`.
+- Operator section: `requests` (1–100000, default 60) in `window-seconds` (1–86400, default 60), for the options route.
+
+## Invariants
+- Order: the assertion's shape, then `passkeys` (user handle, the challenge once and its client, signature, count), then the scope, then the subject's revocation boundary, then the access token, then the refresh token.
+- A missing assertion is `invalid_request`; one that is not an object is `invalid_grant`.
+- Every refusal of `passkeys`, and the revocation boundary, is the same `invalid_grant`, so no answer tells whether a credential is registered.
+- A challenge made for another client is one of those refusals.
+- The audit event holds no credential id and nothing else the request sent.
+- The subject is the passkey's holder.
+- The authentication time is when the challenge was made, and is what the revocation boundary is compared with.
+- Scope and audience are the client's allowance (`client-allowance`); beyond it, `invalid_scope`.
+- The access token is the client's, bound to the request's binding, with amr `hwk` and the authentication time, issued through `tokens`' issuance policies without a session; a refusal starts no family. The policies are first asked once `passkeys` has taken the challenge, since only then is the holder known.
+- The amr is `hwk` whatever the passkey's backup eligibility; the second factor's rule (`swk` when backup eligible) does not apply to a login.
+- The refresh token starts a family bound to no session, only for a client allowed `refresh_token`, after the access token; it carries the same amr and time.
+- The options route lists no credential and reads no store but the challenge's.
+- A store that cannot answer is `503`, never a refusal.
+
+## Depends on
+- `kernel`, `http`, `grants`, `client-allowance`, `webauthn`, `refresh`, `subject-revocation`, `issuer`, `rate-limit`, `audit`

package/webauthn-login/src/audit-events.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly "passkey.login.refused": {
+        readonly attributes: readonly ["client", "reason"];
+        readonly when: "a passkey assertion is not accepted, with why (`reason`, a kind from a fixed list)";
+    };
+};
+export default _default;

package/webauthn-login/src/audit-events.js

@@ -0,0 +1,7 @@
+import { auditEvents } from "@o3co/auth-provider-foundation/audit";
+export default auditEvents({
+    "passkey.login.refused": {
+        attributes: ["client", "reason"],
+        when: "a passkey assertion is not accepted, with why (`reason`, a kind from a fixed list)",
+    },
+});

package/webauthn-login/src/contract.d.ts

@@ -0,0 +1,3 @@
+export declare const webauthnGrantType = "urn:o3co:oauth:grant-type:webauthn";
+/** The amr a passkey login gives, whatever the authenticator's flags: possession of the key alone. */
+export declare const passkeyAmr: readonly ["hwk"];

package/webauthn-login/src/contract.js

@@ -0,0 +1,3 @@
+export const webauthnGrantType = "urn:o3co:oauth:grant-type:webauthn";
+/** The amr a passkey login gives, whatever the authenticator's flags: possession of the key alone. */
+export const passkeyAmr = ["hwk"];

package/webauthn-login/src/grant.d.ts

@@ -0,0 +1,14 @@
+import { type Audit } from "@o3co/auth-provider-foundation/audit";
+import type { Grant } from "@o3co/auth-provider-oauth/grants";
+import type { Lineage } from "@o3co/auth-provider-oauth/refresh";
+import type { SubjectRevocation } from "@o3co/auth-provider-identity/subject-revocation";
+import type { Passkeys } from "@o3co/auth-provider-passkey/webauthn";
+export interface LoginParts {
+    readonly passkeys: Passkeys;
+    readonly lineage: Lineage;
+    readonly revocation: SubjectRevocation;
+    readonly audit: Pick<Audit, "record">;
+    readonly issuer: string;
+}
+/** The passkey login grant: an assertion of a kept passkey for the client's tokens. */
+export declare function passkeyGrant(p: LoginParts): Grant;

package/webauthn-login/src/grant.js

@@ -0,0 +1,95 @@
+import { declaredAudit } from "@o3co/auth-provider-foundation/audit";
+import { clientAllowance } from "@o3co/auth-provider-oauth/client-allowance";
+import events from "./audit-events.js";
+import { passkeyAmr, webauthnGrantType } from "./contract.js";
+/** Each refusal of `passkeys`, as the audit records it. */
+const reasons = {
+    malformed: "assertion_malformed",
+    challenge: "challenge_invalid",
+    origin: "origin_not_allowed",
+    "top-origin": "top_origin_not_allowed",
+    rp: "rp_mismatch",
+    algorithm: "algorithm_not_allowed",
+    signature: "signature_invalid",
+    "sign-count": "sign_count_not_increased",
+    "user-handle": "user_handle_mismatch",
+    "user-verification": "user_verification_missing",
+    "backup-eligibility": "backup_eligibility_changed",
+    "unknown-credential": "credential_unknown",
+    "no-user-handle": "user_handle_missing",
+    raced: "sign_count_raced",
+};
+const invalidGrant = (description) => ({
+    kind: "error",
+    error: "invalid_grant",
+    description,
+});
+/** The passkey login grant: an assertion of a kept passkey for the client's tokens. */
+export function passkeyGrant(p) {
+    return {
+        grantType: webauthnGrantType,
+        bodies: ["json"],
+        handle: async ({ client, param, value, binding, issue }) => {
+            // One answer for every refusal, so it never tells whether a credential is registered.
+            const notAccepted = (reason) => {
+                declaredAudit(p.audit, events).record("passkey.login.refused", {
+                    attributes: { client: client.id, reason },
+                });
+                return invalidGrant("passkey assertion not accepted");
+            };
+            const assertion = value("assertion");
+            if (assertion === undefined) {
+                return { kind: "error", error: "invalid_request", description: "assertion is required" };
+            }
+            if (typeof assertion !== "object" || assertion === null || Array.isArray(assertion)) {
+                return invalidGrant("assertion must be an object");
+            }
+            const asserted = await p.passkeys.assert(assertion, client.id);
+            if (asserted.kind === "refused")
+                return notAccepted(reasons[asserted.reason]);
+            // The authentication time is when the challenge was made.
+            const { subject, challengedAt: authenticatedAt } = asserted;
+            const allowed = clientAllowance.allowedIssuance(client, param("scope"), p.issuer);
+            if (allowed.kind === "error")
+                return allowed;
+            const { scope, audience } = allowed;
+            if ((await p.revocation.check(subject, authenticatedAt)) === "revoked") {
+                return notAccepted("authentication_revoked");
+            }
+            const amr = passkeyAmr;
+            // The holder is known only once `passkeys` has taken the challenge, so `issue` alone asks.
+            // issue binds the access token itself; the family is handed the binding here.
+            const issued = await issue({
+                subject,
+                issuedTo: client.id,
+                audience,
+                scope,
+                amr,
+                authenticatedAt,
+            });
+            if (issued.kind === "refused")
+                return issued;
+            const { access } = issued;
+            const refreshToken = await p.lineage.start({
+                client,
+                subject,
+                scope,
+                audience,
+                authenticatedAt,
+                amr,
+                ...(binding ? { binding } : {}),
+                access: { id: access.id, expiresAt: access.expiresAt },
+            });
+            return {
+                kind: "issued",
+                body: {
+                    access_token: access.token,
+                    token_type: access.tokenType,
+                    expires_in: access.expiresIn,
+                    ...(refreshToken ? { refresh_token: refreshToken } : {}),
+                    ...(scope.length > 0 ? { scope: scope.join(" ") } : {}),
+                },
+            };
+        },
+    };
+}

package/webauthn-login/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/webauthn-login/src/module.js

@@ -0,0 +1,24 @@
+import { audit } from "@o3co/auth-provider-foundation/audit";
+import { grants } from "@o3co/auth-provider-oauth/grants";
+import { routes } from "@o3co/auth-provider-foundation/http";
+import { issuer } from "@o3co/auth-provider-oauth/issuer";
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { lineage } from "@o3co/auth-provider-oauth/refresh";
+import { subjectRevocation } from "@o3co/auth-provider-identity/subject-revocation";
+import { passkeys } from "@o3co/auth-provider-passkey/webauthn";
+import { passkeyGrant } from "./grant.js";
+import { optionsRoute } from "./options.js";
+import { section } from "./section.js";
+export default defineModule({ name: "webauthn-login", section, replicaSafe: true }, (m) => [
+    m.contribute(grants).by(async (c) => passkeyGrant({
+        passkeys: await c.get(passkeys),
+        lineage: await c.get(lineage),
+        revocation: await c.get(subjectRevocation),
+        audit: await c.get(audit),
+        issuer: (await c.get(issuer)).url,
+    })),
+    m.contribute(routes).by(async (c) => optionsRoute(await c.get(passkeys), {
+        limit: c.section.requests,
+        ms: c.section["window-seconds"] * 1000,
+    })),
+]);

package/webauthn-login/src/options.d.ts

@@ -0,0 +1,5 @@
+import { type Route } from "@o3co/auth-provider-foundation/http";
+import { type Window } from "@o3co/auth-provider-foundation/rate-limit";
+import type { Passkeys } from "@o3co/auth-provider-passkey/webauthn";
+/** Request options the same for everyone, whose challenge only the client named redeems. */
+export declare function optionsRoute(passkeys: Passkeys, window: Window): Route;

package/webauthn-login/src/options.js

@@ -0,0 +1,29 @@
+import { noStore, use } from "@o3co/auth-provider-foundation/http";
+import { requestsPerSource } from "@o3co/auth-provider-foundation/rate-limit";
+/** The client the options are for; false unless named as one non-empty string. */
+function requesterOf({ fields, mistyped }) {
+    if (mistyped?.has("client_id") || fields.repeated().includes("client_id"))
+        return false;
+    const id = fields.single("client_id");
+    return id === undefined || id === "" ? false : id;
+}
+/** Request options the same for everyone, whose challenge only the client named redeems. */
+export function optionsRoute(passkeys, window) {
+    return {
+        method: "POST",
+        path: "/oauth/webauthn/authentication/options",
+        uses: [use(requestsPerSource, { name: "webauthn-login", window })],
+        takes: ["json", "form", "none"],
+        handle: async (request) => {
+            const requester = requesterOf(request);
+            if (requester === false) {
+                return { status: 400, headers: noStore, body: { json: { error: "invalid_request" } } };
+            }
+            return {
+                status: 200,
+                headers: noStore,
+                body: { json: (await passkeys.challenge(requester)).options },
+            };
+        },
+    };
+}

package/webauthn-login/src/section.d.ts

@@ -0,0 +1,6 @@
+import { z } from "zod";
+export declare const section: z.ZodObject<{
+    requests: z.ZodDefault<z.ZodNumber>;
+    "window-seconds": z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type Settings = z.output<typeof section>;

package/webauthn-login/src/section.js

@@ -0,0 +1,6 @@
+import { z } from "zod";
+export const section = z.strictObject({
+    /** Requests allowed per source in each window, on the options route. */
+    requests: z.number().int().min(1).max(100_000).default(60),
+    "window-seconds": z.number().int().min(1).max(86_400).default(60),
+});