@openvtc/trust-tasks 0.12.14 → 0.12.15

package/src/auth/passkey/revoke/start/0.1/payload.ts

@@ -34,6 +34,14 @@ export interface AuthPasskeyRevokeStartResponsePayload {
  * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -147,6 +155,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -259,6 +271,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/step-up/approve-request/0.1/payload.ts

@@ -44,6 +44,14 @@ export interface AuthStepUpApproveRequest {
  * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -215,6 +223,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -328,6 +340,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."

package/src/auth/step-up/approve-request/0.2/payload.ts

@@ -44,6 +44,14 @@ export interface AuthStepUpApproveRequest {
  * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
  */
 export interface PublicKeyCredentialRequestOptions {
+  /**
+   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+   *
+   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+   *
+   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   */
+  extensions?: {};
   /**
    * base64url-encoded one-time nonce.
    */
@@ -215,6 +223,10 @@ export const PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."
@@ -328,6 +340,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "challenge"
       ],
       "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
         "challenge": {
           "type": "string",
           "description": "base64url-encoded one-time nonce."