@oxy.so/contracts 2.0.0 → 2.2.0

package/dist/cjs/webauthn.js

@@ -12,10 +12,39 @@
  * create a second, drift-prone definition of a shape we do not own.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = void 0;
+exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.webauthnAssertionResponseSchema = exports.webauthnCredentialIdSchema = void 0;
 const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-const webIdentityCarrier_1 = require("./webIdentityCarrier");
+const accountEmail_1 = require("./accountEmail");
+/** A WebAuthn credential id, base64url as the browser reports it. */
+exports.webauthnCredentialIdSchema = zod_1.z
+    .string()
+    .trim()
+    .min(16)
+    .max(1024)
+    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
+/**
+ * A WebAuthn assertion by one of the account's EXISTING passkeys over a server
+ * challenge — the fresh use of the factor the account already has (linking
+ * Commons to a passkey account, deleting a passkey account). The API verifies
+ * it with `@simplewebauthn/server`; this only bounds its shape.
+ */
+exports.webauthnAssertionResponseSchema = zod_1.z
+    .object({
+    id: exports.webauthnCredentialIdSchema,
+    rawId: zod_1.z.string().min(1).max(2048),
+    type: zod_1.z.literal('public-key'),
+    response: zod_1.z
+        .object({
+        clientDataJSON: zod_1.z.string().min(1).max(8192),
+        authenticatorData: zod_1.z.string().min(1).max(8192),
+        signature: zod_1.z.string().min(1).max(2048),
+        userHandle: zod_1.z.string().max(2048).optional(),
+    })
+        .passthrough(),
+    clientExtensionResults: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    authenticatorAttachment: zod_1.z.string().optional(),
+})
+    .passthrough();
 /**
  * Device-session options shared by every first-party sign-in body
  * (`deviceName`/`deviceFingerprint`). Mirrors what
@@ -36,13 +65,16 @@ const deviceSessionEnvelope = {
     deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
 };
 /**
- * `POST /webauthn/register/options` — request registration options. With a bearer
- * token the caller links a passkey to their signed-in account and `username` is
- * ignored; without one it is a prospective signup and `username` is the desired
- * (not-yet-created) handle.
+ * `POST /webauthn/register/options` — request registration options. Three flows:
+ *
+ * - a bearer: the caller adds a passkey to their signed-in account;
+ * - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
+ *   was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
+ * - `username` (no bearer): a prospective sign-up; the handle is not created yet.
  */
 exports.webauthnRegisterOptionsRequestSchema = zod_1.z.object({
     username: zod_1.z.string().trim().min(1).max(60).optional(),
+    recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
 });
 /**
  * `POST /webauthn/login/options` — request authentication options. When
@@ -56,23 +88,20 @@ exports.webauthnLoginOptionsRequestSchema = zod_1.z.object({
 /**
  * `POST /webauthn/register/verify` — the outer envelope. The browser
  * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here. `username` is required only
- * for the prospective-signup branch (no bearer); the linking branch ignores it.
+ * is validated by `@simplewebauthn/server`, not here.
+ *
+ * - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
+ *   `emailTicket` its code was confirmed with. The account is created with the
+ *   passkey and that verified email, and no key.
+ * - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
+ *   and a session minted.
+ * - A bearer: the passkey is added to the signed-in account.
  */
 exports.webauthnRegisterVerifyRequestSchema = zod_1.z.object({
     username: zod_1.z.string().trim().min(1).max(60).optional(),
-    /**
-     * Sign-up only (ADR 0024 D4): the account's root, created on the holder BEFORE
-     * this request — sealed under the passkey being registered — and a root proof
-     * (`enroll_identity`) whose challenge is the registration challenge. The
-     * account, passkey, root and envelope are then created in one transaction.
-     */
-    identity: zod_1.z
-        .object({
-        envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
-        proof: identityProof_1.identityProofSchema,
-    })
-        .optional(),
+    email: accountEmail_1.emailAddressSchema.optional(),
+    emailTicket: accountEmail_1.emailTicketSchema.optional(),
+    recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
     ...deviceSessionEnvelope,
 });
 /**