@passlock/client 0.9.0

package/src/authentication/authenticate.test.ts

@@ -0,0 +1,207 @@
+import { type RouterOps, RpcClient } from '@passlock/shared/dist/rpc/rpc'
+import { Effect as E, Layer as L, Layer, LogLevel, Logger, pipe } from 'effect'
+import { describe, expect, test, vi } from 'vitest'
+import { mock } from 'vitest-mock-extended'
+import { AuthenticateServiceLive, AuthenticationService, GetCredential } from './authenticate'
+import * as Fixture from './authenticate.fixture'
+import { StorageService } from '../storage/storage'
+
+
+describe('authenticate should', () => {
+  test('return a valid principal', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      const result = yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      expect(result).toEqual(Fixture.principal)
+    })
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.getCredentialTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.storageServiceTest),
+      L.provide(Fixture.rpcClientTest),
+    )
+
+    const effect = pipe(E.provide(assertions, service), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+
+  test('pass the authentication request to the backend', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      const rpcClient = yield* _(RpcClient)
+      expect(rpcClient.getAuthenticationOptions).toHaveBeenCalledOnce()
+      expect(rpcClient.verifyAuthenticationCredential).toHaveBeenCalledOnce()
+    })
+
+    const rpcClientTest = L.effect(
+      RpcClient,
+      E.sync(() => {
+        const rpcMock = mock<RouterOps>()
+
+        rpcMock.getAuthenticationOptions.mockReturnValue(E.succeed(Fixture.optionsRes))
+        rpcMock.verifyAuthenticationCredential.mockReturnValue(E.succeed(Fixture.verificationRes))
+
+        return rpcMock
+      }),
+    )
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.getCredentialTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.storageServiceTest),
+      L.provide(rpcClientTest),
+    )
+
+    const layers = Layer.merge(service, rpcClientTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+
+  test('send the credential to the backend', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      const rpcClient = yield* _(RpcClient)
+      expect(rpcClient.getAuthenticationOptions).toHaveBeenCalledOnce()
+      expect(rpcClient.verifyAuthenticationCredential).toHaveBeenCalledWith(Fixture.verificationReq)
+    })
+
+    const rpcClientTest = L.effect(
+      RpcClient,
+      E.sync(() => {
+        const rpcMock = mock<RouterOps>()
+
+        rpcMock.getAuthenticationOptions.mockReturnValue(E.succeed(Fixture.optionsRes))
+        rpcMock.verifyAuthenticationCredential.mockReturnValue(E.succeed(Fixture.verificationRes))
+
+        return rpcMock
+      }),
+    )
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.getCredentialTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.storageServiceTest),
+      L.provide(rpcClientTest),
+    )
+
+    const layers = Layer.merge(service, rpcClientTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+
+  test('store the credential in local storage', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      const storageService = yield* _(StorageService)
+      expect(storageService.storeToken).toHaveBeenCalledWith(Fixture.principal)
+    })
+
+    const storageServiceTest = L.effect(
+      StorageService,
+      E.sync(() => {
+        const storageMock = mock<StorageService>()
+
+        storageMock.storeToken.mockReturnValue(E.unit)
+        storageMock.clearExpiredToken.mockReturnValue(E.unit)
+
+        return storageMock
+      }),
+    )
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.getCredentialTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.rpcClientTest),
+      L.provide(storageServiceTest),
+    )
+
+    const layers = Layer.merge(service, storageServiceTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+
+  test('schedule deletion of the local token', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      const storageService = yield* _(StorageService)
+      expect(storageService.clearExpiredToken).toHaveBeenCalledWith('passkey')
+    })
+
+    const storageServiceTest = L.effect(
+      StorageService,
+      E.sync(() => {
+        const storageMock = mock<StorageService>()
+
+        storageMock.storeToken.mockReturnValue(E.unit)
+        storageMock.clearExpiredToken.mockReturnValue(E.unit)
+
+        return storageMock
+      }),
+    )
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.getCredentialTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.rpcClientTest),
+      L.provide(storageServiceTest),
+    )
+
+    const layers = Layer.merge(service, storageServiceTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+
+  test("return an error if the browser can't create a credential", async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(AuthenticationService)
+      yield* _(service.authenticatePasskey({ userVerification: 'preferred' }))
+
+      const getCredential = yield* _(GetCredential)
+      expect(getCredential).toHaveBeenCalledOnce()
+    })
+
+    const getCredentialTest = L.effect(
+      GetCredential,
+      E.sync(() => {
+        const getCredentialMock = vi.fn()
+
+        getCredentialMock.mockReturnValue(E.succeed(Fixture.credential))
+
+        return getCredentialMock
+      }),
+    )
+
+    const service = pipe(
+      AuthenticateServiceLive,
+      L.provide(Fixture.storageServiceTest),
+      L.provide(Fixture.capabilitiesTest),
+      L.provide(Fixture.rpcClientTest),
+      L.provide(getCredentialTest),
+    )
+
+    const layers = Layer.merge(service, getCredentialTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+})

package/src/authentication/authenticate.ts

@@ -0,0 +1,147 @@
+/**
+ * Passkey authentication effects
+ */
+import {
+  type CredentialRequestOptionsJSON,
+  parseRequestOptionsFromJSON,
+} from '@github/webauthn-json/browser-ponyfill'
+import {
+  type BadRequest,
+  InternalBrowserError,
+  type NotSupported,
+} from '@passlock/shared/dist/error/error'
+import type {
+  VerificationErrors} from '@passlock/shared/dist/rpc/authentication';
+import {
+  OptionsReq,
+  VerificationReq,
+} from '@passlock/shared/dist/rpc/authentication'
+import { RpcClient } from '@passlock/shared/dist/rpc/rpc'
+import type {
+  AuthenticationCredential,
+  Principal,
+ UserVerification } from '@passlock/shared/dist/schema/schema'
+import { Context, Effect as E, Layer, flow, pipe } from 'effect'
+import { Capabilities } from '../capabilities/capabilities'
+import { StorageService } from '../storage/storage'
+
+
+/* Requests */
+
+export type AuthenticationRequest = { userVerification?: UserVerification }
+
+/* Errors */
+
+export type AuthenticationErrors = NotSupported | BadRequest | VerificationErrors
+
+/* Dependencies */
+
+export type GetCredential = (
+  options: CredentialRequestOptions,
+) => E.Effect<AuthenticationCredential, InternalBrowserError>
+export const GetCredential = Context.GenericTag<GetCredential>('@services/Get')
+
+/* Service */
+
+export type AuthenticationService = {
+  authenticatePasskey: (data: AuthenticationRequest) => E.Effect<Principal, AuthenticationErrors>
+}
+
+export const AuthenticationService = Context.GenericTag<AuthenticationService>(
+  '@services/AuthenticationService',
+)
+
+/* Utilities */
+
+const fetchOptions = (req: OptionsReq) => {
+  return E.gen(function* (_) {
+    yield* _(E.logDebug('Making request'))
+
+    const rpcClient = yield* _(RpcClient)
+    const { publicKey, session } = yield* _(rpcClient.getAuthenticationOptions(req))
+
+    yield* _(E.logDebug('Converting Passlock options to CredentialRequestOptions'))
+    const options = yield* _(toRequestOptions({ publicKey }))
+
+    return { options, session }
+  })
+}
+
+const toRequestOptions = (options: CredentialRequestOptionsJSON) => {
+  return pipe(
+    E.try(() => parseRequestOptionsFromJSON(options)),
+    E.mapError(
+      error =>
+        new InternalBrowserError({
+          message: 'Browser was unable to create credential request options',
+          detail: String(error.error),
+        }),
+    ),
+  )
+}
+
+const verifyCredential = (req: VerificationReq) => {
+  return E.gen(function* (_) {
+    yield* _(E.logDebug('Making request'))
+
+    const rpcClient = yield* _(RpcClient)
+    const { principal } = yield* _(rpcClient.verifyAuthenticationCredential(req))
+
+    return principal
+  })
+}
+
+/* Effects */
+
+type Dependencies = GetCredential | Capabilities | StorageService | RpcClient
+
+export const authenticatePasskey = (
+  request: AuthenticationRequest,
+): E.Effect<Principal, AuthenticationErrors, Dependencies> => {
+  const effect = E.gen(function* (_) {
+    yield* _(E.logInfo('Checking if browser supports Passkeys'))
+    const capabilities = yield* _(Capabilities)
+    yield* _(capabilities.passkeySupport)
+
+    yield* _(E.logInfo('Fetching authentication options from Passlock'))
+    const { options, session } = yield* _(fetchOptions(new OptionsReq(request)))
+
+    yield* _(E.logInfo('Looking up credential'))
+    const get = yield* _(GetCredential)
+    const credential = yield* _(get(options))
+
+    yield* _(E.logInfo('Verifying credential with Passlock'))
+    const principal = yield* _(verifyCredential(new VerificationReq({ credential, session })))
+
+    const storageService = yield* _(StorageService)
+    yield* _(storageService.storeToken(principal))
+    yield* _(E.logDebug('Stored token in local storage'))
+
+    yield* _(E.logDebug('Defering local token deletion'))
+    const delayedClearTokenE = pipe(
+      storageService.clearExpiredToken('passkey'),
+      E.delay('6 minutes'),
+      E.fork,
+    )
+    yield* _(delayedClearTokenE)
+
+    return principal
+  })
+
+  return E.catchTag(effect, 'InternalBrowserError', e => E.die(e))
+}
+
+/* Live */
+
+/* v8 ignore start */
+export const AuthenticateServiceLive = Layer.effect(
+  AuthenticationService,
+  E.gen(function* (_) {
+    const context = yield* _(E.context<GetCredential | RpcClient | Capabilities | StorageService>())
+
+    return AuthenticationService.of({
+      authenticatePasskey: flow(authenticatePasskey, E.provide(context)),
+    })
+  }),
+)
+/* v8 ignore stop */

package/src/capabilities/capabilities.ts

@@ -0,0 +1,81 @@
+/**
+ * Test if the browser supports passkeys, conditional UI etc
+ */
+import { NotSupported } from '@passlock/shared/dist/error/error'
+import { Context, Effect as E, Layer, identity, pipe } from 'effect'
+
+/* Service */
+
+export type Capabilities = {
+  passkeySupport: E.Effect<void, NotSupported>
+  isPasskeySupport: E.Effect<boolean>
+  autofillSupport: E.Effect<void, NotSupported>
+  isAutofillSupport: E.Effect<boolean>
+}
+
+export const Capabilities = Context.GenericTag<Capabilities>('@services/Capabilities')
+
+/* Effects */
+
+const hasWebAuthn = E.suspend(() =>
+  typeof window.PublicKeyCredential === 'function'
+    ? E.unit
+    : new NotSupported({ message: 'WebAuthn API is not supported on this device' }),
+)
+
+const hasPlatformAuth = pipe(
+  E.tryPromise(() => window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()),
+  E.filterOrFail(
+    identity,
+    () => new NotSupported({ message: 'No platform authenticator available on this device' }),
+  ),
+  E.asUnit,
+)
+
+const hasConditionalUi = pipe(
+  E.tryPromise({
+    try: () => window.PublicKeyCredential.isConditionalMediationAvailable(),
+    catch: () =>
+      new NotSupported({ message: 'Conditional mediation not available on this device' }),
+  }),
+  E.filterOrFail(
+    identity,
+    () => new NotSupported({ message: 'Conditional mediation not available on this device' }),
+  ),
+  E.asUnit,
+)
+
+export const passkeySupport = pipe(
+  hasWebAuthn,
+  E.andThen(hasPlatformAuth),
+  E.catchTag('UnknownException', e => E.die(e)),
+)
+
+export const isPasskeySupport = pipe(
+  passkeySupport,
+  E.match({
+    onFailure: () => false,
+    onSuccess: () => true,
+  }),
+)
+
+export const autofillSupport = pipe(passkeySupport, E.andThen(hasConditionalUi))
+
+export const isAutofillSupport = pipe(
+  autofillSupport,
+  E.match({
+    onFailure: () => false,
+    onSuccess: () => true,
+  }),
+)
+
+/* Live */
+
+/* v8 ignore start */
+export const capabilitiesLive = Layer.succeed(Capabilities, {
+  passkeySupport,
+  isPasskeySupport,
+  autofillSupport,
+  isAutofillSupport,
+})
+/* v8 ignore stop */

package/src/config.ts

@@ -0,0 +1,43 @@
+import { RpcConfig } from '@passlock/shared/dist/rpc/rpc'
+import { Context, Layer } from 'effect'
+
+
+export const DefaultEndpoint = 'https://api.passlock.dev'
+
+export type Tenancy = {
+  tenancyId: string
+  clientId: string
+}
+export const Tenancy = Context.GenericTag<Tenancy>('@services/Tenancy')
+
+/**
+ * Allow developers to override the endpoint e.g. to
+ * point to a regional endpoint or a self-hosted backend
+ */
+export type Endpoint = {
+  endpoint?: string
+}
+export const Endpoint = Context.GenericTag<Endpoint>('@services/Endpoint')
+
+export type Config = Tenancy & Endpoint
+export const Config = Context.GenericTag<Config>('@services/Config')
+
+export const buildConfigLayers = (config: Config) => {
+  const tenancyLayer = Layer.succeed(Tenancy, Tenancy.of(config))
+  const endpointLayer = Layer.succeed(Endpoint, Endpoint.of(config))
+  return Layer.mergeAll(tenancyLayer, endpointLayer)
+}
+
+export const buildRpcConfigLayers = (config: Config) => {
+  const endpoint = config.endpoint || DefaultEndpoint
+  return Layer.succeed(
+    RpcConfig,
+    RpcConfig.of({
+      endpoint: endpoint,
+      tenancyId: config.tenancyId,
+      clientId: config.clientId,
+    }),
+  )
+}
+
+export type RequestDependencies = Endpoint | Tenancy | Storage | RpcConfig

package/src/connection/connection.fixture.ts

@@ -0,0 +1,27 @@
+import { BadRequest } from '@passlock/shared/dist/error/error'
+import { PreConnectReq, PreConnectRes } from '@passlock/shared/dist/rpc/connection'
+import { RpcClient } from '@passlock/shared/dist/rpc/rpc'
+import { Effect as E, Layer as L } from 'effect'
+
+
+export const rpcClientTest = L.succeed(
+  RpcClient,
+  RpcClient.of({
+    preConnect: () => E.succeed({ warmed: true }),
+    isExistingUser: () => E.succeed({ existingUser: true }),
+    verifyEmail: () => E.succeed({ verified: true }),
+    getRegistrationOptions: () => E.fail(new BadRequest({ message: 'Not implemeneted' })),
+    verifyRegistrationCredential: () => E.fail(new BadRequest({ message: 'Not implemeneted' })),
+    getAuthenticationOptions: () => E.fail(new BadRequest({ message: 'Not implemeneted' })),
+    verifyAuthenticationCredential: () => E.fail(new BadRequest({ message: 'Not implemeneted' })),
+  }),
+)
+
+export const preConnectReq = new PreConnectReq({})
+export const preConnectRes = new PreConnectRes({ warmed: true })
+
+export const rpcConfig = { 
+  endpoint: 'https://example.com', 
+  tenancyId: 'tenancyId', clientId: 
+  'clientId' 
+}

package/src/connection/connection.test.ts

@@ -0,0 +1,61 @@
+import { type RouterOps, RpcClient, RpcConfig, NetworkService } from '@passlock/shared/dist/rpc/rpc'
+import { Effect as E, Layer as L, Layer, LogLevel, Logger, pipe } from 'effect'
+import { describe, expect, test } from 'vitest'
+import { mock } from 'vitest-mock-extended'
+import { ConnectionService, ConnectionServiceLive } from './connection'
+import * as Fixture from './connection.fixture'
+
+
+describe('preConnect should', () => {
+  test('hit the rpc endpoint', async () => {
+    const assertions = E.gen(function* (_) {
+      const service = yield* _(ConnectionService)
+      yield* _(service.preConnect())
+
+      const rpcClient = yield* _(RpcClient)
+      expect(rpcClient.preConnect).toBeCalledWith(Fixture.preConnectReq)
+
+      const networkService = yield* _(NetworkService)
+      expect(networkService.get).toBeCalledWith(`/token/token?warm=true`)
+    })
+
+    const rpcClientTest = Layer.effect(
+      RpcClient,
+      E.sync(() => {
+        const rpcMock = mock<RouterOps>()
+
+        rpcMock.preConnect.mockReturnValue(E.succeed(Fixture.preConnectRes))
+
+        return rpcMock
+      }),
+    )
+
+    const rpcConfigTest = Layer.succeed(
+      RpcConfig,
+      RpcConfig.of(Fixture.rpcConfig)
+    )
+
+    const networkServiceTest = Layer.effect(
+      NetworkService,
+      E.sync(() => {
+        const networkMock = mock<NetworkService['Type']>()
+
+        networkMock.get.mockReturnValue(E.succeed({ }))
+
+        return networkMock
+      }),
+    )
+
+    const service = pipe(
+      ConnectionServiceLive, 
+      L.provide(rpcClientTest), 
+      L.provide(networkServiceTest), 
+      L.provide(rpcConfigTest)
+    )
+
+    const layers = L.mergeAll(service, rpcClientTest, networkServiceTest)
+    const effect = pipe(E.provide(assertions, layers), Logger.withMinimumLogLevel(LogLevel.None))
+
+    return E.runPromise(effect)
+  })
+})

package/src/connection/connection.ts

@@ -0,0 +1,51 @@
+/**
+ * Hits the rpc endpoint to warm up a lambda
+ */
+import { PreConnectReq } from '@passlock/shared/dist/rpc/connection'
+import { NetworkService, RpcClient, RpcConfig } from '@passlock/shared/dist/rpc/rpc'
+import { Context, Effect as E, Layer, flow, pipe } from 'effect'
+
+/* Service */
+
+export type ConnectionService = {
+  preConnect: () => E.Effect<void>
+}
+
+export const ConnectionService = Context.GenericTag<ConnectionService>('@services/ConnectService')
+
+/* Effects */
+
+const hitPrincipal = pipe(
+  E.logInfo('Pre-connecting to Principal endpoint'),
+  E.zipRight(NetworkService),
+  E.flatMap(networkService => networkService.get('/token/token?warm=true')),
+  E.asUnit,
+  E.catchAll(() => E.unit)
+)
+
+const hitRpc = pipe(
+  E.logInfo('Pre-connecting to RPC endpoint'),
+  E.zipRight(RpcClient),
+  E.flatMap(rpcClient => rpcClient.preConnect(new PreConnectReq({}))),
+  E.asUnit
+)
+
+export const preConnect = () => pipe(
+  E.all([hitPrincipal, hitRpc], { concurrency: 2 }),
+  E.asUnit
+)
+
+/* Live */
+
+/* v8 ignore start */
+export const ConnectionServiceLive = Layer.effect(
+  ConnectionService,
+  E.gen(function* (_) {
+    const context = yield* _(E.context<RpcClient | NetworkService | RpcConfig>())
+
+    return ConnectionService.of({
+      preConnect: flow(preConnect, E.provide(context)),
+    })
+  }),
+)
+/* v8 ignore stop */