@prove-identity/prove-auth 2.14.0 → 2.15.1

package/build/lib/proveauth/authenticator-builder.js

@@ -21,6 +21,7 @@ const main_authenticator_1 = __importDefault(require("./internal/main-authentica
 const logger_1 = require("./common/logger");
 const settings_1 = __importDefault(require("./internal/settings"));
 const device_context_options_1 = require("./device-context-options");
+const user_ppb_steps_1 = require("./internal/user-ppb-steps");
 var DeviceRole;
 (function (DeviceRole) {
     DeviceRole[DeviceRole["Primary"] = 0] = "Primary";
@@ -36,6 +37,7 @@ class AuthenticatorBuilder {
         this.role = DeviceRole.Primary;
         this.mobileAuthImplementation = MobileAuthImplementation.Fetch;
         this.upkEnabled = false;
+        this.ppbEnabled = false;
         this.log = logger_1.LoggerFactory.getLogger('authenticator-builder');
         if (typeof window !== 'undefined') {
             this.storage = window.localStorage;
@@ -131,6 +133,22 @@ class AuthenticatorBuilder {
         this.upkEnabled = this.userConsentStep != null;
         return this;
     }
+    withPrivacyPreservingBiometrics(startStep, finishStep) {
+        this.ppbEnabled = true;
+        if (typeof startStep === 'function') {
+            this.ppbStartStep = { execute: startStep };
+        }
+        else {
+            this.ppbStartStep = startStep;
+        }
+        if (typeof finishStep === 'function') {
+            this.ppbFinishStep = { execute: finishStep };
+        }
+        else {
+            this.ppbFinishStep = finishStep;
+        }
+        return this;
+    }
     getUrlsByBuildConfig(buildConfig) {
         switch (buildConfig) {
             case device_context_options_1.BuildConfig.US_PROD:
@@ -144,7 +162,8 @@ class AuthenticatorBuilder {
                     device_context_options_1.ProveAuthProxyEndpoint.DEFAULT_US_UAT_ENDPOINT.toString(),
                 ];
             case device_context_options_1.BuildConfig.DEV:
-                this.log.debug("Recommended for Prove's internal testing only, BuildConfig.DEV might need custom endpoint URL and custom script URL values to bypass ad blockers");
+                this.log.debug("Recommended for Prove's internal testing only, BuildConfig.DEV " +
+                    'might need custom endpoint URL and custom script URL values to bypass ad blockers');
                 return [undefined, undefined];
             default:
                 this.log.warn('Unknown BuildConfig value: ' + buildConfig);
@@ -237,8 +256,10 @@ class AuthenticatorBuilder {
                 new mobile_instant_step_1.default(this.mobileAuthImplementation, this.getDeviceIp),
                 new mobile_instantlink_step_1.default(this.instantLinkStartStep, this.instantLinkRetryStep, this.getDeviceIp),
                 new mobile_otp_step_1.default(this.otpStartStep, this.otpFinishStep),
-                new user_mobileactive_step_1.default(),
                 new scan_message_step_1.default(this.authMessageHandler),
+                new user_mobileactive_step_1.default(),
+                new user_ppb_steps_1.UserPpbEnrollStep(this.ppbEnabled, this.ppbStartStep, this.ppbFinishStep),
+                new user_ppb_steps_1.UserPpbVerifyStep(this.ppbEnabled, this.ppbStartStep, this.ppbFinishStep),
             ]);
         }
         else {
@@ -246,6 +267,8 @@ class AuthenticatorBuilder {
                 new device_passive_step_1.default(this.getDisplayName, undefined, this.role),
                 new mobile_instant_step_1.default(this.mobileAuthImplementation, this.getDeviceIp),
                 new mobile_instantlink_step_1.default(this.instantLinkStartStep, this.instantLinkRetryStep, this.getDeviceIp),
+                new user_ppb_steps_1.UserPpbEnrollStep(this.ppbEnabled, this.ppbStartStep, this.ppbFinishStep),
+                new user_ppb_steps_1.UserPpbVerifyStep(this.ppbEnabled, this.ppbStartStep, this.ppbFinishStep),
             ]);
         }
     }

package/build/lib/proveauth/external/@authid/web-component/authid-web-component.d.ts

@@ -0,0 +1,3 @@
+declare class AuthIDComponent extends HTMLElement {
+    connectedCallback(): void;
+}

package/build/lib/proveauth/external/@authid/web-component/authid-web-component.js

@@ -0,0 +1,55 @@
+class AuthIDComponent extends HTMLElement {
+    connectedCallback() {
+        const dataUrl = this.getAttribute('data-url');
+        if (!dataUrl) {
+            throw new Error('Missing data-url configuration!');
+        }
+        let dataTarget = this.getAttribute('data-target');
+        if (!dataTarget || dataTarget === 'auto') {
+            dataTarget = /Mobi|Android/i.test(navigator.userAgent) ? 'mobile' : 'desktop';
+        }
+        const iframe = document.createElement('iframe');
+        iframe.setAttribute('allow', 'fullscreen *;camera *;encrypted-media *;');
+        iframe.setAttribute('src', dataUrl);
+        const styleNode = document.createElement('style');
+        styleNode.textContent =
+            'div, iframe {' +
+                'position: fixed;' +
+                'top: 0;' +
+                'left: 0;' +
+                'height: 100vh;' +
+                'width: 100vw;' +
+                'border: 0;' +
+                'padding: 0;' +
+                'margin: 0;' +
+                '}';
+        const shadow = this.attachShadow({ mode: 'closed' });
+        shadow.appendChild(styleNode);
+        const container = document.createElement('div');
+        shadow.appendChild(container);
+        const dataWebauth = this.getAttribute('data-webauth');
+        if (dataWebauth && dataWebauth !== 'false' && dataWebauth !== 'no') {
+            const webauthHandler = document.createElement('script');
+            webauthHandler.setAttribute('src', dataUrl.replace('/?', '/webauthhandler.js?'));
+            shadow.appendChild(webauthHandler);
+        }
+        const dataControl = this.getAttribute('data-control');
+        if (dataControl && dataControl !== 'false' && dataControl !== 'no') {
+            const controlHandler = document.createElement('script');
+            controlHandler.setAttribute('src', dataUrl.replace('/?', '/controlhandler.js?'));
+            shadow.appendChild(controlHandler);
+        }
+        shadow.appendChild(iframe);
+        iframe.addEventListener('load', () => {
+            shadow.removeChild(container);
+            shadow.dispatchEvent(new CustomEvent('load', {
+                composed: true,
+                bubbles: true,
+            }));
+        }, { capture: true, once: true });
+        if (window.getComputedStyle(this)['z-index'] === 'auto') {
+            this.style['z-index'] = 1000;
+        }
+    }
+}
+window.customElements.define('authid-component', AuthIDComponent);

package/build/lib/proveauth/instantlink.d.ts

@@ -1,8 +1,4 @@
-import AuthError from './internal/auth-error';
 import PhoneNumberInput, { PhoneValidationError } from './internal/phone-number-input';
-export declare class InstantLinkMaxRetryError extends AuthError {
-    constructor(message?: string, code?: number);
-}
 export interface InstantLinkStartStep {
     execute: (phoneNumberNeeded: boolean, instantLinkError?: PhoneValidationError) => Promise<PhoneNumberInput | null>;
 }
@@ -12,7 +8,7 @@ export declare enum InstantLinkResultType {
     OnMobileNumberChange = 1
 }
 export interface InstantLinkRetryStep {
-    execute: (instantLinkError?: InstantLinkMaxRetryError) => Promise<InstantLinkResultType>;
+    execute: () => Promise<InstantLinkResultType>;
 }
-export type InstantLinkRetryStepFn = (instantLinkError?: InstantLinkMaxRetryError) => Promise<InstantLinkResultType>;
+export type InstantLinkRetryStepFn = () => Promise<InstantLinkResultType>;
 export type InstantLinkStartInput = PhoneNumberInput;

package/build/lib/proveauth/instantlink.js

@@ -1,16 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InstantLinkResultType = exports.InstantLinkMaxRetryError = void 0;
-const auth_error_1 = __importDefault(require("./internal/auth-error"));
-class InstantLinkMaxRetryError extends auth_error_1.default {
-    constructor(message, code) {
-        super(message, code);
-    }
-}
-exports.InstantLinkMaxRetryError = InstantLinkMaxRetryError;
+exports.InstantLinkResultType = void 0;
 var InstantLinkResultType;
 (function (InstantLinkResultType) {
     InstantLinkResultType[InstantLinkResultType["OnResend"] = 0] = "OnResend";

package/build/lib/proveauth/internal/auth-request.d.ts

@@ -1,6 +1,6 @@
 import { MobileAuthImplementation } from '../authenticator-builder';
 import { AuthResponseStatus } from './auth-response-status';
-export type AuthRequest = V1ClientDeviceFido2RegisterStart | V1ClientDeviceFido2RegisterFinish | V1ClientDeviceFido2VerifyStart | V1ClientDeviceFido2VerifyFinish | V1ClientDevicePassiveRegister | V1ClientDevicePassiveVerify | V1ClientUserResponse | V1ClientAnyError | V1ClientChallenge | V1ClientMobileInstantLinkStart | V1ClientMobileInstantStart | V1ClientMobileInstantFinish | V1ClientOtpStart | V1ClientOtpFinish;
+export type AuthRequest = V1ClientDeviceFido2RegisterStart | V1ClientDeviceFido2RegisterFinish | V1ClientDeviceFido2VerifyStart | V1ClientDeviceFido2VerifyFinish | V1ClientDevicePassiveRegister | V1ClientDevicePassiveVerify | V1ClientUserResponse | V1ClientAnyError | V1ClientChallenge | V1ClientMobileInstantLinkStart | V1ClientMobileInstantStart | V1ClientMobileInstantFinish | V1ClientOtpStart | V1ClientOtpFinish | V1ClientPpbFinish;
 export type AuthRegistration = PassiveRegistration | Fido2Registration;
 export interface PublicKey {
     id: string;
@@ -98,3 +98,7 @@ export interface Signal {
     results?: string;
     error?: string;
 }
+export interface V1ClientPpbFinish {
+    requestId: string;
+    operationId: string;
+}

package/build/lib/proveauth/internal/auth-response.d.ts

@@ -1,66 +1,62 @@
 import AuthMessage from './auth-message';
 export default interface AuthResponse {
     next: string;
+    data?: ResponseData;
     error?: AuthFailure;
     refreshDeviceTrust?: boolean;
 }
+export interface ResponseData {
+}
 export interface AuthFailure {
     message: string;
     code: number;
 }
+export type RegisterStartAuthResponse = AuthResponse;
+export type RegisterFinishAuthResponse = AuthResponse;
+export type DeviceRegisterAuthResponse = AuthResponse;
+export type VerifyStartAuthResponse = AuthResponse;
+export type VerifyFinishAuthResponse = AuthResponse;
+export type MobileStartAuthResponse = AuthResponse;
+export type OtpStartResponse = AuthResponse;
+export type OtpFinishResponse = AuthResponse;
+export type InstantLinkStartResponse = AuthResponse;
+export type PpbStartResponse = AuthResponse;
+export type PpbFinishResponse = AuthResponse;
 export interface RegisterStartAuthResponseData {
     credCreateOptions?: PublicKeyCredentialCreationOptions;
     credRequestOptions?: PublicKeyCredentialRequestOptions;
 }
-export interface RegisterStartAuthResponse extends AuthResponse {
-    data: RegisterStartAuthResponseData;
-}
-export interface RegisterFinishAuthResponseData {
+export interface RegisterFinishAuthResponseData extends ResponseData {
     deviceId: string;
     passkey: boolean;
     scanMessage?: AuthMessage;
 }
-export interface RegisterFinishAuthResponse extends AuthResponse {
-    data: RegisterFinishAuthResponseData;
-}
-export type DeviceRegisterAuthResponse = RegisterFinishAuthResponse;
 export interface VerifyStartAuthResponseData {
     credRequestOptions: PublicKeyCredentialRequestOptions;
 }
-export interface VerifyStartAuthResponse extends AuthResponse {
-    data: VerifyStartAuthResponseData;
-}
-export interface VerifyFinishAuthResponseData {
+export interface VerifyFinishAuthResponseData extends ResponseData {
     scanMessage?: AuthMessage;
     deviceId?: string;
     passkey?: boolean;
 }
-export interface VerifyFinishAuthResponse extends AuthResponse {
-    data?: VerifyFinishAuthResponseData;
-}
 export interface ChallengeResponse extends AuthResponse {
     deviceId?: string;
     challenge?: string;
     ttl?: number;
     receivedAt?: number;
 }
-export interface MobileStartAuthResponseData {
+export interface MobileStartAuthResponseData extends ResponseData {
     redirectUrl?: string;
 }
-export interface MobileStartAuthResponse extends AuthResponse {
-    data?: MobileStartAuthResponseData;
-}
-export interface OtpStartResponse extends AuthResponse {
-    data?: OtpResponseData;
-}
-export interface OtpFinishResponse extends AuthResponse {
-    data?: OtpResponseData;
-}
 export interface OtpResponseData {
     code?: number;
     message?: string;
 }
-export interface InstantLinkStartResponse extends AuthResponse {
-    data?: InstantLinkResponseData;
-}
 export type InstantLinkResponseData = OtpResponseData;
+export interface PpbOperation {
+    operationId: string;
+    oneTimeSecret: string;
+}
+export interface PpbResponseData extends ResponseData {
+    ppb?: PpbOperation;
+}

package/build/lib/proveauth/internal/auth-session.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="webappsec-credential-management" />
 import AuthMessage from './auth-message';
 import { AuthRequest, Signal } from './auth-request';
-import AuthResponse from './auth-response';
+import AuthResponse, { ResponseData } from './auth-response';
 import AuthTokenClaims, { UserVerificationLevel } from './auth-token-claims';
 import { DeviceRegistration } from './device-auth';
 import Platform, { AuthSessionIntegration, MessageChannel, RequestSigner } from './platform';
@@ -16,6 +16,7 @@ export default class AuthSession implements AuthSessionIntegration {
     readonly channels: Set<MessageChannel>;
     private readonly log;
     lastStep?: string;
+    lastData?: ResponseData;
     credential?: CredentialType;
     authMessage?: AuthMessage;
     uvLevel?: UserVerificationLevel;

package/build/lib/proveauth/internal/auth-session.js

@@ -85,6 +85,7 @@ class AuthSession {
                             this.platform.deviceAuth.reset();
                         }
                     }
+                    this.lastData = response.data;
                     resolve(response);
                 })
                     .catch(reject);

package/build/lib/proveauth/internal/auth-token-claims.d.ts

@@ -9,6 +9,8 @@ export interface PassiveAuthenticator {
 }
 export interface InstantAuthenticator {
 }
+export interface PresentAuthenticator {
+}
 export interface InstantLinkAuthenticator {
     mnp: boolean;
     amnrp?: boolean;
@@ -21,28 +23,44 @@ export interface UniversalAuthenticator {
     endp: string;
     ftu: string;
 }
-export interface Authenticators {
+export interface PpbAuthenticator {
+    endp: string;
+}
+export interface DeviceAuthenticators {
+    pasv?: PassiveAuthenticator;
+    unvsl?: UniversalAuthenticator;
+}
+export interface MobileAuthenticators {
     pasv?: PassiveAuthenticator;
     inst?: InstantAuthenticator;
     inln?: InstantLinkAuthenticator;
     otp?: OtpAuthenticator;
     unvsl?: UniversalAuthenticator;
 }
+export interface UserAuthenticators {
+    pasv?: PassiveAuthenticator;
+    prst?: PresentAuthenticator;
+    ppb?: PpbAuthenticator;
+}
 export interface Signals {
     fpt?: boolean;
     fptrr?: number;
     dwn?: boolean;
 }
 export interface DeviceAuthSubjectClaim {
-    auths: Authenticators;
+    auths: DeviceAuthenticators;
     sgnls?: Signals;
 }
 export interface MobileAuthSubjectClaim {
-    auths: Authenticators;
+    auths: MobileAuthenticators;
+}
+export interface UserAuthSubjectClaim {
+    auths: UserAuthenticators;
 }
 export interface AuthSubjectsClaim {
     dev?: DeviceAuthSubjectClaim;
     mob?: MobileAuthSubjectClaim;
+    usr?: UserAuthSubjectClaim;
 }
 export interface AuthClaim {
     id: string;

package/build/lib/proveauth/internal/device-passive-silent-step.js

@@ -78,19 +78,18 @@ class DevicePassiveSilentStep {
                         if ((_a = registration.getSignals().fingerprint) === null || _a === void 0 ? void 0 : _a.results) {
                             session.markNewFptts();
                         }
-                        const deviceRegisterAuthResp = response;
-                        const deviceId = deviceRegisterAuthResp.data.deviceId;
+                        const data = response.data;
+                        const deviceId = data === null || data === void 0 ? void 0 : data.deviceId;
                         if (!deviceId) {
                             reject(new auth_error_1.default('Failed to register device, returned deviceId is null or empty', 0, response.next));
                         }
                         session.settings.deviceId = deviceId;
-                        if (deviceRegisterAuthResp.data.passkey != null) {
-                            session.settings.fidoPasskeyRegistered = deviceRegisterAuthResp.data.passkey;
+                        if (data.passkey != null) {
+                            session.settings.fidoPasskeyRegistered = data.passkey;
                         }
                         registration.deviceId = deviceId;
                         this.log.debug('Device ID: ' + deviceId);
-                        const data = response.data;
-                        if (data && data.scanMessage) {
+                        if (data.scanMessage) {
                             session.authMessage = data.scanMessage;
                         }
                         session.platform.deviceAuth

package/build/lib/proveauth/internal/device-passive-step.js

@@ -30,7 +30,7 @@ class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
                 signals: signals,
             })
                 .then((response) => {
-                var _a, _b, _c;
+                var _a;
                 if (response.error) {
                     reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                 }
@@ -38,8 +38,9 @@ class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
                     if ((_a = signals === null || signals === void 0 ? void 0 : signals.fingerprint) === null || _a === void 0 ? void 0 : _a.results) {
                         session.markNewFptts();
                     }
-                    const creationOptions = (_b = response.data) === null || _b === void 0 ? void 0 : _b.credCreateOptions;
-                    const requestOptions = (_c = response.data) === null || _c === void 0 ? void 0 : _c.credRequestOptions;
+                    const data = response.data;
+                    const creationOptions = data === null || data === void 0 ? void 0 : data.credCreateOptions;
+                    const requestOptions = data === null || data === void 0 ? void 0 : data.credRequestOptions;
                     if (creationOptions) {
                         this.createCredentials(session, displayName, creationOptions, response)
                             .then(resolve)
@@ -70,7 +71,8 @@ class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
                         reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
-                        const options = response.data.credRequestOptions;
+                        const data = response.data;
+                        const options = data === null || data === void 0 ? void 0 : data.credRequestOptions;
                         this.getCredentials(session, options, response).then(resolve).catch(reject);
                     }
                 })
@@ -144,7 +146,7 @@ class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
     parseCredRequestOptions(response, session) {
         return new Promise((resolve, reject) => {
             const data = response.data;
-            if (data.credRequestOptions) {
+            if (data === null || data === void 0 ? void 0 : data.credRequestOptions) {
                 const requestOptions = data.credRequestOptions;
                 this.getCredentials(session, requestOptions, response).then(resolve).catch(reject);
             }

package/build/lib/proveauth/internal/mobile-instant-step.js

@@ -56,15 +56,15 @@ class MobileInstantStep {
                         implementation: this.implementation,
                     })
                         .then((response) => {
-                        var _a;
                         if (response.error) {
                             this.nextBak = response.next;
                             this.errorCodeBak = response.error.code;
                             reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                         }
                         else {
+                            const data = response.data;
                             resolve({
-                                authUrl: (_a = response.data) === null || _a === void 0 ? void 0 : _a.redirectUrl,
+                                authUrl: data ? data.redirectUrl : undefined,
                             });
                         }
                     })

package/build/lib/proveauth/internal/mobile-instantlink-step.d.ts

@@ -10,10 +10,7 @@ export default class MobileInstantLinkStep extends AuthStatusActions implements
     private readonly retryStep?;
     private readonly getDeviceIp;
     constructor(startStep?: InstantLinkStartStep, retryStep?: InstantLinkRetryStep, getDeviceIp?: () => string | null);
-    private isTestMode;
     execute(session: AuthSession): Promise<string>;
-    private getInstantLinkError;
     private runStartStep;
     private runRetryStep;
-    private handleTestMode;
 }