@prove-identity/prove-auth 2.4.4 → 2.7.0

package/build/lib/proveauth/internal/device-auth.d.ts

@@ -1,4 +1,4 @@
-import { AuthRegistration } from './auth-request';
+import { AuthRegistration, Signal, Signals } from './auth-request';
 export interface DeviceRegistrationOptions {
     namespace: string;
     endpoint: string;
@@ -9,9 +9,12 @@ export interface DeviceRegistration {
     readonly algorithm: string;
     readonly endpoint: string;
     deviceId: string | null;
+    fingerprint?: Signal;
     sign: (data: string) => Promise<string>;
     getPublicKey: () => Promise<string>;
     getAuthRegistration: (challenge: string) => Promise<AuthRegistration>;
+    setFpSignal: (fpSignal: Signal) => void;
+    getSignals: () => Signals | undefined;
 }
 export default interface DeviceAuth {
     createRegistration: (options: DeviceRegistrationOptions) => Promise<DeviceRegistration>;

package/build/lib/proveauth/internal/device-passive-register-step.js

@@ -18,23 +18,23 @@ class DevicePassiveRegisterStep {
                 .getDeviceRegistration()
                 .then((devRegistration) => {
                 if (devRegistration) {
-                    this.finishRegistration(session, [this.getFido2Registration(session)])
-                        .then(resolve)
-                        .catch(reject);
+                    session.embedFpResultToDeviceRegistration(devRegistration).then((devRegistration) => {
+                        this.finishRegistration(session, [this.getFido2Registration(session)], devRegistration.getSignals())
+                            .then(resolve)
+                            .catch(reject);
+                    });
                 }
                 else {
                     session.platform.deviceAuth
                         .createRegistration({
                         namespace: session.namespace,
-                        endpoint: session.backendUrl,
+                        endpoint: session.backendOrigin,
                     })
+                        .then((devRegistration) => session.embedFpResultToDeviceRegistration(devRegistration))
                         .then((devRegistration) => {
                         devRegistration
                             .getAuthRegistration(session.challenge)
-                            .then((authRegistration) => this.finishRegistration(session, [
-                            this.getFido2Registration(session),
-                            authRegistration,
-                        ]))
+                            .then((authRegistration) => this.finishRegistration(session, [this.getFido2Registration(session), authRegistration], devRegistration.getSignals()))
                             .then((next) => {
                             devRegistration.deviceId = session.settings.deviceId;
                             session.platform.deviceAuth
@@ -50,13 +50,14 @@ class DevicePassiveRegisterStep {
                 .catch(reject);
         });
     }
-    finishRegistration(session, registrations) {
+    finishRegistration(session, registrations, signals) {
         return new Promise((resolve, reject) => {
             session
                 .fetchFromBackend('/v1/client/device/fido2/register/finish', {
                 deviceName: session.platform.getPlatformName(),
                 deviceCapabilities: session.platform.getDeviceCapabilities(),
                 registrations: registrations,
+                signals: signals,
             })
                 .then((response) => {
                 if (response.error) {

package/build/lib/proveauth/internal/device-passive-silent-step.d.ts

@@ -1,10 +1,16 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
+import UserConsentStep from '../user-consent-step';
 export default class DevicePassiveSilentStep implements AuthStep {
     static readonly NAME = "device/passive/silent";
-    private readonly log;
     readonly name = "device/passive/silent";
+    private readonly log;
+    private readonly forUPK;
+    private readonly userConsentStep;
+    constructor(forUPK: boolean, userConsentStep?: UserConsentStep);
     execute(session: AuthSession): Promise<string>;
+    private getBackendRegisterEndpoint;
+    private getBackendVerifyEndpoint;
     private register;
     private verify;
 }

package/build/lib/proveauth/internal/device-passive-silent-step.js

@@ -6,9 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("../common/logger");
 const auth_error_1 = __importDefault(require("./auth-error"));
 class DevicePassiveSilentStep {
-    constructor() {
-        this.log = logger_1.LoggerFactory.getLogger('device-passive-silent-step');
+    constructor(forUPK, userConsentStep) {
         this.name = DevicePassiveSilentStep.NAME;
+        this.log = logger_1.LoggerFactory.getLogger('device-passive-silent-step');
+        this.forUPK = forUPK;
+        this.userConsentStep = userConsentStep !== null && userConsentStep !== void 0 ? userConsentStep : {
+            execute: () => Promise.resolve({ consentGranted: true }),
+        };
     }
     execute(session) {
         this.log.trace('Executing');
@@ -17,42 +21,66 @@ class DevicePassiveSilentStep {
                 .getDeviceRegistration()
                 .then((registration) => {
                 if (registration) {
-                    this.verify(session, registration).then(resolve).catch(reject);
+                    session.embedFpResultToDeviceRegistration(registration).then((registration) => {
+                        this.verify(session, registration).then(resolve).catch(reject);
+                    });
                 }
                 else {
-                    session.platform.deviceAuth
-                        .createRegistration({
-                        namespace: session.namespace,
-                        endpoint: session.backendUrl,
+                    this.userConsentStep
+                        .execute()
+                        .then((output) => {
+                        if (output.consentGranted) {
+                            session.platform.deviceAuth
+                                .createRegistration({
+                                namespace: session.namespace,
+                                endpoint: session.backendOrigin,
+                            })
+                                .then((registration) => session.embedFpResultToDeviceRegistration(registration))
+                                .then((registration) => this.register(session, registration))
+                                .then(resolve)
+                                .catch(reject);
+                        }
+                        else {
+                            reject(new Error('User denied the consent to register the device'));
+                        }
                     })
-                        .then((registration) => this.register(session, registration))
-                        .then(resolve)
                         .catch(reject);
                 }
             })
                 .catch(reject);
         });
     }
+    getBackendRegisterEndpoint() {
+        return this.forUPK
+            ? '/v1/client/device/universal/register'
+            : '/v1/client/device/passive/register';
+    }
+    getBackendVerifyEndpoint() {
+        return this.forUPK ? '/v1/client/device/universal/verify' : '/v1/client/device/passive/verify';
+    }
     register(session, registration) {
         this.log.trace('Registering');
         return new Promise((resolve, reject) => {
             registration.getAuthRegistration(session.challenge).then((authRegistration) => {
                 session
-                    .fetchFromBackend('/v1/client/device/passive/register', {
+                    .fetchFromBackend(this.getBackendRegisterEndpoint(), {
                     deviceName: session.platform.getPlatformName(),
                     deviceCapabilities: session.platform.getDeviceCapabilities(),
                     registrations: [authRegistration],
+                    signals: registration.getSignals(),
                 })
                     .then((response) => {
                     if (response.error) {
-                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
-                        const deviceId = response.data.deviceId;
+                        const deviceRegisterAuthResp = response;
+                        const deviceId = deviceRegisterAuthResp.data.deviceId;
                         if (!deviceId) {
                             reject(new auth_error_1.default('Failed to register device, returned deviceId is null or empty', 0, response.next));
                         }
                         session.settings.deviceId = deviceId;
+                        session.settings.fidoPasskeyRegistered = deviceRegisterAuthResp.data.passkey;
                         registration.deviceId = deviceId;
                         this.log.debug('Device ID: ' + deviceId);
                         session.platform.deviceAuth
@@ -72,14 +100,15 @@ class DevicePassiveSilentStep {
                 const challenge = registration.deviceId + ':' + session.challenge;
                 registration.sign(challenge).then((signature) => {
                     session
-                        .fetchFromBackend('/v1/client/device/passive/verify', {
+                        .fetchFromBackend(this.getBackendVerifyEndpoint(), {
                         deviceId: registration.deviceId,
                         keyId: registration.keyId,
                         signature: signature,
+                        signals: registration.getSignals(),
                     })
                         .then((response) => {
                         if (response.error) {
-                            reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                            reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                         }
                         else {
                             resolve(response.next);

package/build/lib/proveauth/internal/device-passive-step.d.ts

@@ -1,7 +1,8 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
 import { DeviceRole } from '../authenticator-builder';
-export declare class DevicePassiveActions {
+import { AuthStatusActions } from './auth-status-actions';
+export declare class DevicePassiveActions extends AuthStatusActions {
     protected log: import("../common/logger").Logger;
     private readonly getDisplayName;
     protected constructor(getDisplayName?: () => string | null);

package/build/lib/proveauth/internal/device-passive-step.js

@@ -10,9 +10,10 @@ const device_passive_silent_step_1 = __importDefault(require("./device-passive-s
 const auth_token_claims_1 = require("./auth-token-claims");
 const auth_error_1 = __importDefault(require("./auth-error"));
 const authenticator_builder_1 = require("../authenticator-builder");
-const base_authenticator_1 = __importDefault(require("./base-authenticator"));
-class DevicePassiveActions {
+const auth_status_actions_1 = require("./auth-status-actions");
+class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
     constructor(getDisplayName) {
+        super();
         this.log = logger_1.LoggerFactory.getLogger('device-passive-actions');
         this.getDisplayName = getDisplayName ? getDisplayName : () => null;
     }
@@ -114,7 +115,7 @@ class DevicePassiveStep extends DevicePassiveActions {
     }
     execute(session) {
         if (this.role == authenticator_builder_1.DeviceRole.Secondary) {
-            return Promise.resolve(base_authenticator_1.default.AUTH_DONE);
+            return this.waitForStatus(session);
         }
         if (!session.platform.isFidoSupported() ||
             session.uvLevel === auth_token_claims_1.UserVerificationLevel.Discouraged) {

package/build/lib/proveauth/internal/device-passive-verify-step.d.ts

@@ -1,8 +1,10 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
+import { Signals } from './auth-request';
 export default class DevicePassiveVerifyStep implements AuthStep {
     static readonly NAME = "device/passive/verify";
     private readonly log;
     readonly name = "device/passive/verify";
     execute(session: AuthSession): Promise<string>;
+    runFidoVerifyFinish(session: AuthSession, signals?: Signals): Promise<string>;
 }

package/build/lib/proveauth/internal/device-passive-verify-step.js

@@ -12,6 +12,23 @@ class DevicePassiveVerifyStep {
         this.name = DevicePassiveVerifyStep.NAME;
     }
     execute(session) {
+        return new Promise((resolve, reject) => {
+            session
+                .getFingerprintData()
+                .then((signal) => {
+                const signals = signal ? { fingerprint: signal } : undefined;
+                this.runFidoVerifyFinish(session, signals).then(resolve).catch(reject);
+            })
+                .catch((error) => {
+                var errorMsg = `Unexpected error happened during Fingerprint data collection ${error.toString}`;
+                this.log.warn(errorMsg);
+                this.runFidoVerifyFinish(session, { fingerprint: { error: errorMsg } })
+                    .then(resolve)
+                    .catch(reject);
+            });
+        });
+    }
+    runFidoVerifyFinish(session, signals) {
         return new Promise((resolve, reject) => {
             const credential = session.credential;
             const assertion = credential.response;
@@ -30,6 +47,7 @@ class DevicePassiveVerifyStep {
                             : undefined,
                     },
                 },
+                signals: signals,
             })
                 .then((response) => {
                 if (response.error) {

package/build/lib/proveauth/internal/device-universal-redirect-steps.d.ts

@@ -0,0 +1,14 @@
+import AuthStep from './auth-step';
+import AuthSession from './auth-session';
+export declare class DeviceUniversalRedirectBaseStep implements AuthStep {
+    name: string;
+    execute(session: AuthSession): Promise<string>;
+}
+export declare class DeviceUniversalRedirectFinishStep extends DeviceUniversalRedirectBaseStep {
+    static readonly NAME = "redirect/finish";
+    readonly name = "redirect/finish";
+}
+export declare class DeviceUniversalRedirectExchangeStep extends DeviceUniversalRedirectBaseStep {
+    static readonly NAME = "redirect/exchange";
+    readonly name = "redirect/exchange";
+}

package/build/lib/proveauth/internal/device-universal-redirect-steps.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceUniversalRedirectExchangeStep = exports.DeviceUniversalRedirectFinishStep = exports.DeviceUniversalRedirectBaseStep = void 0;
+const auth_error_1 = __importDefault(require("./auth-error"));
+class DeviceUniversalRedirectBaseStep {
+    constructor() {
+        this.name = '';
+    }
+    execute(session) {
+        return new Promise((resolve, reject) => {
+            var _a, _b, _c;
+            let redirectUrl = (_c = (_b = (_a = session.claims) === null || _a === void 0 ? void 0 : _a.auth.subs.dev) === null || _b === void 0 ? void 0 : _b.auths.unvsl) === null || _c === void 0 ? void 0 : _c.ftu;
+            if (typeof redirectUrl != 'undefined' && redirectUrl) {
+                redirectUrl += `?authId=${session.authId}`;
+                let upkNext = '';
+                if (this.name === 'redirect/exchange') {
+                    upkNext = 'authexchange';
+                }
+                else if (this.name === 'redirect/finish') {
+                    upkNext = 'authfinish';
+                }
+                else {
+                    reject(new auth_error_1.default(`Unknown UPK Step: ${this.name}`, 0, session.next, true));
+                    return;
+                }
+                redirectUrl += `&next=${upkNext}`;
+                session.platform.urlRedirect(redirectUrl);
+                resolve('');
+            }
+            else {
+                reject(new auth_error_1.default('AuthToken claims do not contain final target URL', 0, session.next, true));
+            }
+        });
+    }
+}
+exports.DeviceUniversalRedirectBaseStep = DeviceUniversalRedirectBaseStep;
+class DeviceUniversalRedirectFinishStep extends DeviceUniversalRedirectBaseStep {
+    constructor() {
+        super(...arguments);
+        this.name = DeviceUniversalRedirectFinishStep.NAME;
+    }
+}
+DeviceUniversalRedirectFinishStep.NAME = 'redirect/finish';
+exports.DeviceUniversalRedirectFinishStep = DeviceUniversalRedirectFinishStep;
+class DeviceUniversalRedirectExchangeStep extends DeviceUniversalRedirectBaseStep {
+    constructor() {
+        super(...arguments);
+        this.name = DeviceUniversalRedirectExchangeStep.NAME;
+    }
+}
+DeviceUniversalRedirectExchangeStep.NAME = 'redirect/exchange';
+exports.DeviceUniversalRedirectExchangeStep = DeviceUniversalRedirectExchangeStep;

package/build/lib/proveauth/internal/device-universal-step.d.ts

@@ -0,0 +1,10 @@
+import AuthStep from './auth-step';
+import AuthSession from './auth-session';
+export default class DeviceUniversalStep implements AuthStep {
+    static readonly NAME = "device/universal";
+    private readonly log;
+    readonly name = "device/universal";
+    private forUPK;
+    constructor(forUPK: boolean);
+    execute(session: AuthSession): Promise<string>;
+}

package/build/lib/proveauth/internal/device-universal-step.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = require("../common/logger");
+const auth_error_1 = __importDefault(require("./auth-error"));
+const device_passive_silent_step_1 = __importDefault(require("./device-passive-silent-step"));
+class DeviceUniversalStep {
+    constructor(forUPK) {
+        this.log = logger_1.LoggerFactory.getLogger('device-universal-step');
+        this.name = DeviceUniversalStep.NAME;
+        this.forUPK = false;
+        this.forUPK = forUPK;
+    }
+    execute(session) {
+        this.log.trace('Executing');
+        return new Promise((resolve, reject) => {
+            var _a, _b, _c;
+            if (this.forUPK) {
+                resolve(device_passive_silent_step_1.default.NAME);
+            }
+            else {
+                let redirectUrl = (_c = (_b = (_a = session.claims) === null || _a === void 0 ? void 0 : _a.auth.subs.dev) === null || _b === void 0 ? void 0 : _b.auths.unvsl) === null || _c === void 0 ? void 0 : _c.endp;
+                if (typeof redirectUrl != 'undefined' && redirectUrl) {
+                    redirectUrl += `?authId=${session.authId}&authtoken=${session.authToken}`;
+                    session.platform.urlRedirect(redirectUrl);
+                    resolve('');
+                }
+                else {
+                    reject(new auth_error_1.default('AuthToken claims do not contain universal redirect URL', 0, session.next, true));
+                }
+            }
+        });
+    }
+}
+DeviceUniversalStep.NAME = 'device/universal';
+exports.default = DeviceUniversalStep;

package/build/lib/proveauth/internal/{base-authenticator.d.ts → main-authenticator.d.ts}

@@ -1,19 +1,20 @@
 import AuthFinishStep from '../auth-finish-step';
 import Authenticator from '../authenticator';
 import Settings from './settings';
-import { Logger } from '../common/logger';
 import Platform from './platform';
 import CancelablePromise from '../common/cancelable-promise';
 import AuthSession from './auth-session';
-export default abstract class BaseAuthenticator implements Authenticator {
+import AuthStep from './auth-step';
+export default class MainAuthenticator implements Authenticator {
     static readonly AUTH_DONE = "done";
     static readonly AUTH_EMPTY = "";
     static readonly MAX_ATTEMPTS = 50;
-    protected log: Logger;
+    private readonly steps;
+    protected log: import("../common/logger").Logger;
     protected readonly platform: Platform;
     protected readonly settings: Settings;
     protected readonly authFinishStep?: AuthFinishStep;
-    constructor(platform?: Platform, storage?: Storage, finishStep?: AuthFinishStep);
+    constructor(platform: Platform, settings: Settings, finishStep?: AuthFinishStep, steps?: Array<AuthStep>);
     isPasskeyRegistered(): boolean;
     isFidoSupported(): boolean;
     isDeviceRegistered(): boolean;
@@ -24,5 +25,7 @@ export default abstract class BaseAuthenticator implements Authenticator {
     unregisterDevice(): Promise<void>;
     unregisterPasskey(): Promise<void>;
     private unregister;
-    abstract process(session: AuthSession): CancelablePromise<void>;
+    process(session: AuthSession): CancelablePromise<void>;
+    private nextStep;
+    private getNextStep;
 }

package/build/lib/proveauth/internal/{base-authenticator.js → main-authenticator.js}

@@ -3,23 +3,24 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const settings_1 = __importDefault(require("./settings"));
 const logger_1 = require("../common/logger");
 const cancelable_promise_1 = __importDefault(require("../common/cancelable-promise"));
 const auth_session_1 = __importDefault(require("./auth-session"));
 const auth_error_1 = __importDefault(require("./auth-error"));
-class BaseAuthenticator {
-    constructor(platform, storage, finishStep) {
-        if (!platform) {
-            throw new Error('Implementation of Platform is required');
-        }
-        if (!storage) {
-            throw new Error('Implementation of Storage is required');
-        }
-        this.log = logger_1.LoggerFactory.getLogger('base-authenticator');
+const report_error_step_1 = __importDefault(require("./report-error-step"));
+const error_code_1 = __importDefault(require("./error-code"));
+class MainAuthenticator {
+    constructor(platform, settings, finishStep, steps) {
+        this.steps = new Map();
+        this.log = logger_1.LoggerFactory.getLogger('main-authenticator');
         this.platform = platform;
         this.authFinishStep = finishStep;
-        this.settings = new settings_1.default(storage);
+        this.settings = settings;
+        if (steps) {
+            for (let step of steps) {
+                this.steps.set(step.name, step);
+            }
+        }
     }
     isPasskeyRegistered() {
         return this.settings.fidoPasskeyRegistered;
@@ -51,12 +52,15 @@ class BaseAuthenticator {
             }
             try {
                 const session = new auth_session_1.default(this.settings, this.platform, authToken);
-                var processing = this.process(session);
+                if (this.settings.upkEnabled) {
+                    session.backendOriginOverride = this.platform.getOrigin();
+                }
+                const processing = this.process(session);
                 onCancel(() => processing.cancel());
                 processing
                     .then(() => {
                     var _a;
-                    if (session.lastStep !== BaseAuthenticator.AUTH_EMPTY) {
+                    if (session.lastStep !== MainAuthenticator.AUTH_EMPTY) {
                         this.log.info('Authentication flow has been completed.');
                         return (_a = this.authFinishStep) === null || _a === void 0 ? void 0 : _a.execute({ authId: session.authId });
                     }
@@ -122,8 +126,48 @@ class BaseAuthenticator {
             }
         });
     }
+    process(session) {
+        return new cancelable_promise_1.default((resolve, reject, onCancel) => {
+            onCancel(() => {
+                this.log.info('Canceled');
+                session.closeAllMessageChannels();
+                resolve();
+            });
+            this.nextStep(session, session.next, 1).then(resolve).catch(reject);
+        });
+    }
+    nextStep(session, step, attempt) {
+        this.log.debug(`Authentication attempt ${attempt}, next step: ${step}`);
+        session.lastStep = step;
+        return new Promise((resolve, reject) => {
+            if ([MainAuthenticator.AUTH_DONE, MainAuthenticator.AUTH_EMPTY].includes(step)) {
+                resolve();
+            }
+            else if (attempt > MainAuthenticator.MAX_ATTEMPTS) {
+                reject(new auth_error_1.default('Too many authentication steps', error_code_1.default.ERROR_MAX_ATTEMPTS));
+            }
+            else {
+                this.getNextStep(step)
+                    .execute(session)
+                    .then((next) => this.nextStep(session, next, attempt + 1))
+                    .then(resolve)
+                    .catch((e) => new report_error_step_1.default(e)
+                    .execute(session)
+                    .then((next) => this.nextStep(session, next, attempt + 1))
+                    .then(resolve)
+                    .catch(reject));
+            }
+        });
+    }
+    getNextStep(step) {
+        var nextStep = this.steps.get(step);
+        if (nextStep) {
+            return nextStep;
+        }
+        return new report_error_step_1.default('Unknown authentication step: ' + step);
+    }
 }
-BaseAuthenticator.AUTH_DONE = 'done';
-BaseAuthenticator.AUTH_EMPTY = '';
-BaseAuthenticator.MAX_ATTEMPTS = 50;
-exports.default = BaseAuthenticator;
+MainAuthenticator.AUTH_DONE = 'done';
+MainAuthenticator.AUTH_EMPTY = '';
+MainAuthenticator.MAX_ATTEMPTS = 50;
+exports.default = MainAuthenticator;

package/build/lib/proveauth/internal/mobile-instantlink-step.d.ts

@@ -1,7 +1,8 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
 import { InstantLinkStartStep } from '../instantlink';
-export default class MobileInstantLinkStep implements AuthStep {
+import { AuthStatusActions } from './auth-status-actions';
+export default class MobileInstantLinkStep extends AuthStatusActions implements AuthStep {
     static readonly NAME = "mobile/instantlink";
     readonly name = "mobile/instantlink";
     protected log: import("../common/logger").Logger;

package/build/lib/proveauth/internal/mobile-instantlink-step.js

@@ -6,15 +6,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("../common/logger");
 const phone_number_input_1 = require("./phone-number-input");
 const auth_error_1 = __importDefault(require("./auth-error"));
+const auth_status_actions_1 = require("./auth-status-actions");
 const SIMULATED_LINK_CLICK_DELAY = 100;
-class MobileInstantLinkStep {
+class MobileInstantLinkStep extends auth_status_actions_1.AuthStatusActions {
     constructor(startStep, getDeviceIp) {
+        super();
         this.name = MobileInstantLinkStep.NAME;
         this.log = logger_1.LoggerFactory.getLogger('mobile-instantlink-step');
         this.startStep = startStep;
         this.getDeviceIp = getDeviceIp !== null && getDeviceIp !== void 0 ? getDeviceIp : (() => null);
     }
     execute(session) {
+        this.log.trace('Executing');
         return new Promise((resolve, reject) => {
             var _a, _b, _c, _d, _e, _f;
             var phoneNumberNeeded = true;
@@ -26,9 +29,10 @@ class MobileInstantLinkStep {
                 testMode = true;
             }
             this.runStartStep(session, phoneNumberNeeded)
-                .then((next) => {
+                .then((_) => {
                 this.runFinishStep(session, testMode)
-                    .then(() => resolve(next))
+                    .then(() => this.waitForStatus(session))
+                    .then((next) => resolve(next))
                     .catch(reject);
             })
                 .catch(reject);
@@ -87,9 +91,9 @@ class MobileInstantLinkStep {
                 this.log.info('Simulating user clicking the instant link');
                 setTimeout(() => {
                     session.platform
-                        .fetch(session.backendUrl +
+                        .fetch(session.backendOrigin +
                         '/v1/client/mobile/instantlink/finish?token=' +
-                        session.authToken +
+                        encodeURIComponent(session.authToken) +
                         '&vfp=test-vfp', {
                         mode: 'cors',
                         method: 'GET',

package/build/lib/proveauth/internal/platform.d.ts

@@ -3,6 +3,7 @@ import { AuthenticatorBuilder } from '@prove-identity/mobile-auth';
 import { AuthRequest } from './auth-request';
 import AuthResponse from './auth-response';
 import DeviceAuth, { DeviceRegistration } from './device-auth';
+import { Agent } from '@fingerprintjs/fingerprintjs-pro';
 export declare const DEVICE_CAPABILITY_WEBAUTHN = "webauthn";
 export interface MessageChannel {
     addEventListener: (type: string, listener: (event: any) => void) => void;
@@ -33,11 +34,15 @@ export default interface Platform {
     getUserAgent: () => string | null;
     isFidoSupported: () => boolean;
     fetch: (input: string, init?: RequestInit) => Promise<Response>;
-    createMessageChannel: (endpointUrl: string) => MessageChannel;
+    createMessageChannel: (input: string) => MessageChannel;
     createRequestSigner: (session: AuthSessionIntegration) => RequestSigner;
     getDeviceCapabilities: () => string[];
     getMobileAuthBuilder: () => AuthenticatorBuilder<any>;
     exit: (code?: number) => void;
+    urlRedirect: (url: string) => void;
+    getFpPromise: () => Promise<Agent> | undefined;
+    setFpPromise: (fpPromise: Promise<Agent>) => void;
+    getOrigin: () => string;
 }
 export declare function stringToArrayBuffer(input: string): ArrayBuffer;
 export declare function arrayBufferToString(input: ArrayBuffer): string;

package/build/lib/proveauth/internal/report-error-step.d.ts

@@ -1,7 +1,7 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
 export default class ReportErrorStep implements AuthStep {
-    private static readonly errorKinds;
+    private static readonly errorMap;
     private readonly logger;
     private _message;
     private _code?;
@@ -12,5 +12,5 @@ export default class ReportErrorStep implements AuthStep {
     get code(): number | undefined;
     get message(): string;
     execute(session: AuthSession): Promise<string>;
-    private getKind;
+    private lookupError;
 }