@prove-identity/prove-auth 2.4.5 → 2.7.1

package/build/lib/proveauth/internal/device-passive-silent-step.d.ts

@@ -1,11 +1,13 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
+import UserConsentStep from '../user-consent-step';
 export default class DevicePassiveSilentStep implements AuthStep {
     static readonly NAME = "device/passive/silent";
-    private readonly log;
     readonly name = "device/passive/silent";
-    private forUPK;
-    constructor(forUPK: boolean);
+    private readonly log;
+    private readonly forUPK;
+    private readonly userConsentStep;
+    constructor(forUPK: boolean, userConsentStep?: UserConsentStep);
     execute(session: AuthSession): Promise<string>;
     private getBackendRegisterEndpoint;
     private getBackendVerifyEndpoint;

package/build/lib/proveauth/internal/device-passive-silent-step.js

@@ -6,11 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("../common/logger");
 const auth_error_1 = __importDefault(require("./auth-error"));
 class DevicePassiveSilentStep {
-    constructor(forUPK) {
-        this.log = logger_1.LoggerFactory.getLogger('device-passive-silent-step');
+    constructor(forUPK, userConsentStep) {
         this.name = DevicePassiveSilentStep.NAME;
-        this.forUPK = false;
+        this.log = logger_1.LoggerFactory.getLogger('device-passive-silent-step');
         this.forUPK = forUPK;
+        this.userConsentStep = userConsentStep !== null && userConsentStep !== void 0 ? userConsentStep : {
+            execute: () => Promise.resolve({ consentGranted: true }),
+        };
     }
     execute(session) {
         this.log.trace('Executing');
@@ -19,16 +21,29 @@ class DevicePassiveSilentStep {
                 .getDeviceRegistration()
                 .then((registration) => {
                 if (registration) {
-                    this.verify(session, registration).then(resolve).catch(reject);
+                    session.embedFpResultToDeviceRegistration(registration).then((registration) => {
+                        this.verify(session, registration).then(resolve).catch(reject);
+                    });
                 }
                 else {
-                    session.platform.deviceAuth
-                        .createRegistration({
-                        namespace: session.namespace,
-                        endpoint: session.backendUrl,
+                    this.userConsentStep
+                        .execute()
+                        .then((output) => {
+                        if (output.consentGranted) {
+                            session.platform.deviceAuth
+                                .createRegistration({
+                                namespace: session.namespace,
+                                endpoint: session.backendOrigin,
+                            })
+                                .then((registration) => session.embedFpResultToDeviceRegistration(registration))
+                                .then((registration) => this.register(session, registration))
+                                .then(resolve)
+                                .catch(reject);
+                        }
+                        else {
+                            reject(new Error('User denied the consent to register the device'));
+                        }
                     })
-                        .then((registration) => this.register(session, registration))
-                        .then(resolve)
                         .catch(reject);
                 }
             })
@@ -52,17 +67,20 @@ class DevicePassiveSilentStep {
                     deviceName: session.platform.getPlatformName(),
                     deviceCapabilities: session.platform.getDeviceCapabilities(),
                     registrations: [authRegistration],
+                    signals: registration.getSignals(),
                 })
                     .then((response) => {
                     if (response.error) {
                         reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
-                        const deviceId = response.data.deviceId;
+                        const deviceRegisterAuthResp = response;
+                        const deviceId = deviceRegisterAuthResp.data.deviceId;
                         if (!deviceId) {
                             reject(new auth_error_1.default('Failed to register device, returned deviceId is null or empty', 0, response.next));
                         }
                         session.settings.deviceId = deviceId;
+                        session.settings.fidoPasskeyRegistered = deviceRegisterAuthResp.data.passkey;
                         registration.deviceId = deviceId;
                         this.log.debug('Device ID: ' + deviceId);
                         session.platform.deviceAuth
@@ -86,6 +104,7 @@ class DevicePassiveSilentStep {
                         deviceId: registration.deviceId,
                         keyId: registration.keyId,
                         signature: signature,
+                        signals: registration.getSignals(),
                     })
                         .then((response) => {
                         if (response.error) {

package/build/lib/proveauth/internal/device-passive-verify-step.d.ts

@@ -1,8 +1,10 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
+import { Signals } from './auth-request';
 export default class DevicePassiveVerifyStep implements AuthStep {
     static readonly NAME = "device/passive/verify";
     private readonly log;
     readonly name = "device/passive/verify";
     execute(session: AuthSession): Promise<string>;
+    runFidoVerifyFinish(session: AuthSession, signals?: Signals): Promise<string>;
 }

package/build/lib/proveauth/internal/device-passive-verify-step.js

@@ -12,6 +12,23 @@ class DevicePassiveVerifyStep {
         this.name = DevicePassiveVerifyStep.NAME;
     }
     execute(session) {
+        return new Promise((resolve, reject) => {
+            session
+                .getFingerprintData()
+                .then((signal) => {
+                const signals = signal ? { fingerprint: signal } : undefined;
+                this.runFidoVerifyFinish(session, signals).then(resolve).catch(reject);
+            })
+                .catch((error) => {
+                var errorMsg = `Unexpected error happened during Fingerprint data collection ${error.toString}`;
+                this.log.warn(errorMsg);
+                this.runFidoVerifyFinish(session, { fingerprint: { error: errorMsg } })
+                    .then(resolve)
+                    .catch(reject);
+            });
+        });
+    }
+    runFidoVerifyFinish(session, signals) {
         return new Promise((resolve, reject) => {
             const credential = session.credential;
             const assertion = credential.response;
@@ -30,6 +47,7 @@ class DevicePassiveVerifyStep {
                             : undefined,
                     },
                 },
+                signals: signals,
             })
                 .then((response) => {
                 if (response.error) {

package/build/lib/proveauth/internal/device-universal-redirect-steps.js

@@ -11,8 +11,8 @@ class DeviceUniversalRedirectBaseStep {
     }
     execute(session) {
         return new Promise((resolve, reject) => {
-            var _a, _b, _c;
-            let redirectUrl = (_c = (_b = (_a = session.claims) === null || _a === void 0 ? void 0 : _a.auth.subs.dev) === null || _b === void 0 ? void 0 : _b.auths.unvsl) === null || _c === void 0 ? void 0 : _c.ftu;
+            var _a, _b, _c, _d, _e, _f;
+            let redirectUrl = (_f = (_e = (_d = (_c = (_b = (_a = session.claims) === null || _a === void 0 ? void 0 : _a.auth) === null || _b === void 0 ? void 0 : _b.subs) === null || _c === void 0 ? void 0 : _c.dev) === null || _d === void 0 ? void 0 : _d.auths) === null || _e === void 0 ? void 0 : _e.unvsl) === null || _f === void 0 ? void 0 : _f.ftu;
             if (typeof redirectUrl != 'undefined' && redirectUrl) {
                 redirectUrl += `?authId=${session.authId}`;
                 let upkNext = '';

package/build/lib/proveauth/internal/main-authenticator.d.ts

@@ -1,7 +1,6 @@
 import AuthFinishStep from '../auth-finish-step';
 import Authenticator from '../authenticator';
 import Settings from './settings';
-import { Logger } from '../common/logger';
 import Platform from './platform';
 import CancelablePromise from '../common/cancelable-promise';
 import AuthSession from './auth-session';
@@ -11,11 +10,11 @@ export default class MainAuthenticator implements Authenticator {
     static readonly AUTH_EMPTY = "";
     static readonly MAX_ATTEMPTS = 50;
     private readonly steps;
-    protected log: Logger;
+    protected log: import("../common/logger").Logger;
     protected readonly platform: Platform;
     protected readonly settings: Settings;
     protected readonly authFinishStep?: AuthFinishStep;
-    constructor(platform?: Platform, storage?: Storage, finishStep?: AuthFinishStep, steps?: Array<AuthStep>);
+    constructor(platform: Platform, settings: Settings, finishStep?: AuthFinishStep, steps?: Array<AuthStep>);
     isPasskeyRegistered(): boolean;
     isFidoSupported(): boolean;
     isDeviceRegistered(): boolean;

package/build/lib/proveauth/internal/main-authenticator.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const settings_1 = __importDefault(require("./settings"));
 const logger_1 = require("../common/logger");
 const cancelable_promise_1 = __importDefault(require("../common/cancelable-promise"));
 const auth_session_1 = __importDefault(require("./auth-session"));
@@ -11,18 +10,12 @@ const auth_error_1 = __importDefault(require("./auth-error"));
 const report_error_step_1 = __importDefault(require("./report-error-step"));
 const error_code_1 = __importDefault(require("./error-code"));
 class MainAuthenticator {
-    constructor(platform, storage, finishStep, steps) {
+    constructor(platform, settings, finishStep, steps) {
         this.steps = new Map();
-        if (!platform) {
-            throw new Error('Implementation of Platform is required');
-        }
-        if (!storage) {
-            throw new Error('Implementation of Storage is required');
-        }
         this.log = logger_1.LoggerFactory.getLogger('main-authenticator');
         this.platform = platform;
         this.authFinishStep = finishStep;
-        this.settings = new settings_1.default(storage);
+        this.settings = settings;
         if (steps) {
             for (let step of steps) {
                 this.steps.set(step.name, step);
@@ -59,7 +52,7 @@ class MainAuthenticator {
             }
             try {
                 const session = new auth_session_1.default(this.settings, this.platform, authToken);
-                var processing = this.process(session);
+                const processing = this.process(session);
                 onCancel(() => processing.cancel());
                 processing
                     .then(() => {

package/build/lib/proveauth/internal/mobile-instantlink-step.js

@@ -91,15 +91,17 @@ class MobileInstantLinkStep extends auth_status_actions_1.AuthStatusActions {
                 this.log.info('Simulating user clicking the instant link');
                 setTimeout(() => {
                     session.platform
-                        .fetch(session.backendUrl +
+                        .fetch(session.backendOrigin +
                         '/v1/client/mobile/instantlink/finish?token=' +
                         encodeURIComponent(session.authToken) +
                         '&vfp=test-vfp', {
-                        mode: 'cors',
+                        mode: 'no-cors',
                         method: 'GET',
                     })
-                        .then((_) => resolve())
-                        .catch(reject);
+                        .catch((e) => {
+                        this.log.error('Calling AuthFinish in test mode has failed: ', auth_error_1.default.extractMessage(e));
+                    })
+                        .finally(resolve);
                 }, SIMULATED_LINK_CLICK_DELAY);
             }
             else {

package/build/lib/proveauth/internal/platform.d.ts

@@ -3,6 +3,7 @@ import { AuthenticatorBuilder } from '@prove-identity/mobile-auth';
 import { AuthRequest } from './auth-request';
 import AuthResponse from './auth-response';
 import DeviceAuth, { DeviceRegistration } from './device-auth';
+import { Agent } from '@fingerprintjs/fingerprintjs-pro';
 export declare const DEVICE_CAPABILITY_WEBAUTHN = "webauthn";
 export interface MessageChannel {
     addEventListener: (type: string, listener: (event: any) => void) => void;
@@ -33,12 +34,15 @@ export default interface Platform {
     getUserAgent: () => string | null;
     isFidoSupported: () => boolean;
     fetch: (input: string, init?: RequestInit) => Promise<Response>;
-    createMessageChannel: (endpointUrl: string) => MessageChannel;
+    createMessageChannel: (input: string) => MessageChannel;
     createRequestSigner: (session: AuthSessionIntegration) => RequestSigner;
     getDeviceCapabilities: () => string[];
     getMobileAuthBuilder: () => AuthenticatorBuilder<any>;
     exit: (code?: number) => void;
     urlRedirect: (url: string) => void;
+    getFpPromise: () => Promise<Agent> | undefined;
+    setFpPromise: (fpPromise: Promise<Agent>) => void;
+    getOrigin: () => string;
 }
 export declare function stringToArrayBuffer(input: string): ArrayBuffer;
 export declare function arrayBufferToString(input: ArrayBuffer): string;

package/build/lib/proveauth/internal/report-error-step.d.ts

@@ -1,7 +1,7 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
 export default class ReportErrorStep implements AuthStep {
-    private static readonly errorKinds;
+    private static readonly errorMap;
     private readonly logger;
     private _message;
     private _code?;
@@ -12,5 +12,5 @@ export default class ReportErrorStep implements AuthStep {
     get code(): number | undefined;
     get message(): string;
     execute(session: AuthSession): Promise<string>;
-    private getKind;
+    private lookupError;
 }

package/build/lib/proveauth/internal/report-error-step.js

@@ -55,9 +55,9 @@ class ReportErrorStep {
         }
         else if (!this.nextStep || this.reportable) {
             return new Promise((resolve, reject) => {
-                const errorKind = this.getKind(session.lastStep);
+                const error = this.lookupError(session.lastStep);
                 session
-                    .fetchFromBackend(`/v1/client/${errorKind}/error`, {
+                    .fetchFromBackend(`/v1/client/${error}/error`, {
                     code: this._code ? this._code : undefined,
                     message: this._message,
                 })
@@ -71,12 +71,12 @@ class ReportErrorStep {
             return Promise.resolve(this.nextStep);
         }
     }
-    getKind(last) {
+    lookupError(last) {
         const defaultKind = 'device/passive';
-        return last ? ReportErrorStep.errorKinds.get(last) || defaultKind : defaultKind;
+        return last ? ReportErrorStep.errorMap.get(last) || defaultKind : defaultKind;
     }
 }
-ReportErrorStep.errorKinds = new Map([
+ReportErrorStep.errorMap = new Map([
     [device_passive_step_1.default.NAME, 'device/passive'],
     [device_passive_silent_step_1.default.NAME, 'device/passive'],
     [device_passive_register_step_1.default.NAME, 'device/fido2'],

package/build/lib/proveauth/internal/settings.d.ts

@@ -5,6 +5,7 @@ export default class Settings {
     static readonly FIDO_PASSKEY_REGISTERED_KEY = "fidoPasskeyRegistered";
     private readonly log;
     private storage;
+    upkEnabled: boolean;
     constructor(storage: Storage);
     reset(): void;
     get deviceId(): string | null;

package/build/lib/proveauth/internal/settings.js

@@ -4,6 +4,7 @@ const logger_1 = require("../common/logger");
 class Settings {
     constructor(storage) {
         this.log = logger_1.LoggerFactory.getLogger('settings');
+        this.upkEnabled = false;
         this.storage = storage;
     }
     reset() {

package/build/lib/proveauth/internal/web-device-auth.d.ts

@@ -1,17 +1,20 @@
-import { AuthRegistration } from './auth-request';
+import { AuthRegistration, Signal, Signals } from './auth-request';
 import DeviceAuth, { DeviceRegistration, DeviceRegistrationOptions } from './device-auth';
 export declare class WebDeviceRegistration implements DeviceRegistration {
     private keys?;
     deviceId: string | null;
+    fingerprint?: Signal;
     readonly namespace: string;
     readonly keyId: string;
     readonly algorithm: string;
     readonly endpoint: string;
     readonly createdAt: number;
     constructor(options: DeviceRegistrationOptions | any);
+    setFpSignal(fingerprintSignal: Signal): void;
     sign(data: string): Promise<string>;
     getPublicKey(): Promise<string>;
     getAuthRegistration(challenge: string): Promise<AuthRegistration>;
+    getSignals(): Signals | undefined;
     private initialize;
     private p1363ToDer;
     private lenVal;

package/build/lib/proveauth/internal/web-device-auth.js

@@ -25,6 +25,9 @@ class WebDeviceRegistration {
             this.createdAt = (0, platform_1.getUnixTime)();
         }
     }
+    setFpSignal(fingerprintSignal) {
+        this.fingerprint = fingerprintSignal;
+    }
     sign(data) {
         return new Promise((resolve, reject) => {
             this.initialize()
@@ -80,6 +83,9 @@ class WebDeviceRegistration {
                 .catch(reject);
         });
     }
+    getSignals() {
+        return this.fingerprint ? { fingerprint: this.fingerprint } : undefined;
+    }
     initialize() {
         return new Promise((resolve, reject) => {
             if (this.keys) {

package/build/lib/proveauth/internal/web-platform.d.ts

@@ -1,6 +1,8 @@
+/// <reference types="webappsec-credential-management" />
 import { AuthenticatorBuilder } from '@prove-identity/mobile-auth';
 import Platform, { AuthSessionIntegration, MessageChannel, RequestSigner } from './platform';
 import WebDeviceAuth from './web-device-auth';
+import { Agent } from '@fingerprintjs/fingerprintjs-pro';
 export declare class WebSocketMessageChannel implements MessageChannel {
     private readonly webSocket;
     constructor(endpointUrl: string);
@@ -9,6 +11,7 @@ export declare class WebSocketMessageChannel implements MessageChannel {
     close(): void;
 }
 export declare class WebPlatform implements Platform {
+    private fpPromise;
     readonly webauthn: {
         getCredentials: (options?: CredentialRequestOptions) => Promise<CredentialType | null>;
         createCredentials: (options: CredentialCreationOptions) => Promise<CredentialType | null>;
@@ -18,7 +21,7 @@ export declare class WebPlatform implements Platform {
     getUserAgent(): string | null;
     isFidoSupported(): boolean;
     fetch(input: string, init?: RequestInit): Promise<Response>;
-    createMessageChannel(endpointUrl: string): MessageChannel;
+    createMessageChannel(input: string): MessageChannel;
     createRequestSigner(session: AuthSessionIntegration): RequestSigner;
     private getBrowserName;
     private getBrowserVersion;
@@ -27,4 +30,7 @@ export declare class WebPlatform implements Platform {
     getMobileAuthBuilder(): AuthenticatorBuilder<any>;
     exit(code?: number): void;
     urlRedirect(url: string): void;
+    getFpPromise(): Promise<Agent> | undefined;
+    setFpPromise(fpPromise: Promise<Agent>): void;
+    getOrigin(): string;
 }

package/build/lib/proveauth/internal/web-platform.js

@@ -47,8 +47,8 @@ class WebPlatform {
     fetch(input, init) {
         return fetch(input, init);
     }
-    createMessageChannel(endpointUrl) {
-        return new WebSocketMessageChannel(endpointUrl);
+    createMessageChannel(input) {
+        return new WebSocketMessageChannel(input);
     }
     createRequestSigner(session) {
         return new request_signer_v3_1.default(session);
@@ -159,5 +159,14 @@ class WebPlatform {
     urlRedirect(url) {
         window.location.replace(url);
     }
+    getFpPromise() {
+        return this.fpPromise;
+    }
+    setFpPromise(fpPromise) {
+        this.fpPromise = fpPromise;
+    }
+    getOrigin() {
+        return window.location.origin;
+    }
 }
 exports.WebPlatform = WebPlatform;

package/build/lib/proveauth/user-consent-step.d.ts

@@ -0,0 +1,7 @@
+export interface UserConsentOutput {
+    readonly consentGranted: boolean;
+}
+export default interface UserConsentStep {
+    execute: () => Promise<UserConsentOutput>;
+}
+export type UserConsentStepFn = () => Promise<UserConsentOutput>;

package/build/lib/proveauth/user-consent-step.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/lib/proveauth/version.d.ts

@@ -1,3 +1,3 @@
-export declare const VERSION = "2.4.5";
-export declare const API_CONTRACT_VERSION = "2.7.0";
+export declare const VERSION = "2.7.1";
+export declare const API_CONTRACT_VERSION = "2.8.0";
 export declare const USER_AGENT_VERSIONS: string;

package/build/lib/proveauth/version.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.USER_AGENT_VERSIONS = exports.API_CONTRACT_VERSION = exports.VERSION = void 0;
-exports.VERSION = '2.4.5';
-exports.API_CONTRACT_VERSION = '2.7.0';
+exports.VERSION = '2.7.1';
+exports.API_CONTRACT_VERSION = '2.8.0';
 exports.USER_AGENT_VERSIONS = `ProveAuth/${exports.VERSION} Contract/${exports.API_CONTRACT_VERSION} WEB/1`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prove-identity/prove-auth",
-  "version": "2.4.5",
+  "version": "2.7.1",
   "description": "Prove Auth SDK for Web",
   "main": "build/lib/index.js",
   "files": [
@@ -68,5 +68,13 @@
   },
   "dependencies": {
     "@prove-identity/mobile-auth": "^3.0.0"
+  },
+  "peerDependencies": {
+    "@fingerprintjs/fingerprintjs-pro": "^3.11.0"
+  },
+  "peerDependenciesMeta": {
+    "@fingerprintjs/fingerprintjs-pro": {
+      "optional": true
+    }
   }
 }