@prove-identity/prove-auth 2.7.1 → 2.9.0

package/build/lib/proveauth/internal/auth-error.js

@@ -16,7 +16,7 @@ class AuthError extends Error {
             }
             else {
                 message = error.toString();
-                if (message === '[object Object]') {
+                if (message.startsWith('[object ')) {
                     message = JSON.stringify(error);
                 }
             }

package/build/lib/proveauth/internal/auth-request.d.ts

@@ -27,6 +27,7 @@ export interface Fido2Registration {
 }
 export interface V1ClientDeviceFido2RegisterStart {
     displayName?: string;
+    signals?: Signals;
 }
 export interface V1ClientDeviceFido2RegisterFinish {
     deviceName: string;

package/build/lib/proveauth/internal/auth-response.d.ts

@@ -9,7 +9,8 @@ export interface AuthFailure {
     code: number;
 }
 export interface RegisterStartAuthResponseData {
-    credCreateOptions: PublicKeyCredentialCreationOptions;
+    credCreateOptions?: PublicKeyCredentialCreationOptions;
+    credRequestOptions?: PublicKeyCredentialRequestOptions;
 }
 export interface RegisterStartAuthResponse extends AuthResponse {
     data: RegisterStartAuthResponseData;
@@ -17,6 +18,7 @@ export interface RegisterStartAuthResponse extends AuthResponse {
 export interface RegisterFinishAuthResponseData {
     deviceId: string;
     passkey: boolean;
+    scanMessage?: AuthMessage;
 }
 export interface RegisterFinishAuthResponse extends AuthResponse {
     data: RegisterFinishAuthResponseData;
@@ -30,6 +32,8 @@ export interface VerifyStartAuthResponse extends AuthResponse {
 }
 export interface VerifyFinishAuthResponseData {
     scanMessage?: AuthMessage;
+    deviceId?: string;
+    passkey?: boolean;
 }
 export interface VerifyFinishAuthResponse extends AuthResponse {
     data?: VerifyFinishAuthResponseData;

package/build/lib/proveauth/internal/auth-session.d.ts

@@ -1,11 +1,12 @@
 /// <reference types="webappsec-credential-management" />
 import AuthMessage from './auth-message';
-import { AuthRequest, Signal } from './auth-request';
+import { AuthRequest, Signal, Signals } from './auth-request';
 import AuthResponse from './auth-response';
 import AuthTokenClaims, { UserVerificationLevel } from './auth-token-claims';
 import { DeviceRegistration } from './device-auth';
 import Platform, { AuthSessionIntegration, MessageChannel, RequestSigner } from './platform';
 import Settings from './settings';
+import { WebSocketCloseReasons } from './web-socket-close-reasons';
 export default class AuthSession implements AuthSessionIntegration {
     readonly platform: Platform;
     readonly authToken?: string;
@@ -26,11 +27,15 @@ export default class AuthSession implements AuthSessionIntegration {
     get next(): string;
     constructor(settings: Settings, platform: Platform, authToken?: string);
     fetchFromBackend(query: string, body: AuthRequest): Promise<AuthResponse>;
-    createMessageChannel(query: string, onClose: () => void, onError: (message: string) => void, onMessage: (data: string) => void): MessageChannel;
+    static parseCloseEvent(event: CloseEvent): [WebSocketCloseReasons, number];
+    createMessageChannel(query: string, onClose: (reason: WebSocketCloseReasons, code: number) => void, onError: (message: string) => void, onMessage: (data: string) => void): MessageChannel;
     closeAllMessageChannels(): void;
     getDeviceRegistration(): Promise<DeviceRegistration | null>;
     embedFpResultToDeviceRegistration(registration: DeviceRegistration): Promise<DeviceRegistration>;
+    embedDarwiniumResultToDeviceRegistration(registration: DeviceRegistration): Promise<DeviceRegistration>;
+    embedDarwiniumSignal(signals: Signals): void;
     getFingerprintData(): Promise<Signal | undefined>;
     shouldCollectFP(): boolean;
+    shouldSendDarwiniumData(): boolean;
     private parseJwt;
 }

package/build/lib/proveauth/internal/auth-session.js

@@ -7,6 +7,7 @@ const logger_1 = require("../common/logger");
 const version_1 = require("../version");
 const auth_token_claims_1 = require("./auth-token-claims");
 const error_code_1 = __importDefault(require("./error-code"));
+const web_socket_close_reasons_1 = require("./web-socket-close-reasons");
 class AuthSession {
     get namespace() {
         var _a;
@@ -90,6 +91,48 @@ class AuthSession {
                 .catch(reject);
         });
     }
+    static parseCloseEvent(event) {
+        var reason = web_socket_close_reasons_1.WebSocketCloseReasons.UNKNOWN_REASON;
+        switch (event.code) {
+            case 1000:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.NORMAL_CLOSURE;
+                break;
+            case 1001:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.GOING_AWAY;
+                break;
+            case 1002:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.PROTOCOL_ERROR;
+                break;
+            case 1003:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.UNSUPPORTED_DATA;
+                break;
+            case 1005:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.NO_STATUS_RECEIVED;
+                break;
+            case 1006:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.ABNORMAL_CLOSURE;
+                break;
+            case 1007:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.INVALID_FRAME_PAYLOAD_DATA;
+                break;
+            case 1008:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.POLICY_VIOLATION;
+                break;
+            case 1009:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.MESSAGE_TOO_BIG;
+                break;
+            case 1010:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.MANDATORY_EXTENSION;
+                break;
+            case 1011:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.INTERNAL_ERROR;
+                break;
+            case 1015:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.TLS_HANDSHAKE;
+                break;
+        }
+        return [reason, event.code];
+    }
     createMessageChannel(query, onClose, onError, onMessage) {
         if (!this.authToken) {
             throw new Error('Authentication token is not initialized, cannot create MessageChannel');
@@ -105,29 +148,28 @@ class AuthSession {
                 channel.send('ping');
             }
             else {
-                this.log.error('Failed to receive ping response in time, closing the channel');
+                this.log.warn('Failed to receive ping response in time, closing the channel');
                 clearInterval(keepAlive);
                 channel.close();
                 onError('Channel communication stalled');
                 this.channels.delete(channel);
             }
         }, KEEP_ALIVE_INTERVAL);
-        channel.addEventListener('close', (_) => {
+        channel.addEventListener('close', (event) => {
+            var statusCode = event.code ? `with status code: ${event.code}` : 'without status code';
+            this.log.debug(`Message channel is closed ${statusCode}`);
             clearInterval(keepAlive);
-            onClose();
             this.channels.delete(channel);
+            const [reason, code] = AuthSession.parseCloseEvent(event);
+            onClose(reason, code);
         });
         channel.addEventListener('error', (event) => {
-            clearInterval(keepAlive);
-            if ('message' in event) {
-                onError(event['message']);
-            }
-            else {
-                onError(event.toString());
-            }
-            this.channels.delete(channel);
+            this.log.debug('Message channel encountered an error');
+            this.log.debug(event);
         });
         channel.addEventListener('message', (event) => {
+            this.log.trace('Message channel received a message');
+            this.log.trace(event);
             if ('origin' in event && event['origin'] !== endpoint) {
                 onError('Unexpected origin');
             }
@@ -150,6 +192,7 @@ class AuthSession {
         return channel;
     }
     closeAllMessageChannels() {
+        this.log.trace('Closing all message channels, total ' + this.channels.size + ' registered channels');
         const channelsCopy = new Set(this.channels);
         channelsCopy.forEach((channel) => channel.close());
         channelsCopy.clear();
@@ -190,6 +233,63 @@ class AuthSession {
             });
         });
     }
+    embedDarwiniumResultToDeviceRegistration(registration) {
+        return new Promise((resolve) => {
+            const notAvaialbleErrMsg = 'Darwinium data is not avaialble';
+            if (this.shouldSendDarwiniumData()) {
+                const dResult = this.settings.darwiniumResult;
+                if (dResult) {
+                    if (!dResult.isExpired()) {
+                        if (dResult.getResultBlob()) {
+                            registration.setDarwiniumSignal({ results: dResult.getResultBlob() });
+                        }
+                        else {
+                            if (dResult.getError()) {
+                                registration.setDarwiniumSignal({ error: dResult.getError() });
+                            }
+                            else {
+                                registration.setDarwiniumSignal({ error: notAvaialbleErrMsg });
+                            }
+                        }
+                    }
+                    else {
+                        registration.setDarwiniumSignal({ error: 'Darwinium data is expired' });
+                    }
+                }
+                else {
+                    registration.setDarwiniumSignal({ error: notAvaialbleErrMsg });
+                }
+            }
+            resolve(registration);
+        });
+    }
+    embedDarwiniumSignal(signals) {
+        const notAvaialbleErrMsg = 'Darwinium data is not avaialble';
+        if (this.shouldSendDarwiniumData()) {
+            const dResult = this.settings.darwiniumResult;
+            if (dResult) {
+                if (!dResult.isExpired()) {
+                    if (dResult.getResultBlob()) {
+                        signals.darwinium = { results: dResult.getResultBlob() };
+                    }
+                    else {
+                        if (dResult.getError()) {
+                            signals.darwinium = { error: dResult.getError() };
+                        }
+                        else {
+                            signals.darwinium = { error: notAvaialbleErrMsg };
+                        }
+                    }
+                }
+                else {
+                    signals.darwinium = { error: 'Darwinium data is expired' };
+                }
+            }
+            else {
+                signals.darwinium = { error: notAvaialbleErrMsg };
+            }
+        }
+    }
     getFingerprintData() {
         return new Promise((resolve) => {
             var fpPromise = this.platform.getFpPromise();
@@ -231,6 +331,10 @@ class AuthSession {
         }
         return false;
     }
+    shouldSendDarwiniumData() {
+        var _a, _b, _c;
+        return ((_c = (_b = (_a = this.claims) === null || _a === void 0 ? void 0 : _a.auth.subs.dev) === null || _b === void 0 ? void 0 : _b.sgnls) === null || _c === void 0 ? void 0 : _c.dwn) ? true : false;
+    }
     parseJwt(token) {
         return JSON.parse(atob(token.split('.')[1]));
     }

package/build/lib/proveauth/internal/auth-status-actions.js

@@ -14,13 +14,12 @@ class AuthStatusActions {
         var gotResponse = false;
         this.log.trace('Waiting for auth status');
         return new Promise((resolve, reject) => {
-            const channel = session.createMessageChannel('/v1/client/status?token=' + encodeURIComponent(session.authToken), () => {
+            const channel = session.createMessageChannel('/v1/client/status?token=' + encodeURIComponent(session.authToken), (reason, code) => {
                 if (!gotResponse) {
-                    reject(new auth_error_1.default('Failed to receive secondary authentication status, no response'));
+                    reject(new auth_error_1.default(`Failed to receive secondary authentication with status code ${code}. ${reason}`));
                 }
             }, (errorMessage) => {
                 gotResponse = true;
-                this.log.error('Failed: ' + errorMessage);
                 reject(new auth_error_1.default('Failed to receive secondary authentication status: ' + errorMessage));
             }, (data) => {
                 gotResponse = true;
@@ -28,7 +27,7 @@ class AuthStatusActions {
                     this.log.debug(('Secondary authentication status: ' + data));
                     const response = JSON.parse(data);
                     if (response.error) {
-                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
                         session.lastStep = response.next;
@@ -39,6 +38,7 @@ class AuthStatusActions {
                     reject(e);
                 }
                 finally {
+                    this.log.trace('Closing channel');
                     channel.close();
                 }
             });

package/build/lib/proveauth/internal/auth-token-claims.d.ts

@@ -29,6 +29,7 @@ export interface Authenticators {
 }
 export interface Signals {
     fpt?: boolean;
+    dwn?: boolean;
 }
 export interface DeviceAuthSubjectClaim {
     auths: Authenticators;

package/build/lib/proveauth/internal/device-auth.d.ts

@@ -10,11 +10,13 @@ export interface DeviceRegistration {
     readonly endpoint: string;
     deviceId: string | null;
     fingerprint?: Signal;
+    darwinium?: Signal;
     sign: (data: string) => Promise<string>;
     getPublicKey: () => Promise<string>;
     getAuthRegistration: (challenge: string) => Promise<AuthRegistration>;
     setFpSignal: (fpSignal: Signal) => void;
-    getSignals: () => Signals | undefined;
+    setDarwiniumSignal: (dSignal: Signal) => void;
+    getSignals: () => Signals;
 }
 export default interface DeviceAuth {
     createRegistration: (options: DeviceRegistrationOptions) => Promise<DeviceRegistration>;

package/build/lib/proveauth/internal/device-passive-register-step.d.ts

@@ -5,6 +5,7 @@ export default class DevicePassiveRegisterStep implements AuthStep {
     private readonly log;
     readonly name = "device/passive/register";
     execute(session: AuthSession): Promise<string>;
+    static hasAssertionResponse(session: AuthSession): boolean;
     private finishRegistration;
     private getFido2Registration;
 }

package/build/lib/proveauth/internal/device-passive-register-step.js

@@ -7,6 +7,7 @@ const base64_1 = __importDefault(require("../common/base64"));
 const logger_1 = require("../common/logger");
 const auth_error_1 = __importDefault(require("./auth-error"));
 const error_code_1 = __importDefault(require("./error-code"));
+const device_passive_verify_step_1 = __importDefault(require("./device-passive-verify-step"));
 class DevicePassiveRegisterStep {
     constructor() {
         this.log = logger_1.LoggerFactory.getLogger('device-passive-register-step');
@@ -14,42 +15,56 @@ class DevicePassiveRegisterStep {
     }
     execute(session) {
         return new Promise((resolve, reject) => {
-            session
-                .getDeviceRegistration()
-                .then((devRegistration) => {
-                if (devRegistration) {
-                    session.embedFpResultToDeviceRegistration(devRegistration).then((devRegistration) => {
-                        this.finishRegistration(session, [this.getFido2Registration(session)], devRegistration.getSignals())
-                            .then(resolve)
-                            .catch(reject);
-                    });
-                }
-                else {
-                    session.platform.deviceAuth
-                        .createRegistration({
-                        namespace: session.namespace,
-                        endpoint: session.backendOrigin,
-                    })
-                        .then((devRegistration) => session.embedFpResultToDeviceRegistration(devRegistration))
-                        .then((devRegistration) => {
-                        devRegistration
-                            .getAuthRegistration(session.challenge)
-                            .then((authRegistration) => this.finishRegistration(session, [this.getFido2Registration(session), authRegistration], devRegistration.getSignals()))
-                            .then((next) => {
-                            devRegistration.deviceId = session.settings.deviceId;
-                            session.platform.deviceAuth
-                                .storeRegistration(devRegistration)
-                                .then(() => resolve(next))
+            if (DevicePassiveRegisterStep.hasAssertionResponse(session)) {
+                device_passive_verify_step_1.default.runFidoVerify(this.log, session).then(resolve).catch(reject);
+            }
+            else {
+                session
+                    .getDeviceRegistration()
+                    .then((devRegistration) => {
+                    if (devRegistration) {
+                        session
+                            .embedFpResultToDeviceRegistration(devRegistration)
+                            .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => {
+                            this.finishRegistration(session, [this.getFido2Registration(session)], devRegistration.getSignals())
+                                .then(resolve)
+                                .catch(reject);
+                        });
+                    }
+                    else {
+                        session.platform.deviceAuth
+                            .createRegistration({
+                            namespace: session.namespace,
+                            endpoint: session.backendOrigin,
+                        })
+                            .then((devRegistration) => session.embedFpResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => {
+                            devRegistration
+                                .getAuthRegistration(session.challenge)
+                                .then((authRegistration) => this.finishRegistration(session, [this.getFido2Registration(session), authRegistration], devRegistration.getSignals()))
+                                .then((next) => {
+                                devRegistration.deviceId = session.settings.deviceId;
+                                session.platform.deviceAuth
+                                    .storeRegistration(devRegistration)
+                                    .then(() => resolve(next))
+                                    .catch(reject);
+                            })
                                 .catch(reject);
                         })
                             .catch(reject);
-                    })
-                        .catch(reject);
-                }
-            })
-                .catch(reject);
+                    }
+                })
+                    .catch(reject);
+            }
         });
     }
+    static hasAssertionResponse(session) {
+        const credential = session.credential;
+        const assertion = credential.response;
+        return assertion && 'authenticatorData' in assertion && 'signature' in assertion;
+    }
     finishRegistration(session, registrations, signals) {
         return new Promise((resolve, reject) => {
             session
@@ -61,13 +76,18 @@ class DevicePassiveRegisterStep {
             })
                 .then((response) => {
                 if (response.error) {
-                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                 }
                 else {
                     const data = response.data;
-                    if (data && data.deviceId) {
-                        session.settings.deviceId = data.deviceId;
-                        session.settings.fidoPasskeyRegistered = true;
+                    if (data) {
+                        if (data.deviceId) {
+                            session.settings.deviceId = data.deviceId;
+                            session.settings.fidoPasskeyRegistered = true;
+                        }
+                        if (data.scanMessage) {
+                            session.authMessage = data.scanMessage;
+                        }
                         resolve(response.next);
                     }
                     else {

package/build/lib/proveauth/internal/device-passive-silent-step.js

@@ -21,7 +21,10 @@ class DevicePassiveSilentStep {
                 .getDeviceRegistration()
                 .then((registration) => {
                 if (registration) {
-                    session.embedFpResultToDeviceRegistration(registration).then((registration) => {
+                    session
+                        .embedFpResultToDeviceRegistration(registration)
+                        .then((registration) => session.embedDarwiniumResultToDeviceRegistration(registration))
+                        .then((registration) => {
                         this.verify(session, registration).then(resolve).catch(reject);
                     });
                 }
@@ -36,6 +39,7 @@ class DevicePassiveSilentStep {
                                 endpoint: session.backendOrigin,
                             })
                                 .then((registration) => session.embedFpResultToDeviceRegistration(registration))
+                                .then((registration) => session.embedDarwiniumResultToDeviceRegistration(registration))
                                 .then((registration) => this.register(session, registration))
                                 .then(resolve)
                                 .catch(reject);
@@ -83,6 +87,10 @@ class DevicePassiveSilentStep {
                         session.settings.fidoPasskeyRegistered = deviceRegisterAuthResp.data.passkey;
                         registration.deviceId = deviceId;
                         this.log.debug('Device ID: ' + deviceId);
+                        const data = response.data;
+                        if (data && data.scanMessage) {
+                            session.authMessage = data.scanMessage;
+                        }
                         session.platform.deviceAuth
                             .storeRegistration(registration)
                             .then(() => resolve(response.next))

package/build/lib/proveauth/internal/device-passive-step.d.ts

@@ -1,18 +1,26 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
-import { DeviceRole } from '../authenticator-builder';
+import { DeviceRole, PasskeyAlreadyExistCallback } from '../authenticator-builder';
 import { AuthStatusActions } from './auth-status-actions';
+import { Signals } from './auth-request';
 export declare class DevicePassiveActions extends AuthStatusActions {
     protected log: import("../common/logger").Logger;
     private readonly getDisplayName;
-    protected constructor(getDisplayName?: () => string | null);
-    protected register(session: AuthSession): Promise<string>;
+    private handler?;
+    static readonly NO_REQUEST_CREDS_FOUND = "Passkey has already been registered but found no CredentialRequestOptions in the fido/register/start response payload";
+    static readonly NO_CREDS_FOUND = "Neither credCreateOptions nor credRequestOptions are found in the fido/register/start response payload";
+    static readonly USER_NOT_ACCEPTING_RESPONSE = "User not accepting to continue by reusing the existing passkey with user response";
+    protected constructor(getDisplayName?: () => string | null, handler?: PasskeyAlreadyExistCallback);
+    protected register(session: AuthSession, signals?: Signals): Promise<string>;
     protected verify(session: AuthSession): Promise<string>;
+    private createCredentials;
+    private parseCredRequestOptions;
+    private getCredentials;
 }
 export default class DevicePassiveStep extends DevicePassiveActions implements AuthStep {
     static readonly NAME = "device/passive";
     readonly name = "device/passive";
     private readonly role;
-    constructor(getDisplayName?: () => string | null, role?: DeviceRole);
+    constructor(getDisplayName?: () => string | null, handler?: PasskeyAlreadyExistCallback, role?: DeviceRole);
     execute(session: AuthSession): Promise<string>;
 }