@prove-identity/prove-auth 2.8.2 → 2.9.0

package/build/lib/proveauth/internal/auth-response.d.ts

@@ -9,7 +9,8 @@ export interface AuthFailure {
     code: number;
 }
 export interface RegisterStartAuthResponseData {
-    credCreateOptions: PublicKeyCredentialCreationOptions;
+    credCreateOptions?: PublicKeyCredentialCreationOptions;
+    credRequestOptions?: PublicKeyCredentialRequestOptions;
 }
 export interface RegisterStartAuthResponse extends AuthResponse {
     data: RegisterStartAuthResponseData;
@@ -17,6 +18,7 @@ export interface RegisterStartAuthResponse extends AuthResponse {
 export interface RegisterFinishAuthResponseData {
     deviceId: string;
     passkey: boolean;
+    scanMessage?: AuthMessage;
 }
 export interface RegisterFinishAuthResponse extends AuthResponse {
     data: RegisterFinishAuthResponseData;
@@ -30,6 +32,8 @@ export interface VerifyStartAuthResponse extends AuthResponse {
 }
 export interface VerifyFinishAuthResponseData {
     scanMessage?: AuthMessage;
+    deviceId?: string;
+    passkey?: boolean;
 }
 export interface VerifyFinishAuthResponse extends AuthResponse {
     data?: VerifyFinishAuthResponseData;

package/build/lib/proveauth/internal/auth-session.d.ts

@@ -6,6 +6,7 @@ import AuthTokenClaims, { UserVerificationLevel } from './auth-token-claims';
 import { DeviceRegistration } from './device-auth';
 import Platform, { AuthSessionIntegration, MessageChannel, RequestSigner } from './platform';
 import Settings from './settings';
+import { WebSocketCloseReasons } from './web-socket-close-reasons';
 export default class AuthSession implements AuthSessionIntegration {
     readonly platform: Platform;
     readonly authToken?: string;
@@ -26,7 +27,8 @@ export default class AuthSession implements AuthSessionIntegration {
     get next(): string;
     constructor(settings: Settings, platform: Platform, authToken?: string);
     fetchFromBackend(query: string, body: AuthRequest): Promise<AuthResponse>;
-    createMessageChannel(query: string, onClose: () => void, onError: (message: string) => void, onMessage: (data: string) => void): MessageChannel;
+    static parseCloseEvent(event: CloseEvent): [WebSocketCloseReasons, number];
+    createMessageChannel(query: string, onClose: (reason: WebSocketCloseReasons, code: number) => void, onError: (message: string) => void, onMessage: (data: string) => void): MessageChannel;
     closeAllMessageChannels(): void;
     getDeviceRegistration(): Promise<DeviceRegistration | null>;
     embedFpResultToDeviceRegistration(registration: DeviceRegistration): Promise<DeviceRegistration>;

package/build/lib/proveauth/internal/auth-session.js

@@ -5,9 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("../common/logger");
 const version_1 = require("../version");
-const auth_error_1 = __importDefault(require("./auth-error"));
 const auth_token_claims_1 = require("./auth-token-claims");
 const error_code_1 = __importDefault(require("./error-code"));
+const web_socket_close_reasons_1 = require("./web-socket-close-reasons");
 class AuthSession {
     get namespace() {
         var _a;
@@ -91,6 +91,48 @@ class AuthSession {
                 .catch(reject);
         });
     }
+    static parseCloseEvent(event) {
+        var reason = web_socket_close_reasons_1.WebSocketCloseReasons.UNKNOWN_REASON;
+        switch (event.code) {
+            case 1000:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.NORMAL_CLOSURE;
+                break;
+            case 1001:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.GOING_AWAY;
+                break;
+            case 1002:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.PROTOCOL_ERROR;
+                break;
+            case 1003:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.UNSUPPORTED_DATA;
+                break;
+            case 1005:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.NO_STATUS_RECEIVED;
+                break;
+            case 1006:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.ABNORMAL_CLOSURE;
+                break;
+            case 1007:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.INVALID_FRAME_PAYLOAD_DATA;
+                break;
+            case 1008:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.POLICY_VIOLATION;
+                break;
+            case 1009:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.MESSAGE_TOO_BIG;
+                break;
+            case 1010:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.MANDATORY_EXTENSION;
+                break;
+            case 1011:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.INTERNAL_ERROR;
+                break;
+            case 1015:
+                reason = web_socket_close_reasons_1.WebSocketCloseReasons.TLS_HANDSHAKE;
+                break;
+        }
+        return [reason, event.code];
+    }
     createMessageChannel(query, onClose, onError, onMessage) {
         if (!this.authToken) {
             throw new Error('Authentication token is not initialized, cannot create MessageChannel');
@@ -113,18 +155,17 @@ class AuthSession {
                 this.channels.delete(channel);
             }
         }, KEEP_ALIVE_INTERVAL);
-        channel.addEventListener('close', (_) => {
-            this.log.debug('Message channel is closed');
+        channel.addEventListener('close', (event) => {
+            var statusCode = event.code ? `with status code: ${event.code}` : 'without status code';
+            this.log.debug(`Message channel is closed ${statusCode}`);
             clearInterval(keepAlive);
-            onClose();
             this.channels.delete(channel);
+            const [reason, code] = AuthSession.parseCloseEvent(event);
+            onClose(reason, code);
         });
         channel.addEventListener('error', (event) => {
-            this.log.trace('Message channel encountered an error');
-            this.log.trace(event);
-            clearInterval(keepAlive);
-            onError(auth_error_1.default.extractMessage(event));
-            this.channels.delete(channel);
+            this.log.debug('Message channel encountered an error');
+            this.log.debug(event);
         });
         channel.addEventListener('message', (event) => {
             this.log.trace('Message channel received a message');

package/build/lib/proveauth/internal/auth-status-actions.js

@@ -14,9 +14,9 @@ class AuthStatusActions {
         var gotResponse = false;
         this.log.trace('Waiting for auth status');
         return new Promise((resolve, reject) => {
-            const channel = session.createMessageChannel('/v1/client/status?token=' + encodeURIComponent(session.authToken), () => {
+            const channel = session.createMessageChannel('/v1/client/status?token=' + encodeURIComponent(session.authToken), (reason, code) => {
                 if (!gotResponse) {
-                    reject(new auth_error_1.default('Failed to receive secondary authentication status, no response'));
+                    reject(new auth_error_1.default(`Failed to receive secondary authentication with status code ${code}. ${reason}`));
                 }
             }, (errorMessage) => {
                 gotResponse = true;
@@ -27,7 +27,7 @@ class AuthStatusActions {
                     this.log.debug(('Secondary authentication status: ' + data));
                     const response = JSON.parse(data);
                     if (response.error) {
-                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
                         session.lastStep = response.next;

package/build/lib/proveauth/internal/device-passive-register-step.d.ts

@@ -5,6 +5,7 @@ export default class DevicePassiveRegisterStep implements AuthStep {
     private readonly log;
     readonly name = "device/passive/register";
     execute(session: AuthSession): Promise<string>;
+    static hasAssertionResponse(session: AuthSession): boolean;
     private finishRegistration;
     private getFido2Registration;
 }

package/build/lib/proveauth/internal/device-passive-register-step.js

@@ -7,6 +7,7 @@ const base64_1 = __importDefault(require("../common/base64"));
 const logger_1 = require("../common/logger");
 const auth_error_1 = __importDefault(require("./auth-error"));
 const error_code_1 = __importDefault(require("./error-code"));
+const device_passive_verify_step_1 = __importDefault(require("./device-passive-verify-step"));
 class DevicePassiveRegisterStep {
     constructor() {
         this.log = logger_1.LoggerFactory.getLogger('device-passive-register-step');
@@ -14,46 +15,56 @@ class DevicePassiveRegisterStep {
     }
     execute(session) {
         return new Promise((resolve, reject) => {
-            session
-                .getDeviceRegistration()
-                .then((devRegistration) => {
-                if (devRegistration) {
-                    session
-                        .embedFpResultToDeviceRegistration(devRegistration)
-                        .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
-                        .then((devRegistration) => {
-                        this.finishRegistration(session, [this.getFido2Registration(session)], devRegistration.getSignals())
-                            .then(resolve)
-                            .catch(reject);
-                    });
-                }
-                else {
-                    session.platform.deviceAuth
-                        .createRegistration({
-                        namespace: session.namespace,
-                        endpoint: session.backendOrigin,
-                    })
-                        .then((devRegistration) => session.embedFpResultToDeviceRegistration(devRegistration))
-                        .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
-                        .then((devRegistration) => {
-                        devRegistration
-                            .getAuthRegistration(session.challenge)
-                            .then((authRegistration) => this.finishRegistration(session, [this.getFido2Registration(session), authRegistration], devRegistration.getSignals()))
-                            .then((next) => {
-                            devRegistration.deviceId = session.settings.deviceId;
-                            session.platform.deviceAuth
-                                .storeRegistration(devRegistration)
-                                .then(() => resolve(next))
+            if (DevicePassiveRegisterStep.hasAssertionResponse(session)) {
+                device_passive_verify_step_1.default.runFidoVerify(this.log, session).then(resolve).catch(reject);
+            }
+            else {
+                session
+                    .getDeviceRegistration()
+                    .then((devRegistration) => {
+                    if (devRegistration) {
+                        session
+                            .embedFpResultToDeviceRegistration(devRegistration)
+                            .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => {
+                            this.finishRegistration(session, [this.getFido2Registration(session)], devRegistration.getSignals())
+                                .then(resolve)
+                                .catch(reject);
+                        });
+                    }
+                    else {
+                        session.platform.deviceAuth
+                            .createRegistration({
+                            namespace: session.namespace,
+                            endpoint: session.backendOrigin,
+                        })
+                            .then((devRegistration) => session.embedFpResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => session.embedDarwiniumResultToDeviceRegistration(devRegistration))
+                            .then((devRegistration) => {
+                            devRegistration
+                                .getAuthRegistration(session.challenge)
+                                .then((authRegistration) => this.finishRegistration(session, [this.getFido2Registration(session), authRegistration], devRegistration.getSignals()))
+                                .then((next) => {
+                                devRegistration.deviceId = session.settings.deviceId;
+                                session.platform.deviceAuth
+                                    .storeRegistration(devRegistration)
+                                    .then(() => resolve(next))
+                                    .catch(reject);
+                            })
                                 .catch(reject);
                         })
                             .catch(reject);
-                    })
-                        .catch(reject);
-                }
-            })
-                .catch(reject);
+                    }
+                })
+                    .catch(reject);
+            }
         });
     }
+    static hasAssertionResponse(session) {
+        const credential = session.credential;
+        const assertion = credential.response;
+        return assertion && 'authenticatorData' in assertion && 'signature' in assertion;
+    }
     finishRegistration(session, registrations, signals) {
         return new Promise((resolve, reject) => {
             session
@@ -65,13 +76,18 @@ class DevicePassiveRegisterStep {
             })
                 .then((response) => {
                 if (response.error) {
-                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                 }
                 else {
                     const data = response.data;
-                    if (data && data.deviceId) {
-                        session.settings.deviceId = data.deviceId;
-                        session.settings.fidoPasskeyRegistered = true;
+                    if (data) {
+                        if (data.deviceId) {
+                            session.settings.deviceId = data.deviceId;
+                            session.settings.fidoPasskeyRegistered = true;
+                        }
+                        if (data.scanMessage) {
+                            session.authMessage = data.scanMessage;
+                        }
                         resolve(response.next);
                     }
                     else {

package/build/lib/proveauth/internal/device-passive-silent-step.js

@@ -87,6 +87,10 @@ class DevicePassiveSilentStep {
                         session.settings.fidoPasskeyRegistered = deviceRegisterAuthResp.data.passkey;
                         registration.deviceId = deviceId;
                         this.log.debug('Device ID: ' + deviceId);
+                        const data = response.data;
+                        if (data && data.scanMessage) {
+                            session.authMessage = data.scanMessage;
+                        }
                         session.platform.deviceAuth
                             .storeRegistration(registration)
                             .then(() => resolve(response.next))

package/build/lib/proveauth/internal/device-passive-step.d.ts

@@ -1,18 +1,26 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
-import { DeviceRole } from '../authenticator-builder';
+import { DeviceRole, PasskeyAlreadyExistCallback } from '../authenticator-builder';
 import { AuthStatusActions } from './auth-status-actions';
+import { Signals } from './auth-request';
 export declare class DevicePassiveActions extends AuthStatusActions {
     protected log: import("../common/logger").Logger;
     private readonly getDisplayName;
-    protected constructor(getDisplayName?: () => string | null);
-    protected register(session: AuthSession): Promise<string>;
+    private handler?;
+    static readonly NO_REQUEST_CREDS_FOUND = "Passkey has already been registered but found no CredentialRequestOptions in the fido/register/start response payload";
+    static readonly NO_CREDS_FOUND = "Neither credCreateOptions nor credRequestOptions are found in the fido/register/start response payload";
+    static readonly USER_NOT_ACCEPTING_RESPONSE = "User not accepting to continue by reusing the existing passkey with user response";
+    protected constructor(getDisplayName?: () => string | null, handler?: PasskeyAlreadyExistCallback);
+    protected register(session: AuthSession, signals?: Signals): Promise<string>;
     protected verify(session: AuthSession): Promise<string>;
+    private createCredentials;
+    private parseCredRequestOptions;
+    private getCredentials;
 }
 export default class DevicePassiveStep extends DevicePassiveActions implements AuthStep {
     static readonly NAME = "device/passive";
     readonly name = "device/passive";
     private readonly role;
-    constructor(getDisplayName?: () => string | null, role?: DeviceRole);
+    constructor(getDisplayName?: () => string | null, handler?: PasskeyAlreadyExistCallback, role?: DeviceRole);
     execute(session: AuthSession): Promise<string>;
 }

package/build/lib/proveauth/internal/device-passive-step.js

@@ -11,57 +11,51 @@ const auth_token_claims_1 = require("./auth-token-claims");
 const auth_error_1 = __importDefault(require("./auth-error"));
 const authenticator_builder_1 = require("../authenticator-builder");
 const auth_status_actions_1 = require("./auth-status-actions");
+const fido_options_error_1 = require("./fido-options-error");
+const auth_response_status_1 = require("./auth-response-status");
 class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
-    constructor(getDisplayName) {
+    constructor(getDisplayName, handler) {
         super();
         this.log = logger_1.LoggerFactory.getLogger('device-passive-actions');
         this.getDisplayName = getDisplayName ? getDisplayName : () => null;
+        this.handler = handler;
     }
-    register(session) {
-        this.log.trace('Registering');
+    register(session, signals) {
+        this.log.trace('Registering Passkey');
         return new Promise((resolve, reject) => {
             const displayName = this.getDisplayName();
             session
                 .fetchFromBackend('/v1/client/device/fido2/register/start', {
                 displayName: displayName ? displayName : undefined,
+                signals: signals,
             })
                 .then((response) => {
+                var _a, _b;
                 if (response.error) {
-                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                 }
                 else {
-                    let options = response.data.credCreateOptions;
-                    options.challenge = base64_1.default.bufferDecode(options.challenge);
-                    options.user.id = base64_1.default.bufferDecode(options.user.id);
-                    if (displayName) {
-                        options.user.displayName = displayName;
+                    const creationOptions = (_a = response.data) === null || _a === void 0 ? void 0 : _a.credCreateOptions;
+                    const requestOptions = (_b = response.data) === null || _b === void 0 ? void 0 : _b.credRequestOptions;
+                    if (creationOptions) {
+                        this.createCredentials(session, displayName, creationOptions, response)
+                            .then(resolve)
+                            .catch(reject);
+                    }
+                    else if (requestOptions) {
+                        this.getCredentials(session, requestOptions, response).then(resolve).catch(reject);
                     }
-                    if (options.excludeCredentials) {
-                        options.excludeCredentials.forEach((i) => {
-                            i.id = base64_1.default.bufferDecode(i.id);
-                        });
+                    else {
+                        const error = new auth_error_1.default(DevicePassiveActions.NO_CREDS_FOUND);
+                        reject(error);
                     }
-                    session.platform.webauthn
-                        .createCredentials({
-                        publicKey: options,
-                    })
-                        .then((credential) => {
-                        if (!credential) {
-                            reject(new auth_error_1.default('Failed to create FIDO2 credentials'));
-                        }
-                        else {
-                            session.credential = credential;
-                            resolve(response.next);
-                        }
-                    })
-                        .catch(reject);
                 }
             })
                 .catch(reject);
         });
     }
     verify(session) {
-        this.log.trace('Verifying');
+        this.log.trace('Verifying Passkey');
         return new Promise((resolve, reject) => {
             if (session.settings.deviceId) {
                 session
@@ -69,46 +63,150 @@ class DevicePassiveActions extends auth_status_actions_1.AuthStatusActions {
                     deviceId: session.settings.deviceId,
                 })
                     .then((response) => {
-                    var _a;
                     if (response.error) {
-                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
-                        let options = response.data.credRequestOptions;
-                        options.challenge = base64_1.default.bufferDecode(options.challenge);
-                        if (options.allowCredentials) {
-                            (_a = options.allowCredentials) === null || _a === void 0 ? void 0 : _a.forEach((i) => {
-                                i.id = base64_1.default.bufferDecode(i.id);
-                            });
-                        }
-                        session.platform.webauthn
-                            .getCredentials({
-                            publicKey: options,
-                        })
-                            .then((credential) => {
-                            if (!credential) {
-                                reject(new Error('Failed to load FIDO2 credentials'));
+                        const options = response.data.credRequestOptions;
+                        this.getCredentials(session, options, response).then(resolve).catch(reject);
+                    }
+                })
+                    .catch(reject);
+            }
+            else {
+                reject(new auth_error_1.default('Failed to start verification, DeviceId is missing'));
+            }
+        });
+    }
+    createCredentials(session, displayName, options, response) {
+        this.log.trace('Trying create new FIDO credentials');
+        return new Promise((resolve, reject) => {
+            options.challenge = base64_1.default.bufferDecode(options.challenge);
+            options.user.id = base64_1.default.bufferDecode(options.user.id);
+            if (displayName) {
+                options.user.displayName = displayName;
+            }
+            if (options.excludeCredentials) {
+                options.excludeCredentials.forEach((i) => {
+                    i.id = base64_1.default.bufferDecode(i.id);
+                });
+            }
+            if (options.authenticatorSelection) {
+                options.authenticatorSelection.residentKey = 'preferred';
+                options.authenticatorSelection.requireResidentKey = false;
+            }
+            else {
+                options.authenticatorSelection = {
+                    residentKey: 'preferred',
+                    requireResidentKey: false,
+                };
+            }
+            const fidoCreationOptions = {
+                publicKey: options,
+            };
+            session.platform.webauthn
+                .createCredentials(fidoCreationOptions)
+                .then((credential) => {
+                if (!credential) {
+                    reject(new auth_error_1.default('Failed to create FIDO2 credentials'));
+                }
+                else {
+                    session.credential = credential;
+                    resolve(response.next);
+                }
+            })
+                .catch((error) => {
+                const fidoCreationError = fido_options_error_1.FidoOptionsError.identifyRegistrationError({
+                    error: error,
+                    options: fidoCreationOptions,
+                    platform: session.platform,
+                });
+                if (fidoCreationError instanceof fido_options_error_1.FidoOptionsError &&
+                    fidoCreationError.name === 'InvalidStateError') {
+                    if (this.handler) {
+                        this.log.trace('Passkey handler callback has been defined');
+                        this.handler()
+                            .then((userResponse) => {
+                            if (userResponse === auth_response_status_1.AuthResponseStatus.Accept) {
+                                this.parseCredRequestOptions(response, session).then(resolve).catch(reject);
                             }
                             else {
-                                session.credential = credential;
-                                resolve(response.next);
+                                reject(new auth_error_1.default(`${DevicePassiveActions.USER_NOT_ACCEPTING_RESPONSE}: ${userResponse}`));
+                                return;
                             }
                         })
                             .catch(reject);
                     }
-                })
-                    .catch(reject);
+                    else {
+                        this.log.trace('Passkey handler callback is null, go ahead with passkey discoverable as default behavior');
+                        this.parseCredRequestOptions(response, session).then(resolve).catch(reject);
+                    }
+                }
+                else {
+                    reject(fidoCreationError);
+                }
+            });
+        });
+    }
+    parseCredRequestOptions(response, session) {
+        return new Promise((resolve, reject) => {
+            const data = response.data;
+            if (data.credRequestOptions) {
+                const requestOptions = data.credRequestOptions;
+                this.getCredentials(session, requestOptions, response).then(resolve).catch(reject);
             }
             else {
-                reject(new auth_error_1.default('Failed to start verification, DeviceId is missing'));
+                reject(new auth_error_1.default(DevicePassiveActions.NO_REQUEST_CREDS_FOUND));
+            }
+        });
+    }
+    getCredentials(session, options, response) {
+        this.log.trace('Trying get existing FIDO credentials');
+        return new Promise((resolve, reject) => {
+            var _a, _b;
+            if (((_a = options.allowCredentials) === null || _a === void 0 ? void 0 : _a.length) == 0) {
+                reject(new auth_error_1.default('AllowCredentials array should not be empty when call getCredentials()'));
+            }
+            else {
+                options.challenge = base64_1.default.bufferDecode(options.challenge);
+                if (options.allowCredentials) {
+                    (_b = options.allowCredentials) === null || _b === void 0 ? void 0 : _b.forEach((i) => {
+                        i.id = base64_1.default.bufferDecode(i.id);
+                    });
+                }
+                const fidoRequestOptions = {
+                    publicKey: options,
+                };
+                session.platform.webauthn
+                    .getCredentials(fidoRequestOptions)
+                    .then((credential) => {
+                    if (!credential) {
+                        reject(new auth_error_1.default('Failed to load FIDO2 credentials'));
+                    }
+                    else {
+                        session.credential = credential;
+                        resolve(response.next);
+                    }
+                })
+                    .catch((error) => {
+                    const fidoAuthenticationError = fido_options_error_1.FidoOptionsError.identifyAuthenticationError({
+                        error: error,
+                        options: fidoRequestOptions,
+                        platform: session.platform,
+                    });
+                    reject(fidoAuthenticationError);
+                });
             }
         });
     }
 }
+DevicePassiveActions.NO_REQUEST_CREDS_FOUND = 'Passkey has already been registered but found no CredentialRequestOptions in the fido/register/start response payload';
+DevicePassiveActions.NO_CREDS_FOUND = 'Neither credCreateOptions nor credRequestOptions are found in the fido/register/start response payload';
+DevicePassiveActions.USER_NOT_ACCEPTING_RESPONSE = 'User not accepting to continue by reusing the existing passkey with user response';
 exports.DevicePassiveActions = DevicePassiveActions;
 class DevicePassiveStep extends DevicePassiveActions {
-    constructor(getDisplayName, role) {
-        super(getDisplayName);
+    constructor(getDisplayName, handler, role) {
+        super(getDisplayName, handler);
         this.name = DevicePassiveStep.NAME;
         this.role = role !== null && role !== void 0 ? role : authenticator_builder_1.DeviceRole.Primary;
         this.log = logger_1.LoggerFactory.getLogger('device-passive-step');
@@ -127,7 +225,29 @@ class DevicePassiveStep extends DevicePassiveActions {
             }
             return Promise.resolve(device_passive_silent_step_1.default.NAME);
         }
-        return this.register(session);
+        return new Promise((resolve, reject) => {
+            session
+                .getFingerprintData()
+                .then((signal) => {
+                const signals = {
+                    fingerprint: signal,
+                };
+                session.embedDarwiniumSignal(signals);
+                this.register(session, signals).then(resolve).catch(reject);
+            })
+                .catch((error) => {
+                const errorMsg = `Unexpected error happened during Fingerprint data collection: ${error.message}`;
+                this.log.warn(errorMsg);
+                this.log.warn(error);
+                const signals = {
+                    fingerprint: {
+                        error: errorMsg,
+                    },
+                };
+                session.embedDarwiniumSignal(signals);
+                this.register(session, signals).then(resolve).catch(reject);
+            });
+        });
     }
 }
 DevicePassiveStep.NAME = 'device/passive';

package/build/lib/proveauth/internal/device-passive-stepup-step.d.ts

@@ -1,9 +1,10 @@
+import { PasskeyAlreadyExistCallback } from '../authenticator-builder';
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
 import { DevicePassiveActions } from './device-passive-step';
 export default class DevicePassiveStepupStep extends DevicePassiveActions implements AuthStep {
     static readonly NAME = "device/passive/stepup";
     readonly name = "device/passive/stepup";
-    constructor(getDisplayName?: () => string | null);
+    constructor(getDisplayName?: () => string | null, handler?: PasskeyAlreadyExistCallback);
     execute(session: AuthSession): Promise<string>;
 }