@simplewebauthn/server 12.0.0 → 13.0.0-alpha1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (161) hide show
  1. package/README.md +2 -2
  2. package/esm/authentication/generateAuthenticationOptions.d.ts +13 -13
  3. package/esm/authentication/generateAuthenticationOptions.d.ts.map +1 -1
  4. package/esm/authentication/verifyAuthenticationResponse.d.ts +18 -15
  5. package/esm/authentication/verifyAuthenticationResponse.d.ts.map +1 -1
  6. package/esm/helpers/convertCertBufferToPEM.d.ts +1 -1
  7. package/esm/helpers/convertCertBufferToPEM.d.ts.map +1 -1
  8. package/esm/helpers/cose.d.ts +22 -0
  9. package/esm/helpers/cose.d.ts.map +1 -1
  10. package/esm/helpers/cose.js +20 -0
  11. package/esm/helpers/decodeAttestationObject.d.ts +4 -0
  12. package/esm/helpers/decodeAttestationObject.d.ts.map +1 -1
  13. package/esm/helpers/decodeAttestationObject.js +4 -1
  14. package/esm/helpers/decodeClientDataJSON.d.ts +5 -1
  15. package/esm/helpers/decodeClientDataJSON.d.ts.map +1 -1
  16. package/esm/helpers/decodeClientDataJSON.js +4 -1
  17. package/esm/helpers/decodeCredentialPublicKey.d.ts +4 -0
  18. package/esm/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
  19. package/esm/helpers/decodeCredentialPublicKey.js +4 -1
  20. package/esm/helpers/fetch.d.ts +4 -0
  21. package/esm/helpers/fetch.d.ts.map +1 -1
  22. package/esm/helpers/fetch.js +4 -1
  23. package/esm/helpers/generateChallenge.d.ts +4 -0
  24. package/esm/helpers/generateChallenge.d.ts.map +1 -1
  25. package/esm/helpers/generateChallenge.js +4 -1
  26. package/esm/helpers/generateUserID.d.ts +4 -0
  27. package/esm/helpers/generateUserID.d.ts.map +1 -1
  28. package/esm/helpers/generateUserID.js +4 -1
  29. package/esm/helpers/index.d.ts +16 -23
  30. package/esm/helpers/index.d.ts.map +1 -1
  31. package/esm/helpers/index.js +16 -17
  32. package/esm/helpers/iso/isoBase64URL.d.ts +1 -1
  33. package/esm/helpers/iso/isoBase64URL.d.ts.map +1 -1
  34. package/esm/helpers/iso/isoBase64URL.js +4 -0
  35. package/esm/helpers/iso/isoCBOR.d.ts +4 -0
  36. package/esm/helpers/iso/isoCBOR.d.ts.map +1 -1
  37. package/esm/helpers/iso/isoCBOR.js +4 -0
  38. package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts +1 -1
  39. package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts.map +1 -1
  40. package/esm/helpers/iso/isoCrypto/index.d.ts +4 -0
  41. package/esm/helpers/iso/isoCrypto/index.d.ts.map +1 -1
  42. package/esm/helpers/iso/isoCrypto/index.js +4 -0
  43. package/esm/helpers/iso/isoUint8Array.d.ts +4 -0
  44. package/esm/helpers/iso/isoUint8Array.d.ts.map +1 -1
  45. package/esm/helpers/iso/isoUint8Array.js +4 -0
  46. package/esm/helpers/parseAuthenticatorData.d.ts +4 -0
  47. package/esm/helpers/parseAuthenticatorData.d.ts.map +1 -1
  48. package/esm/helpers/parseAuthenticatorData.js +4 -1
  49. package/esm/helpers/parseBackupFlags.d.ts +1 -1
  50. package/esm/helpers/parseBackupFlags.d.ts.map +1 -1
  51. package/esm/helpers/validateCertificatePath.d.ts +3 -3
  52. package/esm/helpers/validateCertificatePath.d.ts.map +1 -1
  53. package/esm/helpers/validateCertificatePath.js +81 -58
  54. package/esm/helpers/verifySignature.d.ts +4 -0
  55. package/esm/helpers/verifySignature.d.ts.map +1 -1
  56. package/esm/helpers/verifySignature.js +4 -1
  57. package/esm/index.d.ts +8 -17
  58. package/esm/index.d.ts.map +1 -1
  59. package/esm/index.js +8 -11
  60. package/esm/metadata/mdsTypes.d.ts +5 -1
  61. package/esm/metadata/mdsTypes.d.ts.map +1 -1
  62. package/esm/metadata/verifyAttestationWithMetadata.d.ts +2 -2
  63. package/esm/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
  64. package/esm/metadata/verifyAttestationWithMetadata.js +1 -1
  65. package/esm/registration/generateRegistrationOptions.d.ts +21 -19
  66. package/esm/registration/generateRegistrationOptions.d.ts.map +1 -1
  67. package/esm/registration/generateRegistrationOptions.js +22 -1
  68. package/esm/registration/verifyRegistrationResponse.d.ts +17 -14
  69. package/esm/registration/verifyRegistrationResponse.d.ts.map +1 -1
  70. package/esm/services/metadataService.d.ts +22 -18
  71. package/esm/services/metadataService.d.ts.map +1 -1
  72. package/esm/services/metadataService.js +0 -19
  73. package/esm/services/settingsService.d.ts +11 -1
  74. package/esm/services/settingsService.d.ts.map +1 -1
  75. package/esm/services/settingsService.js +0 -10
  76. package/esm/types/dom.d.ts +329 -0
  77. package/esm/types/dom.d.ts.map +1 -0
  78. package/esm/types/dom.js +1 -0
  79. package/esm/types/index.d.ts +205 -0
  80. package/esm/types/index.d.ts.map +1 -0
  81. package/esm/types/index.js +1 -0
  82. package/package.json +2 -3
  83. package/script/authentication/generateAuthenticationOptions.d.ts +13 -13
  84. package/script/authentication/generateAuthenticationOptions.d.ts.map +1 -1
  85. package/script/authentication/verifyAuthenticationResponse.d.ts +18 -15
  86. package/script/authentication/verifyAuthenticationResponse.d.ts.map +1 -1
  87. package/script/helpers/convertCertBufferToPEM.d.ts +1 -1
  88. package/script/helpers/convertCertBufferToPEM.d.ts.map +1 -1
  89. package/script/helpers/cose.d.ts +22 -0
  90. package/script/helpers/cose.d.ts.map +1 -1
  91. package/script/helpers/cose.js +20 -0
  92. package/script/helpers/decodeAttestationObject.d.ts +4 -0
  93. package/script/helpers/decodeAttestationObject.d.ts.map +1 -1
  94. package/script/helpers/decodeAttestationObject.js +4 -1
  95. package/script/helpers/decodeClientDataJSON.d.ts +5 -1
  96. package/script/helpers/decodeClientDataJSON.d.ts.map +1 -1
  97. package/script/helpers/decodeClientDataJSON.js +4 -1
  98. package/script/helpers/decodeCredentialPublicKey.d.ts +4 -0
  99. package/script/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
  100. package/script/helpers/decodeCredentialPublicKey.js +4 -1
  101. package/script/helpers/fetch.d.ts +4 -0
  102. package/script/helpers/fetch.d.ts.map +1 -1
  103. package/script/helpers/fetch.js +4 -1
  104. package/script/helpers/generateChallenge.d.ts +4 -0
  105. package/script/helpers/generateChallenge.d.ts.map +1 -1
  106. package/script/helpers/generateChallenge.js +4 -1
  107. package/script/helpers/generateUserID.d.ts +4 -0
  108. package/script/helpers/generateUserID.d.ts.map +1 -1
  109. package/script/helpers/generateUserID.js +4 -1
  110. package/script/helpers/index.d.ts +16 -23
  111. package/script/helpers/index.d.ts.map +1 -1
  112. package/script/helpers/index.js +20 -36
  113. package/script/helpers/iso/isoBase64URL.d.ts +1 -1
  114. package/script/helpers/iso/isoBase64URL.d.ts.map +1 -1
  115. package/script/helpers/iso/isoBase64URL.js +4 -0
  116. package/script/helpers/iso/isoCBOR.d.ts +4 -0
  117. package/script/helpers/iso/isoCBOR.d.ts.map +1 -1
  118. package/script/helpers/iso/isoCBOR.js +4 -0
  119. package/script/helpers/iso/isoCrypto/getWebCrypto.d.ts +1 -1
  120. package/script/helpers/iso/isoCrypto/getWebCrypto.d.ts.map +1 -1
  121. package/script/helpers/iso/isoCrypto/index.d.ts +4 -0
  122. package/script/helpers/iso/isoCrypto/index.d.ts.map +1 -1
  123. package/script/helpers/iso/isoCrypto/index.js +4 -0
  124. package/script/helpers/iso/isoUint8Array.d.ts +4 -0
  125. package/script/helpers/iso/isoUint8Array.d.ts.map +1 -1
  126. package/script/helpers/iso/isoUint8Array.js +4 -0
  127. package/script/helpers/parseAuthenticatorData.d.ts +4 -0
  128. package/script/helpers/parseAuthenticatorData.d.ts.map +1 -1
  129. package/script/helpers/parseAuthenticatorData.js +4 -1
  130. package/script/helpers/parseBackupFlags.d.ts +1 -1
  131. package/script/helpers/parseBackupFlags.d.ts.map +1 -1
  132. package/script/helpers/validateCertificatePath.d.ts +3 -3
  133. package/script/helpers/validateCertificatePath.d.ts.map +1 -1
  134. package/script/helpers/validateCertificatePath.js +81 -58
  135. package/script/helpers/verifySignature.d.ts +4 -0
  136. package/script/helpers/verifySignature.d.ts.map +1 -1
  137. package/script/helpers/verifySignature.js +4 -1
  138. package/script/index.d.ts +8 -17
  139. package/script/index.d.ts.map +1 -1
  140. package/script/index.js +22 -17
  141. package/script/metadata/mdsTypes.d.ts +5 -1
  142. package/script/metadata/mdsTypes.d.ts.map +1 -1
  143. package/script/metadata/verifyAttestationWithMetadata.d.ts +2 -2
  144. package/script/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
  145. package/script/registration/generateRegistrationOptions.d.ts +21 -19
  146. package/script/registration/generateRegistrationOptions.d.ts.map +1 -1
  147. package/script/registration/generateRegistrationOptions.js +22 -1
  148. package/script/registration/verifyRegistrationResponse.d.ts +17 -14
  149. package/script/registration/verifyRegistrationResponse.d.ts.map +1 -1
  150. package/script/services/metadataService.d.ts +22 -18
  151. package/script/services/metadataService.d.ts.map +1 -1
  152. package/script/services/metadataService.js +0 -19
  153. package/script/services/settingsService.d.ts +11 -1
  154. package/script/services/settingsService.d.ts.map +1 -1
  155. package/script/services/settingsService.js +0 -10
  156. package/script/types/dom.d.ts +329 -0
  157. package/script/types/dom.d.ts.map +1 -0
  158. package/script/types/dom.js +2 -0
  159. package/script/types/index.d.ts +205 -0
  160. package/script/types/index.d.ts.map +1 -0
  161. package/script/types/index.js +2 -0
@@ -15,7 +15,10 @@ async function generateUserID() {
15
15
  await index_js_1.isoCrypto.getRandomValues(newUserID);
16
16
  return exports._generateUserIDInternals.stubThis(newUserID);
17
17
  }
18
- // Make it possible to stub the return value during testing
18
+ /**
19
+ * Make it possible to stub the return value during testing
20
+ * @ignore Don't include this in docs output
21
+ */
19
22
  exports._generateUserIDInternals = {
20
23
  stubThis: (value) => value,
21
24
  };
@@ -1,24 +1,17 @@
1
- import { convertAAGUIDToString } from './convertAAGUIDToString.js';
2
- import { convertCertBufferToPEM } from './convertCertBufferToPEM.js';
3
- import { convertCOSEtoPKCS } from './convertCOSEtoPKCS.js';
4
- import { decodeAttestationObject } from './decodeAttestationObject.js';
5
- import { decodeClientDataJSON } from './decodeClientDataJSON.js';
6
- import { decodeCredentialPublicKey } from './decodeCredentialPublicKey.js';
7
- import { generateChallenge } from './generateChallenge.js';
8
- import { generateUserID } from './generateUserID.js';
9
- import { getCertificateInfo } from './getCertificateInfo.js';
10
- import { isCertRevoked } from './isCertRevoked.js';
11
- import { parseAuthenticatorData } from './parseAuthenticatorData.js';
12
- import { toHash } from './toHash.js';
13
- import { validateCertificatePath } from './validateCertificatePath.js';
14
- import { verifySignature } from './verifySignature.js';
15
- import { isoBase64URL, isoCBOR, isoCrypto, isoUint8Array } from './iso/index.js';
16
- import * as cose from './cose.js';
17
- export { convertAAGUIDToString, convertCertBufferToPEM, convertCOSEtoPKCS, cose, decodeAttestationObject, decodeClientDataJSON, decodeCredentialPublicKey, generateChallenge, generateUserID, getCertificateInfo, isCertRevoked, isoBase64URL, isoCBOR, isoCrypto, isoUint8Array, parseAuthenticatorData, toHash, validateCertificatePath, verifySignature, };
18
- import type { AttestationFormat, AttestationObject, AttestationStatement } from './decodeAttestationObject.js';
19
- import type { CertificateInfo } from './getCertificateInfo.js';
20
- import type { ClientDataJSON } from './decodeClientDataJSON.js';
21
- import type { COSEPublicKey, COSEPublicKeyEC2, COSEPublicKeyOKP, COSEPublicKeyRSA } from './cose.js';
22
- import type { ParsedAuthenticatorData } from './parseAuthenticatorData.js';
23
- export type { AttestationFormat, AttestationObject, AttestationStatement, CertificateInfo, ClientDataJSON, COSEPublicKey, COSEPublicKeyEC2, COSEPublicKeyOKP, COSEPublicKeyRSA, ParsedAuthenticatorData, };
1
+ export * from './convertAAGUIDToString.js';
2
+ export * from './convertCertBufferToPEM.js';
3
+ export * from './convertCOSEtoPKCS.js';
4
+ export * from './decodeAttestationObject.js';
5
+ export * from './decodeClientDataJSON.js';
6
+ export * from './decodeCredentialPublicKey.js';
7
+ export * from './generateChallenge.js';
8
+ export * from './generateUserID.js';
9
+ export * from './getCertificateInfo.js';
10
+ export * from './isCertRevoked.js';
11
+ export * from './parseAuthenticatorData.js';
12
+ export * from './toHash.js';
13
+ export * from './validateCertificatePath.js';
14
+ export * from './verifySignature.js';
15
+ export * from './iso/index.js';
16
+ export * as cose from './cose.js';
24
17
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,IAAI,EACJ,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACT,aAAa,EACb,sBAAsB,EACtB,MAAM,EACN,uBAAuB,EACvB,eAAe,GAChB,CAAC;AAEF,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}
@@ -15,6 +15,9 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
15
15
  }) : function(o, v) {
16
16
  o["default"] = v;
17
17
  });
18
+ var __exportStar = (this && this.__exportStar) || function(m, exports) {
19
+ for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
20
+ };
18
21
  var __importStar = (this && this.__importStar) || function (mod) {
19
22
  if (mod && mod.__esModule) return mod;
20
23
  var result = {};
@@ -23,39 +26,20 @@ var __importStar = (this && this.__importStar) || function (mod) {
23
26
  return result;
24
27
  };
25
28
  Object.defineProperty(exports, "__esModule", { value: true });
26
- exports.verifySignature = exports.validateCertificatePath = exports.toHash = exports.parseAuthenticatorData = exports.isoUint8Array = exports.isoCrypto = exports.isoCBOR = exports.isoBase64URL = exports.isCertRevoked = exports.getCertificateInfo = exports.generateUserID = exports.generateChallenge = exports.decodeCredentialPublicKey = exports.decodeClientDataJSON = exports.decodeAttestationObject = exports.cose = exports.convertCOSEtoPKCS = exports.convertCertBufferToPEM = exports.convertAAGUIDToString = void 0;
27
- const convertAAGUIDToString_js_1 = require("./convertAAGUIDToString.js");
28
- Object.defineProperty(exports, "convertAAGUIDToString", { enumerable: true, get: function () { return convertAAGUIDToString_js_1.convertAAGUIDToString; } });
29
- const convertCertBufferToPEM_js_1 = require("./convertCertBufferToPEM.js");
30
- Object.defineProperty(exports, "convertCertBufferToPEM", { enumerable: true, get: function () { return convertCertBufferToPEM_js_1.convertCertBufferToPEM; } });
31
- const convertCOSEtoPKCS_js_1 = require("./convertCOSEtoPKCS.js");
32
- Object.defineProperty(exports, "convertCOSEtoPKCS", { enumerable: true, get: function () { return convertCOSEtoPKCS_js_1.convertCOSEtoPKCS; } });
33
- const decodeAttestationObject_js_1 = require("./decodeAttestationObject.js");
34
- Object.defineProperty(exports, "decodeAttestationObject", { enumerable: true, get: function () { return decodeAttestationObject_js_1.decodeAttestationObject; } });
35
- const decodeClientDataJSON_js_1 = require("./decodeClientDataJSON.js");
36
- Object.defineProperty(exports, "decodeClientDataJSON", { enumerable: true, get: function () { return decodeClientDataJSON_js_1.decodeClientDataJSON; } });
37
- const decodeCredentialPublicKey_js_1 = require("./decodeCredentialPublicKey.js");
38
- Object.defineProperty(exports, "decodeCredentialPublicKey", { enumerable: true, get: function () { return decodeCredentialPublicKey_js_1.decodeCredentialPublicKey; } });
39
- const generateChallenge_js_1 = require("./generateChallenge.js");
40
- Object.defineProperty(exports, "generateChallenge", { enumerable: true, get: function () { return generateChallenge_js_1.generateChallenge; } });
41
- const generateUserID_js_1 = require("./generateUserID.js");
42
- Object.defineProperty(exports, "generateUserID", { enumerable: true, get: function () { return generateUserID_js_1.generateUserID; } });
43
- const getCertificateInfo_js_1 = require("./getCertificateInfo.js");
44
- Object.defineProperty(exports, "getCertificateInfo", { enumerable: true, get: function () { return getCertificateInfo_js_1.getCertificateInfo; } });
45
- const isCertRevoked_js_1 = require("./isCertRevoked.js");
46
- Object.defineProperty(exports, "isCertRevoked", { enumerable: true, get: function () { return isCertRevoked_js_1.isCertRevoked; } });
47
- const parseAuthenticatorData_js_1 = require("./parseAuthenticatorData.js");
48
- Object.defineProperty(exports, "parseAuthenticatorData", { enumerable: true, get: function () { return parseAuthenticatorData_js_1.parseAuthenticatorData; } });
49
- const toHash_js_1 = require("./toHash.js");
50
- Object.defineProperty(exports, "toHash", { enumerable: true, get: function () { return toHash_js_1.toHash; } });
51
- const validateCertificatePath_js_1 = require("./validateCertificatePath.js");
52
- Object.defineProperty(exports, "validateCertificatePath", { enumerable: true, get: function () { return validateCertificatePath_js_1.validateCertificatePath; } });
53
- const verifySignature_js_1 = require("./verifySignature.js");
54
- Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return verifySignature_js_1.verifySignature; } });
55
- const index_js_1 = require("./iso/index.js");
56
- Object.defineProperty(exports, "isoBase64URL", { enumerable: true, get: function () { return index_js_1.isoBase64URL; } });
57
- Object.defineProperty(exports, "isoCBOR", { enumerable: true, get: function () { return index_js_1.isoCBOR; } });
58
- Object.defineProperty(exports, "isoCrypto", { enumerable: true, get: function () { return index_js_1.isoCrypto; } });
59
- Object.defineProperty(exports, "isoUint8Array", { enumerable: true, get: function () { return index_js_1.isoUint8Array; } });
60
- const cose = __importStar(require("./cose.js"));
61
- exports.cose = cose;
29
+ exports.cose = void 0;
30
+ __exportStar(require("./convertAAGUIDToString.js"), exports);
31
+ __exportStar(require("./convertCertBufferToPEM.js"), exports);
32
+ __exportStar(require("./convertCOSEtoPKCS.js"), exports);
33
+ __exportStar(require("./decodeAttestationObject.js"), exports);
34
+ __exportStar(require("./decodeClientDataJSON.js"), exports);
35
+ __exportStar(require("./decodeCredentialPublicKey.js"), exports);
36
+ __exportStar(require("./generateChallenge.js"), exports);
37
+ __exportStar(require("./generateUserID.js"), exports);
38
+ __exportStar(require("./getCertificateInfo.js"), exports);
39
+ __exportStar(require("./isCertRevoked.js"), exports);
40
+ __exportStar(require("./parseAuthenticatorData.js"), exports);
41
+ __exportStar(require("./toHash.js"), exports);
42
+ __exportStar(require("./validateCertificatePath.js"), exports);
43
+ __exportStar(require("./verifySignature.js"), exports);
44
+ __exportStar(require("./iso/index.js"), exports);
45
+ exports.cose = __importStar(require("./cose.js"));
@@ -1,4 +1,4 @@
1
- import type { Base64URLString } from '@simplewebauthn/types';
1
+ import type { Base64URLString } from '../../types/index.js';
2
2
  /**
3
3
  * Decode from a Base64URL-encoded string to an ArrayBuffer. Best used when converting a
4
4
  * credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or
@@ -1 +1 @@
1
- {"version":3,"file":"isoBase64URL.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoBase64URL.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,eAAe,EAAE,MAAM,EACvB,IAAI,GAAE,QAAQ,GAAG,WAAyB,GACzC,UAAU,CAGZ;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,UAAU,EAClB,EAAE,GAAE,QAAQ,GAAG,WAAyB,GACvC,MAAM,CAER;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAEnE"}
1
+ {"version":3,"file":"isoBase64URL.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoBase64URL.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,eAAe,EAAE,MAAM,EACvB,IAAI,GAAE,QAAQ,GAAG,WAAyB,GACzC,UAAU,CAGZ;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,UAAU,EAClB,EAAE,GAAE,QAAQ,GAAG,WAAyB,GACvC,MAAM,CAER;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAEnE"}
@@ -11,6 +11,10 @@ exports.toUTF8String = toUTF8String;
11
11
  exports.isBase64 = isBase64;
12
12
  exports.isBase64URL = isBase64URL;
13
13
  exports.trimPadding = trimPadding;
14
+ /**
15
+ * A runtime-agnostic collection of methods for working with Base64URL encoding
16
+ * @module
17
+ */
14
18
  const base64_1 = __importDefault(require("@hexagon/base64"));
15
19
  /**
16
20
  * Decode from a Base64URL-encoded string to an ArrayBuffer. Best used when converting a
@@ -1,3 +1,7 @@
1
+ /**
2
+ * A runtime-agnostic collection of methods for working with CBOR encoding
3
+ * @module
4
+ */
1
5
  import * as tinyCbor from '@levischuck/tiny-cbor';
2
6
  /**
3
7
  * Whatever CBOR encoder is used should keep CBOR data the same length when data is re-encoded
@@ -1 +1 @@
1
- {"version":3,"file":"isoCBOR.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoCBOR.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAQzD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAE3D"}
1
+ {"version":3,"file":"isoCBOR.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoCBOR.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAQzD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAE3D"}
@@ -25,6 +25,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
25
25
  Object.defineProperty(exports, "__esModule", { value: true });
26
26
  exports.decodeFirst = decodeFirst;
27
27
  exports.encode = encode;
28
+ /**
29
+ * A runtime-agnostic collection of methods for working with CBOR encoding
30
+ * @module
31
+ */
28
32
  const tinyCbor = __importStar(require("@levischuck/tiny-cbor"));
29
33
  /**
30
34
  * Whatever CBOR encoder is used should keep CBOR data the same length when data is re-encoded
@@ -1,4 +1,4 @@
1
- import type { Crypto } from '@simplewebauthn/types';
1
+ import type { Crypto } from '../../../types/index.js';
2
2
  /**
3
3
  * Try to get an instance of the Crypto API from the current runtime. Should support Node,
4
4
  * as well as others, like Deno, that implement Web APIs.
@@ -1 +1 @@
1
- {"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAIpD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
1
+ {"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
@@ -1,3 +1,7 @@
1
+ /**
2
+ * A runtime-agnostic collection of methods for working with the WebCrypto API
3
+ * @module
4
+ */
1
5
  export { digest } from './digest.js';
2
6
  export { getRandomValues } from './getRandomValues.js';
3
7
  export { verify } from './verify.js';
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
@@ -1,6 +1,10 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.verify = exports.getRandomValues = exports.digest = void 0;
4
+ /**
5
+ * A runtime-agnostic collection of methods for working with the WebCrypto API
6
+ * @module
7
+ */
4
8
  var digest_js_1 = require("./digest.js");
5
9
  Object.defineProperty(exports, "digest", { enumerable: true, get: function () { return digest_js_1.digest; } });
6
10
  var getRandomValues_js_1 = require("./getRandomValues.js");
@@ -1,3 +1,7 @@
1
+ /**
2
+ * A runtime-agnostic collection of methods for working with Uint8Arrays
3
+ * @module
4
+ */
1
5
  /**
2
6
  * Make sure two Uint8Arrays are deeply equivalent
3
7
  */
@@ -1 +1 @@
1
- {"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAe/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAYvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEtD"}
1
+ {"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAe/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAYvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEtD"}
@@ -1,4 +1,8 @@
1
1
  "use strict";
2
+ /**
3
+ * A runtime-agnostic collection of methods for working with Uint8Arrays
4
+ * @module
5
+ */
2
6
  Object.defineProperty(exports, "__esModule", { value: true });
3
7
  exports.areEqual = areEqual;
4
8
  exports.toHex = toHex;
@@ -23,6 +23,10 @@ export type ParsedAuthenticatorData = {
23
23
  extensionsData?: AuthenticationExtensionsAuthenticatorOutputs;
24
24
  extensionsDataBuffer?: Uint8Array;
25
25
  };
26
+ /**
27
+ * Make it possible to stub the return value during testing
28
+ * @ignore Don't include this in docs output
29
+ */
26
30
  export declare const _parseAuthenticatorDataInternals: {
27
31
  stubThis: (value: ParsedAuthenticatorData) => ParsedAuthenticatorData;
28
32
  };
@@ -1 +1 @@
1
- {"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAE7C,MAAM,oCAAoC,CAAC;AAI5C;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC;AAGF,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
1
+ {"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAE7C,MAAM,oCAAoC,CAAC;AAI5C;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
@@ -101,7 +101,10 @@ function parseAuthenticatorData(authData) {
101
101
  extensionsDataBuffer,
102
102
  });
103
103
  }
104
- // Make it possible to stub the return value during testing
104
+ /**
105
+ * Make it possible to stub the return value during testing
106
+ * @ignore Don't include this in docs output
107
+ */
105
108
  exports._parseAuthenticatorDataInternals = {
106
109
  stubThis: (value) => value,
107
110
  };
@@ -1,4 +1,4 @@
1
- import type { CredentialDeviceType } from '@simplewebauthn/types';
1
+ import type { CredentialDeviceType } from '../types/index.js';
2
2
  /**
3
3
  * Make sense of Bits 3 and 4 in authenticator indicating:
4
4
  *
@@ -1 +1 @@
1
- {"version":3,"file":"parseBackupFlags.d.ts","sourceRoot":"","sources":["../../src/helpers/parseBackupFlags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG;IAC1E,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAeA;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B"}
1
+ {"version":3,"file":"parseBackupFlags.d.ts","sourceRoot":"","sources":["../../src/helpers/parseBackupFlags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG;IAC1E,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAeA;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B"}
@@ -1,7 +1,7 @@
1
1
  /**
2
2
  * Traverse an array of PEM certificates and ensure they form a proper chain
3
- * @param certificates Typically the result of `x5c.map(convertASN1toPEM)`
4
- * @param rootCertificates Possible root certificates to complete the path
3
+ * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
4
+ * @param trustAnchorsPEM PEM-formatted certs that an attestation statement x5c may chain back to
5
5
  */
6
- export declare function validateCertificatePath(certificates: string[], rootCertificates?: string[]): Promise<boolean>;
6
+ export declare function validateCertificatePath(x5cCertsPEM: string[], trustAnchorsPEM?: string[]): Promise<boolean>;
7
7
  //# sourceMappingURL=validateCertificatePath.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EAAE,EACtB,gBAAgB,GAAE,MAAM,EAAO,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuClB"}
1
+ {"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsClB"}
@@ -9,23 +9,22 @@ const getCertificateInfo_js_1 = require("./getCertificateInfo.js");
9
9
  const convertPEMToBytes_js_1 = require("./convertPEMToBytes.js");
10
10
  /**
11
11
  * Traverse an array of PEM certificates and ensure they form a proper chain
12
- * @param certificates Typically the result of `x5c.map(convertASN1toPEM)`
13
- * @param rootCertificates Possible root certificates to complete the path
12
+ * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
13
+ * @param trustAnchorsPEM PEM-formatted certs that an attestation statement x5c may chain back to
14
14
  */
15
- async function validateCertificatePath(certificates, rootCertificates = []) {
16
- if (rootCertificates.length === 0) {
17
- // We have no root certs with which to create a full path, so skip path validation
18
- // TODO: Is this going to be acceptable default behavior??
15
+ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
16
+ if (trustAnchorsPEM.length === 0) {
17
+ // We have no trust anchors to chain back to, so skip path validation
19
18
  return true;
20
19
  }
21
20
  let invalidSubjectAndIssuerError = false;
22
21
  let certificateNotYetValidOrExpiredErrorMessage = undefined;
23
- for (const rootCert of rootCertificates) {
22
+ for (const anchorPEM of trustAnchorsPEM) {
24
23
  try {
25
- const certsWithRoot = certificates.concat([rootCert]);
26
- await _validatePath(certsWithRoot);
24
+ const certsWithTrustAnchor = x5cCertsPEM.concat([anchorPEM]);
25
+ await _validatePath(certsWithTrustAnchor);
27
26
  // If we successfully validated a path then there's no need to continue. Reset any existing
28
- // errors that were thrown by earlier root certificates
27
+ // errors that were thrown by earlier trust anchors
29
28
  invalidSubjectAndIssuerError = false;
30
29
  certificateNotYetValidOrExpiredErrorMessage = undefined;
31
30
  break;
@@ -42,7 +41,7 @@ async function validateCertificatePath(certificates, rootCertificates = []) {
42
41
  }
43
42
  }
44
43
  }
45
- // We tried multiple root certs and none of them worked
44
+ // We tried multiple trust anchors and none of them worked
46
45
  if (invalidSubjectAndIssuerError) {
47
46
  throw new InvalidSubjectAndIssuer();
48
47
  }
@@ -51,64 +50,81 @@ async function validateCertificatePath(certificates, rootCertificates = []) {
51
50
  }
52
51
  return true;
53
52
  }
54
- async function _validatePath(certificates) {
55
- if (new Set(certificates).size !== certificates.length) {
53
+ /**
54
+ * @param x5cCerts X.509 `x5c` certs in PEM string format
55
+ * @param anchorCert X.509 trust anchor cert in PEM string format
56
+ */
57
+ async function _validatePath(x5cCertsWithTrustAnchorPEM) {
58
+ if (new Set(x5cCertsWithTrustAnchorPEM).size !== x5cCertsWithTrustAnchorPEM.length) {
56
59
  throw new Error('Invalid certificate path: found duplicate certificates');
57
60
  }
58
- // From leaf to root, make sure each cert is issued by the next certificate in the chain
59
- for (let i = 0; i < certificates.length; i += 1) {
60
- const subjectPem = certificates[i];
61
- const isLeafCert = i === 0;
62
- const isRootCert = i + 1 >= certificates.length;
63
- let issuerPem = '';
64
- if (isRootCert) {
65
- issuerPem = subjectPem;
66
- }
67
- else {
68
- issuerPem = certificates[i + 1];
69
- }
61
+ // Make sure no certs are revoked, and all are within their time validity window
62
+ for (const certificatePEM of x5cCertsWithTrustAnchorPEM) {
63
+ const certInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(certificatePEM));
64
+ await assertCertNotRevoked(certInfo.parsedCertificate);
65
+ assertCertIsWithinValidTimeWindow(certInfo, certificatePEM);
66
+ }
67
+ // Make sure each x5c cert is issued by the next certificate in the chain
68
+ for (let i = 0; i < (x5cCertsWithTrustAnchorPEM.length - 1); i += 1) {
69
+ const subjectPem = x5cCertsWithTrustAnchorPEM[i];
70
+ const issuerPem = x5cCertsWithTrustAnchorPEM[i + 1];
70
71
  const subjectInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(subjectPem));
71
72
  const issuerInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPem));
72
- const x509Subject = subjectInfo.parsedCertificate;
73
- // Check for certificate revocation
74
- const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(x509Subject);
75
- if (subjectCertRevoked) {
76
- throw new Error(`Found revoked certificate in certificate path`);
77
- }
78
- // Check that intermediate certificate is within its valid time window
79
- const { notBefore, notAfter } = issuerInfo;
80
- const now = new Date(Date.now());
81
- if (notBefore > now || notAfter < now) {
82
- if (isLeafCert) {
83
- throw new CertificateNotYetValidOrExpired(`Leaf certificate is not yet valid or expired: ${issuerPem}`);
84
- }
85
- else if (isRootCert) {
86
- throw new CertificateNotYetValidOrExpired(`Root certificate is not yet valid or expired: ${issuerPem}`);
87
- }
88
- else {
89
- throw new CertificateNotYetValidOrExpired(`Intermediate certificate is not yet valid or expired: ${issuerPem}`);
90
- }
91
- }
73
+ // Make sure subject issuer is issuer subject
92
74
  if (subjectInfo.issuer.combined !== issuerInfo.subject.combined) {
93
75
  throw new InvalidSubjectAndIssuer();
94
76
  }
95
- // Verify the subject certificate's signature with the issuer cert's public key
96
- const data = asn1_schema_1.AsnSerializer.serialize(x509Subject.tbsCertificate);
97
- const signature = x509Subject.signatureValue;
98
- const signatureAlgorithm = (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(x509Subject.signatureAlgorithm.algorithm);
99
- const issuerCertBytes = (0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPem);
100
- const verified = await (0, verifySignature_js_1.verifySignature)({
101
- data: new Uint8Array(data),
102
- signature: new Uint8Array(signature),
103
- x509Certificate: issuerCertBytes,
104
- hashAlgorithm: signatureAlgorithm,
105
- });
106
- if (!verified) {
107
- throw new Error('Invalid certificate path: invalid signature');
77
+ const issuerCertIsRootCert = issuerInfo.issuer.combined === issuerInfo.subject.combined;
78
+ await assertSubjectIsSignedByIssuer(subjectInfo.parsedCertificate, issuerPem);
79
+ // Perform one final check if the issuer cert is also a root certificate
80
+ if (issuerCertIsRootCert) {
81
+ await assertSubjectIsSignedByIssuer(issuerInfo.parsedCertificate, issuerPem);
108
82
  }
109
83
  }
110
84
  return true;
111
85
  }
86
+ /**
87
+ * Check if the certificate is revoked or not. If it is, raise an error
88
+ */
89
+ async function assertCertNotRevoked(certificate) {
90
+ // Check for certificate revocation
91
+ const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate);
92
+ if (subjectCertRevoked) {
93
+ throw new Error(`Found revoked certificate in certificate path`);
94
+ }
95
+ }
96
+ /**
97
+ * Require the cert to be within its notBefore and notAfter time window
98
+ *
99
+ * @param certInfo Parsed cert information
100
+ * @param certPEM PEM-formatted certificate, for error reporting
101
+ */
102
+ function assertCertIsWithinValidTimeWindow(certInfo, certPEM) {
103
+ const { notBefore, notAfter } = certInfo;
104
+ const now = new Date(Date.now());
105
+ if (notBefore > now || notAfter < now) {
106
+ throw new CertificateNotYetValidOrExpired(`Certificate is not yet valid or expired: ${certPEM}`);
107
+ }
108
+ }
109
+ /**
110
+ * Ensure that the subject cert has been signed by the next cert in the chain
111
+ */
112
+ async function assertSubjectIsSignedByIssuer(subjectCert, issuerPEM) {
113
+ // Verify the subject certificate's signature with the issuer cert's public key
114
+ const data = asn1_schema_1.AsnSerializer.serialize(subjectCert.tbsCertificate);
115
+ const signature = subjectCert.signatureValue;
116
+ const signatureAlgorithm = (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(subjectCert.signatureAlgorithm.algorithm);
117
+ const issuerCertBytes = (0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPEM);
118
+ const verified = await (0, verifySignature_js_1.verifySignature)({
119
+ data: new Uint8Array(data),
120
+ signature: new Uint8Array(signature),
121
+ x509Certificate: issuerCertBytes,
122
+ hashAlgorithm: signatureAlgorithm,
123
+ });
124
+ if (!verified) {
125
+ throw new InvalidSubjectSignatureForIssuer();
126
+ }
127
+ }
112
128
  // Custom errors to help pass on certain errors
113
129
  class InvalidSubjectAndIssuer extends Error {
114
130
  constructor() {
@@ -117,6 +133,13 @@ class InvalidSubjectAndIssuer extends Error {
117
133
  this.name = 'InvalidSubjectAndIssuer';
118
134
  }
119
135
  }
136
+ class InvalidSubjectSignatureForIssuer extends Error {
137
+ constructor() {
138
+ const message = 'Subject signature was invalid for issuer';
139
+ super(message);
140
+ this.name = 'InvalidSubjectSignatureForIssuer';
141
+ }
142
+ }
120
143
  class CertificateNotYetValidOrExpired extends Error {
121
144
  constructor(message) {
122
145
  super(message);
@@ -9,6 +9,10 @@ export declare function verifySignature(opts: {
9
9
  x509Certificate?: Uint8Array;
10
10
  hashAlgorithm?: COSEALG;
11
11
  }): Promise<boolean>;
12
+ /**
13
+ * Make it possible to stub the return value during testing
14
+ * @ignore Don't include this in docs output
15
+ */
12
16
  export declare const _verifySignatureInternals: {
13
17
  stubThis: (value: Promise<boolean>) => Promise<boolean>;
14
18
  };
@@ -1 +1 @@
1
- {"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAKnD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAGD,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
1
+ {"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAKnD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
@@ -30,7 +30,10 @@ function verifySignature(opts) {
30
30
  shaHashOverride: hashAlgorithm,
31
31
  }));
32
32
  }
33
- // Make it possible to stub the return value during testing
33
+ /**
34
+ * Make it possible to stub the return value during testing
35
+ * @ignore Don't include this in docs output
36
+ */
34
37
  exports._verifySignatureInternals = {
35
38
  stubThis: (value) => value,
36
39
  };
package/script/index.d.ts CHANGED
@@ -1,18 +1,9 @@
1
- /**
2
- * @packageDocumentation
3
- * @module @simplewebauthn/server
4
- */
5
- import { generateRegistrationOptions } from './registration/generateRegistrationOptions.js';
6
- import { verifyRegistrationResponse } from './registration/verifyRegistrationResponse.js';
7
- import { generateAuthenticationOptions } from './authentication/generateAuthenticationOptions.js';
8
- import { verifyAuthenticationResponse } from './authentication/verifyAuthenticationResponse.js';
9
- import { MetadataService } from './services/metadataService.js';
10
- import { SettingsService } from './services/settingsService.js';
11
- export { generateAuthenticationOptions, generateRegistrationOptions, MetadataService, SettingsService, verifyAuthenticationResponse, verifyRegistrationResponse, };
12
- import type { GenerateRegistrationOptionsOpts } from './registration/generateRegistrationOptions.js';
13
- import type { GenerateAuthenticationOptionsOpts } from './authentication/generateAuthenticationOptions.js';
14
- import type { MetadataStatement } from './metadata/mdsTypes.js';
15
- import type { VerifiedRegistrationResponse, VerifyRegistrationResponseOpts } from './registration/verifyRegistrationResponse.js';
16
- import type { VerifiedAuthenticationResponse, VerifyAuthenticationResponseOpts } from './authentication/verifyAuthenticationResponse.js';
17
- export type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, MetadataStatement, VerifiedAuthenticationResponse, VerifiedRegistrationResponse, VerifyAuthenticationResponseOpts, VerifyRegistrationResponseOpts, };
1
+ export * from './registration/generateRegistrationOptions.js';
2
+ export * from './registration/verifyRegistrationResponse.js';
3
+ export * from './authentication/generateAuthenticationOptions.js';
4
+ export * from './authentication/verifyAuthenticationResponse.js';
5
+ export * from './services/metadataService.js';
6
+ export * from './services/settingsService.js';
7
+ export * from './metadata/mdsTypes.js';
8
+ export * from './types/index.js';
18
9
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,4BAA4B,EAC5B,0BAA0B,GAC3B,CAAC;AAEF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,mDAAmD,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EACV,4BAA4B,EAC5B,8BAA8B,EAC/B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,kDAAkD,CAAC;AAE1D,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,GAC/B,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}