@simplewebauthn/server 12.0.0 → 13.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/esm/authentication/generateAuthenticationOptions.d.ts +13 -13
- package/esm/authentication/generateAuthenticationOptions.d.ts.map +1 -1
- package/esm/authentication/verifyAuthenticationResponse.d.ts +18 -15
- package/esm/authentication/verifyAuthenticationResponse.d.ts.map +1 -1
- package/esm/helpers/convertCertBufferToPEM.d.ts +1 -1
- package/esm/helpers/convertCertBufferToPEM.d.ts.map +1 -1
- package/esm/helpers/cose.d.ts +22 -0
- package/esm/helpers/cose.d.ts.map +1 -1
- package/esm/helpers/cose.js +20 -0
- package/esm/helpers/decodeAttestationObject.d.ts +4 -0
- package/esm/helpers/decodeAttestationObject.d.ts.map +1 -1
- package/esm/helpers/decodeAttestationObject.js +4 -1
- package/esm/helpers/decodeClientDataJSON.d.ts +5 -1
- package/esm/helpers/decodeClientDataJSON.d.ts.map +1 -1
- package/esm/helpers/decodeClientDataJSON.js +4 -1
- package/esm/helpers/decodeCredentialPublicKey.d.ts +4 -0
- package/esm/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
- package/esm/helpers/decodeCredentialPublicKey.js +4 -1
- package/esm/helpers/fetch.d.ts +4 -0
- package/esm/helpers/fetch.d.ts.map +1 -1
- package/esm/helpers/fetch.js +4 -1
- package/esm/helpers/generateChallenge.d.ts +4 -0
- package/esm/helpers/generateChallenge.d.ts.map +1 -1
- package/esm/helpers/generateChallenge.js +4 -1
- package/esm/helpers/generateUserID.d.ts +4 -0
- package/esm/helpers/generateUserID.d.ts.map +1 -1
- package/esm/helpers/generateUserID.js +4 -1
- package/esm/helpers/index.d.ts +16 -23
- package/esm/helpers/index.d.ts.map +1 -1
- package/esm/helpers/index.js +16 -17
- package/esm/helpers/iso/isoBase64URL.d.ts +1 -1
- package/esm/helpers/iso/isoBase64URL.d.ts.map +1 -1
- package/esm/helpers/iso/isoBase64URL.js +4 -0
- package/esm/helpers/iso/isoCBOR.d.ts +4 -0
- package/esm/helpers/iso/isoCBOR.d.ts.map +1 -1
- package/esm/helpers/iso/isoCBOR.js +4 -0
- package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts +1 -1
- package/esm/helpers/iso/isoCrypto/getWebCrypto.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/index.d.ts +4 -0
- package/esm/helpers/iso/isoCrypto/index.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/index.js +4 -0
- package/esm/helpers/iso/isoUint8Array.d.ts +4 -0
- package/esm/helpers/iso/isoUint8Array.d.ts.map +1 -1
- package/esm/helpers/iso/isoUint8Array.js +4 -0
- package/esm/helpers/parseAuthenticatorData.d.ts +4 -0
- package/esm/helpers/parseAuthenticatorData.d.ts.map +1 -1
- package/esm/helpers/parseAuthenticatorData.js +4 -1
- package/esm/helpers/parseBackupFlags.d.ts +1 -1
- package/esm/helpers/parseBackupFlags.d.ts.map +1 -1
- package/esm/helpers/validateCertificatePath.d.ts +3 -3
- package/esm/helpers/validateCertificatePath.d.ts.map +1 -1
- package/esm/helpers/validateCertificatePath.js +81 -58
- package/esm/helpers/verifySignature.d.ts +4 -0
- package/esm/helpers/verifySignature.d.ts.map +1 -1
- package/esm/helpers/verifySignature.js +4 -1
- package/esm/index.d.ts +8 -17
- package/esm/index.d.ts.map +1 -1
- package/esm/index.js +8 -11
- package/esm/metadata/mdsTypes.d.ts +5 -1
- package/esm/metadata/mdsTypes.d.ts.map +1 -1
- package/esm/metadata/verifyAttestationWithMetadata.d.ts +2 -2
- package/esm/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
- package/esm/metadata/verifyAttestationWithMetadata.js +1 -1
- package/esm/registration/generateRegistrationOptions.d.ts +21 -19
- package/esm/registration/generateRegistrationOptions.d.ts.map +1 -1
- package/esm/registration/generateRegistrationOptions.js +22 -1
- package/esm/registration/verifyRegistrationResponse.d.ts +17 -14
- package/esm/registration/verifyRegistrationResponse.d.ts.map +1 -1
- package/esm/services/metadataService.d.ts +22 -18
- package/esm/services/metadataService.d.ts.map +1 -1
- package/esm/services/metadataService.js +0 -19
- package/esm/services/settingsService.d.ts +11 -1
- package/esm/services/settingsService.d.ts.map +1 -1
- package/esm/services/settingsService.js +0 -10
- package/esm/types/dom.d.ts +329 -0
- package/esm/types/dom.d.ts.map +1 -0
- package/esm/types/dom.js +1 -0
- package/esm/types/index.d.ts +205 -0
- package/esm/types/index.d.ts.map +1 -0
- package/esm/types/index.js +1 -0
- package/package.json +2 -3
- package/script/authentication/generateAuthenticationOptions.d.ts +13 -13
- package/script/authentication/generateAuthenticationOptions.d.ts.map +1 -1
- package/script/authentication/verifyAuthenticationResponse.d.ts +18 -15
- package/script/authentication/verifyAuthenticationResponse.d.ts.map +1 -1
- package/script/helpers/convertCertBufferToPEM.d.ts +1 -1
- package/script/helpers/convertCertBufferToPEM.d.ts.map +1 -1
- package/script/helpers/cose.d.ts +22 -0
- package/script/helpers/cose.d.ts.map +1 -1
- package/script/helpers/cose.js +20 -0
- package/script/helpers/decodeAttestationObject.d.ts +4 -0
- package/script/helpers/decodeAttestationObject.d.ts.map +1 -1
- package/script/helpers/decodeAttestationObject.js +4 -1
- package/script/helpers/decodeClientDataJSON.d.ts +5 -1
- package/script/helpers/decodeClientDataJSON.d.ts.map +1 -1
- package/script/helpers/decodeClientDataJSON.js +4 -1
- package/script/helpers/decodeCredentialPublicKey.d.ts +4 -0
- package/script/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
- package/script/helpers/decodeCredentialPublicKey.js +4 -1
- package/script/helpers/fetch.d.ts +4 -0
- package/script/helpers/fetch.d.ts.map +1 -1
- package/script/helpers/fetch.js +4 -1
- package/script/helpers/generateChallenge.d.ts +4 -0
- package/script/helpers/generateChallenge.d.ts.map +1 -1
- package/script/helpers/generateChallenge.js +4 -1
- package/script/helpers/generateUserID.d.ts +4 -0
- package/script/helpers/generateUserID.d.ts.map +1 -1
- package/script/helpers/generateUserID.js +4 -1
- package/script/helpers/index.d.ts +16 -23
- package/script/helpers/index.d.ts.map +1 -1
- package/script/helpers/index.js +20 -36
- package/script/helpers/iso/isoBase64URL.d.ts +1 -1
- package/script/helpers/iso/isoBase64URL.d.ts.map +1 -1
- package/script/helpers/iso/isoBase64URL.js +4 -0
- package/script/helpers/iso/isoCBOR.d.ts +4 -0
- package/script/helpers/iso/isoCBOR.d.ts.map +1 -1
- package/script/helpers/iso/isoCBOR.js +4 -0
- package/script/helpers/iso/isoCrypto/getWebCrypto.d.ts +1 -1
- package/script/helpers/iso/isoCrypto/getWebCrypto.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/index.d.ts +4 -0
- package/script/helpers/iso/isoCrypto/index.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/index.js +4 -0
- package/script/helpers/iso/isoUint8Array.d.ts +4 -0
- package/script/helpers/iso/isoUint8Array.d.ts.map +1 -1
- package/script/helpers/iso/isoUint8Array.js +4 -0
- package/script/helpers/parseAuthenticatorData.d.ts +4 -0
- package/script/helpers/parseAuthenticatorData.d.ts.map +1 -1
- package/script/helpers/parseAuthenticatorData.js +4 -1
- package/script/helpers/parseBackupFlags.d.ts +1 -1
- package/script/helpers/parseBackupFlags.d.ts.map +1 -1
- package/script/helpers/validateCertificatePath.d.ts +3 -3
- package/script/helpers/validateCertificatePath.d.ts.map +1 -1
- package/script/helpers/validateCertificatePath.js +81 -58
- package/script/helpers/verifySignature.d.ts +4 -0
- package/script/helpers/verifySignature.d.ts.map +1 -1
- package/script/helpers/verifySignature.js +4 -1
- package/script/index.d.ts +8 -17
- package/script/index.d.ts.map +1 -1
- package/script/index.js +22 -17
- package/script/metadata/mdsTypes.d.ts +5 -1
- package/script/metadata/mdsTypes.d.ts.map +1 -1
- package/script/metadata/verifyAttestationWithMetadata.d.ts +2 -2
- package/script/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
- package/script/registration/generateRegistrationOptions.d.ts +21 -19
- package/script/registration/generateRegistrationOptions.d.ts.map +1 -1
- package/script/registration/generateRegistrationOptions.js +22 -1
- package/script/registration/verifyRegistrationResponse.d.ts +17 -14
- package/script/registration/verifyRegistrationResponse.d.ts.map +1 -1
- package/script/services/metadataService.d.ts +22 -18
- package/script/services/metadataService.d.ts.map +1 -1
- package/script/services/metadataService.js +0 -19
- package/script/services/settingsService.d.ts +11 -1
- package/script/services/settingsService.d.ts.map +1 -1
- package/script/services/settingsService.js +0 -10
- package/script/types/dom.d.ts +329 -0
- package/script/types/dom.d.ts.map +1 -0
- package/script/types/dom.js +2 -0
- package/script/types/index.d.ts +205 -0
- package/script/types/index.d.ts.map +1 -0
- package/script/types/index.js +2 -0
|
@@ -15,7 +15,10 @@ async function generateUserID() {
|
|
|
15
15
|
await index_js_1.isoCrypto.getRandomValues(newUserID);
|
|
16
16
|
return exports._generateUserIDInternals.stubThis(newUserID);
|
|
17
17
|
}
|
|
18
|
-
|
|
18
|
+
/**
|
|
19
|
+
* Make it possible to stub the return value during testing
|
|
20
|
+
* @ignore Don't include this in docs output
|
|
21
|
+
*/
|
|
19
22
|
exports._generateUserIDInternals = {
|
|
20
23
|
stubThis: (value) => value,
|
|
21
24
|
};
|
|
@@ -1,24 +1,17 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
export { convertAAGUIDToString, convertCertBufferToPEM, convertCOSEtoPKCS, cose, decodeAttestationObject, decodeClientDataJSON, decodeCredentialPublicKey, generateChallenge, generateUserID, getCertificateInfo, isCertRevoked, isoBase64URL, isoCBOR, isoCrypto, isoUint8Array, parseAuthenticatorData, toHash, validateCertificatePath, verifySignature, };
|
|
18
|
-
import type { AttestationFormat, AttestationObject, AttestationStatement } from './decodeAttestationObject.js';
|
|
19
|
-
import type { CertificateInfo } from './getCertificateInfo.js';
|
|
20
|
-
import type { ClientDataJSON } from './decodeClientDataJSON.js';
|
|
21
|
-
import type { COSEPublicKey, COSEPublicKeyEC2, COSEPublicKeyOKP, COSEPublicKeyRSA } from './cose.js';
|
|
22
|
-
import type { ParsedAuthenticatorData } from './parseAuthenticatorData.js';
|
|
23
|
-
export type { AttestationFormat, AttestationObject, AttestationStatement, CertificateInfo, ClientDataJSON, COSEPublicKey, COSEPublicKeyEC2, COSEPublicKeyOKP, COSEPublicKeyRSA, ParsedAuthenticatorData, };
|
|
1
|
+
export * from './convertAAGUIDToString.js';
|
|
2
|
+
export * from './convertCertBufferToPEM.js';
|
|
3
|
+
export * from './convertCOSEtoPKCS.js';
|
|
4
|
+
export * from './decodeAttestationObject.js';
|
|
5
|
+
export * from './decodeClientDataJSON.js';
|
|
6
|
+
export * from './decodeCredentialPublicKey.js';
|
|
7
|
+
export * from './generateChallenge.js';
|
|
8
|
+
export * from './generateUserID.js';
|
|
9
|
+
export * from './getCertificateInfo.js';
|
|
10
|
+
export * from './isCertRevoked.js';
|
|
11
|
+
export * from './parseAuthenticatorData.js';
|
|
12
|
+
export * from './toHash.js';
|
|
13
|
+
export * from './validateCertificatePath.js';
|
|
14
|
+
export * from './verifySignature.js';
|
|
15
|
+
export * from './iso/index.js';
|
|
16
|
+
export * as cose from './cose.js';
|
|
24
17
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC"}
|
package/script/helpers/index.js
CHANGED
|
@@ -15,6 +15,9 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
|
|
|
15
15
|
}) : function(o, v) {
|
|
16
16
|
o["default"] = v;
|
|
17
17
|
});
|
|
18
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
19
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
20
|
+
};
|
|
18
21
|
var __importStar = (this && this.__importStar) || function (mod) {
|
|
19
22
|
if (mod && mod.__esModule) return mod;
|
|
20
23
|
var result = {};
|
|
@@ -23,39 +26,20 @@ var __importStar = (this && this.__importStar) || function (mod) {
|
|
|
23
26
|
return result;
|
|
24
27
|
};
|
|
25
28
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
26
|
-
exports.
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
const getCertificateInfo_js_1 = require("./getCertificateInfo.js");
|
|
44
|
-
Object.defineProperty(exports, "getCertificateInfo", { enumerable: true, get: function () { return getCertificateInfo_js_1.getCertificateInfo; } });
|
|
45
|
-
const isCertRevoked_js_1 = require("./isCertRevoked.js");
|
|
46
|
-
Object.defineProperty(exports, "isCertRevoked", { enumerable: true, get: function () { return isCertRevoked_js_1.isCertRevoked; } });
|
|
47
|
-
const parseAuthenticatorData_js_1 = require("./parseAuthenticatorData.js");
|
|
48
|
-
Object.defineProperty(exports, "parseAuthenticatorData", { enumerable: true, get: function () { return parseAuthenticatorData_js_1.parseAuthenticatorData; } });
|
|
49
|
-
const toHash_js_1 = require("./toHash.js");
|
|
50
|
-
Object.defineProperty(exports, "toHash", { enumerable: true, get: function () { return toHash_js_1.toHash; } });
|
|
51
|
-
const validateCertificatePath_js_1 = require("./validateCertificatePath.js");
|
|
52
|
-
Object.defineProperty(exports, "validateCertificatePath", { enumerable: true, get: function () { return validateCertificatePath_js_1.validateCertificatePath; } });
|
|
53
|
-
const verifySignature_js_1 = require("./verifySignature.js");
|
|
54
|
-
Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return verifySignature_js_1.verifySignature; } });
|
|
55
|
-
const index_js_1 = require("./iso/index.js");
|
|
56
|
-
Object.defineProperty(exports, "isoBase64URL", { enumerable: true, get: function () { return index_js_1.isoBase64URL; } });
|
|
57
|
-
Object.defineProperty(exports, "isoCBOR", { enumerable: true, get: function () { return index_js_1.isoCBOR; } });
|
|
58
|
-
Object.defineProperty(exports, "isoCrypto", { enumerable: true, get: function () { return index_js_1.isoCrypto; } });
|
|
59
|
-
Object.defineProperty(exports, "isoUint8Array", { enumerable: true, get: function () { return index_js_1.isoUint8Array; } });
|
|
60
|
-
const cose = __importStar(require("./cose.js"));
|
|
61
|
-
exports.cose = cose;
|
|
29
|
+
exports.cose = void 0;
|
|
30
|
+
__exportStar(require("./convertAAGUIDToString.js"), exports);
|
|
31
|
+
__exportStar(require("./convertCertBufferToPEM.js"), exports);
|
|
32
|
+
__exportStar(require("./convertCOSEtoPKCS.js"), exports);
|
|
33
|
+
__exportStar(require("./decodeAttestationObject.js"), exports);
|
|
34
|
+
__exportStar(require("./decodeClientDataJSON.js"), exports);
|
|
35
|
+
__exportStar(require("./decodeCredentialPublicKey.js"), exports);
|
|
36
|
+
__exportStar(require("./generateChallenge.js"), exports);
|
|
37
|
+
__exportStar(require("./generateUserID.js"), exports);
|
|
38
|
+
__exportStar(require("./getCertificateInfo.js"), exports);
|
|
39
|
+
__exportStar(require("./isCertRevoked.js"), exports);
|
|
40
|
+
__exportStar(require("./parseAuthenticatorData.js"), exports);
|
|
41
|
+
__exportStar(require("./toHash.js"), exports);
|
|
42
|
+
__exportStar(require("./validateCertificatePath.js"), exports);
|
|
43
|
+
__exportStar(require("./verifySignature.js"), exports);
|
|
44
|
+
__exportStar(require("./iso/index.js"), exports);
|
|
45
|
+
exports.cose = __importStar(require("./cose.js"));
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { Base64URLString } from '
|
|
1
|
+
import type { Base64URLString } from '../../types/index.js';
|
|
2
2
|
/**
|
|
3
3
|
* Decode from a Base64URL-encoded string to an ArrayBuffer. Best used when converting a
|
|
4
4
|
* credential ID from a JSON string to an ArrayBuffer, like in allowCredentials or
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isoBase64URL.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoBase64URL.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"isoBase64URL.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoBase64URL.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,eAAe,EAAE,MAAM,EACvB,IAAI,GAAE,QAAQ,GAAG,WAAyB,GACzC,UAAU,CAGZ;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,UAAU,EAClB,EAAE,GAAE,QAAQ,GAAG,WAAyB,GACvC,MAAM,CAER;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAEnE"}
|
|
@@ -11,6 +11,10 @@ exports.toUTF8String = toUTF8String;
|
|
|
11
11
|
exports.isBase64 = isBase64;
|
|
12
12
|
exports.isBase64URL = isBase64URL;
|
|
13
13
|
exports.trimPadding = trimPadding;
|
|
14
|
+
/**
|
|
15
|
+
* A runtime-agnostic collection of methods for working with Base64URL encoding
|
|
16
|
+
* @module
|
|
17
|
+
*/
|
|
14
18
|
const base64_1 = __importDefault(require("@hexagon/base64"));
|
|
15
19
|
/**
|
|
16
20
|
* Decode from a Base64URL-encoded string to an ArrayBuffer. Best used when converting a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isoCBOR.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoCBOR.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAQzD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAE3D"}
|
|
1
|
+
{"version":3,"file":"isoCBOR.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoCBOR.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAQzD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAE3D"}
|
|
@@ -25,6 +25,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
|
|
|
25
25
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
26
26
|
exports.decodeFirst = decodeFirst;
|
|
27
27
|
exports.encode = encode;
|
|
28
|
+
/**
|
|
29
|
+
* A runtime-agnostic collection of methods for working with CBOR encoding
|
|
30
|
+
* @module
|
|
31
|
+
*/
|
|
28
32
|
const tinyCbor = __importStar(require("@levischuck/tiny-cbor"));
|
|
29
33
|
/**
|
|
30
34
|
* Whatever CBOR encoder is used should keep CBOR data the same length when data is re-encoded
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"getWebCrypto.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/getWebCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAgC9C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAM1C;AAGD,eAAO,MAAM,sBAAsB;;iCAGJ,MAAM,GAAG,SAAS;CAGhD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
|
|
@@ -1,6 +1,10 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.verify = exports.getRandomValues = exports.digest = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* A runtime-agnostic collection of methods for working with the WebCrypto API
|
|
6
|
+
* @module
|
|
7
|
+
*/
|
|
4
8
|
var digest_js_1 = require("./digest.js");
|
|
5
9
|
Object.defineProperty(exports, "digest", { enumerable: true, get: function () { return digest_js_1.digest; } });
|
|
6
10
|
var getRandomValues_js_1 = require("./getRandomValues.js");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAe/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAYvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEtD"}
|
|
1
|
+
{"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAe/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAYvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEtD"}
|
|
@@ -23,6 +23,10 @@ export type ParsedAuthenticatorData = {
|
|
|
23
23
|
extensionsData?: AuthenticationExtensionsAuthenticatorOutputs;
|
|
24
24
|
extensionsDataBuffer?: Uint8Array;
|
|
25
25
|
};
|
|
26
|
+
/**
|
|
27
|
+
* Make it possible to stub the return value during testing
|
|
28
|
+
* @ignore Don't include this in docs output
|
|
29
|
+
*/
|
|
26
30
|
export declare const _parseAuthenticatorDataInternals: {
|
|
27
31
|
stubThis: (value: ParsedAuthenticatorData) => ParsedAuthenticatorData;
|
|
28
32
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAE7C,MAAM,oCAAoC,CAAC;AAI5C;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC;
|
|
1
|
+
{"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAE7C,MAAM,oCAAoC,CAAC;AAI5C;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
|
|
@@ -101,7 +101,10 @@ function parseAuthenticatorData(authData) {
|
|
|
101
101
|
extensionsDataBuffer,
|
|
102
102
|
});
|
|
103
103
|
}
|
|
104
|
-
|
|
104
|
+
/**
|
|
105
|
+
* Make it possible to stub the return value during testing
|
|
106
|
+
* @ignore Don't include this in docs output
|
|
107
|
+
*/
|
|
105
108
|
exports._parseAuthenticatorDataInternals = {
|
|
106
109
|
stubThis: (value) => value,
|
|
107
110
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parseBackupFlags.d.ts","sourceRoot":"","sources":["../../src/helpers/parseBackupFlags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"parseBackupFlags.d.ts","sourceRoot":"","sources":["../../src/helpers/parseBackupFlags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG;IAC1E,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAeA;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Traverse an array of PEM certificates and ensure they form a proper chain
|
|
3
|
-
* @param
|
|
4
|
-
* @param
|
|
3
|
+
* @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
|
|
4
|
+
* @param trustAnchorsPEM PEM-formatted certs that an attestation statement x5c may chain back to
|
|
5
5
|
*/
|
|
6
|
-
export declare function validateCertificatePath(
|
|
6
|
+
export declare function validateCertificatePath(x5cCertsPEM: string[], trustAnchorsPEM?: string[]): Promise<boolean>;
|
|
7
7
|
//# sourceMappingURL=validateCertificatePath.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsClB"}
|
|
@@ -9,23 +9,22 @@ const getCertificateInfo_js_1 = require("./getCertificateInfo.js");
|
|
|
9
9
|
const convertPEMToBytes_js_1 = require("./convertPEMToBytes.js");
|
|
10
10
|
/**
|
|
11
11
|
* Traverse an array of PEM certificates and ensure they form a proper chain
|
|
12
|
-
* @param
|
|
13
|
-
* @param
|
|
12
|
+
* @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
|
|
13
|
+
* @param trustAnchorsPEM PEM-formatted certs that an attestation statement x5c may chain back to
|
|
14
14
|
*/
|
|
15
|
-
async function validateCertificatePath(
|
|
16
|
-
if (
|
|
17
|
-
// We have no
|
|
18
|
-
// TODO: Is this going to be acceptable default behavior??
|
|
15
|
+
async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
|
|
16
|
+
if (trustAnchorsPEM.length === 0) {
|
|
17
|
+
// We have no trust anchors to chain back to, so skip path validation
|
|
19
18
|
return true;
|
|
20
19
|
}
|
|
21
20
|
let invalidSubjectAndIssuerError = false;
|
|
22
21
|
let certificateNotYetValidOrExpiredErrorMessage = undefined;
|
|
23
|
-
for (const
|
|
22
|
+
for (const anchorPEM of trustAnchorsPEM) {
|
|
24
23
|
try {
|
|
25
|
-
const
|
|
26
|
-
await _validatePath(
|
|
24
|
+
const certsWithTrustAnchor = x5cCertsPEM.concat([anchorPEM]);
|
|
25
|
+
await _validatePath(certsWithTrustAnchor);
|
|
27
26
|
// If we successfully validated a path then there's no need to continue. Reset any existing
|
|
28
|
-
// errors that were thrown by earlier
|
|
27
|
+
// errors that were thrown by earlier trust anchors
|
|
29
28
|
invalidSubjectAndIssuerError = false;
|
|
30
29
|
certificateNotYetValidOrExpiredErrorMessage = undefined;
|
|
31
30
|
break;
|
|
@@ -42,7 +41,7 @@ async function validateCertificatePath(certificates, rootCertificates = []) {
|
|
|
42
41
|
}
|
|
43
42
|
}
|
|
44
43
|
}
|
|
45
|
-
// We tried multiple
|
|
44
|
+
// We tried multiple trust anchors and none of them worked
|
|
46
45
|
if (invalidSubjectAndIssuerError) {
|
|
47
46
|
throw new InvalidSubjectAndIssuer();
|
|
48
47
|
}
|
|
@@ -51,64 +50,81 @@ async function validateCertificatePath(certificates, rootCertificates = []) {
|
|
|
51
50
|
}
|
|
52
51
|
return true;
|
|
53
52
|
}
|
|
54
|
-
|
|
55
|
-
|
|
53
|
+
/**
|
|
54
|
+
* @param x5cCerts X.509 `x5c` certs in PEM string format
|
|
55
|
+
* @param anchorCert X.509 trust anchor cert in PEM string format
|
|
56
|
+
*/
|
|
57
|
+
async function _validatePath(x5cCertsWithTrustAnchorPEM) {
|
|
58
|
+
if (new Set(x5cCertsWithTrustAnchorPEM).size !== x5cCertsWithTrustAnchorPEM.length) {
|
|
56
59
|
throw new Error('Invalid certificate path: found duplicate certificates');
|
|
57
60
|
}
|
|
58
|
-
//
|
|
59
|
-
for (
|
|
60
|
-
const
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
issuerPem = certificates[i + 1];
|
|
69
|
-
}
|
|
61
|
+
// Make sure no certs are revoked, and all are within their time validity window
|
|
62
|
+
for (const certificatePEM of x5cCertsWithTrustAnchorPEM) {
|
|
63
|
+
const certInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(certificatePEM));
|
|
64
|
+
await assertCertNotRevoked(certInfo.parsedCertificate);
|
|
65
|
+
assertCertIsWithinValidTimeWindow(certInfo, certificatePEM);
|
|
66
|
+
}
|
|
67
|
+
// Make sure each x5c cert is issued by the next certificate in the chain
|
|
68
|
+
for (let i = 0; i < (x5cCertsWithTrustAnchorPEM.length - 1); i += 1) {
|
|
69
|
+
const subjectPem = x5cCertsWithTrustAnchorPEM[i];
|
|
70
|
+
const issuerPem = x5cCertsWithTrustAnchorPEM[i + 1];
|
|
70
71
|
const subjectInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(subjectPem));
|
|
71
72
|
const issuerInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPem));
|
|
72
|
-
|
|
73
|
-
// Check for certificate revocation
|
|
74
|
-
const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(x509Subject);
|
|
75
|
-
if (subjectCertRevoked) {
|
|
76
|
-
throw new Error(`Found revoked certificate in certificate path`);
|
|
77
|
-
}
|
|
78
|
-
// Check that intermediate certificate is within its valid time window
|
|
79
|
-
const { notBefore, notAfter } = issuerInfo;
|
|
80
|
-
const now = new Date(Date.now());
|
|
81
|
-
if (notBefore > now || notAfter < now) {
|
|
82
|
-
if (isLeafCert) {
|
|
83
|
-
throw new CertificateNotYetValidOrExpired(`Leaf certificate is not yet valid or expired: ${issuerPem}`);
|
|
84
|
-
}
|
|
85
|
-
else if (isRootCert) {
|
|
86
|
-
throw new CertificateNotYetValidOrExpired(`Root certificate is not yet valid or expired: ${issuerPem}`);
|
|
87
|
-
}
|
|
88
|
-
else {
|
|
89
|
-
throw new CertificateNotYetValidOrExpired(`Intermediate certificate is not yet valid or expired: ${issuerPem}`);
|
|
90
|
-
}
|
|
91
|
-
}
|
|
73
|
+
// Make sure subject issuer is issuer subject
|
|
92
74
|
if (subjectInfo.issuer.combined !== issuerInfo.subject.combined) {
|
|
93
75
|
throw new InvalidSubjectAndIssuer();
|
|
94
76
|
}
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
const verified = await (0, verifySignature_js_1.verifySignature)({
|
|
101
|
-
data: new Uint8Array(data),
|
|
102
|
-
signature: new Uint8Array(signature),
|
|
103
|
-
x509Certificate: issuerCertBytes,
|
|
104
|
-
hashAlgorithm: signatureAlgorithm,
|
|
105
|
-
});
|
|
106
|
-
if (!verified) {
|
|
107
|
-
throw new Error('Invalid certificate path: invalid signature');
|
|
77
|
+
const issuerCertIsRootCert = issuerInfo.issuer.combined === issuerInfo.subject.combined;
|
|
78
|
+
await assertSubjectIsSignedByIssuer(subjectInfo.parsedCertificate, issuerPem);
|
|
79
|
+
// Perform one final check if the issuer cert is also a root certificate
|
|
80
|
+
if (issuerCertIsRootCert) {
|
|
81
|
+
await assertSubjectIsSignedByIssuer(issuerInfo.parsedCertificate, issuerPem);
|
|
108
82
|
}
|
|
109
83
|
}
|
|
110
84
|
return true;
|
|
111
85
|
}
|
|
86
|
+
/**
|
|
87
|
+
* Check if the certificate is revoked or not. If it is, raise an error
|
|
88
|
+
*/
|
|
89
|
+
async function assertCertNotRevoked(certificate) {
|
|
90
|
+
// Check for certificate revocation
|
|
91
|
+
const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate);
|
|
92
|
+
if (subjectCertRevoked) {
|
|
93
|
+
throw new Error(`Found revoked certificate in certificate path`);
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
/**
|
|
97
|
+
* Require the cert to be within its notBefore and notAfter time window
|
|
98
|
+
*
|
|
99
|
+
* @param certInfo Parsed cert information
|
|
100
|
+
* @param certPEM PEM-formatted certificate, for error reporting
|
|
101
|
+
*/
|
|
102
|
+
function assertCertIsWithinValidTimeWindow(certInfo, certPEM) {
|
|
103
|
+
const { notBefore, notAfter } = certInfo;
|
|
104
|
+
const now = new Date(Date.now());
|
|
105
|
+
if (notBefore > now || notAfter < now) {
|
|
106
|
+
throw new CertificateNotYetValidOrExpired(`Certificate is not yet valid or expired: ${certPEM}`);
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
/**
|
|
110
|
+
* Ensure that the subject cert has been signed by the next cert in the chain
|
|
111
|
+
*/
|
|
112
|
+
async function assertSubjectIsSignedByIssuer(subjectCert, issuerPEM) {
|
|
113
|
+
// Verify the subject certificate's signature with the issuer cert's public key
|
|
114
|
+
const data = asn1_schema_1.AsnSerializer.serialize(subjectCert.tbsCertificate);
|
|
115
|
+
const signature = subjectCert.signatureValue;
|
|
116
|
+
const signatureAlgorithm = (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(subjectCert.signatureAlgorithm.algorithm);
|
|
117
|
+
const issuerCertBytes = (0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPEM);
|
|
118
|
+
const verified = await (0, verifySignature_js_1.verifySignature)({
|
|
119
|
+
data: new Uint8Array(data),
|
|
120
|
+
signature: new Uint8Array(signature),
|
|
121
|
+
x509Certificate: issuerCertBytes,
|
|
122
|
+
hashAlgorithm: signatureAlgorithm,
|
|
123
|
+
});
|
|
124
|
+
if (!verified) {
|
|
125
|
+
throw new InvalidSubjectSignatureForIssuer();
|
|
126
|
+
}
|
|
127
|
+
}
|
|
112
128
|
// Custom errors to help pass on certain errors
|
|
113
129
|
class InvalidSubjectAndIssuer extends Error {
|
|
114
130
|
constructor() {
|
|
@@ -117,6 +133,13 @@ class InvalidSubjectAndIssuer extends Error {
|
|
|
117
133
|
this.name = 'InvalidSubjectAndIssuer';
|
|
118
134
|
}
|
|
119
135
|
}
|
|
136
|
+
class InvalidSubjectSignatureForIssuer extends Error {
|
|
137
|
+
constructor() {
|
|
138
|
+
const message = 'Subject signature was invalid for issuer';
|
|
139
|
+
super(message);
|
|
140
|
+
this.name = 'InvalidSubjectSignatureForIssuer';
|
|
141
|
+
}
|
|
142
|
+
}
|
|
120
143
|
class CertificateNotYetValidOrExpired extends Error {
|
|
121
144
|
constructor(message) {
|
|
122
145
|
super(message);
|
|
@@ -9,6 +9,10 @@ export declare function verifySignature(opts: {
|
|
|
9
9
|
x509Certificate?: Uint8Array;
|
|
10
10
|
hashAlgorithm?: COSEALG;
|
|
11
11
|
}): Promise<boolean>;
|
|
12
|
+
/**
|
|
13
|
+
* Make it possible to stub the return value during testing
|
|
14
|
+
* @ignore Don't include this in docs output
|
|
15
|
+
*/
|
|
12
16
|
export declare const _verifySignatureInternals: {
|
|
13
17
|
stubThis: (value: Promise<boolean>) => Promise<boolean>;
|
|
14
18
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAKnD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;
|
|
1
|
+
{"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAKnD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
|
|
@@ -30,7 +30,10 @@ function verifySignature(opts) {
|
|
|
30
30
|
shaHashOverride: hashAlgorithm,
|
|
31
31
|
}));
|
|
32
32
|
}
|
|
33
|
-
|
|
33
|
+
/**
|
|
34
|
+
* Make it possible to stub the return value during testing
|
|
35
|
+
* @ignore Don't include this in docs output
|
|
36
|
+
*/
|
|
34
37
|
exports._verifySignatureInternals = {
|
|
35
38
|
stubThis: (value) => value,
|
|
36
39
|
};
|
package/script/index.d.ts
CHANGED
|
@@ -1,18 +1,9 @@
|
|
|
1
|
-
|
|
2
|
-
*
|
|
3
|
-
*
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
import { MetadataService } from './services/metadataService.js';
|
|
10
|
-
import { SettingsService } from './services/settingsService.js';
|
|
11
|
-
export { generateAuthenticationOptions, generateRegistrationOptions, MetadataService, SettingsService, verifyAuthenticationResponse, verifyRegistrationResponse, };
|
|
12
|
-
import type { GenerateRegistrationOptionsOpts } from './registration/generateRegistrationOptions.js';
|
|
13
|
-
import type { GenerateAuthenticationOptionsOpts } from './authentication/generateAuthenticationOptions.js';
|
|
14
|
-
import type { MetadataStatement } from './metadata/mdsTypes.js';
|
|
15
|
-
import type { VerifiedRegistrationResponse, VerifyRegistrationResponseOpts } from './registration/verifyRegistrationResponse.js';
|
|
16
|
-
import type { VerifiedAuthenticationResponse, VerifyAuthenticationResponseOpts } from './authentication/verifyAuthenticationResponse.js';
|
|
17
|
-
export type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, MetadataStatement, VerifiedAuthenticationResponse, VerifiedRegistrationResponse, VerifyAuthenticationResponseOpts, VerifyRegistrationResponseOpts, };
|
|
1
|
+
export * from './registration/generateRegistrationOptions.js';
|
|
2
|
+
export * from './registration/verifyRegistrationResponse.js';
|
|
3
|
+
export * from './authentication/generateAuthenticationOptions.js';
|
|
4
|
+
export * from './authentication/verifyAuthenticationResponse.js';
|
|
5
|
+
export * from './services/metadataService.js';
|
|
6
|
+
export * from './services/settingsService.js';
|
|
7
|
+
export * from './metadata/mdsTypes.js';
|
|
8
|
+
export * from './types/index.js';
|
|
18
9
|
//# sourceMappingURL=index.d.ts.map
|
package/script/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}
|