@simplewebauthn/server 13.1.1 → 13.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/authentication/generateAuthenticationOptions.d.ts +2 -2
- package/esm/authentication/generateAuthenticationOptions.d.ts.map +1 -1
- package/esm/authentication/generateAuthenticationOptions.js +1 -1
- package/esm/helpers/convertAAGUIDToString.d.ts +2 -1
- package/esm/helpers/convertAAGUIDToString.d.ts.map +1 -1
- package/esm/helpers/convertCOSEtoPKCS.d.ts +2 -1
- package/esm/helpers/convertCOSEtoPKCS.d.ts.map +1 -1
- package/esm/helpers/convertCertBufferToPEM.d.ts +2 -2
- package/esm/helpers/convertCertBufferToPEM.d.ts.map +1 -1
- package/esm/helpers/convertPEMToBytes.d.ts +2 -1
- package/esm/helpers/convertPEMToBytes.d.ts.map +1 -1
- package/esm/helpers/convertX509PublicKeyToCOSE.d.ts +2 -1
- package/esm/helpers/convertX509PublicKeyToCOSE.d.ts.map +1 -1
- package/esm/helpers/convertX509PublicKeyToCOSE.js +2 -2
- package/esm/helpers/cose.d.ts +11 -10
- package/esm/helpers/cose.d.ts.map +1 -1
- package/esm/helpers/cose.js +0 -11
- package/esm/helpers/decodeAttestationObject.d.ts +8 -7
- package/esm/helpers/decodeAttestationObject.d.ts.map +1 -1
- package/esm/helpers/decodeAuthenticatorExtensions.d.ts +2 -1
- package/esm/helpers/decodeAuthenticatorExtensions.d.ts.map +1 -1
- package/esm/helpers/decodeCredentialPublicKey.d.ts +3 -2
- package/esm/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
- package/esm/helpers/generateChallenge.d.ts +3 -2
- package/esm/helpers/generateChallenge.d.ts.map +1 -1
- package/esm/helpers/generateUserID.d.ts +3 -2
- package/esm/helpers/generateUserID.d.ts.map +1 -1
- package/esm/helpers/getCertificateInfo.d.ts +2 -1
- package/esm/helpers/getCertificateInfo.d.ts.map +1 -1
- package/esm/helpers/isCertRevoked.d.ts +2 -2
- package/esm/helpers/isCertRevoked.d.ts.map +1 -1
- package/esm/helpers/isCertRevoked.js +19 -22
- package/esm/helpers/iso/isoBase64URL.d.ts +3 -3
- package/esm/helpers/iso/isoBase64URL.d.ts.map +1 -1
- package/esm/helpers/iso/isoBase64URL.js +1 -1
- package/esm/helpers/iso/isoCBOR.d.ts +3 -2
- package/esm/helpers/iso/isoCBOR.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/digest.d.ts +3 -2
- package/esm/helpers/iso/isoCrypto/digest.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/getRandomValues.d.ts +2 -1
- package/esm/helpers/iso/isoCrypto/getRandomValues.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts +2 -1
- package/esm/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/verify.d.ts +4 -3
- package/esm/helpers/iso/isoCrypto/verify.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts +4 -3
- package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts +4 -3
- package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts.map +1 -1
- package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts +4 -3
- package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts.map +1 -1
- package/esm/helpers/iso/isoUint8Array.d.ts +9 -8
- package/esm/helpers/iso/isoUint8Array.d.ts.map +1 -1
- package/esm/helpers/matchExpectedRPID.d.ts +2 -1
- package/esm/helpers/matchExpectedRPID.d.ts.map +1 -1
- package/esm/helpers/parseAuthenticatorData.d.ts +10 -9
- package/esm/helpers/parseAuthenticatorData.d.ts.map +1 -1
- package/esm/helpers/toHash.d.ts +3 -2
- package/esm/helpers/toHash.d.ts.map +1 -1
- package/esm/helpers/validateCertificatePath.d.ts.map +1 -1
- package/esm/helpers/validateCertificatePath.js +85 -90
- package/esm/helpers/validateExtFIDOGenCEAAGUID.d.ts +3 -2
- package/esm/helpers/validateExtFIDOGenCEAAGUID.d.ts.map +1 -1
- package/esm/helpers/verifySignature.d.ts +5 -4
- package/esm/helpers/verifySignature.d.ts.map +1 -1
- package/esm/metadata/verifyAttestationWithMetadata.d.ts +3 -2
- package/esm/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
- package/esm/metadata/verifyJWT.d.ts +2 -1
- package/esm/metadata/verifyJWT.d.ts.map +1 -1
- package/esm/registration/generateRegistrationOptions.d.ts +3 -3
- package/esm/registration/generateRegistrationOptions.d.ts.map +1 -1
- package/esm/registration/verifications/tpm/parseCertInfo.d.ts +9 -8
- package/esm/registration/verifications/tpm/parseCertInfo.d.ts.map +1 -1
- package/esm/registration/verifications/tpm/parsePubArea.d.ts +4 -3
- package/esm/registration/verifications/tpm/parsePubArea.d.ts.map +1 -1
- package/esm/registration/verifications/tpm/verifyAttestationTPM.d.ts.map +1 -1
- package/esm/registration/verifications/verifyAttestationAndroidKey.js +2 -2
- package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map +1 -1
- package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.js +2 -2
- package/esm/registration/verifyRegistrationResponse.d.ts +16 -10
- package/esm/registration/verifyRegistrationResponse.d.ts.map +1 -1
- package/esm/registration/verifyRegistrationResponse.js +12 -10
- package/esm/services/defaultRootCerts/mds.d.ts +1 -1
- package/esm/services/defaultRootCerts/mds.d.ts.map +1 -1
- package/esm/services/defaultRootCerts/mds.js +20 -20
- package/esm/services/metadataService.d.ts +2 -1
- package/esm/services/metadataService.d.ts.map +1 -1
- package/esm/services/metadataService.js +1 -1
- package/esm/services/settingsService.d.ts +2 -1
- package/esm/services/settingsService.d.ts.map +1 -1
- package/esm/types/dom.d.ts +1 -1
- package/esm/types/dom.d.ts.map +1 -1
- package/esm/types/index.d.ts +17 -2
- package/esm/types/index.d.ts.map +1 -1
- package/package.json +3 -2
- package/script/authentication/generateAuthenticationOptions.d.ts +2 -2
- package/script/authentication/generateAuthenticationOptions.d.ts.map +1 -1
- package/script/authentication/generateAuthenticationOptions.js +1 -1
- package/script/helpers/convertAAGUIDToString.d.ts +2 -1
- package/script/helpers/convertAAGUIDToString.d.ts.map +1 -1
- package/script/helpers/convertCOSEtoPKCS.d.ts +2 -1
- package/script/helpers/convertCOSEtoPKCS.d.ts.map +1 -1
- package/script/helpers/convertCertBufferToPEM.d.ts +2 -2
- package/script/helpers/convertCertBufferToPEM.d.ts.map +1 -1
- package/script/helpers/convertPEMToBytes.d.ts +2 -1
- package/script/helpers/convertPEMToBytes.d.ts.map +1 -1
- package/script/helpers/convertX509PublicKeyToCOSE.d.ts +2 -1
- package/script/helpers/convertX509PublicKeyToCOSE.d.ts.map +1 -1
- package/script/helpers/convertX509PublicKeyToCOSE.js +2 -2
- package/script/helpers/cose.d.ts +11 -10
- package/script/helpers/cose.d.ts.map +1 -1
- package/script/helpers/cose.js +0 -11
- package/script/helpers/decodeAttestationObject.d.ts +8 -7
- package/script/helpers/decodeAttestationObject.d.ts.map +1 -1
- package/script/helpers/decodeAuthenticatorExtensions.d.ts +2 -1
- package/script/helpers/decodeAuthenticatorExtensions.d.ts.map +1 -1
- package/script/helpers/decodeCredentialPublicKey.d.ts +3 -2
- package/script/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
- package/script/helpers/generateChallenge.d.ts +3 -2
- package/script/helpers/generateChallenge.d.ts.map +1 -1
- package/script/helpers/generateUserID.d.ts +3 -2
- package/script/helpers/generateUserID.d.ts.map +1 -1
- package/script/helpers/getCertificateInfo.d.ts +2 -1
- package/script/helpers/getCertificateInfo.d.ts.map +1 -1
- package/script/helpers/isCertRevoked.d.ts +2 -2
- package/script/helpers/isCertRevoked.d.ts.map +1 -1
- package/script/helpers/isCertRevoked.js +19 -22
- package/script/helpers/iso/isoBase64URL.d.ts +3 -3
- package/script/helpers/iso/isoBase64URL.d.ts.map +1 -1
- package/script/helpers/iso/isoBase64URL.js +1 -1
- package/script/helpers/iso/isoCBOR.d.ts +3 -2
- package/script/helpers/iso/isoCBOR.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/digest.d.ts +3 -2
- package/script/helpers/iso/isoCrypto/digest.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/getRandomValues.d.ts +2 -1
- package/script/helpers/iso/isoCrypto/getRandomValues.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts +2 -1
- package/script/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/verify.d.ts +4 -3
- package/script/helpers/iso/isoCrypto/verify.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/verifyEC2.d.ts +4 -3
- package/script/helpers/iso/isoCrypto/verifyEC2.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/verifyOKP.d.ts +4 -3
- package/script/helpers/iso/isoCrypto/verifyOKP.d.ts.map +1 -1
- package/script/helpers/iso/isoCrypto/verifyRSA.d.ts +4 -3
- package/script/helpers/iso/isoCrypto/verifyRSA.d.ts.map +1 -1
- package/script/helpers/iso/isoUint8Array.d.ts +9 -8
- package/script/helpers/iso/isoUint8Array.d.ts.map +1 -1
- package/script/helpers/iso/isoUint8Array.js +4 -4
- package/script/helpers/matchExpectedRPID.d.ts +2 -1
- package/script/helpers/matchExpectedRPID.d.ts.map +1 -1
- package/script/helpers/parseAuthenticatorData.d.ts +10 -9
- package/script/helpers/parseAuthenticatorData.d.ts.map +1 -1
- package/script/helpers/toHash.d.ts +3 -2
- package/script/helpers/toHash.d.ts.map +1 -1
- package/script/helpers/validateCertificatePath.d.ts.map +1 -1
- package/script/helpers/validateCertificatePath.js +85 -90
- package/script/helpers/validateExtFIDOGenCEAAGUID.d.ts +3 -2
- package/script/helpers/validateExtFIDOGenCEAAGUID.d.ts.map +1 -1
- package/script/helpers/verifySignature.d.ts +5 -4
- package/script/helpers/verifySignature.d.ts.map +1 -1
- package/script/metadata/verifyAttestationWithMetadata.d.ts +3 -2
- package/script/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
- package/script/metadata/verifyJWT.d.ts +2 -1
- package/script/metadata/verifyJWT.d.ts.map +1 -1
- package/script/registration/generateRegistrationOptions.d.ts +3 -3
- package/script/registration/generateRegistrationOptions.d.ts.map +1 -1
- package/script/registration/verifications/tpm/parseCertInfo.d.ts +9 -8
- package/script/registration/verifications/tpm/parseCertInfo.d.ts.map +1 -1
- package/script/registration/verifications/tpm/parsePubArea.d.ts +4 -3
- package/script/registration/verifications/tpm/parsePubArea.d.ts.map +1 -1
- package/script/registration/verifications/tpm/verifyAttestationTPM.d.ts.map +1 -1
- package/script/registration/verifications/verifyAttestationAndroidKey.js +2 -2
- package/script/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map +1 -1
- package/script/registration/verifications/verifyAttestationAndroidSafetyNet.js +2 -2
- package/script/registration/verifyRegistrationResponse.d.ts +16 -10
- package/script/registration/verifyRegistrationResponse.d.ts.map +1 -1
- package/script/registration/verifyRegistrationResponse.js +12 -10
- package/script/services/defaultRootCerts/mds.d.ts +1 -1
- package/script/services/defaultRootCerts/mds.d.ts.map +1 -1
- package/script/services/defaultRootCerts/mds.js +20 -20
- package/script/services/metadataService.d.ts +2 -1
- package/script/services/metadataService.d.ts.map +1 -1
- package/script/services/metadataService.js +1 -1
- package/script/services/settingsService.d.ts +2 -1
- package/script/services/settingsService.d.ts.map +1 -1
- package/script/types/dom.d.ts +1 -1
- package/script/types/dom.d.ts.map +1 -1
- package/script/types/index.d.ts +17 -2
- package/script/types/index.d.ts.map +1 -1
|
@@ -1,11 +1,12 @@
|
|
|
1
|
-
import { COSEALG, COSEPublicKey } from '../../cose.js';
|
|
1
|
+
import { type COSEALG, type COSEPublicKey } from '../../cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../../../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Verify signatures with their public key. Supports EC2 and RSA public keys.
|
|
4
5
|
*/
|
|
5
6
|
export declare function verify(opts: {
|
|
6
7
|
cosePublicKey: COSEPublicKey;
|
|
7
|
-
signature:
|
|
8
|
-
data:
|
|
8
|
+
signature: Uint8Array_;
|
|
9
|
+
data: Uint8Array_;
|
|
9
10
|
shaHashOverride?: COSEALG;
|
|
10
11
|
}): Promise<boolean>;
|
|
11
12
|
//# sourceMappingURL=verify.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,
|
|
1
|
+
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
|
-
import { COSEALG, COSEPublicKeyEC2 } from '../../cose.js';
|
|
1
|
+
import { type COSEALG, type COSEPublicKeyEC2 } from '../../cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../../../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Verify a signature using an EC2 public key
|
|
4
5
|
*/
|
|
5
6
|
export declare function verifyEC2(opts: {
|
|
6
7
|
cosePublicKey: COSEPublicKeyEC2;
|
|
7
|
-
signature:
|
|
8
|
-
data:
|
|
8
|
+
signature: Uint8Array_;
|
|
9
|
+
data: Uint8Array_;
|
|
9
10
|
shaHashOverride?: COSEALG;
|
|
10
11
|
}): Promise<boolean>;
|
|
11
12
|
//# sourceMappingURL=verifyEC2.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
|
|
@@ -1,7 +1,8 @@
|
|
|
1
|
-
import { COSEPublicKeyOKP } from '../../cose.js';
|
|
1
|
+
import { type COSEPublicKeyOKP } from '../../cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../../../types/index.js';
|
|
2
3
|
export declare function verifyOKP(opts: {
|
|
3
4
|
cosePublicKey: COSEPublicKeyOKP;
|
|
4
|
-
signature:
|
|
5
|
-
data:
|
|
5
|
+
signature: Uint8Array_;
|
|
6
|
+
data: Uint8Array_;
|
|
6
7
|
}): Promise<boolean>;
|
|
7
8
|
//# sourceMappingURL=verifyOKP.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,gBAAgB,EAAa,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
|
-
import { COSEALG, COSEPublicKeyRSA } from '../../cose.js';
|
|
1
|
+
import { type COSEALG, type COSEPublicKeyRSA } from '../../cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../../../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Verify a signature using an RSA public key
|
|
4
5
|
*/
|
|
5
6
|
export declare function verifyRSA(opts: {
|
|
6
7
|
cosePublicKey: COSEPublicKeyRSA;
|
|
7
|
-
signature:
|
|
8
|
-
data:
|
|
8
|
+
signature: Uint8Array_;
|
|
9
|
+
data: Uint8Array_;
|
|
9
10
|
shaHashOverride?: COSEALG;
|
|
10
11
|
}): Promise<boolean>;
|
|
11
12
|
//# sourceMappingURL=verifyRSA.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,gBAAgB,EAAa,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { Uint8Array_ } from '../../types/index.js';
|
|
1
2
|
/**
|
|
2
3
|
* A runtime-agnostic collection of methods for working with Uint8Arrays
|
|
3
4
|
* @module
|
|
@@ -5,37 +6,37 @@
|
|
|
5
6
|
/**
|
|
6
7
|
* Make sure two Uint8Arrays are deeply equivalent
|
|
7
8
|
*/
|
|
8
|
-
export declare function areEqual(array1:
|
|
9
|
+
export declare function areEqual(array1: Uint8Array_, array2: Uint8Array_): boolean;
|
|
9
10
|
/**
|
|
10
11
|
* Convert a Uint8Array to Hexadecimal.
|
|
11
12
|
*
|
|
12
13
|
* A replacement for `Buffer.toString('hex')`
|
|
13
14
|
*/
|
|
14
|
-
export declare function toHex(array:
|
|
15
|
+
export declare function toHex(array: Uint8Array_): string;
|
|
15
16
|
/**
|
|
16
17
|
* Convert a hexadecimal string to isoUint8Array.
|
|
17
18
|
*
|
|
18
19
|
* A replacement for `Buffer.from('...', 'hex')`
|
|
19
20
|
*/
|
|
20
|
-
export declare function fromHex(hex: string):
|
|
21
|
+
export declare function fromHex(hex: string): Uint8Array_;
|
|
21
22
|
/**
|
|
22
23
|
* Combine multiple Uint8Arrays into a single Uint8Array
|
|
23
24
|
*/
|
|
24
|
-
export declare function concat(arrays:
|
|
25
|
+
export declare function concat(arrays: Uint8Array_[]): Uint8Array_;
|
|
25
26
|
/**
|
|
26
27
|
* Convert bytes into a UTF-8 string
|
|
27
28
|
*/
|
|
28
|
-
export declare function toUTF8String(array:
|
|
29
|
+
export declare function toUTF8String(array: Uint8Array_): string;
|
|
29
30
|
/**
|
|
30
31
|
* Convert a UTF-8 string back into bytes
|
|
31
32
|
*/
|
|
32
|
-
export declare function fromUTF8String(utf8String: string):
|
|
33
|
+
export declare function fromUTF8String(utf8String: string): Uint8Array_;
|
|
33
34
|
/**
|
|
34
35
|
* Convert an ASCII string to Uint8Array
|
|
35
36
|
*/
|
|
36
|
-
export declare function fromASCIIString(value: string):
|
|
37
|
+
export declare function fromASCIIString(value: string): Uint8Array_;
|
|
37
38
|
/**
|
|
38
39
|
* Prepare a DataView we can slice our way around in as we parse the bytes in a Uint8Array
|
|
39
40
|
*/
|
|
40
|
-
export declare function toDataView(array:
|
|
41
|
+
export declare function toDataView(array: Uint8Array_): DataView;
|
|
41
42
|
//# sourceMappingURL=isoUint8Array.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAM1E;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKhD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAehD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAYzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAGvD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAG9D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAE1D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAEvD"}
|
|
@@ -1,8 +1,9 @@
|
|
|
1
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
1
2
|
/**
|
|
2
3
|
* Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
|
|
3
4
|
* that matched the hash in the response.
|
|
4
5
|
*
|
|
5
6
|
* Raises an `UnexpectedRPIDHash` error if no match is found
|
|
6
7
|
*/
|
|
7
|
-
export declare function matchExpectedRPID(rpIDHash:
|
|
8
|
+
export declare function matchExpectedRPID(rpIDHash: Uint8Array_, expectedRPIDs: string[]): Promise<string>;
|
|
8
9
|
//# sourceMappingURL=matchExpectedRPID.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"matchExpectedRPID.d.ts","sourceRoot":"","sources":["../../src/helpers/matchExpectedRPID.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"matchExpectedRPID.d.ts","sourceRoot":"","sources":["../../src/helpers/matchExpectedRPID.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,WAAW,EACrB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
|
-
import { AuthenticationExtensionsAuthenticatorOutputs } from './decodeAuthenticatorExtensions.js';
|
|
1
|
+
import { type AuthenticationExtensionsAuthenticatorOutputs } from './decodeAuthenticatorExtensions.js';
|
|
2
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Make sense of the authData buffer contained in an Attestation
|
|
4
5
|
*/
|
|
5
|
-
export declare function parseAuthenticatorData(authData:
|
|
6
|
+
export declare function parseAuthenticatorData(authData: Uint8Array_): ParsedAuthenticatorData;
|
|
6
7
|
export type ParsedAuthenticatorData = {
|
|
7
|
-
rpIdHash:
|
|
8
|
-
flagsBuf:
|
|
8
|
+
rpIdHash: Uint8Array_;
|
|
9
|
+
flagsBuf: Uint8Array_;
|
|
9
10
|
flags: {
|
|
10
11
|
up: boolean;
|
|
11
12
|
uv: boolean;
|
|
@@ -16,12 +17,12 @@ export type ParsedAuthenticatorData = {
|
|
|
16
17
|
flagsInt: number;
|
|
17
18
|
};
|
|
18
19
|
counter: number;
|
|
19
|
-
counterBuf:
|
|
20
|
-
aaguid?:
|
|
21
|
-
credentialID?:
|
|
22
|
-
credentialPublicKey?:
|
|
20
|
+
counterBuf: Uint8Array_;
|
|
21
|
+
aaguid?: Uint8Array_;
|
|
22
|
+
credentialID?: Uint8Array_;
|
|
23
|
+
credentialPublicKey?: Uint8Array_;
|
|
23
24
|
extensionsData?: AuthenticationExtensionsAuthenticatorOutputs;
|
|
24
|
-
extensionsDataBuffer?:
|
|
25
|
+
extensionsDataBuffer?: Uint8Array_;
|
|
25
26
|
};
|
|
26
27
|
/**
|
|
27
28
|
* Make it possible to stub the return value during testing
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,
|
|
1
|
+
{"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,4CAA4C,EAElD,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,WAAW,GACpB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,WAAW,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,WAAW,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
|
package/esm/helpers/toHash.d.ts
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
|
-
import { COSEALG } from './cose.js';
|
|
1
|
+
import type { COSEALG } from './cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Returns hash digest of the given data, using the given algorithm when provided. Defaults to using
|
|
4
5
|
* SHA-256.
|
|
5
6
|
*/
|
|
6
|
-
export declare function toHash(data:
|
|
7
|
+
export declare function toHash(data: Uint8Array_ | string, algorithm?: COSEALG): Promise<Uint8Array_>;
|
|
7
8
|
//# sourceMappingURL=toHash.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"toHash.d.ts","sourceRoot":"","sources":["../../src/helpers/toHash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"toHash.d.ts","sourceRoot":"","sources":["../../src/helpers/toHash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,WAAW,GAAG,MAAM,EAC1B,SAAS,GAAE,OAAY,GACtB,OAAO,CAAC,WAAW,CAAC,CAQtB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CA6HlB"}
|
|
@@ -1,9 +1,6 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { X509Certificate } from '@peculiar/x509';
|
|
2
2
|
import { isCertRevoked } from './isCertRevoked.js';
|
|
3
|
-
import {
|
|
4
|
-
import { mapX509SignatureAlgToCOSEAlg } from './mapX509SignatureAlgToCOSEAlg.js';
|
|
5
|
-
import { getCertificateInfo } from './getCertificateInfo.js';
|
|
6
|
-
import { convertPEMToBytes } from './convertPEMToBytes.js';
|
|
3
|
+
import { getWebCrypto } from './iso/isoCrypto/getWebCrypto.js';
|
|
7
4
|
/**
|
|
8
5
|
* Traverse an array of PEM certificates and ensure they form a proper chain
|
|
9
6
|
* @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
|
|
@@ -14,27 +11,97 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
|
|
|
14
11
|
// We have no trust anchors to chain back to, so skip path validation
|
|
15
12
|
return true;
|
|
16
13
|
}
|
|
14
|
+
const WebCrypto = await getWebCrypto();
|
|
15
|
+
// Prepare to work with x5c certs
|
|
16
|
+
const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
|
|
17
|
+
// Check for any expired or temporally invalid certs in x5c
|
|
18
|
+
for (let i = 0; i < x5cCertsParsed.length; i++) {
|
|
19
|
+
const cert = x5cCertsParsed[i];
|
|
20
|
+
const certPEM = x5cCertsPEM[i];
|
|
21
|
+
try {
|
|
22
|
+
await assertCertNotRevoked(cert);
|
|
23
|
+
}
|
|
24
|
+
catch (_err) {
|
|
25
|
+
throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
|
|
26
|
+
}
|
|
27
|
+
try {
|
|
28
|
+
assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
|
|
29
|
+
}
|
|
30
|
+
catch (_err) {
|
|
31
|
+
throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
// Prepare to work with trust anchor certs
|
|
35
|
+
const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
|
|
36
|
+
try {
|
|
37
|
+
return new X509Certificate(certPEM);
|
|
38
|
+
}
|
|
39
|
+
catch (err) {
|
|
40
|
+
const _err = err;
|
|
41
|
+
throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
|
|
42
|
+
}
|
|
43
|
+
});
|
|
44
|
+
// Filter out any expired or temporally invalid trust anchors certs
|
|
45
|
+
const validTrustAnchors = [];
|
|
46
|
+
for (let i = 0; i < trustAnchorsParsed.length; i++) {
|
|
47
|
+
const cert = trustAnchorsParsed[i];
|
|
48
|
+
try {
|
|
49
|
+
await assertCertNotRevoked(cert);
|
|
50
|
+
}
|
|
51
|
+
catch (_err) {
|
|
52
|
+
// Continue processing the other certs
|
|
53
|
+
continue;
|
|
54
|
+
}
|
|
55
|
+
try {
|
|
56
|
+
assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
|
|
57
|
+
}
|
|
58
|
+
catch (_err) {
|
|
59
|
+
// Continue processing the other certs
|
|
60
|
+
continue;
|
|
61
|
+
}
|
|
62
|
+
validTrustAnchors.push(cert);
|
|
63
|
+
}
|
|
64
|
+
if (validTrustAnchors.length === 0) {
|
|
65
|
+
throw new Error('No specified trust anchor was valid for verifying x5c');
|
|
66
|
+
}
|
|
67
|
+
// Try to verify x5c with each trust anchor
|
|
17
68
|
let invalidSubjectAndIssuerError = false;
|
|
18
|
-
|
|
19
|
-
for (const anchorPEM of trustAnchorsPEM) {
|
|
69
|
+
for (const anchor of trustAnchorsParsed) {
|
|
20
70
|
try {
|
|
21
|
-
const
|
|
22
|
-
|
|
71
|
+
const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
|
|
72
|
+
if (new Set(x5cWithTrustAnchor).size !== x5cWithTrustAnchor.length) {
|
|
73
|
+
throw new Error('Invalid certificate path: found duplicate certificates');
|
|
74
|
+
}
|
|
75
|
+
// Check signatures, and notBefore and notAfter
|
|
76
|
+
for (let i = 0; i < x5cWithTrustAnchor.length - 1; i++) {
|
|
77
|
+
const subject = x5cWithTrustAnchor[i];
|
|
78
|
+
const issuer = x5cWithTrustAnchor[i + 1];
|
|
79
|
+
// Leaf or intermediate cert, make sure the next cert in the chain signed it
|
|
80
|
+
const issuerSignedSubject = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
|
|
81
|
+
if (!issuerSignedSubject) {
|
|
82
|
+
throw new InvalidSubjectAndIssuer();
|
|
83
|
+
}
|
|
84
|
+
if (issuer.subject === issuer.issuer) {
|
|
85
|
+
// Root cert detected, make sure it signed itself
|
|
86
|
+
const issuerSignedIssuer = await issuer.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
|
|
87
|
+
if (!issuerSignedIssuer) {
|
|
88
|
+
throw new InvalidSubjectAndIssuer();
|
|
89
|
+
}
|
|
90
|
+
// Don't process anything else after a root cert
|
|
91
|
+
break;
|
|
92
|
+
}
|
|
93
|
+
}
|
|
23
94
|
// If we successfully validated a path then there's no need to continue. Reset any existing
|
|
24
95
|
// errors that were thrown by earlier trust anchors
|
|
25
96
|
invalidSubjectAndIssuerError = false;
|
|
26
|
-
certificateNotYetValidOrExpiredErrorMessage = undefined;
|
|
27
97
|
break;
|
|
28
98
|
}
|
|
29
99
|
catch (err) {
|
|
30
100
|
if (err instanceof InvalidSubjectAndIssuer) {
|
|
31
101
|
invalidSubjectAndIssuerError = true;
|
|
32
102
|
}
|
|
33
|
-
else if (err instanceof CertificateNotYetValidOrExpired) {
|
|
34
|
-
certificateNotYetValidOrExpiredErrorMessage = err.message;
|
|
35
|
-
}
|
|
36
103
|
else {
|
|
37
|
-
throw err;
|
|
104
|
+
throw new Error('Unexpected error while validating certificate path', { cause: err });
|
|
38
105
|
}
|
|
39
106
|
}
|
|
40
107
|
}
|
|
@@ -42,42 +109,6 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
|
|
|
42
109
|
if (invalidSubjectAndIssuerError) {
|
|
43
110
|
throw new InvalidSubjectAndIssuer();
|
|
44
111
|
}
|
|
45
|
-
else if (certificateNotYetValidOrExpiredErrorMessage) {
|
|
46
|
-
throw new CertificateNotYetValidOrExpired(certificateNotYetValidOrExpiredErrorMessage);
|
|
47
|
-
}
|
|
48
|
-
return true;
|
|
49
|
-
}
|
|
50
|
-
/**
|
|
51
|
-
* @param x5cCerts X.509 `x5c` certs in PEM string format
|
|
52
|
-
* @param anchorCert X.509 trust anchor cert in PEM string format
|
|
53
|
-
*/
|
|
54
|
-
async function _validatePath(x5cCertsWithTrustAnchorPEM) {
|
|
55
|
-
if (new Set(x5cCertsWithTrustAnchorPEM).size !== x5cCertsWithTrustAnchorPEM.length) {
|
|
56
|
-
throw new Error('Invalid certificate path: found duplicate certificates');
|
|
57
|
-
}
|
|
58
|
-
// Make sure no certs are revoked, and all are within their time validity window
|
|
59
|
-
for (const certificatePEM of x5cCertsWithTrustAnchorPEM) {
|
|
60
|
-
const certInfo = getCertificateInfo(convertPEMToBytes(certificatePEM));
|
|
61
|
-
await assertCertNotRevoked(certInfo.parsedCertificate);
|
|
62
|
-
assertCertIsWithinValidTimeWindow(certInfo, certificatePEM);
|
|
63
|
-
}
|
|
64
|
-
// Make sure each x5c cert is issued by the next certificate in the chain
|
|
65
|
-
for (let i = 0; i < (x5cCertsWithTrustAnchorPEM.length - 1); i += 1) {
|
|
66
|
-
const subjectPem = x5cCertsWithTrustAnchorPEM[i];
|
|
67
|
-
const issuerPem = x5cCertsWithTrustAnchorPEM[i + 1];
|
|
68
|
-
const subjectInfo = getCertificateInfo(convertPEMToBytes(subjectPem));
|
|
69
|
-
const issuerInfo = getCertificateInfo(convertPEMToBytes(issuerPem));
|
|
70
|
-
// Make sure subject issuer is issuer subject
|
|
71
|
-
if (subjectInfo.issuer.combined !== issuerInfo.subject.combined) {
|
|
72
|
-
throw new InvalidSubjectAndIssuer();
|
|
73
|
-
}
|
|
74
|
-
const issuerCertIsRootCert = issuerInfo.issuer.combined === issuerInfo.subject.combined;
|
|
75
|
-
await assertSubjectIsSignedByIssuer(subjectInfo.parsedCertificate, issuerPem);
|
|
76
|
-
// Perform one final check if the issuer cert is also a root certificate
|
|
77
|
-
if (issuerCertIsRootCert) {
|
|
78
|
-
await assertSubjectIsSignedByIssuer(issuerInfo.parsedCertificate, issuerPem);
|
|
79
|
-
}
|
|
80
|
-
}
|
|
81
112
|
return true;
|
|
82
113
|
}
|
|
83
114
|
/**
|
|
@@ -87,39 +118,16 @@ async function assertCertNotRevoked(certificate) {
|
|
|
87
118
|
// Check for certificate revocation
|
|
88
119
|
const subjectCertRevoked = await isCertRevoked(certificate);
|
|
89
120
|
if (subjectCertRevoked) {
|
|
90
|
-
throw new Error(
|
|
121
|
+
throw new Error('Found revoked certificate in certificate path');
|
|
91
122
|
}
|
|
92
123
|
}
|
|
93
124
|
/**
|
|
94
125
|
* Require the cert to be within its notBefore and notAfter time window
|
|
95
|
-
*
|
|
96
|
-
* @param certInfo Parsed cert information
|
|
97
|
-
* @param certPEM PEM-formatted certificate, for error reporting
|
|
98
126
|
*/
|
|
99
|
-
function assertCertIsWithinValidTimeWindow(
|
|
100
|
-
const { notBefore, notAfter } = certInfo;
|
|
127
|
+
function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
|
|
101
128
|
const now = new Date(Date.now());
|
|
102
|
-
if (
|
|
103
|
-
throw new
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
/**
|
|
107
|
-
* Ensure that the subject cert has been signed by the next cert in the chain
|
|
108
|
-
*/
|
|
109
|
-
async function assertSubjectIsSignedByIssuer(subjectCert, issuerPEM) {
|
|
110
|
-
// Verify the subject certificate's signature with the issuer cert's public key
|
|
111
|
-
const data = AsnSerializer.serialize(subjectCert.tbsCertificate);
|
|
112
|
-
const signature = subjectCert.signatureValue;
|
|
113
|
-
const signatureAlgorithm = mapX509SignatureAlgToCOSEAlg(subjectCert.signatureAlgorithm.algorithm);
|
|
114
|
-
const issuerCertBytes = convertPEMToBytes(issuerPEM);
|
|
115
|
-
const verified = await verifySignature({
|
|
116
|
-
data: new Uint8Array(data),
|
|
117
|
-
signature: new Uint8Array(signature),
|
|
118
|
-
x509Certificate: issuerCertBytes,
|
|
119
|
-
hashAlgorithm: signatureAlgorithm,
|
|
120
|
-
});
|
|
121
|
-
if (!verified) {
|
|
122
|
-
throw new InvalidSubjectSignatureForIssuer();
|
|
129
|
+
if (certNotBefore > now || certNotAfter < now) {
|
|
130
|
+
throw new Error('Certificate is not yet valid or expired');
|
|
123
131
|
}
|
|
124
132
|
}
|
|
125
133
|
// Custom errors to help pass on certain errors
|
|
@@ -130,16 +138,3 @@ class InvalidSubjectAndIssuer extends Error {
|
|
|
130
138
|
this.name = 'InvalidSubjectAndIssuer';
|
|
131
139
|
}
|
|
132
140
|
}
|
|
133
|
-
class InvalidSubjectSignatureForIssuer extends Error {
|
|
134
|
-
constructor() {
|
|
135
|
-
const message = 'Subject signature was invalid for issuer';
|
|
136
|
-
super(message);
|
|
137
|
-
this.name = 'InvalidSubjectSignatureForIssuer';
|
|
138
|
-
}
|
|
139
|
-
}
|
|
140
|
-
class CertificateNotYetValidOrExpired extends Error {
|
|
141
|
-
constructor(message) {
|
|
142
|
-
super(message);
|
|
143
|
-
this.name = 'CertificateNotYetValidOrExpired';
|
|
144
|
-
}
|
|
145
|
-
}
|
|
@@ -1,7 +1,8 @@
|
|
|
1
|
-
import { Extensions } from '@peculiar/asn1-x509';
|
|
1
|
+
import type { Extensions } from '@peculiar/asn1-x509';
|
|
2
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
|
|
4
5
|
* the attestation statement AAGUID.
|
|
5
6
|
*/
|
|
6
|
-
export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid:
|
|
7
|
+
export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid: Uint8Array_): boolean;
|
|
7
8
|
//# sourceMappingURL=validateExtFIDOGenCEAAGUID.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validateExtFIDOGenCEAAGUID.d.ts","sourceRoot":"","sources":["../../src/helpers/validateExtFIDOGenCEAAGUID.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"validateExtFIDOGenCEAAGUID.d.ts","sourceRoot":"","sources":["../../src/helpers/validateExtFIDOGenCEAAGUID.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,UAAU,GAAG,SAAS,EACtC,MAAM,EAAE,WAAW,GAClB,OAAO,CA6BT"}
|
|
@@ -1,12 +1,13 @@
|
|
|
1
1
|
import { COSEALG } from './cose.js';
|
|
2
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
2
3
|
/**
|
|
3
4
|
* Verify an authenticator's signature
|
|
4
5
|
*/
|
|
5
6
|
export declare function verifySignature(opts: {
|
|
6
|
-
signature:
|
|
7
|
-
data:
|
|
8
|
-
credentialPublicKey?:
|
|
9
|
-
x509Certificate?:
|
|
7
|
+
signature: Uint8Array_;
|
|
8
|
+
data: Uint8Array_;
|
|
9
|
+
credentialPublicKey?: Uint8Array_;
|
|
10
|
+
x509Certificate?: Uint8Array_;
|
|
10
11
|
hashAlgorithm?: COSEALG;
|
|
11
12
|
}): Promise<boolean>;
|
|
12
13
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAInD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
|
|
@@ -1,14 +1,15 @@
|
|
|
1
1
|
import type { Base64URLString } from '../types/index.js';
|
|
2
2
|
import type { AlgSign, MetadataStatement } from './mdsTypes.js';
|
|
3
3
|
import { type COSEALG, type COSECRV, COSEKTY } from '../helpers/cose.js';
|
|
4
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
4
5
|
/**
|
|
5
6
|
* Match properties of the authenticator's attestation statement against expected values as
|
|
6
7
|
* registered with the FIDO Alliance Metadata Service
|
|
7
8
|
*/
|
|
8
9
|
export declare function verifyAttestationWithMetadata({ statement, credentialPublicKey, x5c, attestationStatementAlg, }: {
|
|
9
10
|
statement: MetadataStatement;
|
|
10
|
-
credentialPublicKey:
|
|
11
|
-
x5c:
|
|
11
|
+
credentialPublicKey: Uint8Array_;
|
|
12
|
+
x5c: Uint8Array_[] | Base64URLString[];
|
|
12
13
|
attestationStatementAlg?: number;
|
|
13
14
|
}): Promise<boolean>;
|
|
14
15
|
type COSEInfo = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { Uint8Array_ } from '../types/index.js';
|
|
1
2
|
/**
|
|
2
3
|
* Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
|
|
3
4
|
*
|
|
@@ -7,5 +8,5 @@
|
|
|
7
8
|
*
|
|
8
9
|
* (Pulled from https://www.rfc-editor.org/rfc/rfc7515#section-4.1.1)
|
|
9
10
|
*/
|
|
10
|
-
export declare function verifyJWT(jwt: string, leafCert:
|
|
11
|
+
export declare function verifyJWT(jwt: string, leafCert: Uint8Array_): Promise<boolean>;
|
|
11
12
|
//# sourceMappingURL=verifyJWT.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B9E"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON } from '../types/index.js';
|
|
1
|
+
import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
|
|
2
2
|
export type GenerateRegistrationOptionsOpts = Parameters<typeof generateRegistrationOptions>[0];
|
|
3
3
|
/**
|
|
4
4
|
* Supported crypto algo identifiers
|
|
@@ -29,8 +29,8 @@ export declare function generateRegistrationOptions(options: {
|
|
|
29
29
|
rpName: string;
|
|
30
30
|
rpID: string;
|
|
31
31
|
userName: string;
|
|
32
|
-
userID?:
|
|
33
|
-
challenge?: string |
|
|
32
|
+
userID?: Uint8Array_;
|
|
33
|
+
challenge?: string | Uint8Array_;
|
|
34
34
|
userDisplayName?: string;
|
|
35
35
|
timeout?: number;
|
|
36
36
|
attestationType?: 'direct' | 'enterprise' | 'none';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,
|
|
1
|
+
{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
|
|
@@ -1,24 +1,25 @@
|
|
|
1
|
+
import type { Uint8Array_ } from '../../../types/index.js';
|
|
1
2
|
/**
|
|
2
3
|
* Cut up a TPM attestation's certInfo into intelligible chunks
|
|
3
4
|
*/
|
|
4
|
-
export declare function parseCertInfo(certInfo:
|
|
5
|
+
export declare function parseCertInfo(certInfo: Uint8Array_): ParsedCertInfo;
|
|
5
6
|
type ParsedCertInfo = {
|
|
6
7
|
magic: number;
|
|
7
8
|
type: string;
|
|
8
|
-
qualifiedSigner:
|
|
9
|
-
extraData:
|
|
9
|
+
qualifiedSigner: Uint8Array_;
|
|
10
|
+
extraData: Uint8Array_;
|
|
10
11
|
clockInfo: {
|
|
11
|
-
clock:
|
|
12
|
+
clock: Uint8Array_;
|
|
12
13
|
resetCount: number;
|
|
13
14
|
restartCount: number;
|
|
14
15
|
safe: boolean;
|
|
15
16
|
};
|
|
16
|
-
firmwareVersion:
|
|
17
|
+
firmwareVersion: Uint8Array_;
|
|
17
18
|
attested: {
|
|
18
19
|
nameAlg: string;
|
|
19
|
-
nameAlgBuffer:
|
|
20
|
-
name:
|
|
21
|
-
qualifiedName:
|
|
20
|
+
nameAlgBuffer: Uint8Array_;
|
|
21
|
+
name: Uint8Array_;
|
|
22
|
+
qualifiedName: Uint8Array_;
|
|
22
23
|
};
|
|
23
24
|
};
|
|
24
25
|
export {};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parseCertInfo.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parseCertInfo.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"parseCertInfo.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parseCertInfo.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAkEnE;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,WAAW,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE;QACT,KAAK,EAAE,WAAW,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC;KACf,CAAC;IACF,eAAe,EAAE,WAAW,CAAC;IAC7B,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,WAAW,CAAC;QAC3B,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,EAAE,WAAW,CAAC;KAC5B,CAAC;CACH,CAAC"}
|