@simplewebauthn/server 13.1.1 → 13.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (190) hide show
  1. package/esm/authentication/generateAuthenticationOptions.d.ts +2 -2
  2. package/esm/authentication/generateAuthenticationOptions.d.ts.map +1 -1
  3. package/esm/authentication/generateAuthenticationOptions.js +1 -1
  4. package/esm/helpers/convertAAGUIDToString.d.ts +2 -1
  5. package/esm/helpers/convertAAGUIDToString.d.ts.map +1 -1
  6. package/esm/helpers/convertCOSEtoPKCS.d.ts +2 -1
  7. package/esm/helpers/convertCOSEtoPKCS.d.ts.map +1 -1
  8. package/esm/helpers/convertCertBufferToPEM.d.ts +2 -2
  9. package/esm/helpers/convertCertBufferToPEM.d.ts.map +1 -1
  10. package/esm/helpers/convertPEMToBytes.d.ts +2 -1
  11. package/esm/helpers/convertPEMToBytes.d.ts.map +1 -1
  12. package/esm/helpers/convertX509PublicKeyToCOSE.d.ts +2 -1
  13. package/esm/helpers/convertX509PublicKeyToCOSE.d.ts.map +1 -1
  14. package/esm/helpers/convertX509PublicKeyToCOSE.js +2 -2
  15. package/esm/helpers/cose.d.ts +11 -10
  16. package/esm/helpers/cose.d.ts.map +1 -1
  17. package/esm/helpers/cose.js +0 -11
  18. package/esm/helpers/decodeAttestationObject.d.ts +8 -7
  19. package/esm/helpers/decodeAttestationObject.d.ts.map +1 -1
  20. package/esm/helpers/decodeAuthenticatorExtensions.d.ts +2 -1
  21. package/esm/helpers/decodeAuthenticatorExtensions.d.ts.map +1 -1
  22. package/esm/helpers/decodeCredentialPublicKey.d.ts +3 -2
  23. package/esm/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
  24. package/esm/helpers/generateChallenge.d.ts +3 -2
  25. package/esm/helpers/generateChallenge.d.ts.map +1 -1
  26. package/esm/helpers/generateUserID.d.ts +3 -2
  27. package/esm/helpers/generateUserID.d.ts.map +1 -1
  28. package/esm/helpers/getCertificateInfo.d.ts +2 -1
  29. package/esm/helpers/getCertificateInfo.d.ts.map +1 -1
  30. package/esm/helpers/isCertRevoked.d.ts +2 -2
  31. package/esm/helpers/isCertRevoked.d.ts.map +1 -1
  32. package/esm/helpers/isCertRevoked.js +19 -22
  33. package/esm/helpers/iso/isoBase64URL.d.ts +3 -3
  34. package/esm/helpers/iso/isoBase64URL.d.ts.map +1 -1
  35. package/esm/helpers/iso/isoBase64URL.js +1 -1
  36. package/esm/helpers/iso/isoCBOR.d.ts +3 -2
  37. package/esm/helpers/iso/isoCBOR.d.ts.map +1 -1
  38. package/esm/helpers/iso/isoCrypto/digest.d.ts +3 -2
  39. package/esm/helpers/iso/isoCrypto/digest.d.ts.map +1 -1
  40. package/esm/helpers/iso/isoCrypto/getRandomValues.d.ts +2 -1
  41. package/esm/helpers/iso/isoCrypto/getRandomValues.d.ts.map +1 -1
  42. package/esm/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts +2 -1
  43. package/esm/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts.map +1 -1
  44. package/esm/helpers/iso/isoCrypto/verify.d.ts +4 -3
  45. package/esm/helpers/iso/isoCrypto/verify.d.ts.map +1 -1
  46. package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts +4 -3
  47. package/esm/helpers/iso/isoCrypto/verifyEC2.d.ts.map +1 -1
  48. package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts +4 -3
  49. package/esm/helpers/iso/isoCrypto/verifyOKP.d.ts.map +1 -1
  50. package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts +4 -3
  51. package/esm/helpers/iso/isoCrypto/verifyRSA.d.ts.map +1 -1
  52. package/esm/helpers/iso/isoUint8Array.d.ts +9 -8
  53. package/esm/helpers/iso/isoUint8Array.d.ts.map +1 -1
  54. package/esm/helpers/matchExpectedRPID.d.ts +2 -1
  55. package/esm/helpers/matchExpectedRPID.d.ts.map +1 -1
  56. package/esm/helpers/parseAuthenticatorData.d.ts +10 -9
  57. package/esm/helpers/parseAuthenticatorData.d.ts.map +1 -1
  58. package/esm/helpers/toHash.d.ts +3 -2
  59. package/esm/helpers/toHash.d.ts.map +1 -1
  60. package/esm/helpers/validateCertificatePath.d.ts.map +1 -1
  61. package/esm/helpers/validateCertificatePath.js +85 -90
  62. package/esm/helpers/validateExtFIDOGenCEAAGUID.d.ts +3 -2
  63. package/esm/helpers/validateExtFIDOGenCEAAGUID.d.ts.map +1 -1
  64. package/esm/helpers/verifySignature.d.ts +5 -4
  65. package/esm/helpers/verifySignature.d.ts.map +1 -1
  66. package/esm/metadata/verifyAttestationWithMetadata.d.ts +3 -2
  67. package/esm/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
  68. package/esm/metadata/verifyJWT.d.ts +2 -1
  69. package/esm/metadata/verifyJWT.d.ts.map +1 -1
  70. package/esm/registration/generateRegistrationOptions.d.ts +3 -3
  71. package/esm/registration/generateRegistrationOptions.d.ts.map +1 -1
  72. package/esm/registration/verifications/tpm/parseCertInfo.d.ts +9 -8
  73. package/esm/registration/verifications/tpm/parseCertInfo.d.ts.map +1 -1
  74. package/esm/registration/verifications/tpm/parsePubArea.d.ts +4 -3
  75. package/esm/registration/verifications/tpm/parsePubArea.d.ts.map +1 -1
  76. package/esm/registration/verifications/tpm/verifyAttestationTPM.d.ts.map +1 -1
  77. package/esm/registration/verifications/verifyAttestationAndroidKey.js +2 -2
  78. package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map +1 -1
  79. package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.js +2 -2
  80. package/esm/registration/verifyRegistrationResponse.d.ts +16 -10
  81. package/esm/registration/verifyRegistrationResponse.d.ts.map +1 -1
  82. package/esm/registration/verifyRegistrationResponse.js +12 -10
  83. package/esm/services/defaultRootCerts/mds.d.ts +1 -1
  84. package/esm/services/defaultRootCerts/mds.d.ts.map +1 -1
  85. package/esm/services/defaultRootCerts/mds.js +20 -20
  86. package/esm/services/metadataService.d.ts +2 -1
  87. package/esm/services/metadataService.d.ts.map +1 -1
  88. package/esm/services/metadataService.js +1 -1
  89. package/esm/services/settingsService.d.ts +2 -1
  90. package/esm/services/settingsService.d.ts.map +1 -1
  91. package/esm/types/dom.d.ts +1 -1
  92. package/esm/types/dom.d.ts.map +1 -1
  93. package/esm/types/index.d.ts +17 -2
  94. package/esm/types/index.d.ts.map +1 -1
  95. package/package.json +3 -2
  96. package/script/authentication/generateAuthenticationOptions.d.ts +2 -2
  97. package/script/authentication/generateAuthenticationOptions.d.ts.map +1 -1
  98. package/script/authentication/generateAuthenticationOptions.js +1 -1
  99. package/script/helpers/convertAAGUIDToString.d.ts +2 -1
  100. package/script/helpers/convertAAGUIDToString.d.ts.map +1 -1
  101. package/script/helpers/convertCOSEtoPKCS.d.ts +2 -1
  102. package/script/helpers/convertCOSEtoPKCS.d.ts.map +1 -1
  103. package/script/helpers/convertCertBufferToPEM.d.ts +2 -2
  104. package/script/helpers/convertCertBufferToPEM.d.ts.map +1 -1
  105. package/script/helpers/convertPEMToBytes.d.ts +2 -1
  106. package/script/helpers/convertPEMToBytes.d.ts.map +1 -1
  107. package/script/helpers/convertX509PublicKeyToCOSE.d.ts +2 -1
  108. package/script/helpers/convertX509PublicKeyToCOSE.d.ts.map +1 -1
  109. package/script/helpers/convertX509PublicKeyToCOSE.js +2 -2
  110. package/script/helpers/cose.d.ts +11 -10
  111. package/script/helpers/cose.d.ts.map +1 -1
  112. package/script/helpers/cose.js +0 -11
  113. package/script/helpers/decodeAttestationObject.d.ts +8 -7
  114. package/script/helpers/decodeAttestationObject.d.ts.map +1 -1
  115. package/script/helpers/decodeAuthenticatorExtensions.d.ts +2 -1
  116. package/script/helpers/decodeAuthenticatorExtensions.d.ts.map +1 -1
  117. package/script/helpers/decodeCredentialPublicKey.d.ts +3 -2
  118. package/script/helpers/decodeCredentialPublicKey.d.ts.map +1 -1
  119. package/script/helpers/generateChallenge.d.ts +3 -2
  120. package/script/helpers/generateChallenge.d.ts.map +1 -1
  121. package/script/helpers/generateUserID.d.ts +3 -2
  122. package/script/helpers/generateUserID.d.ts.map +1 -1
  123. package/script/helpers/getCertificateInfo.d.ts +2 -1
  124. package/script/helpers/getCertificateInfo.d.ts.map +1 -1
  125. package/script/helpers/isCertRevoked.d.ts +2 -2
  126. package/script/helpers/isCertRevoked.d.ts.map +1 -1
  127. package/script/helpers/isCertRevoked.js +19 -22
  128. package/script/helpers/iso/isoBase64URL.d.ts +3 -3
  129. package/script/helpers/iso/isoBase64URL.d.ts.map +1 -1
  130. package/script/helpers/iso/isoBase64URL.js +1 -1
  131. package/script/helpers/iso/isoCBOR.d.ts +3 -2
  132. package/script/helpers/iso/isoCBOR.d.ts.map +1 -1
  133. package/script/helpers/iso/isoCrypto/digest.d.ts +3 -2
  134. package/script/helpers/iso/isoCrypto/digest.d.ts.map +1 -1
  135. package/script/helpers/iso/isoCrypto/getRandomValues.d.ts +2 -1
  136. package/script/helpers/iso/isoCrypto/getRandomValues.d.ts.map +1 -1
  137. package/script/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts +2 -1
  138. package/script/helpers/iso/isoCrypto/unwrapEC2Signature.d.ts.map +1 -1
  139. package/script/helpers/iso/isoCrypto/verify.d.ts +4 -3
  140. package/script/helpers/iso/isoCrypto/verify.d.ts.map +1 -1
  141. package/script/helpers/iso/isoCrypto/verifyEC2.d.ts +4 -3
  142. package/script/helpers/iso/isoCrypto/verifyEC2.d.ts.map +1 -1
  143. package/script/helpers/iso/isoCrypto/verifyOKP.d.ts +4 -3
  144. package/script/helpers/iso/isoCrypto/verifyOKP.d.ts.map +1 -1
  145. package/script/helpers/iso/isoCrypto/verifyRSA.d.ts +4 -3
  146. package/script/helpers/iso/isoCrypto/verifyRSA.d.ts.map +1 -1
  147. package/script/helpers/iso/isoUint8Array.d.ts +9 -8
  148. package/script/helpers/iso/isoUint8Array.d.ts.map +1 -1
  149. package/script/helpers/iso/isoUint8Array.js +4 -4
  150. package/script/helpers/matchExpectedRPID.d.ts +2 -1
  151. package/script/helpers/matchExpectedRPID.d.ts.map +1 -1
  152. package/script/helpers/parseAuthenticatorData.d.ts +10 -9
  153. package/script/helpers/parseAuthenticatorData.d.ts.map +1 -1
  154. package/script/helpers/toHash.d.ts +3 -2
  155. package/script/helpers/toHash.d.ts.map +1 -1
  156. package/script/helpers/validateCertificatePath.d.ts.map +1 -1
  157. package/script/helpers/validateCertificatePath.js +85 -90
  158. package/script/helpers/validateExtFIDOGenCEAAGUID.d.ts +3 -2
  159. package/script/helpers/validateExtFIDOGenCEAAGUID.d.ts.map +1 -1
  160. package/script/helpers/verifySignature.d.ts +5 -4
  161. package/script/helpers/verifySignature.d.ts.map +1 -1
  162. package/script/metadata/verifyAttestationWithMetadata.d.ts +3 -2
  163. package/script/metadata/verifyAttestationWithMetadata.d.ts.map +1 -1
  164. package/script/metadata/verifyJWT.d.ts +2 -1
  165. package/script/metadata/verifyJWT.d.ts.map +1 -1
  166. package/script/registration/generateRegistrationOptions.d.ts +3 -3
  167. package/script/registration/generateRegistrationOptions.d.ts.map +1 -1
  168. package/script/registration/verifications/tpm/parseCertInfo.d.ts +9 -8
  169. package/script/registration/verifications/tpm/parseCertInfo.d.ts.map +1 -1
  170. package/script/registration/verifications/tpm/parsePubArea.d.ts +4 -3
  171. package/script/registration/verifications/tpm/parsePubArea.d.ts.map +1 -1
  172. package/script/registration/verifications/tpm/verifyAttestationTPM.d.ts.map +1 -1
  173. package/script/registration/verifications/verifyAttestationAndroidKey.js +2 -2
  174. package/script/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map +1 -1
  175. package/script/registration/verifications/verifyAttestationAndroidSafetyNet.js +2 -2
  176. package/script/registration/verifyRegistrationResponse.d.ts +16 -10
  177. package/script/registration/verifyRegistrationResponse.d.ts.map +1 -1
  178. package/script/registration/verifyRegistrationResponse.js +12 -10
  179. package/script/services/defaultRootCerts/mds.d.ts +1 -1
  180. package/script/services/defaultRootCerts/mds.d.ts.map +1 -1
  181. package/script/services/defaultRootCerts/mds.js +20 -20
  182. package/script/services/metadataService.d.ts +2 -1
  183. package/script/services/metadataService.d.ts.map +1 -1
  184. package/script/services/metadataService.js +1 -1
  185. package/script/services/settingsService.d.ts +2 -1
  186. package/script/services/settingsService.d.ts.map +1 -1
  187. package/script/types/dom.d.ts +1 -1
  188. package/script/types/dom.d.ts.map +1 -1
  189. package/script/types/index.d.ts +17 -2
  190. package/script/types/index.d.ts.map +1 -1
@@ -1,11 +1,12 @@
1
- import { COSEALG, COSEPublicKey } from '../../cose.js';
1
+ import { type COSEALG, type COSEPublicKey } from '../../cose.js';
2
+ import type { Uint8Array_ } from '../../../types/index.js';
2
3
  /**
3
4
  * Verify signatures with their public key. Supports EC2 and RSA public keys.
4
5
  */
5
6
  export declare function verify(opts: {
6
7
  cosePublicKey: COSEPublicKey;
7
- signature: Uint8Array;
8
- data: Uint8Array;
8
+ signature: Uint8Array_;
9
+ data: Uint8Array_;
9
10
  shaHashOverride?: COSEALG;
10
11
  }): Promise<boolean>;
11
12
  //# sourceMappingURL=verify.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EAEP,aAAa,EAKd,MAAM,eAAe,CAAC;AAMvB;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
1
+ {"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
@@ -1,11 +1,12 @@
1
- import { COSEALG, COSEPublicKeyEC2 } from '../../cose.js';
1
+ import { type COSEALG, type COSEPublicKeyEC2 } from '../../cose.js';
2
+ import type { Uint8Array_ } from '../../../types/index.js';
2
3
  /**
3
4
  * Verify a signature using an EC2 public key
4
5
  */
5
6
  export declare function verifyEC2(opts: {
6
7
  cosePublicKey: COSEPublicKeyEC2;
7
- signature: Uint8Array;
8
- data: Uint8Array;
8
+ signature: Uint8Array_;
9
+ data: Uint8Array_;
9
10
  shaHashOverride?: COSEALG;
10
11
  }): Promise<boolean>;
11
12
  //# sourceMappingURL=verifyEC2.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAO7E;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
1
+ {"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
@@ -1,7 +1,8 @@
1
- import { COSEPublicKeyOKP } from '../../cose.js';
1
+ import { type COSEPublicKeyOKP } from '../../cose.js';
2
+ import type { Uint8Array_ } from '../../../types/index.js';
2
3
  export declare function verifyOKP(opts: {
3
4
  cosePublicKey: COSEPublicKeyOKP;
4
- signature: Uint8Array;
5
- data: Uint8Array;
5
+ signature: Uint8Array_;
6
+ data: Uint8Array_;
6
7
  }): Promise<boolean>;
7
8
  //# sourceMappingURL=verifyOKP.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAM/E,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
1
+ {"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
@@ -1,11 +1,12 @@
1
- import { COSEALG, COSEPublicKeyRSA } from '../../cose.js';
1
+ import { type COSEALG, type COSEPublicKeyRSA } from '../../cose.js';
2
+ import type { Uint8Array_ } from '../../../types/index.js';
2
3
  /**
3
4
  * Verify a signature using an RSA public key
4
5
  */
5
6
  export declare function verifyRSA(opts: {
6
7
  cosePublicKey: COSEPublicKeyRSA;
7
- signature: Uint8Array;
8
- data: Uint8Array;
8
+ signature: Uint8Array_;
9
+ data: Uint8Array_;
9
10
  shaHashOverride?: COSEALG;
10
11
  }): Promise<boolean>;
11
12
  //# sourceMappingURL=verifyRSA.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAO/E;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
1
+ {"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
@@ -1,3 +1,4 @@
1
+ import type { Uint8Array_ } from '../../types/index.js';
1
2
  /**
2
3
  * A runtime-agnostic collection of methods for working with Uint8Arrays
3
4
  * @module
@@ -5,37 +6,37 @@
5
6
  /**
6
7
  * Make sure two Uint8Arrays are deeply equivalent
7
8
  */
8
- export declare function areEqual(array1: Uint8Array, array2: Uint8Array): boolean;
9
+ export declare function areEqual(array1: Uint8Array_, array2: Uint8Array_): boolean;
9
10
  /**
10
11
  * Convert a Uint8Array to Hexadecimal.
11
12
  *
12
13
  * A replacement for `Buffer.toString('hex')`
13
14
  */
14
- export declare function toHex(array: Uint8Array): string;
15
+ export declare function toHex(array: Uint8Array_): string;
15
16
  /**
16
17
  * Convert a hexadecimal string to isoUint8Array.
17
18
  *
18
19
  * A replacement for `Buffer.from('...', 'hex')`
19
20
  */
20
- export declare function fromHex(hex: string): Uint8Array;
21
+ export declare function fromHex(hex: string): Uint8Array_;
21
22
  /**
22
23
  * Combine multiple Uint8Arrays into a single Uint8Array
23
24
  */
24
- export declare function concat(arrays: Uint8Array[]): Uint8Array;
25
+ export declare function concat(arrays: Uint8Array_[]): Uint8Array_;
25
26
  /**
26
27
  * Convert bytes into a UTF-8 string
27
28
  */
28
- export declare function toUTF8String(array: Uint8Array): string;
29
+ export declare function toUTF8String(array: Uint8Array_): string;
29
30
  /**
30
31
  * Convert a UTF-8 string back into bytes
31
32
  */
32
- export declare function fromUTF8String(utf8String: string): Uint8Array;
33
+ export declare function fromUTF8String(utf8String: string): Uint8Array_;
33
34
  /**
34
35
  * Convert an ASCII string to Uint8Array
35
36
  */
36
- export declare function fromASCIIString(value: string): Uint8Array;
37
+ export declare function fromASCIIString(value: string): Uint8Array_;
37
38
  /**
38
39
  * Prepare a DataView we can slice our way around in as we parse the bytes in a Uint8Array
39
40
  */
40
- export declare function toDataView(array: Uint8Array): DataView;
41
+ export declare function toDataView(array: Uint8Array_): DataView;
41
42
  //# sourceMappingURL=isoUint8Array.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAe/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAYvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAG7D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEtD"}
1
+ {"version":3,"file":"isoUint8Array.d.ts","sourceRoot":"","sources":["../../../src/helpers/iso/isoUint8Array.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;GAGG;AAEH;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAM1E;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKhD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAehD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAYzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAGvD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAG9D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAE1D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAEvD"}
@@ -1,8 +1,9 @@
1
+ import type { Uint8Array_ } from '../types/index.js';
1
2
  /**
2
3
  * Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
3
4
  * that matched the hash in the response.
4
5
  *
5
6
  * Raises an `UnexpectedRPIDHash` error if no match is found
6
7
  */
7
- export declare function matchExpectedRPID(rpIDHash: Uint8Array, expectedRPIDs: string[]): Promise<string>;
8
+ export declare function matchExpectedRPID(rpIDHash: Uint8Array_, expectedRPIDs: string[]): Promise<string>;
8
9
  //# sourceMappingURL=matchExpectedRPID.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"matchExpectedRPID.d.ts","sourceRoot":"","sources":["../../src/helpers/matchExpectedRPID.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,UAAU,EACpB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
1
+ {"version":3,"file":"matchExpectedRPID.d.ts","sourceRoot":"","sources":["../../src/helpers/matchExpectedRPID.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,WAAW,EACrB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
@@ -1,11 +1,12 @@
1
- import { AuthenticationExtensionsAuthenticatorOutputs } from './decodeAuthenticatorExtensions.js';
1
+ import { type AuthenticationExtensionsAuthenticatorOutputs } from './decodeAuthenticatorExtensions.js';
2
+ import type { Uint8Array_ } from '../types/index.js';
2
3
  /**
3
4
  * Make sense of the authData buffer contained in an Attestation
4
5
  */
5
- export declare function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData;
6
+ export declare function parseAuthenticatorData(authData: Uint8Array_): ParsedAuthenticatorData;
6
7
  export type ParsedAuthenticatorData = {
7
- rpIdHash: Uint8Array;
8
- flagsBuf: Uint8Array;
8
+ rpIdHash: Uint8Array_;
9
+ flagsBuf: Uint8Array_;
9
10
  flags: {
10
11
  up: boolean;
11
12
  uv: boolean;
@@ -16,12 +17,12 @@ export type ParsedAuthenticatorData = {
16
17
  flagsInt: number;
17
18
  };
18
19
  counter: number;
19
- counterBuf: Uint8Array;
20
- aaguid?: Uint8Array;
21
- credentialID?: Uint8Array;
22
- credentialPublicKey?: Uint8Array;
20
+ counterBuf: Uint8Array_;
21
+ aaguid?: Uint8Array_;
22
+ credentialID?: Uint8Array_;
23
+ credentialPublicKey?: Uint8Array_;
23
24
  extensionsData?: AuthenticationExtensionsAuthenticatorOutputs;
24
- extensionsDataBuffer?: Uint8Array;
25
+ extensionsDataBuffer?: Uint8Array_;
25
26
  };
26
27
  /**
27
28
  * Make it possible to stub the return value during testing
@@ -1 +1 @@
1
- {"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAE7C,MAAM,oCAAoC,CAAC;AAI5C;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,UAAU,GACnB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,UAAU,CAAC;IACrB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
1
+ {"version":3,"file":"parseAuthenticatorData.d.ts","sourceRoot":"","sources":["../../src/helpers/parseAuthenticatorData.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,4CAA4C,EAElD,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,WAAW,GACpB,uBAAuB,CAwHzB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE;QACL,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,WAAW,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,cAAc,CAAC,EAAE,4CAA4C,CAAC;IAC9D,oBAAoB,CAAC,EAAE,WAAW,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC;sBACzB,uBAAuB;CAC1C,CAAC"}
@@ -1,7 +1,8 @@
1
- import { COSEALG } from './cose.js';
1
+ import type { COSEALG } from './cose.js';
2
+ import type { Uint8Array_ } from '../types/index.js';
2
3
  /**
3
4
  * Returns hash digest of the given data, using the given algorithm when provided. Defaults to using
4
5
  * SHA-256.
5
6
  */
6
- export declare function toHash(data: Uint8Array | string, algorithm?: COSEALG): Promise<Uint8Array>;
7
+ export declare function toHash(data: Uint8Array_ | string, algorithm?: COSEALG): Promise<Uint8Array_>;
7
8
  //# sourceMappingURL=toHash.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"toHash.d.ts","sourceRoot":"","sources":["../../src/helpers/toHash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;GAGG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,SAAS,GAAE,OAAY,GACtB,OAAO,CAAC,UAAU,CAAC,CAQrB"}
1
+ {"version":3,"file":"toHash.d.ts","sourceRoot":"","sources":["../../src/helpers/toHash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,WAAW,GAAG,MAAM,EAC1B,SAAS,GAAE,OAAY,GACtB,OAAO,CAAC,WAAW,CAAC,CAQtB"}
@@ -1 +1 @@
1
- {"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsClB"}
1
+ {"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CA6HlB"}
@@ -1,9 +1,6 @@
1
- import { AsnSerializer } from '@peculiar/asn1-schema';
1
+ import { X509Certificate } from '@peculiar/x509';
2
2
  import { isCertRevoked } from './isCertRevoked.js';
3
- import { verifySignature } from './verifySignature.js';
4
- import { mapX509SignatureAlgToCOSEAlg } from './mapX509SignatureAlgToCOSEAlg.js';
5
- import { getCertificateInfo } from './getCertificateInfo.js';
6
- import { convertPEMToBytes } from './convertPEMToBytes.js';
3
+ import { getWebCrypto } from './iso/isoCrypto/getWebCrypto.js';
7
4
  /**
8
5
  * Traverse an array of PEM certificates and ensure they form a proper chain
9
6
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -14,27 +11,97 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
14
11
  // We have no trust anchors to chain back to, so skip path validation
15
12
  return true;
16
13
  }
14
+ const WebCrypto = await getWebCrypto();
15
+ // Prepare to work with x5c certs
16
+ const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
17
+ // Check for any expired or temporally invalid certs in x5c
18
+ for (let i = 0; i < x5cCertsParsed.length; i++) {
19
+ const cert = x5cCertsParsed[i];
20
+ const certPEM = x5cCertsPEM[i];
21
+ try {
22
+ await assertCertNotRevoked(cert);
23
+ }
24
+ catch (_err) {
25
+ throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
26
+ }
27
+ try {
28
+ assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
29
+ }
30
+ catch (_err) {
31
+ throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
32
+ }
33
+ }
34
+ // Prepare to work with trust anchor certs
35
+ const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
36
+ try {
37
+ return new X509Certificate(certPEM);
38
+ }
39
+ catch (err) {
40
+ const _err = err;
41
+ throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
42
+ }
43
+ });
44
+ // Filter out any expired or temporally invalid trust anchors certs
45
+ const validTrustAnchors = [];
46
+ for (let i = 0; i < trustAnchorsParsed.length; i++) {
47
+ const cert = trustAnchorsParsed[i];
48
+ try {
49
+ await assertCertNotRevoked(cert);
50
+ }
51
+ catch (_err) {
52
+ // Continue processing the other certs
53
+ continue;
54
+ }
55
+ try {
56
+ assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
57
+ }
58
+ catch (_err) {
59
+ // Continue processing the other certs
60
+ continue;
61
+ }
62
+ validTrustAnchors.push(cert);
63
+ }
64
+ if (validTrustAnchors.length === 0) {
65
+ throw new Error('No specified trust anchor was valid for verifying x5c');
66
+ }
67
+ // Try to verify x5c with each trust anchor
17
68
  let invalidSubjectAndIssuerError = false;
18
- let certificateNotYetValidOrExpiredErrorMessage = undefined;
19
- for (const anchorPEM of trustAnchorsPEM) {
69
+ for (const anchor of trustAnchorsParsed) {
20
70
  try {
21
- const certsWithTrustAnchor = x5cCertsPEM.concat([anchorPEM]);
22
- await _validatePath(certsWithTrustAnchor);
71
+ const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
72
+ if (new Set(x5cWithTrustAnchor).size !== x5cWithTrustAnchor.length) {
73
+ throw new Error('Invalid certificate path: found duplicate certificates');
74
+ }
75
+ // Check signatures, and notBefore and notAfter
76
+ for (let i = 0; i < x5cWithTrustAnchor.length - 1; i++) {
77
+ const subject = x5cWithTrustAnchor[i];
78
+ const issuer = x5cWithTrustAnchor[i + 1];
79
+ // Leaf or intermediate cert, make sure the next cert in the chain signed it
80
+ const issuerSignedSubject = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
81
+ if (!issuerSignedSubject) {
82
+ throw new InvalidSubjectAndIssuer();
83
+ }
84
+ if (issuer.subject === issuer.issuer) {
85
+ // Root cert detected, make sure it signed itself
86
+ const issuerSignedIssuer = await issuer.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
87
+ if (!issuerSignedIssuer) {
88
+ throw new InvalidSubjectAndIssuer();
89
+ }
90
+ // Don't process anything else after a root cert
91
+ break;
92
+ }
93
+ }
23
94
  // If we successfully validated a path then there's no need to continue. Reset any existing
24
95
  // errors that were thrown by earlier trust anchors
25
96
  invalidSubjectAndIssuerError = false;
26
- certificateNotYetValidOrExpiredErrorMessage = undefined;
27
97
  break;
28
98
  }
29
99
  catch (err) {
30
100
  if (err instanceof InvalidSubjectAndIssuer) {
31
101
  invalidSubjectAndIssuerError = true;
32
102
  }
33
- else if (err instanceof CertificateNotYetValidOrExpired) {
34
- certificateNotYetValidOrExpiredErrorMessage = err.message;
35
- }
36
103
  else {
37
- throw err;
104
+ throw new Error('Unexpected error while validating certificate path', { cause: err });
38
105
  }
39
106
  }
40
107
  }
@@ -42,42 +109,6 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
42
109
  if (invalidSubjectAndIssuerError) {
43
110
  throw new InvalidSubjectAndIssuer();
44
111
  }
45
- else if (certificateNotYetValidOrExpiredErrorMessage) {
46
- throw new CertificateNotYetValidOrExpired(certificateNotYetValidOrExpiredErrorMessage);
47
- }
48
- return true;
49
- }
50
- /**
51
- * @param x5cCerts X.509 `x5c` certs in PEM string format
52
- * @param anchorCert X.509 trust anchor cert in PEM string format
53
- */
54
- async function _validatePath(x5cCertsWithTrustAnchorPEM) {
55
- if (new Set(x5cCertsWithTrustAnchorPEM).size !== x5cCertsWithTrustAnchorPEM.length) {
56
- throw new Error('Invalid certificate path: found duplicate certificates');
57
- }
58
- // Make sure no certs are revoked, and all are within their time validity window
59
- for (const certificatePEM of x5cCertsWithTrustAnchorPEM) {
60
- const certInfo = getCertificateInfo(convertPEMToBytes(certificatePEM));
61
- await assertCertNotRevoked(certInfo.parsedCertificate);
62
- assertCertIsWithinValidTimeWindow(certInfo, certificatePEM);
63
- }
64
- // Make sure each x5c cert is issued by the next certificate in the chain
65
- for (let i = 0; i < (x5cCertsWithTrustAnchorPEM.length - 1); i += 1) {
66
- const subjectPem = x5cCertsWithTrustAnchorPEM[i];
67
- const issuerPem = x5cCertsWithTrustAnchorPEM[i + 1];
68
- const subjectInfo = getCertificateInfo(convertPEMToBytes(subjectPem));
69
- const issuerInfo = getCertificateInfo(convertPEMToBytes(issuerPem));
70
- // Make sure subject issuer is issuer subject
71
- if (subjectInfo.issuer.combined !== issuerInfo.subject.combined) {
72
- throw new InvalidSubjectAndIssuer();
73
- }
74
- const issuerCertIsRootCert = issuerInfo.issuer.combined === issuerInfo.subject.combined;
75
- await assertSubjectIsSignedByIssuer(subjectInfo.parsedCertificate, issuerPem);
76
- // Perform one final check if the issuer cert is also a root certificate
77
- if (issuerCertIsRootCert) {
78
- await assertSubjectIsSignedByIssuer(issuerInfo.parsedCertificate, issuerPem);
79
- }
80
- }
81
112
  return true;
82
113
  }
83
114
  /**
@@ -87,39 +118,16 @@ async function assertCertNotRevoked(certificate) {
87
118
  // Check for certificate revocation
88
119
  const subjectCertRevoked = await isCertRevoked(certificate);
89
120
  if (subjectCertRevoked) {
90
- throw new Error(`Found revoked certificate in certificate path`);
121
+ throw new Error('Found revoked certificate in certificate path');
91
122
  }
92
123
  }
93
124
  /**
94
125
  * Require the cert to be within its notBefore and notAfter time window
95
- *
96
- * @param certInfo Parsed cert information
97
- * @param certPEM PEM-formatted certificate, for error reporting
98
126
  */
99
- function assertCertIsWithinValidTimeWindow(certInfo, certPEM) {
100
- const { notBefore, notAfter } = certInfo;
127
+ function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
101
128
  const now = new Date(Date.now());
102
- if (notBefore > now || notAfter < now) {
103
- throw new CertificateNotYetValidOrExpired(`Certificate is not yet valid or expired: ${certPEM}`);
104
- }
105
- }
106
- /**
107
- * Ensure that the subject cert has been signed by the next cert in the chain
108
- */
109
- async function assertSubjectIsSignedByIssuer(subjectCert, issuerPEM) {
110
- // Verify the subject certificate's signature with the issuer cert's public key
111
- const data = AsnSerializer.serialize(subjectCert.tbsCertificate);
112
- const signature = subjectCert.signatureValue;
113
- const signatureAlgorithm = mapX509SignatureAlgToCOSEAlg(subjectCert.signatureAlgorithm.algorithm);
114
- const issuerCertBytes = convertPEMToBytes(issuerPEM);
115
- const verified = await verifySignature({
116
- data: new Uint8Array(data),
117
- signature: new Uint8Array(signature),
118
- x509Certificate: issuerCertBytes,
119
- hashAlgorithm: signatureAlgorithm,
120
- });
121
- if (!verified) {
122
- throw new InvalidSubjectSignatureForIssuer();
129
+ if (certNotBefore > now || certNotAfter < now) {
130
+ throw new Error('Certificate is not yet valid or expired');
123
131
  }
124
132
  }
125
133
  // Custom errors to help pass on certain errors
@@ -130,16 +138,3 @@ class InvalidSubjectAndIssuer extends Error {
130
138
  this.name = 'InvalidSubjectAndIssuer';
131
139
  }
132
140
  }
133
- class InvalidSubjectSignatureForIssuer extends Error {
134
- constructor() {
135
- const message = 'Subject signature was invalid for issuer';
136
- super(message);
137
- this.name = 'InvalidSubjectSignatureForIssuer';
138
- }
139
- }
140
- class CertificateNotYetValidOrExpired extends Error {
141
- constructor(message) {
142
- super(message);
143
- this.name = 'CertificateNotYetValidOrExpired';
144
- }
145
- }
@@ -1,7 +1,8 @@
1
- import { Extensions } from '@peculiar/asn1-x509';
1
+ import type { Extensions } from '@peculiar/asn1-x509';
2
+ import type { Uint8Array_ } from '../types/index.js';
2
3
  /**
3
4
  * Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
4
5
  * the attestation statement AAGUID.
5
6
  */
6
- export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid: Uint8Array): boolean;
7
+ export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid: Uint8Array_): boolean;
7
8
  //# sourceMappingURL=validateExtFIDOGenCEAAGUID.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"validateExtFIDOGenCEAAGUID.d.ts","sourceRoot":"","sources":["../../src/helpers/validateExtFIDOGenCEAAGUID.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAWjD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,UAAU,GAAG,SAAS,EACtC,MAAM,EAAE,UAAU,GACjB,OAAO,CA6BT"}
1
+ {"version":3,"file":"validateExtFIDOGenCEAAGUID.d.ts","sourceRoot":"","sources":["../../src/helpers/validateExtFIDOGenCEAAGUID.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,UAAU,GAAG,SAAS,EACtC,MAAM,EAAE,WAAW,GAClB,OAAO,CA6BT"}
@@ -1,12 +1,13 @@
1
1
  import { COSEALG } from './cose.js';
2
+ import type { Uint8Array_ } from '../types/index.js';
2
3
  /**
3
4
  * Verify an authenticator's signature
4
5
  */
5
6
  export declare function verifySignature(opts: {
6
- signature: Uint8Array;
7
- data: Uint8Array;
8
- credentialPublicKey?: Uint8Array;
9
- x509Certificate?: Uint8Array;
7
+ signature: Uint8Array_;
8
+ data: Uint8Array_;
9
+ credentialPublicKey?: Uint8Array_;
10
+ x509Certificate?: Uint8Array_;
10
11
  hashAlgorithm?: COSEALG;
11
12
  }): Promise<boolean>;
12
13
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAKnD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,UAAU,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
1
+ {"version":3,"file":"verifySignature.d.ts","sourceRoot":"","sources":["../../src/helpers/verifySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,WAAW,CAAC;AAInD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmCnB;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB;sBAClB,OAAO,CAAC,OAAO,CAAC;CACnC,CAAC"}
@@ -1,14 +1,15 @@
1
1
  import type { Base64URLString } from '../types/index.js';
2
2
  import type { AlgSign, MetadataStatement } from './mdsTypes.js';
3
3
  import { type COSEALG, type COSECRV, COSEKTY } from '../helpers/cose.js';
4
+ import type { Uint8Array_ } from '../types/index.js';
4
5
  /**
5
6
  * Match properties of the authenticator's attestation statement against expected values as
6
7
  * registered with the FIDO Alliance Metadata Service
7
8
  */
8
9
  export declare function verifyAttestationWithMetadata({ statement, credentialPublicKey, x5c, attestationStatementAlg, }: {
9
10
  statement: MetadataStatement;
10
- credentialPublicKey: Uint8Array;
11
- x5c: Uint8Array[] | Base64URLString[];
11
+ credentialPublicKey: Uint8Array_;
12
+ x5c: Uint8Array_[] | Base64URLString[];
12
13
  attestationStatementAlg?: number;
13
14
  }): Promise<boolean>;
14
15
  type COSEInfo = {
@@ -1 +1 @@
1
- {"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,UAAU,CAAC;IAChC,GAAG,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
1
+ {"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
@@ -1,3 +1,4 @@
1
+ import type { Uint8Array_ } from '../types/index.js';
1
2
  /**
2
3
  * Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
3
4
  *
@@ -7,5 +8,5 @@
7
8
  *
8
9
  * (Pulled from https://www.rfc-editor.org/rfc/rfc7515#section-4.1.1)
9
10
  */
10
- export declare function verifyJWT(jwt: string, leafCert: Uint8Array): Promise<boolean>;
11
+ export declare function verifyJWT(jwt: string, leafCert: Uint8Array_): Promise<boolean>;
11
12
  //# sourceMappingURL=verifyJWT.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B7E"}
1
+ {"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B9E"}
@@ -1,4 +1,4 @@
1
- import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON } from '../types/index.js';
1
+ import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
2
2
  export type GenerateRegistrationOptionsOpts = Parameters<typeof generateRegistrationOptions>[0];
3
3
  /**
4
4
  * Supported crypto algo identifiers
@@ -29,8 +29,8 @@ export declare function generateRegistrationOptions(options: {
29
29
  rpName: string;
30
30
  rpID: string;
31
31
  userName: string;
32
- userID?: Uint8Array;
33
- challenge?: string | Uint8Array;
32
+ userID?: Uint8Array_;
33
+ challenge?: string | Uint8Array_;
34
34
  userDisplayName?: string;
35
35
  timeout?: number;
36
36
  attestationType?: 'direct' | 'enterprise' | 'none';
@@ -1 +1 @@
1
- {"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGvC,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
1
+ {"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
@@ -1,24 +1,25 @@
1
+ import type { Uint8Array_ } from '../../../types/index.js';
1
2
  /**
2
3
  * Cut up a TPM attestation's certInfo into intelligible chunks
3
4
  */
4
- export declare function parseCertInfo(certInfo: Uint8Array): ParsedCertInfo;
5
+ export declare function parseCertInfo(certInfo: Uint8Array_): ParsedCertInfo;
5
6
  type ParsedCertInfo = {
6
7
  magic: number;
7
8
  type: string;
8
- qualifiedSigner: Uint8Array;
9
- extraData: Uint8Array;
9
+ qualifiedSigner: Uint8Array_;
10
+ extraData: Uint8Array_;
10
11
  clockInfo: {
11
- clock: Uint8Array;
12
+ clock: Uint8Array_;
12
13
  resetCount: number;
13
14
  restartCount: number;
14
15
  safe: boolean;
15
16
  };
16
- firmwareVersion: Uint8Array;
17
+ firmwareVersion: Uint8Array_;
17
18
  attested: {
18
19
  nameAlg: string;
19
- nameAlgBuffer: Uint8Array;
20
- name: Uint8Array;
21
- qualifiedName: Uint8Array;
20
+ nameAlgBuffer: Uint8Array_;
21
+ name: Uint8Array_;
22
+ qualifiedName: Uint8Array_;
22
23
  };
23
24
  };
24
25
  export {};
@@ -1 +1 @@
1
- {"version":3,"file":"parseCertInfo.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parseCertInfo.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,UAAU,GAAG,cAAc,CAkElE;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,UAAU,CAAC;IAC5B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE;QACT,KAAK,EAAE,UAAU,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC;KACf,CAAC;IACF,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,UAAU,CAAC;QAC1B,IAAI,EAAE,UAAU,CAAC;QACjB,aAAa,EAAE,UAAU,CAAC;KAC3B,CAAC;CACH,CAAC"}
1
+ {"version":3,"file":"parseCertInfo.d.ts","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parseCertInfo.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAkEnE;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,WAAW,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE;QACT,KAAK,EAAE,WAAW,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC;KACf,CAAC;IACF,eAAe,EAAE,WAAW,CAAC;IAC7B,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,WAAW,CAAC;QAC3B,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,EAAE,WAAW,CAAC;KAC5B,CAAC;CACH,CAAC"}