@simplewebauthn/server 13.3.2 → 14.0.0

package/script/helpers/iso/isoCrypto/{importKey.js → importJWKKey.js}

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.importKey = importKey;
+exports.importJWKKey = importJWKKey;
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
-async function importKey(opts) {
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+async function importJWKKey(opts) {
     const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
     const { keyData, algorithm } = opts;
-    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, [
-        'verify',
-    ]);
+    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, ['verify']);
 }

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts

@@ -0,0 +1,10 @@
+import type { SubtleCryptoAlg } from './structs.js';
+import { COSEALG } from '../../cose.js';
+/**
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
+ */
+export declare function mapCoseAlgToWebCryptoHashAlgName(alg: COSEALG): SubtleCryptoAlg;
+//# sourceMappingURL=mapCoseAlgToWebCryptoHashAlgName.d.ts.map

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCoseAlgToWebCryptoHashAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAe9E"}

package/script/helpers/iso/isoCrypto/{mapCoseAlgToWebCryptoAlg.js → mapCoseAlgToWebCryptoHashAlgName.js}

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mapCoseAlgToWebCryptoAlg = mapCoseAlgToWebCryptoAlg;
+exports.mapCoseAlgToWebCryptoHashAlgName = mapCoseAlgToWebCryptoHashAlgName;
 const cose_js_1 = require("../../cose.js");
 /**
- * Convert a COSE alg ID into a corresponding string value that WebCrypto APIs expect
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
-function mapCoseAlgToWebCryptoAlg(alg) {
+function mapCoseAlgToWebCryptoHashAlgName(alg) {
     if ([cose_js_1.COSEALG.RS1].indexOf(alg) >= 0) {
         return 'SHA-1';
     }
@@ -19,5 +22,5 @@ function mapCoseAlgToWebCryptoAlg(alg) {
         0) {
         return 'SHA-512';
     }
-    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`);
+    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto hash alg name`);
 }

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts

@@ -1,7 +1,10 @@
 import { COSEALG } from '../../cose.js';
-import { SubtleCryptoKeyAlgName } from './structs.js';
+import type { SubtleCryptoKeyAlgName } from './structs.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export declare function mapCoseAlgToWebCryptoKeyAlgName(alg: COSEALG): SubtleCryptoKeyAlgName;
 //# sourceMappingURL=mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAoBxB"}
+{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAuBxB"}

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js

@@ -4,6 +4,9 @@ exports.mapCoseAlgToWebCryptoKeyAlgName = mapCoseAlgToWebCryptoKeyAlgName;
 const cose_js_1 = require("../../cose.js");
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     if ([cose_js_1.COSEALG.EdDSA].indexOf(alg) >= 0) {
@@ -18,5 +21,17 @@ function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     else if ([cose_js_1.COSEALG.PS256, cose_js_1.COSEALG.PS384, cose_js_1.COSEALG.PS512].indexOf(alg) >= 0) {
         return 'RSA-PSS';
     }
+    else if ([cose_js_1.COSEALG.ML_DSA_44].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-44';
+    }
+    else if ([cose_js_1.COSEALG.ML_DSA_65].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-65';
+    }
+    else if ([cose_js_1.COSEALG.ML_DSA_87].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-87';
+    }
     throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`);
 }

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts

@@ -0,0 +1,7 @@
+import type { AlgorithmIdentifier } from '../../../types/index.js';
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export declare function runtimeSupportsWebCryptoKeyAlg(alg: AlgorithmIdentifier): boolean;
+//# sourceMappingURL=runtimeSupportsWebCryptoKeyAlg.d.ts.map

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSupportsWebCryptoKeyAlg.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;AAEvF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAYhF"}

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeSupportsWebCryptoKeyAlg = runtimeSupportsWebCryptoKeyAlg;
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+function runtimeSupportsWebCryptoKeyAlg(alg) {
+    const globalSubtleCrypto = globalThis.SubtleCrypto;
+    if (typeof globalSubtleCrypto.supports !== 'function') {
+        return false;
+    }
+    try {
+        return globalSubtleCrypto.supports('verify', alg);
+    }
+    catch (_err) {
+        return false;
+    }
+}

package/script/helpers/iso/isoCrypto/structs.d.ts

@@ -1,4 +1,4 @@
 export type SubtleCryptoAlg = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 export type SubtleCryptoCrv = 'P-256' | 'P-384' | 'P-521' | 'Ed25519';
-export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
+export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
 //# sourceMappingURL=structs.d.ts.map

package/script/helpers/iso/isoCrypto/structs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,SAAS,CAAC"}
+{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,WAAW,GACX,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,SAAS,CAAC"}

package/script/helpers/iso/isoCrypto/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAMnB,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BnB"}

package/script/helpers/iso/isoCrypto/verify.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verify = verify;
 const cose_js_1 = require("../../cose.js");
+const verifyAKP_js_1 = require("./verifyAKP.js");
 const verifyEC2_js_1 = require("./verifyEC2.js");
 const verifyRSA_js_1 = require("./verifyRSA.js");
 const verifyOKP_js_1 = require("./verifyOKP.js");
@@ -30,6 +31,9 @@ function verify(opts) {
     else if ((0, cose_js_1.isCOSEPublicKeyOKP)(cosePublicKey)) {
         return (0, verifyOKP_js_1.verifyOKP)({ cosePublicKey, signature, data });
     }
+    else if ((0, cose_js_1.isCOSEPublicKeyAKP)(cosePublicKey)) {
+        return (0, verifyAKP_js_1.verifyAKP)({ cosePublicKey, signature, data });
+    }
     const kty = cosePublicKey.get(cose_js_1.COSEKEYS.kty);
     throw new Error(`Signature verification with public key of kty ${kty} is not supported by this method`);
 }

package/script/helpers/iso/isoCrypto/verifyAKP.d.ts

@@ -0,0 +1,9 @@
+import { type COSEPublicKeyAKP } from '../../cose.js';
+import type { Uint8Array_ } from '../../../types/index.js';
+/** AKP, a.k.a ML-DSA */
+export declare function verifyAKP(opts: {
+    cosePublicKey: COSEPublicKeyAKP;
+    signature: Uint8Array_;
+    data: Uint8Array_;
+}): Promise<boolean>;
+//# sourceMappingURL=verifyAKP.d.ts.map

package/script/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAK3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB"}

package/script/helpers/iso/isoCrypto/verifyAKP.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAKP = verifyAKP;
+const cose_js_1 = require("../../cose.js");
+const index_js_1 = require("../../index.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
+const getWebCrypto_js_1 = require("./getWebCrypto.js");
+const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
+/** AKP, a.k.a ML-DSA */
+async function verifyAKP(opts) {
+    const { cosePublicKey, signature, data } = opts;
+    const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
+    const alg = cosePublicKey.get(cose_js_1.COSEKEYS.alg);
+    const pub = cosePublicKey.get(cose_js_1.COSEKEYS.pub);
+    if (!alg) {
+        throw new Error('Public key was missing alg (AKP)');
+    }
+    if (!(0, cose_js_1.isCOSEAlg)(alg)) {
+        throw new Error(`Public key had invalid alg ${alg} (AKP)`);
+    }
+    if (!pub) {
+        throw new Error('Public key was missing pub (AKP)');
+    }
+    const webCryptoAlg = (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg);
+    // See https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-operations-import-key -> "jwk"
+    const keyData = {
+        kty: 'AKP',
+        alg: webCryptoAlg,
+        pub: index_js_1.isoBase64URL.fromBuffer(pub),
+        ext: false,
+    };
+    /**
+     * ML-DSA support is pretty cutting edge, so take some steps to help RP's understand this instead
+     * of them getting a `NotSupportedError: Unrecognized algorithm name` and trying to interpret it.
+     */
+    let key;
+    try {
+        key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: webCryptoAlg });
+    }
+    catch (err) {
+        const _err = err;
+        if (_err.name === 'NotSupportedError') {
+            throw new Error(`This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}. See the \`cause\` property of this error for more info`, { cause: err });
+        }
+        else {
+            throw err;
+        }
+    }
+    return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
+}

package/script/helpers/iso/isoCrypto/verifyEC2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
+{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAuEnB"}

package/script/helpers/iso/isoCrypto/verifyEC2.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyEC2 = verifyEC2;
 const cose_js_1 = require("../../cose.js");
-const mapCoseAlgToWebCryptoAlg_js_1 = require("./mapCoseAlgToWebCryptoAlg.js");
-const importKey_js_1 = require("./importKey.js");
+const mapCoseAlgToWebCryptoHashAlgName_js_1 = require("./mapCoseAlgToWebCryptoHashAlgName.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const index_js_1 = require("../index.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 /**
@@ -59,14 +59,11 @@ async function verifyEC2(opts) {
         name: 'ECDSA',
         namedCurve: _crv,
     };
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     // Determine which SHA algorithm to use for signature verification
-    let subtleAlg = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(alg);
+    let subtleAlg = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(alg);
     if (shaHashOverride) {
-        subtleAlg = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(shaHashOverride);
+        subtleAlg = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(shaHashOverride);
     }
     const verifyAlgorithm = {
         name: 'ECDSA',

package/script/helpers/iso/isoCrypto/verifyOKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
+{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsDnB"}

package/script/helpers/iso/isoCrypto/verifyOKP.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyOKP = verifyOKP;
 const cose_js_1 = require("../../cose.js");
 const index_js_1 = require("../../index.js");
-const importKey_js_1 = require("./importKey.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 async function verifyOKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -43,10 +43,7 @@ async function verifyOKP(opts) {
         name: _crv,
         namedCurve: _crv,
     };
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     const verifyAlgorithm = {
         name: _crv,
     };

package/script/helpers/iso/isoCrypto/verifyRSA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
+{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAwFnB"}

package/script/helpers/iso/isoCrypto/verifyRSA.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyRSA = verifyRSA;
 const cose_js_1 = require("../../cose.js");
-const mapCoseAlgToWebCryptoAlg_js_1 = require("./mapCoseAlgToWebCryptoAlg.js");
-const importKey_js_1 = require("./importKey.js");
+const mapCoseAlgToWebCryptoHashAlgName_js_1 = require("./mapCoseAlgToWebCryptoHashAlgName.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const index_js_1 = require("../index.js");
 const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
@@ -37,13 +37,13 @@ async function verifyRSA(opts) {
     };
     const keyAlgorithm = {
         name: (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg),
-        hash: { name: (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(alg) },
+        hash: { name: (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(alg) },
     };
     const verifyAlgorithm = {
         name: (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg),
     };
     if (shaHashOverride) {
-        keyAlgorithm.hash.name = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(shaHashOverride);
+        keyAlgorithm.hash.name = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(shaHashOverride);
     }
     if (keyAlgorithm.name === 'RSASSA-PKCS1-v1_5') {
         if (keyAlgorithm.hash.name === 'SHA-256') {
@@ -86,9 +86,6 @@ async function verifyRSA(opts) {
     else {
         throw new Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);
     }
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }

package/script/helpers/logging.d.ts

@@ -1,16 +1,34 @@
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
+ * A basic logging interface that enables projects to capture logging output from SimpleWebAuthn
+ * using whatever logging method is appropriate for the project. Logging levels can be defined
+ * independently to only capture desired levels.
  *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
+ * For example, a project using `console` statements to capture logs can use the following
+ * implementation of this interface:
  *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
+ * ```ts
+ * const ConsoleLogger: SimpleWebAuthnLogger = {
+ *   // debug(message: string, ...args: unknown[]) { console.debug(message, ...args); },
+ *   info(message: string, ...args: unknown[]) { console.info(message, ...args); },
+ *   warn(message: string, ...args: unknown[]) { console.warn(message, ...args); },
+ *   error(message: string, ...args: unknown[]) { console.error(message, ...args); },
+ * };
  * ```
  */
-export declare function getLogger(_name: string): (message: string, ..._rest: unknown[]) => void;
+export interface SimpleWebAuthnLogger {
+    debug?: (message: string, ...args: unknown[]) => void;
+    info?: (message: string, ...args: unknown[]) => void;
+    warn?: (message: string, ...args: unknown[]) => void;
+    error?: (message: string, ...args: unknown[]) => void;
+}
+/**
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
+ */
+export declare const DefaultNoopLogger: Required<SimpleWebAuthnLogger>;
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export declare function buildLoggerAllMethods(logger: SimpleWebAuthnLogger): Required<SimpleWebAuthnLogger>;
 //# sourceMappingURL=logging.d.ts.map

package/script/helpers/logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAGvF"}
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACvD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,oBAAoB,CAK5D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,oBAAoB,CAAC,CAoBhC"}

package/script/helpers/logging.js

@@ -1,22 +1,34 @@
 "use strict";
-// const defaultLogger = debug('SimpleWebAuthn');
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLogger = getLogger;
+exports.DefaultNoopLogger = void 0;
+exports.buildLoggerAllMethods = buildLoggerAllMethods;
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
- *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
- *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
- * ```
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
  */
-function getLogger(_name) {
-    // This is a noop for now while I search for a better debug logger technique
-    return (_message, ..._rest) => { };
+exports.DefaultNoopLogger = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+function buildLoggerAllMethods(logger) {
+    const toReturn = { ...exports.DefaultNoopLogger };
+    if (logger.debug) {
+        toReturn.debug = logger.debug;
+    }
+    if (logger.info) {
+        toReturn.info = logger.info;
+    }
+    if (logger.warn) {
+        toReturn.warn = logger.warn;
+    }
+    if (logger.error) {
+        toReturn.error = logger.error;
+    }
+    return toReturn;
 }

package/script/helpers/mapJWSAlgToCOSEAlg.d.ts

@@ -0,0 +1,8 @@
+import { COSEALG } from './cose.js';
+/**
+ * Map JWS algorithms to COSE algorithm IDs
+ *
+ * See https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1 for possible values
+ */
+export declare function mapJWSAlgToCOSEAlg(alg: string): COSEALG;
+//# sourceMappingURL=mapJWSAlgToCOSEAlg.d.ts.map

package/script/helpers/mapJWSAlgToCOSEAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapJWSAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapJWSAlgToCOSEAlg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoBvD"}

package/script/helpers/mapJWSAlgToCOSEAlg.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapJWSAlgToCOSEAlg = mapJWSAlgToCOSEAlg;
+const cose_js_1 = require("./cose.js");
+/**
+ * Map JWS algorithms to COSE algorithm IDs
+ *
+ * See https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1 for possible values
+ */
+function mapJWSAlgToCOSEAlg(alg) {
+    let algCOSE;
+    if (alg === 'ES256') {
+        algCOSE = cose_js_1.COSEALG.ES256;
+    }
+    else if (alg === 'ES384') {
+        algCOSE = cose_js_1.COSEALG.ES384;
+    }
+    else if (alg === 'ES512') {
+        algCOSE = cose_js_1.COSEALG.ES512;
+    }
+    else if (alg === 'RS256') {
+        algCOSE = cose_js_1.COSEALG.RS256;
+    }
+    else if (alg === 'RS384') {
+        algCOSE = cose_js_1.COSEALG.RS384;
+    }
+    else if (alg === 'RS512') {
+        algCOSE = cose_js_1.COSEALG.RS512;
+    }
+    else {
+        throw new Error(`Unable to map JWS algorithm "${alg}" to a COSE algorithm`);
+    }
+    return algCOSE;
+}

package/script/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}

package/script/helpers/validateCertificatePath.js

@@ -82,15 +82,33 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new x509_1.X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
-            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            // Attempt to build a certificate path
             const chain = await chainBuilder.build(x5cLeafCert);
-            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
-            if (chain.length < numUniqueCerts) {
-                // Invalid cert chain, try the next trust anchor
-                continue;
+            /**
+             * The cert chain must chain to the anchor. Usually this is as simple as asserting that the
+             * final cert in the chain is the anchor cert. However there's an odd scenario where an
+             * intermediate certificate can chain to an anchor cert's public key, but not actually to the
+             * anchor cert because e.g. the chain builder stopped at a cross-signed cert for the anchor
+             * and not the anchor cert itself.
+             *
+             * So here we're going to check for that. In the simplest case we'll be fine with the last
+             * cert in the chain being byte-equivalent to the current anchor cert. If not, then move a
+             * cert up the chain and explicitly check that it was signed by the anchor cert. This also
+             * future-proofs this logic from the internals of whatever future X.509 library might be used
+             * to build the cert path.
+             */
+            const lastCert = chain[chain.length - 1];
+            const lastCertEqualsAnchor = lastCert.equal(anchor);
+            let certBeforeLastSignedByAnchor = false;
+            if (!lastCertEqualsAnchor && chain.length > 1) {
+                const certBeforeLast = chain[chain.length - 2];
+                certBeforeLastSignedByAnchor = await certBeforeLast.verify({
+                    publicKey: anchor.publicKey,
+                    signatureOnly: true,
+                });
             }
-            // Check if the chain is to the trust anchor
-            if (chain[chain.length - 1].subject !== anchor.subject) {
+            const chainReachesAnchor = lastCertEqualsAnchor || certBeforeLastSignedByAnchor;
+            if (!chainReachesAnchor) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }

package/script/metadata/verifyJWT.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CA0B9E"}
+{"version":3,"file":"verifyJWT.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAgC9E"}

package/script/metadata/verifyJWT.js

@@ -4,6 +4,7 @@ exports.verifyJWT = verifyJWT;
 const convertX509PublicKeyToCOSE_js_1 = require("../helpers/convertX509PublicKeyToCOSE.js");
 const index_js_1 = require("../helpers/iso/index.js");
 const cose_js_1 = require("../helpers/cose.js");
+const mapJWSAlgToCOSEAlg_js_1 = require("../helpers/mapJWSAlgToCOSEAlg.js");
 const verifyEC2_js_1 = require("../helpers/iso/isoCrypto/verifyEC2.js");
 const verifyRSA_js_1 = require("../helpers/iso/isoCrypto/verifyRSA.js");
 /**
@@ -20,12 +21,15 @@ function verifyJWT(jwt, leafCert) {
     const certCOSE = (0, convertX509PublicKeyToCOSE_js_1.convertX509PublicKeyToCOSE)(leafCert);
     const data = index_js_1.isoUint8Array.fromUTF8String(`${header}.${payload}`);
     const signatureBytes = index_js_1.isoBase64URL.toBuffer(signature);
+    // We just need the `alg` from the header, so only partially define the shape of it
+    const headerJSON = JSON.parse(index_js_1.isoBase64URL.toUTF8String(header));
+    const jwtHeaderHashAlgCOSE = (0, mapJWSAlgToCOSEAlg_js_1.mapJWSAlgToCOSEAlg)(headerJSON.alg);
     if ((0, cose_js_1.isCOSEPublicKeyEC2)(certCOSE)) {
         return (0, verifyEC2_js_1.verifyEC2)({
             data,
             signature: signatureBytes,
             cosePublicKey: certCOSE,
-            shaHashOverride: cose_js_1.COSEALG.ES256,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
         });
     }
     else if ((0, cose_js_1.isCOSEPublicKeyRSA)(certCOSE)) {
@@ -33,6 +37,7 @@ function verifyJWT(jwt, leafCert) {
             data,
             signature: signatureBytes,
             cosePublicKey: certCOSE,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
         });
     }
     const kty = certCOSE.get(cose_js_1.COSEKEYS.kty);