@simplewebauthn/server 13.3.3 → 14.0.0

package/script/helpers/iso/isoCrypto/{importKey.js → importJWKKey.js}

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.importKey = importKey;
+exports.importJWKKey = importJWKKey;
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
-async function importKey(opts) {
+/**
+ * Convert a JWK-formatted public key into a WebCrypto CryptoKey that can be used for
+ * signature verification
+ */
+async function importJWKKey(opts) {
     const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
     const { keyData, algorithm } = opts;
-    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, [
-        'verify',
-    ]);
+    return WebCrypto.subtle.importKey('jwk', keyData, algorithm, false, ['verify']);
 }

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts

@@ -0,0 +1,10 @@
+import type { SubtleCryptoAlg } from './structs.js';
+import { COSEALG } from '../../cose.js';
+/**
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
+ */
+export declare function mapCoseAlgToWebCryptoHashAlgName(alg: COSEALG): SubtleCryptoAlg;
+//# sourceMappingURL=mapCoseAlgToWebCryptoHashAlgName.d.ts.map

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCoseAlgToWebCryptoHashAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoHashAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAe9E"}

package/script/helpers/iso/isoCrypto/{mapCoseAlgToWebCryptoAlg.js → mapCoseAlgToWebCryptoHashAlgName.js}

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mapCoseAlgToWebCryptoAlg = mapCoseAlgToWebCryptoAlg;
+exports.mapCoseAlgToWebCryptoHashAlgName = mapCoseAlgToWebCryptoHashAlgName;
 const cose_js_1 = require("../../cose.js");
 /**
- * Convert a COSE alg ID into a corresponding string value that WebCrypto APIs expect
+ * Convert a COSE alg ID into a corresponding hash algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
-function mapCoseAlgToWebCryptoAlg(alg) {
+function mapCoseAlgToWebCryptoHashAlgName(alg) {
     if ([cose_js_1.COSEALG.RS1].indexOf(alg) >= 0) {
         return 'SHA-1';
     }
@@ -19,5 +22,5 @@ function mapCoseAlgToWebCryptoAlg(alg) {
         0) {
         return 'SHA-512';
     }
-    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`);
+    throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto hash alg name`);
 }

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts

@@ -1,7 +1,10 @@
 import { COSEALG } from '../../cose.js';
-import { SubtleCryptoKeyAlgName } from './structs.js';
+import type { SubtleCryptoKeyAlgName } from './structs.js';
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 export declare function mapCoseAlgToWebCryptoKeyAlgName(alg: COSEALG): SubtleCryptoKeyAlgName;
 //# sourceMappingURL=mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;GAEG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAoBxB"}
+{"version":3,"file":"mapCoseAlgToWebCryptoKeyAlgName.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,sBAAsB,CAuBxB"}

package/script/helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js

@@ -4,6 +4,9 @@ exports.mapCoseAlgToWebCryptoKeyAlgName = mapCoseAlgToWebCryptoKeyAlgName;
 const cose_js_1 = require("../../cose.js");
 /**
  * Convert a COSE alg ID into a corresponding key algorithm string value that WebCrypto APIs expect
+ *
+ * Unless otherwise specified, mappings were referenced from
+ * https://w3c.github.io/webcrypto/#jwk-mapping-alg
  */
 function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     if ([cose_js_1.COSEALG.EdDSA].indexOf(alg) >= 0) {
@@ -18,5 +21,17 @@ function mapCoseAlgToWebCryptoKeyAlgName(alg) {
     else if ([cose_js_1.COSEALG.PS256, cose_js_1.COSEALG.PS384, cose_js_1.COSEALG.PS512].indexOf(alg) >= 0) {
         return 'RSA-PSS';
     }
+    else if ([cose_js_1.COSEALG.ML_DSA_44].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-44';
+    }
+    else if ([cose_js_1.COSEALG.ML_DSA_65].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-65';
+    }
+    else if ([cose_js_1.COSEALG.ML_DSA_87].indexOf(alg) >= 0) {
+        // https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-registration
+        return 'ML-DSA-87';
+    }
     throw new Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`);
 }

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts

@@ -0,0 +1,7 @@
+import type { AlgorithmIdentifier } from '../../../types/index.js';
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+export declare function runtimeSupportsWebCryptoKeyAlg(alg: AlgorithmIdentifier): boolean;
+//# sourceMappingURL=runtimeSupportsWebCryptoKeyAlg.d.ts.map

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeSupportsWebCryptoKeyAlg.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;AAEvF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAYhF"}

package/script/helpers/iso/isoCrypto/runtimeSupportsWebCryptoKeyAlg.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeSupportsWebCryptoKeyAlg = runtimeSupportsWebCryptoKeyAlg;
+/**
+ * Use SubtleCrypto.supports() to understand if the runtime supports using the given key algorithm
+ * for signature verification.
+ */
+function runtimeSupportsWebCryptoKeyAlg(alg) {
+    const globalSubtleCrypto = globalThis.SubtleCrypto;
+    if (typeof globalSubtleCrypto.supports !== 'function') {
+        return false;
+    }
+    try {
+        return globalSubtleCrypto.supports('verify', alg);
+    }
+    catch (_err) {
+        return false;
+    }
+}

package/script/helpers/iso/isoCrypto/structs.d.ts

@@ -1,4 +1,4 @@
 export type SubtleCryptoAlg = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';
 export type SubtleCryptoCrv = 'P-256' | 'P-384' | 'P-521' | 'Ed25519';
-export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
+export type SubtleCryptoKeyAlgName = 'ECDSA' | 'Ed25519' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS';
 //# sourceMappingURL=structs.d.ts.map

package/script/helpers/iso/isoCrypto/structs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,SAAS,CAAC"}
+{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/structs.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,SAAS,GACT,WAAW,GACX,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,SAAS,CAAC"}

package/script/helpers/iso/isoCrypto/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBnB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAMnB,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BnB"}

package/script/helpers/iso/isoCrypto/verify.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verify = verify;
 const cose_js_1 = require("../../cose.js");
+const verifyAKP_js_1 = require("./verifyAKP.js");
 const verifyEC2_js_1 = require("./verifyEC2.js");
 const verifyRSA_js_1 = require("./verifyRSA.js");
 const verifyOKP_js_1 = require("./verifyOKP.js");
@@ -30,6 +31,9 @@ function verify(opts) {
     else if ((0, cose_js_1.isCOSEPublicKeyOKP)(cosePublicKey)) {
         return (0, verifyOKP_js_1.verifyOKP)({ cosePublicKey, signature, data });
     }
+    else if ((0, cose_js_1.isCOSEPublicKeyAKP)(cosePublicKey)) {
+        return (0, verifyAKP_js_1.verifyAKP)({ cosePublicKey, signature, data });
+    }
     const kty = cosePublicKey.get(cose_js_1.COSEKEYS.kty);
     throw new Error(`Signature verification with public key of kty ${kty} is not supported by this method`);
 }

package/script/helpers/iso/isoCrypto/verifyAKP.d.ts

@@ -0,0 +1,9 @@
+import { type COSEPublicKeyAKP } from '../../cose.js';
+import type { Uint8Array_ } from '../../../types/index.js';
+/** AKP, a.k.a ML-DSA */
+export declare function verifyAKP(opts: {
+    cosePublicKey: COSEPublicKeyAKP;
+    signature: Uint8Array_;
+    data: Uint8Array_;
+}): Promise<boolean>;
+//# sourceMappingURL=verifyAKP.d.ts.map

package/script/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAK3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB"}

package/script/helpers/iso/isoCrypto/verifyAKP.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAKP = verifyAKP;
+const cose_js_1 = require("../../cose.js");
+const index_js_1 = require("../../index.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
+const getWebCrypto_js_1 = require("./getWebCrypto.js");
+const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
+/** AKP, a.k.a ML-DSA */
+async function verifyAKP(opts) {
+    const { cosePublicKey, signature, data } = opts;
+    const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
+    const alg = cosePublicKey.get(cose_js_1.COSEKEYS.alg);
+    const pub = cosePublicKey.get(cose_js_1.COSEKEYS.pub);
+    if (!alg) {
+        throw new Error('Public key was missing alg (AKP)');
+    }
+    if (!(0, cose_js_1.isCOSEAlg)(alg)) {
+        throw new Error(`Public key had invalid alg ${alg} (AKP)`);
+    }
+    if (!pub) {
+        throw new Error('Public key was missing pub (AKP)');
+    }
+    const webCryptoAlg = (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg);
+    // See https://wicg.github.io/webcrypto-modern-algos/#ml-dsa-operations-import-key -> "jwk"
+    const keyData = {
+        kty: 'AKP',
+        alg: webCryptoAlg,
+        pub: index_js_1.isoBase64URL.fromBuffer(pub),
+        ext: false,
+    };
+    /**
+     * ML-DSA support is pretty cutting edge, so take some steps to help RP's understand this instead
+     * of them getting a `NotSupportedError: Unrecognized algorithm name` and trying to interpret it.
+     */
+    let key;
+    try {
+        key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: webCryptoAlg });
+    }
+    catch (err) {
+        const _err = err;
+        if (_err.name === 'NotSupportedError') {
+            throw new Error(`This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}. See the \`cause\` property of this error for more info`, { cause: err });
+        }
+        else {
+            throw err;
+        }
+    }
+    return WebCrypto.subtle.verify(webCryptoAlg, key, signature, data);
+}

package/script/helpers/iso/isoCrypto/verifyEC2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA0EnB"}
+{"version":3,"file":"verifyEC2.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyEC2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAuEnB"}

package/script/helpers/iso/isoCrypto/verifyEC2.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyEC2 = verifyEC2;
 const cose_js_1 = require("../../cose.js");
-const mapCoseAlgToWebCryptoAlg_js_1 = require("./mapCoseAlgToWebCryptoAlg.js");
-const importKey_js_1 = require("./importKey.js");
+const mapCoseAlgToWebCryptoHashAlgName_js_1 = require("./mapCoseAlgToWebCryptoHashAlgName.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const index_js_1 = require("../index.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 /**
@@ -59,14 +59,11 @@ async function verifyEC2(opts) {
         name: 'ECDSA',
         namedCurve: _crv,
     };
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     // Determine which SHA algorithm to use for signature verification
-    let subtleAlg = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(alg);
+    let subtleAlg = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(alg);
     if (shaHashOverride) {
-        subtleAlg = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(shaHashOverride);
+        subtleAlg = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(shaHashOverride);
     }
     const verifyAlgorithm = {
         name: 'ECDSA',

package/script/helpers/iso/isoCrypto/verifyOKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAyDnB"}
+{"version":3,"file":"verifyOKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyOKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAKpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAsDnB"}

package/script/helpers/iso/isoCrypto/verifyOKP.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyOKP = verifyOKP;
 const cose_js_1 = require("../../cose.js");
 const index_js_1 = require("../../index.js");
-const importKey_js_1 = require("./importKey.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 async function verifyOKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -43,10 +43,7 @@ async function verifyOKP(opts) {
         name: _crv,
         namedCurve: _crv,
     };
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     const verifyAlgorithm = {
         name: _crv,
     };

package/script/helpers/iso/isoCrypto/verifyRSA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CA2FnB"}
+{"version":3,"file":"verifyRSA.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyRSA.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAMzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAwFnB"}

package/script/helpers/iso/isoCrypto/verifyRSA.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyRSA = verifyRSA;
 const cose_js_1 = require("../../cose.js");
-const mapCoseAlgToWebCryptoAlg_js_1 = require("./mapCoseAlgToWebCryptoAlg.js");
-const importKey_js_1 = require("./importKey.js");
+const mapCoseAlgToWebCryptoHashAlgName_js_1 = require("./mapCoseAlgToWebCryptoHashAlgName.js");
+const importJWKKey_js_1 = require("./importJWKKey.js");
 const index_js_1 = require("../index.js");
 const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
@@ -37,13 +37,13 @@ async function verifyRSA(opts) {
     };
     const keyAlgorithm = {
         name: (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg),
-        hash: { name: (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(alg) },
+        hash: { name: (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(alg) },
     };
     const verifyAlgorithm = {
         name: (0, mapCoseAlgToWebCryptoKeyAlgName_js_1.mapCoseAlgToWebCryptoKeyAlgName)(alg),
     };
     if (shaHashOverride) {
-        keyAlgorithm.hash.name = (0, mapCoseAlgToWebCryptoAlg_js_1.mapCoseAlgToWebCryptoAlg)(shaHashOverride);
+        keyAlgorithm.hash.name = (0, mapCoseAlgToWebCryptoHashAlgName_js_1.mapCoseAlgToWebCryptoHashAlgName)(shaHashOverride);
     }
     if (keyAlgorithm.name === 'RSASSA-PKCS1-v1_5') {
         if (keyAlgorithm.hash.name === 'SHA-256') {
@@ -86,9 +86,6 @@ async function verifyRSA(opts) {
     else {
         throw new Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);
     }
-    const key = await (0, importKey_js_1.importKey)({
-        keyData,
-        algorithm: keyAlgorithm,
-    });
+    const key = await (0, importJWKKey_js_1.importJWKKey)({ keyData, algorithm: keyAlgorithm });
     return WebCrypto.subtle.verify(verifyAlgorithm, key, signature, data);
 }

package/script/helpers/logging.d.ts

@@ -1,16 +1,34 @@
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
+ * A basic logging interface that enables projects to capture logging output from SimpleWebAuthn
+ * using whatever logging method is appropriate for the project. Logging levels can be defined
+ * independently to only capture desired levels.
  *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
+ * For example, a project using `console` statements to capture logs can use the following
+ * implementation of this interface:
  *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
+ * ```ts
+ * const ConsoleLogger: SimpleWebAuthnLogger = {
+ *   // debug(message: string, ...args: unknown[]) { console.debug(message, ...args); },
+ *   info(message: string, ...args: unknown[]) { console.info(message, ...args); },
+ *   warn(message: string, ...args: unknown[]) { console.warn(message, ...args); },
+ *   error(message: string, ...args: unknown[]) { console.error(message, ...args); },
+ * };
  * ```
  */
-export declare function getLogger(_name: string): (message: string, ..._rest: unknown[]) => void;
+export interface SimpleWebAuthnLogger {
+    debug?: (message: string, ...args: unknown[]) => void;
+    info?: (message: string, ...args: unknown[]) => void;
+    warn?: (message: string, ...args: unknown[]) => void;
+    error?: (message: string, ...args: unknown[]) => void;
+}
+/**
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
+ */
+export declare const DefaultNoopLogger: Required<SimpleWebAuthnLogger>;
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+export declare function buildLoggerAllMethods(logger: SimpleWebAuthnLogger): Required<SimpleWebAuthnLogger>;
 //# sourceMappingURL=logging.d.ts.map

package/script/helpers/logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAGvF"}
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/helpers/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACvD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,oBAAoB,CAK5D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,oBAAoB,CAAC,CAoBhC"}

package/script/helpers/logging.js

@@ -1,22 +1,34 @@
 "use strict";
-// const defaultLogger = debug('SimpleWebAuthn');
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLogger = getLogger;
+exports.DefaultNoopLogger = void 0;
+exports.buildLoggerAllMethods = buildLoggerAllMethods;
 /**
- * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
- * consistent naming.
- *
- * See https://www.npmjs.com/package/debug for information on how to control logging output when
- * using @simplewebauthn/server
- *
- * Example:
- *
- * ```
- * const log = getLogger('mds');
- * log('hello'); // simplewebauthn:mds hello +0ms
- * ```
+ * A logger instance that doesn't do anything. Useful as a default argument when no custom instance
+ * of the `SimpleWebAuthnLogger` interface is specified.
  */
-function getLogger(_name) {
-    // This is a noop for now while I search for a better debug logger technique
-    return (_message, ..._rest) => { };
+exports.DefaultNoopLogger = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+/**
+ * Generate an instance of SimpleWebAuthnLogger that defines all methods. Any logging method not
+ * defined on `logger` will be a no-op.
+ */
+function buildLoggerAllMethods(logger) {
+    const toReturn = { ...exports.DefaultNoopLogger };
+    if (logger.debug) {
+        toReturn.debug = logger.debug;
+    }
+    if (logger.info) {
+        toReturn.info = logger.info;
+    }
+    if (logger.warn) {
+        toReturn.warn = logger.warn;
+    }
+    if (logger.error) {
+        toReturn.error = logger.error;
+    }
+    return toReturn;
 }

package/script/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}

package/script/helpers/validateCertificatePath.js

@@ -82,15 +82,33 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new x509_1.X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
-            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            // Attempt to build a certificate path
             const chain = await chainBuilder.build(x5cLeafCert);
-            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
-            if (chain.length < numUniqueCerts) {
-                // Invalid cert chain, try the next trust anchor
-                continue;
+            /**
+             * The cert chain must chain to the anchor. Usually this is as simple as asserting that the
+             * final cert in the chain is the anchor cert. However there's an odd scenario where an
+             * intermediate certificate can chain to an anchor cert's public key, but not actually to the
+             * anchor cert because e.g. the chain builder stopped at a cross-signed cert for the anchor
+             * and not the anchor cert itself.
+             *
+             * So here we're going to check for that. In the simplest case we'll be fine with the last
+             * cert in the chain being byte-equivalent to the current anchor cert. If not, then move a
+             * cert up the chain and explicitly check that it was signed by the anchor cert. This also
+             * future-proofs this logic from the internals of whatever future X.509 library might be used
+             * to build the cert path.
+             */
+            const lastCert = chain[chain.length - 1];
+            const lastCertEqualsAnchor = lastCert.equal(anchor);
+            let certBeforeLastSignedByAnchor = false;
+            if (!lastCertEqualsAnchor && chain.length > 1) {
+                const certBeforeLast = chain[chain.length - 2];
+                certBeforeLastSignedByAnchor = await certBeforeLast.verify({
+                    publicKey: anchor.publicKey,
+                    signatureOnly: true,
+                });
             }
-            // Check if the chain is to the trust anchor
-            if (chain[chain.length - 1].subject !== anchor.subject) {
+            const chainReachesAnchor = lastCertEqualsAnchor || certBeforeLastSignedByAnchor;
+            if (!chainReachesAnchor) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }

package/script/registration/generateRegistrationOptions.d.ts

@@ -1,11 +1,13 @@
-import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import type { AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, Base64URLString, PublicKeyCredentialCreationOptionsJSON, Uint8Array_ } from '../types/index.js';
+import { COSEALG } from '../helpers/cose.js';
 export type GenerateRegistrationOptionsOpts = Parameters<typeof generateRegistrationOptions>[0];
 /**
- * Supported crypto algo identifiers
- * See https://w3c.github.io/webauthn/#sctn-alg-identifier
- * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ * Use the most commonly-supported algorithms
+ * See the following:
+ *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
  */
-export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[];
+export declare let defaultSupportedAlgorithmIDs: COSEALG[];
 /**
  * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
  *
@@ -22,7 +24,7 @@ export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[
  * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
  * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
  * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
- * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers indicating supported public key algorithms. Import `COSEALG` from \@simplewebauthn/server/helpers for suitable values. Defaults to `[COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256]`
  * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
  */
 export declare function generateRegistrationOptions(options: {
@@ -36,11 +38,11 @@ export declare function generateRegistrationOptions(options: {
     attestationType?: 'direct' | 'enterprise' | 'none';
     excludeCredentials?: {
         id: Base64URLString;
-        transports?: AuthenticatorTransportFuture[];
+        transports?: string[];
     }[];
     authenticatorSelection?: AuthenticatorSelectionCriteria;
     extensions?: AuthenticationExtensionsClientInputs;
-    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+    supportedAlgorithmIDs?: number[];
     preferredAuthenticatorType?: 'securityKey' | 'localDevice' | 'remoteDevice';
 }): Promise<PublicKeyCredentialCreationOptionsJSON>;
 //# sourceMappingURL=generateRegistrationOptions.d.ts.map

package/script/registration/generateRegistrationOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,uBAAuB,EAqBtE,CAAC;AAsBF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;KAC7C,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}
+{"version":3,"file":"generateRegistrationOptions.d.ts","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,sCAAsC,EAGtC,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAchG;;;;;GAKG;AACH,eAAO,IAAI,4BAA4B,EAAE,OAAO,EAI/C,CAAC;AAMF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;IACnD,kBAAkB,CAAC,EAAE;QACnB,EAAE,EAAE,eAAe,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,EAAE,CAAC;IACJ,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,0BAA0B,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,cAAc,CAAC;CAC7E,GACA,OAAO,CAAC,sCAAsC,CAAC,CAqIjD"}