@simplewebauthn/server 14.0.0 → 14.0.2

package/script/helpers/isCertRevoked.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isCertRevoked = isCertRevoked;
+require("reflect-metadata");
 const x509_1 = require("@peculiar/x509");
 const fetch_js_1 = require("./fetch.js");
 const cacheRevokedCerts = {};
@@ -10,90 +11,110 @@ const cacheRevokedCerts = {};
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-async function isCertRevoked(cert) {
-    const { extensions } = cert;
+async function isCertRevoked(certificate, issuer) {
+    if (!issuer) {
+        // We don't have a public key to verify any CRL signature so don't bother continuing
+        return false;
+    }
+    const { extensions } = certificate;
     if (!extensions) {
         return false;
     }
-    let extAuthorityKeyID;
-    let extSubjectKeyID;
-    let extCRLDistributionPoints;
-    extensions.forEach((ext) => {
-        if (ext instanceof x509_1.AuthorityKeyIdentifierExtension) {
-            extAuthorityKeyID = ext;
-        }
-        else if (ext instanceof x509_1.SubjectKeyIdentifierExtension) {
-            extSubjectKeyID = ext;
-        }
-        else if (ext instanceof x509_1.CRLDistributionPointsExtension) {
-            extCRLDistributionPoints = ext;
-        }
+    const extCRLDistributionPoints = extensions.find((ext) => ext instanceof x509_1.CRLDistributionPointsExtension);
+    // Get all CRL URLs from within the certificate
+    const crlURLs = [];
+    extCRLDistributionPoints?.distributionPoints?.forEach((dPoint) => {
+        dPoint.distributionPoint?.fullName?.forEach((fullName) => {
+            if (fullName.uniformResourceIdentifier) {
+                crlURLs.push(fullName.uniformResourceIdentifier);
+            }
+        });
     });
-    // Check to see if we've got cached info for the cert's CA
-    let keyIdentifier = undefined;
-    if (extAuthorityKeyID && extAuthorityKeyID.keyId) {
-        keyIdentifier = extAuthorityKeyID.keyId;
+    // If no URL(s) is provided then we have nothing to check
+    if (!(crlURLs.length > 0)) {
+        return false;
     }
-    else if (extSubjectKeyID) {
-        /**
-         * We might be dealing with a self-signed root certificate. Check the
-         * Subject key Identifier extension next.
-         */
-        keyIdentifier = extSubjectKeyID.keyId;
+    // Get the issuer's key identifier for part of the cache key and to check against the
+    // certificate's and CRL's AuthorityKeyIdentifier extension
+    const { keyIdentifier: issuerKeyIdentifier, fromExtension: issuerKeyIdentifierFromExtension, } = await getIssuerKeyIdentifier(issuer);
+    const certificateExtAuthorityKeyID = certificate.extensions.find((ext) => ext instanceof x509_1.AuthorityKeyIdentifierExtension);
+    // When present, assert that certificates's AuthorityKeyIdentifier mirrors
+    // the issuer's SubjectKeyIdentifier
+    if (issuerKeyIdentifierFromExtension &&
+        certificateExtAuthorityKeyID?.keyId &&
+        certificateExtAuthorityKeyID.keyId !== issuerKeyIdentifier) {
+        throw new Error(`Certificate's AuthorityKeyIdentifier did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
     }
-    if (keyIdentifier) {
-        const cached = cacheRevokedCerts[keyIdentifier];
+    for (const crlURL of crlURLs) {
+        // Key off of issuer public key and CRL URL in case multiple CRLs are specified
+        const cacheKey = `${issuerKeyIdentifier}|${crlURL}`;
+        const cached = cacheRevokedCerts[cacheKey];
         if (cached) {
             const now = new Date();
             // If there's a nextUpdate then make sure we're before it
             if (!cached.nextUpdate || cached.nextUpdate > now) {
-                return cached.revokedCerts.indexOf(cert.serialNumber) >= 0;
+                return cached.revokedCerts.indexOf(certificate.serialNumber) >= 0;
             }
         }
-    }
-    const crlURL = extCRLDistributionPoints?.distributionPoints?.[0].distributionPoint?.fullName?.[0]
-        .uniformResourceIdentifier;
-    // If no URL is provided then we have nothing to check
-    if (!crlURL) {
-        return false;
-    }
-    // Download and read the CRL
-    let certListBytes;
-    try {
-        const respCRL = await (0, fetch_js_1.fetch)(crlURL);
-        certListBytes = await respCRL.arrayBuffer();
-    }
-    catch (_err) {
-        return false;
-    }
-    let data;
-    try {
-        data = new x509_1.X509Crl(certListBytes);
-    }
-    catch (_err) {
-        // Something was malformed with the CRL, so pass
-        return false;
-    }
-    const newCached = {
-        revokedCerts: [],
-        nextUpdate: undefined,
-    };
-    // nextUpdate
-    if (data.nextUpdate) {
-        newCached.nextUpdate = data.nextUpdate;
-    }
-    // revokedCertificates
-    const revokedCerts = data.entries;
-    if (revokedCerts) {
-        for (const cert of revokedCerts) {
-            const revokedHex = cert.serialNumber;
-            newCached.revokedCerts.push(revokedHex);
+        // Download and read the CRL
+        let crlBytes;
+        try {
+            const respCRL = await (0, fetch_js_1.fetch)(crlURL);
+            crlBytes = await respCRL.arrayBuffer();
+        }
+        catch (_err) {
+            // Some kind of network error occurred so try the next URL
+            continue;
+        }
+        let certCRL;
+        try {
+            certCRL = new x509_1.X509Crl(crlBytes);
+        }
+        catch (_err) {
+            // Something was malformed with the CRL so try the next URL
+            continue;
+        }
+        const certCRLVerified = await certCRL.verify({ publicKey: issuer.publicKey });
+        if (!certCRLVerified) {
+            throw new Error(`CRL from ${crlURL} failed signature verification against issuer "${issuer.subject}"`);
         }
-        // Cache the results
-        if (keyIdentifier) {
-            cacheRevokedCerts[keyIdentifier] = newCached;
+        // When present, assert that the CRL's AuthorityKeyIdentifier mirrors
+        // the issuer's SubjectKeyIdentifier
+        const crlAKI = certCRL.getExtension(x509_1.AuthorityKeyIdentifierExtension);
+        if (issuerKeyIdentifierFromExtension &&
+            crlAKI?.keyId &&
+            crlAKI.keyId !== issuerKeyIdentifier) {
+            throw new Error(`CRL from ${crlURL} contained an AuthorityKeyIdentifier that did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
+        }
+        // Cache the CRL only if a nextUpdate has been provided
+        if (certCRL.nextUpdate) {
+            cacheRevokedCerts[cacheKey] = {
+                revokedCerts: certCRL.entries.map((entry) => entry.serialNumber),
+                nextUpdate: certCRL.nextUpdate,
+            };
+        }
+        // Finally, check entries for revocation status
+        const revoked = certCRL.findRevoked(certificate);
+        if (revoked) {
+            return true;
         }
-        return newCached.revokedCerts.indexOf(cert.serialNumber) >= 0;
     }
     return false;
 }
+/**
+ * Determine a unique key ID for the issuer certificate, based either on its
+ * SubjectKeyIdentifierExtension or by generating the same value using the issuer's public key
+ */
+async function getIssuerKeyIdentifier(issuer) {
+    const issuerSKI = issuer.extensions?.find((ext) => ext instanceof x509_1.SubjectKeyIdentifierExtension);
+    if (issuerSKI?.keyId) {
+        return { keyIdentifier: issuerSKI.keyId, fromExtension: true };
+    }
+    /**
+     * The issuer carries no SubjectKeyIdentifier extension, so derive one from its public key
+     * (RFC 5280, method 1). This is good enough to keep unrelated CAs from colliding when computing
+     * the revocation cache key, but it's not authoritative enough to reject a certificate over.
+     */
+    const computed = await x509_1.SubjectKeyIdentifierExtension.create(issuer.publicKey);
+    return { keyIdentifier: computed.keyId, fromExtension: false };
+}

package/script/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAK3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB"}
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAM3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CA+CnB"}

package/script/helpers/iso/isoCrypto/verifyAKP.js

@@ -6,6 +6,7 @@ const index_js_1 = require("../../index.js");
 const importJWKKey_js_1 = require("./importJWKKey.js");
 const getWebCrypto_js_1 = require("./getWebCrypto.js");
 const mapCoseAlgToWebCryptoKeyAlgName_js_1 = require("./mapCoseAlgToWebCryptoKeyAlgName.js");
+const index_js_2 = require("../../../errors/index.js");
 /** AKP, a.k.a ML-DSA */
 async function verifyAKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -40,7 +41,7 @@ async function verifyAKP(opts) {
     catch (err) {
         const _err = err;
         if (_err.name === 'NotSupportedError') {
-            throw new Error(`This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}. See the \`cause\` property of this error for more info`, { cause: err });
+            throw new index_js_2.PQCNotSupportedError(alg);
         }
         else {
             throw err;

package/script/helpers/mapX509SignatureAlgToCOSEAlg.d.ts

@@ -1,9 +1,6 @@
 import { COSEALG } from './cose.js';
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 export declare function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm: string): COSEALG;
 //# sourceMappingURL=mapX509SignatureAlgToCOSEAlg.d.ts.map

package/script/helpers/mapX509SignatureAlgToCOSEAlg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAwBT"}
+{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CA8BT"}

package/script/helpers/mapX509SignatureAlgToCOSEAlg.js

@@ -1,36 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mapX509SignatureAlgToCOSEAlg = mapX509SignatureAlgToCOSEAlg;
+const asn1_ecc_1 = require("@peculiar/asn1-ecc");
+const asn1_rsa_1 = require("@peculiar/asn1-rsa");
+const asn1_x509_post_quantum_1 = require("@peculiar/asn1-x509-post-quantum");
 const cose_js_1 = require("./cose.js");
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
     let alg;
-    if (signatureAlgorithm === '1.2.840.10045.4.3.2') {
+    if (signatureAlgorithm === asn1_ecc_1.id_ecdsaWithSHA256) {
         alg = cose_js_1.COSEALG.ES256;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.3') {
+    else if (signatureAlgorithm === asn1_ecc_1.id_ecdsaWithSHA384) {
         alg = cose_js_1.COSEALG.ES384;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.4') {
+    else if (signatureAlgorithm === asn1_ecc_1.id_ecdsaWithSHA512) {
         alg = cose_js_1.COSEALG.ES512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.11') {
+    else if (signatureAlgorithm === asn1_rsa_1.id_sha256WithRSAEncryption) {
         alg = cose_js_1.COSEALG.RS256;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.12') {
+    else if (signatureAlgorithm === asn1_rsa_1.id_sha384WithRSAEncryption) {
         alg = cose_js_1.COSEALG.RS384;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.13') {
+    else if (signatureAlgorithm === asn1_rsa_1.id_sha512WithRSAEncryption) {
         alg = cose_js_1.COSEALG.RS512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.5') {
+    else if (signatureAlgorithm === asn1_rsa_1.id_sha1WithRSAEncryption) {
         alg = cose_js_1.COSEALG.RS1;
     }
+    else if (signatureAlgorithm === asn1_x509_post_quantum_1.id_ml_dsa_44) {
+        alg = cose_js_1.COSEALG.ML_DSA_44;
+    }
+    else if (signatureAlgorithm === asn1_x509_post_quantum_1.id_ml_dsa_65) {
+        alg = cose_js_1.COSEALG.ML_DSA_65;
+    }
+    else if (signatureAlgorithm === asn1_x509_post_quantum_1.id_ml_dsa_87) {
+        alg = cose_js_1.COSEALG.ML_DSA_87;
+    }
     else {
         throw new Error(`Unable to map X.509 signature algorithm ${signatureAlgorithm} to a COSE algorithm`);
     }

package/script/helpers/validateCertificatePath.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`

package/script/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiLlB"}

package/script/helpers/validateCertificatePath.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCertificatePath = validateCertificatePath;
+require("reflect-metadata");
 const x509_1 = require("@peculiar/x509");
 const isCertRevoked_js_1 = require("./isCertRevoked.js");
+const index_js_1 = require("../errors/index.js");
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -13,48 +15,25 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    // Prepare to work with x5c certs
-    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new x509_1.X509Certificate(certPEM));
-    // Check for any expired or temporally invalid certs in x5c
-    for (let i = 0; i < x5cCertsParsed.length; i++) {
-        const cert = x5cCertsParsed[i];
-        const certPEM = x5cCertsPEM[i];
-        try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            throw new Error(`Found revoked certificate in x5c:\n${certPEM}`);
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
-        }
-        catch (_err) {
-            throw new Error(`Found certificate out of validity period in x5c:\n${certPEM}`);
-        }
-    }
     // Prepare to work with trust anchor certs
     const trustAnchorsParsed = trustAnchorsPEM.map((certPEM) => {
         try {
             return new x509_1.X509Certificate(certPEM);
         }
         catch (err) {
-            const _err = err;
-            throw new Error(`Could not parse trust anchor certificate:\n${certPEM}`, { cause: _err });
+            throw new index_js_1.SimpleWebAuthnError({
+                message: `Could not parse trust anchor certificate:\n${certPEM}`,
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     });
-    // Filter out any expired or temporally invalid trust anchors certs
+    // Filter out any temporally invalid trust anchors certs
     const validTrustAnchors = [];
     for (let i = 0; i < trustAnchorsParsed.length; i++) {
         const cert = trustAnchorsParsed[i];
         try {
-            await assertCertNotRevoked(cert);
-        }
-        catch (_err) {
-            // Continue processing the other certs
-            continue;
-        }
-        try {
-            assertCertIsWithinValidTimeWindow(cert.notBefore, cert.notAfter);
+            assertCertIsWithinValidTimeWindow(cert);
         }
         catch (_err) {
             // Continue processing the other certs
@@ -63,22 +42,31 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
         validTrustAnchors.push(cert);
     }
     if (validTrustAnchors.length === 0) {
-        throw new Error('No specified trust anchor was valid for verifying x5c');
+        throw new index_js_1.SimpleWebAuthnError({
+            message: 'No specified trust anchor was valid for verifying x5c',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
+    }
+    // Prepare to work with x5c certs
+    const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new x509_1.X509Certificate(certPEM));
+    // Break apart x5c into leaf + intermediates
+    const x5cLeafCert = x5cCertsParsed[0];
+    let x5cIntermediates = [];
+    if (x5cCertsParsed.length > 1) {
+        x5cIntermediates = x5cCertsParsed.slice(1);
     }
     // Try to verify x5c with each valid trust anchor
     let invalidCertificateChain = true;
+    let validatedChain = undefined;
     for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
             const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
             if (numUniqueCerts !== x5cWithTrustAnchor.length) {
-                throw new Error('Invalid certificate path: found duplicate certificates');
-            }
-            // Break apart x5c to try and build a valid cert chain
-            const x5cLeafCert = x5cCertsParsed[0];
-            let x5cIntermediates = [];
-            if (x5cCertsParsed.length > 1) {
-                x5cIntermediates = x5cCertsParsed.slice(1);
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: 'Invalid certificate path: found duplicate certificates',
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
             }
             // Order of certs doesn't matter here but for readability
             const chainBuilder = new x509_1.X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
@@ -112,27 +100,87 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
                 // Invalid cert chain, try the next trust anchor
                 continue;
             }
-            // If we successfully validated a path then there's no need to continue. Reset any existing
-            // errors that were thrown by earlier trust anchors
+            if (certBeforeLastSignedByAnchor) {
+                /**
+                 * Swap out the last cert in the chain with the anchor that we've already verified
+                 * chains to the second-to-last certificate. This makes it easier to verify the chain
+                 * as a standard certificate chain.
+                 */
+                chain[chain.length - 1] = anchor;
+            }
+            // We successfully validated a chain so there's no need to continue
             invalidCertificateChain = false;
+            validatedChain = chain;
             break;
         }
         catch (err) {
-            throw new Error('Unexpected error while validating certificate path', { cause: err });
+            throw new index_js_1.SimpleWebAuthnError({
+                message: 'Unexpected error while validating certificate path',
+                code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                cause: err,
+            });
         }
     }
+    if (validatedChain) {
+        // Check for any temporally invalid or expired certs in the chain
+        for (let i = 0; i < validatedChain.length; i++) {
+            const cert = validatedChain[i];
+            try {
+                assertCertIsWithinValidTimeWindow(cert);
+            }
+            catch (_err) {
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: `Found certificate out of validity period:\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                });
+            }
+            /**
+             * Checking revocation is very expensive so do it only at the end when we're certain a cert
+             * is otherwise valid
+             */
+            let issuerCert = undefined;
+            if (i < validatedChain.length - 1) {
+                // Issuer cert is simply the next cert in the chain
+                issuerCert = validatedChain[i + 1];
+            }
+            else {
+                // `cert` is the anchor. Only try to verify its revocation status if it's a root certificate
+                if (await cert.isSelfSigned()) {
+                    issuerCert = cert;
+                }
+            }
+            try {
+                await assertCertNotRevoked(cert, issuerCert);
+            }
+            catch (err) {
+                throw new index_js_1.SimpleWebAuthnError({
+                    message: `The following certificate failed revocation status check\n${cert.toString()}`,
+                    code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+                    cause: err,
+                });
+            }
+        }
+    }
+    else {
+        invalidCertificateChain = true;
+    }
     // We tried multiple trust anchors and none of them worked
     if (invalidCertificateChain) {
-        throw new InvalidCertificatePath();
+        throw new index_js_1.SimpleWebAuthnError({
+            message: 'x5c could not be chained to any specified trust anchor',
+            code: 'CERTIFICATE_PATH_VERIFICATION_FAILED',
+        });
     }
     return true;
 }
 /**
  * Check if the certificate is revoked or not. If it is, raise an error
+ *
+ * @throws Error - Wrap this in a SimpleWebAuthnError so RPs can identify issues here
  */
-async function assertCertNotRevoked(certificate) {
+async function assertCertNotRevoked(certificate, issuerCert) {
     // Check for certificate revocation
-    const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate);
+    const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(certificate, issuerCert);
     if (subjectCertRevoked) {
         throw new Error('Found revoked certificate in certificate path');
     }
@@ -140,16 +188,10 @@ async function assertCertNotRevoked(certificate) {
 /**
  * Require the cert to be within its notBefore and notAfter time window
  */
-function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
+function assertCertIsWithinValidTimeWindow(certificate) {
+    const { notBefore: certNotBefore, notAfter: certNotAfter } = certificate;
     const now = new Date(Date.now());
     if (certNotBefore > now || certNotAfter < now) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-class InvalidCertificatePath extends Error {
-    constructor() {
-        const message = 'x5c could not be chained to any specified trust anchor';
-        super(message);
-        this.name = 'InvalidX5CChain';
-    }
-}

package/script/index.d.ts

@@ -6,4 +6,5 @@ export * from './services/metadataService.js';
 export * from './services/settingsService.js';
 export * from './metadata/mdsTypes.js';
 export * from './types/index.js';
+export * from './errors/index.js';
 //# sourceMappingURL=index.d.ts.map

package/script/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+CAA+C,CAAC;AAC9D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/script/index.js

@@ -22,3 +22,4 @@ __exportStar(require("./services/metadataService.js"), exports);
 __exportStar(require("./services/settingsService.js"), exports);
 __exportStar(require("./metadata/mdsTypes.js"), exports);
 __exportStar(require("./types/index.js"), exports);
+__exportStar(require("./errors/index.js"), exports);

package/script/metadata/verifyAttestationWithMetadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJnB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}
+{"version":3,"file":"verifyAttestationWithMetadata.d.ts","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAIhE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,EAEZ,OAAO,EAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,SAAS,EACT,mBAAmB,EACnB,GAAG,EACH,uBAAuB,GACxB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,WAAW,CAAC;IACjC,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6InB;AAED,KAAK,QAAQ,GAAG;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE;KAAG,GAAG,IAAI,OAAO,GAAG,QAAQ;CAe9D,CAAC"}

package/script/metadata/verifyAttestationWithMetadata.js

@@ -110,13 +110,7 @@ async function verifyAttestationWithMetadata({ statement, credentialPublicKey, x
         authenticatorIsSelfReferencing = true;
     }
     if (!authenticatorIsSelfReferencing) {
-        try {
-            await (0, validateCertificatePath_js_1.validateCertificatePath)(authenticatorCerts, statementRootCerts);
-        }
-        catch (err) {
-            const _err = err;
-            throw new Error(`Could not validate certificate path with any metadata root certificates: ${_err.message}`);
-        }
+        await (0, validateCertificatePath_js_1.validateCertificatePath)(authenticatorCerts, statementRootCerts);
     }
     return true;
 }

package/script/registration/verifications/verifyAttestationPacked.js

@@ -94,7 +94,7 @@ async function verifyAttestationPacked(options) {
             }
             catch (err) {
                 const _err = err;
-                throw new Error(`${_err.message} (Packed|Full)`);
+                throw new Error(`${_err.message} (Packed|Full)`, { cause: _err });
             }
         }
         verified = await (0, verifySignature_js_1.verifySignature)({

package/script/registration/verifyRegistrationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CAqPvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}
+{"version":3,"file":"verifyRegistrationResponse.d.ts","sourceRoot":"","sources":["../../src/registration/verifyRegistrationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAoBhH;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE;IACP,QAAQ,EAAE,wBAAwB,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,GACA,OAAO,CAAC,4BAA4B,CAAC,CA8PvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,GAAG;IACF,QAAQ,EAAE,IAAI,CAAC;IACf,gBAAgB,EAAE;QAChB,GAAG,EAAE,iBAAiB,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,kBAAkB,CAAC;QAC/B,cAAc,EAAE,YAAY,CAAC;QAC7B,iBAAiB,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,cAAc,EAAE,WAAW,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,mBAAmB,EAAE,WAAW,CAAC;IACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mCAAmC,CAAC,EAAE,OAAO,CAAC;CAC/C,CAAC"}