@simplewebauthn/server 14.0.0 → 14.0.2

package/script/registration/verifyRegistrationResponse.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyRegistrationResponse = verifyRegistrationResponse;
+const index_js_1 = require("../errors/index.js");
 const decodeAttestationObject_js_1 = require("../helpers/decodeAttestationObject.js");
 const decodeClientDataJSON_js_1 = require("../helpers/decodeClientDataJSON.js");
 const parseAuthenticatorData_js_1 = require("../helpers/parseAuthenticatorData.js");
@@ -10,7 +11,7 @@ const cose_js_1 = require("../helpers/cose.js");
 const convertAAGUIDToString_js_1 = require("../helpers/convertAAGUIDToString.js");
 const parseBackupFlags_js_1 = require("../helpers/parseBackupFlags.js");
 const matchExpectedRPID_js_1 = require("../helpers/matchExpectedRPID.js");
-const index_js_1 = require("../helpers/iso/index.js");
+const index_js_2 = require("../helpers/iso/index.js");
 const settingsService_js_1 = require("../services/settingsService.js");
 const generateRegistrationOptions_js_1 = require("./generateRegistrationOptions.js");
 const verifyAttestationFIDOU2F_js_1 = require("./verifications/verifyAttestationFIDOU2F.js");
@@ -94,7 +95,7 @@ async function verifyRegistrationResponse(options) {
             throw new Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`);
         }
     }
-    const attestationObject = index_js_1.isoBase64URL.toBuffer(attestationResponse.attestationObject);
+    const attestationObject = index_js_2.isoBase64URL.toBuffer(attestationResponse.attestationObject);
     const decodedAttestationObject = (0, decodeAttestationObject_js_1.decodeAttestationObject)(attestationObject);
     const fmt = decodedAttestationObject.get('fmt');
     const authData = decodedAttestationObject.get('authData');
@@ -131,19 +132,29 @@ async function verifyRegistrationResponse(options) {
         throw new Error('No AAGUID was present during registration');
     }
     const decodedPublicKey = (0, decodeCredentialPublicKey_js_1.decodeCredentialPublicKey)(credentialPublicKey);
-    const alg = decodedPublicKey.get(cose_js_1.COSEKEYS.alg);
-    if (typeof alg !== 'number') {
+    const pubKeyAlg = decodedPublicKey.get(cose_js_1.COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
         throw new Error('Credential public key was missing numeric alg');
     }
     // Make sure the key algorithm is one we specified within the registration options
-    if (!supportedAlgorithmIDs.includes(alg)) {
+    if (!supportedAlgorithmIDs.includes(pubKeyAlg)) {
         const supported = supportedAlgorithmIDs.join(', ');
-        throw new Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`);
+        throw new Error(`Unexpected public key alg "${pubKeyAlg}", expected one of "${supported}"`);
     }
-    const clientDataHash = await (0, toHash_js_1.toHash)(index_js_1.isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
-    const rootCertificates = settingsService_js_1.SettingsService.getRootCertificates({
-        identifier: fmt,
-    });
+    /**
+     * If the runtime doesn't support PQC passkeys then terminate here at the first sign of a PQC
+     * algorithm so that downstream issues that arise due to lack of PQC support won't get masked as
+     * unexpected behavior.
+     *
+     * I'm choosing to raise here even if attestation is "none" because it feels weird to allow an RP
+     * to parse a registration response w/o attestation only to encounter failure when trying to auth
+     * with the PQC passkey and the runtime doesn't support PQC.
+     */
+    if ((0, cose_js_1.isPQCCOSEAlg)(pubKeyAlg) && !settingsService_js_1.SettingsService.runtimeSupportsPQC()) {
+        throw new index_js_1.PQCNotSupportedError(pubKeyAlg);
+    }
+    const clientDataHash = await (0, toHash_js_1.toHash)(index_js_2.isoBase64URL.toBuffer(attestationResponse.clientDataJSON));
+    const rootCertificates = settingsService_js_1.SettingsService.getRootCertificates({ identifier: fmt });
     // Prepare arguments to pass to the relevant verification method
     const verifierOpts = {
         aaguid,
@@ -199,7 +210,7 @@ async function verifyRegistrationResponse(options) {
             aaguid: (0, convertAAGUIDToString_js_1.convertAAGUIDToString)(aaguid),
             credentialType,
             credential: {
-                id: index_js_1.isoBase64URL.fromBuffer(credentialID),
+                id: index_js_2.isoBase64URL.fromBuffer(credentialID),
                 publicKey: credentialPublicKey,
                 counter,
                 transports: response.response.transports,