@simplewebauthn/server 7.4.0 → 8.0.0

package/script/helpers/logging.d.ts

@@ -0,0 +1,17 @@
+/// <reference types="debug" />
+import { Debugger } from '../deps.js';
+/**
+ * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
+ * consistent naming.
+ *
+ * See https://www.npmjs.com/package/debug for information on how to control logging output when
+ * using @simplewebauthn/server
+ *
+ * Example:
+ *
+ * ```
+ * const log = getLogger('mds');
+ * log('hello'); // simplewebauthn:mds hello +0ms
+ * ```
+ */
+export declare function getLogger(name: string): Debugger;

package/{dist → script}/helpers/logging.js

@@ -1,11 +1,8 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLogger = void 0;
-const debug_1 = __importDefault(require("debug"));
-const defaultLogger = (0, debug_1.default)('SimpleWebAuthn');
+const deps_js_1 = require("../deps.js");
+const defaultLogger = (0, deps_js_1.debug)('SimpleWebAuthn');
 /**
  * Generate an instance of a `debug` logger that extends off of the "simplewebauthn" namespace for
  * consistent naming.
@@ -24,4 +21,3 @@ function getLogger(name) {
     return defaultLogger.extend(name);
 }
 exports.getLogger = getLogger;
-//# sourceMappingURL=logging.js.map

package/script/helpers/mapX509SignatureAlgToCOSEAlg.d.ts

@@ -0,0 +1,8 @@
+import { COSEALG } from './cose.js';
+/**
+ * Map X.509 signature algorithm OIDs to COSE algorithm IDs
+ *
+ * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
+ * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
+ */
+export declare function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm: string): COSEALG;

package/{dist → script}/helpers/mapX509SignatureAlgToCOSEAlg.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mapX509SignatureAlgToCOSEAlg = void 0;
-const cose_1 = require("./cose");
+const cose_js_1 = require("./cose.js");
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
  *
@@ -11,25 +11,25 @@ const cose_1 = require("./cose");
 function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
     let alg;
     if (signatureAlgorithm === '1.2.840.10045.4.3.2') {
-        alg = cose_1.COSEALG.ES256;
+        alg = cose_js_1.COSEALG.ES256;
     }
     else if (signatureAlgorithm === '1.2.840.10045.4.3.3') {
-        alg = cose_1.COSEALG.ES384;
+        alg = cose_js_1.COSEALG.ES384;
     }
     else if (signatureAlgorithm === '1.2.840.10045.4.3.4') {
-        alg = cose_1.COSEALG.ES512;
+        alg = cose_js_1.COSEALG.ES512;
     }
     else if (signatureAlgorithm === '1.2.840.113549.1.1.11') {
-        alg = cose_1.COSEALG.RS256;
+        alg = cose_js_1.COSEALG.RS256;
     }
     else if (signatureAlgorithm === '1.2.840.113549.1.1.12') {
-        alg = cose_1.COSEALG.RS384;
+        alg = cose_js_1.COSEALG.RS384;
     }
     else if (signatureAlgorithm === '1.2.840.113549.1.1.13') {
-        alg = cose_1.COSEALG.RS512;
+        alg = cose_js_1.COSEALG.RS512;
     }
     else if (signatureAlgorithm === '1.2.840.113549.1.1.5') {
-        alg = cose_1.COSEALG.RS1;
+        alg = cose_js_1.COSEALG.RS1;
     }
     else {
         throw new Error(`Unable to map X.509 signature algorithm ${signatureAlgorithm} to a COSE algorithm`);
@@ -37,4 +37,3 @@ function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
     return alg;
 }
 exports.mapX509SignatureAlgToCOSEAlg = mapX509SignatureAlgToCOSEAlg;
-//# sourceMappingURL=mapX509SignatureAlgToCOSEAlg.js.map

package/script/helpers/matchExpectedRPID.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
+ * that matched the hash in the response.
+ *
+ * Raises an `UnexpectedRPIDHash` error if no match is found
+ */
+export declare function matchExpectedRPID(rpIDHash: Uint8Array, expectedRPIDs: string[]): Promise<string>;

package/{dist → script}/helpers/matchExpectedRPID.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.matchExpectedRPID = void 0;
-const toHash_1 = require("./toHash");
-const iso_1 = require("./iso");
+const toHash_js_1 = require("./toHash.js");
+const index_js_1 = require("./iso/index.js");
 /**
  * Go through each expected RP ID and try to find one that matches. Returns the unhashed RP ID
  * that matched the hash in the response.
@@ -11,10 +11,10 @@ const iso_1 = require("./iso");
  */
 async function matchExpectedRPID(rpIDHash, expectedRPIDs) {
     try {
-        const matchedRPID = await Promise.any(expectedRPIDs.map(expected => {
+        const matchedRPID = await Promise.any(expectedRPIDs.map((expected) => {
             return new Promise((resolve, reject) => {
-                (0, toHash_1.toHash)(iso_1.isoUint8Array.fromASCIIString(expected)).then(expectedRPIDHash => {
-                    if (iso_1.isoUint8Array.areEqual(rpIDHash, expectedRPIDHash)) {
+                (0, toHash_js_1.toHash)(index_js_1.isoUint8Array.fromASCIIString(expected)).then((expectedRPIDHash) => {
+                    if (index_js_1.isoUint8Array.areEqual(rpIDHash, expectedRPIDHash)) {
                         resolve(expected);
                     }
                     else {
@@ -43,4 +43,3 @@ class UnexpectedRPIDHash extends Error {
         this.name = 'UnexpectedRPIDHash';
     }
 }
-//# sourceMappingURL=matchExpectedRPID.js.map

package/script/helpers/parseAuthenticatorData.d.ts

@@ -0,0 +1,28 @@
+import { AuthenticationExtensionsAuthenticatorOutputs } from './decodeAuthenticatorExtensions.js';
+/**
+ * Make sense of the authData buffer contained in an Attestation
+ */
+export declare function parseAuthenticatorData(authData: Uint8Array): ParsedAuthenticatorData;
+export type ParsedAuthenticatorData = {
+    rpIdHash: Uint8Array;
+    flagsBuf: Uint8Array;
+    flags: {
+        up: boolean;
+        uv: boolean;
+        be: boolean;
+        bs: boolean;
+        at: boolean;
+        ed: boolean;
+        flagsInt: number;
+    };
+    counter: number;
+    counterBuf: Uint8Array;
+    aaguid?: Uint8Array;
+    credentialID?: Uint8Array;
+    credentialPublicKey?: Uint8Array;
+    extensionsData?: AuthenticationExtensionsAuthenticatorOutputs;
+    extensionsDataBuffer?: Uint8Array;
+};
+export declare const _parseAuthenticatorDataInternals: {
+    stubThis: (value: ParsedAuthenticatorData) => ParsedAuthenticatorData;
+};

package/{dist → script}/helpers/parseAuthenticatorData.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseAuthenticatorData = void 0;
-const decodeAuthenticatorExtensions_1 = require("./decodeAuthenticatorExtensions");
-const iso_1 = require("./iso");
+exports._parseAuthenticatorDataInternals = exports.parseAuthenticatorData = void 0;
+const decodeAuthenticatorExtensions_js_1 = require("./decodeAuthenticatorExtensions.js");
+const index_js_1 = require("./iso/index.js");
 /**
  * Make sense of the authData buffer contained in an Attestation
  */
@@ -11,9 +11,9 @@ function parseAuthenticatorData(authData) {
         throw new Error(`Authenticator data was ${authData.byteLength} bytes, expected at least 37 bytes`);
     }
     let pointer = 0;
-    const dataView = iso_1.isoUint8Array.toDataView(authData);
-    const rpIdHash = authData.slice(pointer, (pointer += 32));
-    const flagsBuf = authData.slice(pointer, (pointer += 1));
+    const dataView = index_js_1.isoUint8Array.toDataView(authData);
+    const rpIdHash = authData.slice(pointer, pointer += 32);
+    const flagsBuf = authData.slice(pointer, pointer += 1);
     const flagsInt = flagsBuf[0];
     // Bit positions can be referenced here:
     // https://www.w3.org/TR/webauthn-2/#flags
@@ -33,29 +33,29 @@ function parseAuthenticatorData(authData) {
     let credentialID = undefined;
     let credentialPublicKey = undefined;
     if (flags.at) {
-        aaguid = authData.slice(pointer, (pointer += 16));
+        aaguid = authData.slice(pointer, pointer += 16);
         const credIDLen = dataView.getUint16(pointer);
         pointer += 2;
-        credentialID = authData.slice(pointer, (pointer += credIDLen));
+        credentialID = authData.slice(pointer, pointer += credIDLen);
         // Decode the next CBOR item in the buffer, then re-encode it back to a Buffer
-        const firstDecoded = iso_1.isoCBOR.decodeFirst(authData.slice(pointer));
-        const firstEncoded = Uint8Array.from(iso_1.isoCBOR.encode(firstDecoded));
+        const firstDecoded = index_js_1.isoCBOR.decodeFirst(authData.slice(pointer));
+        const firstEncoded = Uint8Array.from(index_js_1.isoCBOR.encode(firstDecoded));
         credentialPublicKey = firstEncoded;
         pointer += firstEncoded.byteLength;
     }
     let extensionsData = undefined;
     let extensionsDataBuffer = undefined;
     if (flags.ed) {
-        const firstDecoded = iso_1.isoCBOR.decodeFirst(authData.slice(pointer));
-        extensionsDataBuffer = Uint8Array.from(iso_1.isoCBOR.encode(firstDecoded));
-        extensionsData = (0, decodeAuthenticatorExtensions_1.decodeAuthenticatorExtensions)(extensionsDataBuffer);
+        const firstDecoded = index_js_1.isoCBOR.decodeFirst(authData.slice(pointer));
+        extensionsDataBuffer = Uint8Array.from(index_js_1.isoCBOR.encode(firstDecoded));
+        extensionsData = (0, decodeAuthenticatorExtensions_js_1.decodeAuthenticatorExtensions)(extensionsDataBuffer);
         pointer += extensionsDataBuffer.byteLength;
     }
     // Pointer should be at the end of the authenticator data, otherwise too much data was sent
     if (authData.byteLength > pointer) {
         throw new Error('Leftover bytes detected while parsing authenticator data');
     }
-    return {
+    return exports._parseAuthenticatorDataInternals.stubThis({
         rpIdHash,
         flagsBuf,
         flags,
@@ -66,7 +66,10 @@ function parseAuthenticatorData(authData) {
         credentialPublicKey,
         extensionsData,
         extensionsDataBuffer,
-    };
+    });
 }
 exports.parseAuthenticatorData = parseAuthenticatorData;
-//# sourceMappingURL=parseAuthenticatorData.js.map
+// Make it possible to stub the return value during testing
+exports._parseAuthenticatorDataInternals = {
+    stubThis: (value) => value,
+};

package/script/helpers/parseBackupFlags.d.ts

@@ -0,0 +1,19 @@
+import type { CredentialDeviceType } from '../deps.js';
+/**
+ * Make sense of Bits 3 and 4 in authenticator indicating:
+ *
+ * - Whether the credential can be used on multiple devices
+ * - Whether the credential is backed up or not
+ *
+ * Invalid configurations will raise an `Error`
+ */
+export declare function parseBackupFlags({ be, bs }: {
+    be: boolean;
+    bs: boolean;
+}): {
+    credentialDeviceType: CredentialDeviceType;
+    credentialBackedUp: boolean;
+};
+export declare class InvalidBackupFlags extends Error {
+    constructor(message: string);
+}

package/{dist → script}/helpers/parseBackupFlags.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseBackupFlags = void 0;
+exports.InvalidBackupFlags = exports.parseBackupFlags = void 0;
 /**
  * Make sense of Bits 3 and 4 in authenticator indicating:
  *
@@ -27,4 +27,4 @@ class InvalidBackupFlags extends Error {
         this.name = 'InvalidBackupFlags';
     }
 }
-//# sourceMappingURL=parseBackupFlags.js.map
+exports.InvalidBackupFlags = InvalidBackupFlags;

package/script/helpers/toHash.d.ts

@@ -0,0 +1,6 @@
+import { COSEALG } from './cose.js';
+/**
+ * Returns hash digest of the given data, using the given algorithm when provided. Defaults to using
+ * SHA-256.
+ */
+export declare function toHash(data: Uint8Array | string, algorithm?: COSEALG): Promise<Uint8Array>;

package/{dist → script}/helpers/toHash.js

@@ -1,17 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toHash = void 0;
-const iso_1 = require("./iso");
+const index_js_1 = require("./iso/index.js");
 /**
  * Returns hash digest of the given data, using the given algorithm when provided. Defaults to using
  * SHA-256.
  */
-async function toHash(data, algorithm = -7) {
+function toHash(data, algorithm = -7) {
     if (typeof data === 'string') {
-        data = iso_1.isoUint8Array.fromUTF8String(data);
+        data = index_js_1.isoUint8Array.fromUTF8String(data);
     }
-    const digest = iso_1.isoCrypto.digest(data, algorithm);
+    const digest = index_js_1.isoCrypto.digest(data, algorithm);
     return digest;
 }
 exports.toHash = toHash;
-//# sourceMappingURL=toHash.js.map

package/script/helpers/validateCertificatePath.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Traverse an array of PEM certificates and ensure they form a proper chain
+ * @param certificates Typically the result of `x5c.map(convertASN1toPEM)`
+ * @param rootCertificates Possible root certificates to complete the path
+ */
+export declare function validateCertificatePath(certificates: string[], rootCertificates?: string[]): Promise<boolean>;

package/{dist → script}/helpers/validateCertificatePath.js

@@ -1,13 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCertificatePath = void 0;
-/* eslint-disable @typescript-eslint/ban-ts-comment */
-const asn1_schema_1 = require("@peculiar/asn1-schema");
-const isCertRevoked_1 = require("./isCertRevoked");
-const verifySignature_1 = require("./verifySignature");
-const mapX509SignatureAlgToCOSEAlg_1 = require("./mapX509SignatureAlgToCOSEAlg");
-const getCertificateInfo_1 = require("./getCertificateInfo");
-const convertPEMToBytes_1 = require("./convertPEMToBytes");
+const deps_js_1 = require("../deps.js");
+const isCertRevoked_js_1 = require("./isCertRevoked.js");
+const verifySignature_js_1 = require("./verifySignature.js");
+const mapX509SignatureAlgToCOSEAlg_js_1 = require("./mapX509SignatureAlgToCOSEAlg.js");
+const getCertificateInfo_js_1 = require("./getCertificateInfo.js");
+const convertPEMToBytes_js_1 = require("./convertPEMToBytes.js");
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param certificates Typically the result of `x5c.map(convertASN1toPEM)`
@@ -69,11 +68,11 @@ async function _validatePath(certificates) {
         else {
             issuerPem = certificates[i + 1];
         }
-        const subjectInfo = (0, getCertificateInfo_1.getCertificateInfo)((0, convertPEMToBytes_1.convertPEMToBytes)(subjectPem));
-        const issuerInfo = (0, getCertificateInfo_1.getCertificateInfo)((0, convertPEMToBytes_1.convertPEMToBytes)(issuerPem));
+        const subjectInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(subjectPem));
+        const issuerInfo = (0, getCertificateInfo_js_1.getCertificateInfo)((0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPem));
         const x509Subject = subjectInfo.parsedCertificate;
         // Check for certificate revocation
-        const subjectCertRevoked = await (0, isCertRevoked_1.isCertRevoked)(x509Subject);
+        const subjectCertRevoked = await (0, isCertRevoked_js_1.isCertRevoked)(x509Subject);
         if (subjectCertRevoked) {
             throw new Error(`Found revoked certificate in certificate path`);
         }
@@ -95,11 +94,11 @@ async function _validatePath(certificates) {
             throw new InvalidSubjectAndIssuer();
         }
         // Verify the subject certificate's signature with the issuer cert's public key
-        const data = asn1_schema_1.AsnSerializer.serialize(x509Subject.tbsCertificate);
+        const data = deps_js_1.AsnSerializer.serialize(x509Subject.tbsCertificate);
         const signature = x509Subject.signatureValue;
-        const signatureAlgorithm = (0, mapX509SignatureAlgToCOSEAlg_1.mapX509SignatureAlgToCOSEAlg)(x509Subject.signatureAlgorithm.algorithm);
-        const issuerCertBytes = (0, convertPEMToBytes_1.convertPEMToBytes)(issuerPem);
-        const verified = await (0, verifySignature_1.verifySignature)({
+        const signatureAlgorithm = (0, mapX509SignatureAlgToCOSEAlg_js_1.mapX509SignatureAlgToCOSEAlg)(x509Subject.signatureAlgorithm.algorithm);
+        const issuerCertBytes = (0, convertPEMToBytes_js_1.convertPEMToBytes)(issuerPem);
+        const verified = await (0, verifySignature_js_1.verifySignature)({
             data: new Uint8Array(data),
             signature: new Uint8Array(signature),
             x509Certificate: issuerCertBytes,
@@ -125,4 +124,3 @@ class CertificateNotYetValidOrExpired extends Error {
         this.name = 'CertificateNotYetValidOrExpired';
     }
 }
-//# sourceMappingURL=validateCertificatePath.js.map

package/script/helpers/verifySignature.d.ts

@@ -0,0 +1,14 @@
+import { COSEALG } from './cose.js';
+/**
+ * Verify an authenticator's signature
+ */
+export declare function verifySignature(opts: {
+    signature: Uint8Array;
+    data: Uint8Array;
+    credentialPublicKey?: Uint8Array;
+    x509Certificate?: Uint8Array;
+    hashAlgorithm?: COSEALG;
+}): Promise<boolean>;
+export declare const _verifySignatureInternals: {
+    stubThis: (value: Promise<boolean>) => Promise<boolean>;
+};

package/script/helpers/verifySignature.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._verifySignatureInternals = exports.verifySignature = void 0;
+const index_js_1 = require("./iso/index.js");
+const decodeCredentialPublicKey_js_1 = require("./decodeCredentialPublicKey.js");
+const convertX509PublicKeyToCOSE_js_1 = require("./convertX509PublicKeyToCOSE.js");
+/**
+ * Verify an authenticator's signature
+ */
+function verifySignature(opts) {
+    const { signature, data, credentialPublicKey, x509Certificate, hashAlgorithm, } = opts;
+    if (!x509Certificate && !credentialPublicKey) {
+        throw new Error('Must declare either "leafCert" or "credentialPublicKey"');
+    }
+    if (x509Certificate && credentialPublicKey) {
+        throw new Error('Must not declare both "leafCert" and "credentialPublicKey"');
+    }
+    let cosePublicKey = new Map();
+    if (credentialPublicKey) {
+        cosePublicKey = (0, decodeCredentialPublicKey_js_1.decodeCredentialPublicKey)(credentialPublicKey);
+    }
+    else if (x509Certificate) {
+        cosePublicKey = (0, convertX509PublicKeyToCOSE_js_1.convertX509PublicKeyToCOSE)(x509Certificate);
+    }
+    return exports._verifySignatureInternals.stubThis(index_js_1.isoCrypto.verify({
+        cosePublicKey,
+        signature,
+        data,
+        shaHashOverride: hashAlgorithm,
+    }));
+}
+exports.verifySignature = verifySignature;
+// Make it possible to stub the return value during testing
+exports._verifySignatureInternals = {
+    stubThis: (value) => value,
+};

package/script/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @packageDocumentation
+ * @module @simplewebauthn/server
+ */
+import { generateRegistrationOptions } from './registration/generateRegistrationOptions.js';
+import { verifyRegistrationResponse } from './registration/verifyRegistrationResponse.js';
+import { generateAuthenticationOptions } from './authentication/generateAuthenticationOptions.js';
+import { verifyAuthenticationResponse } from './authentication/verifyAuthenticationResponse.js';
+import { MetadataService } from './services/metadataService.js';
+import { SettingsService } from './services/settingsService.js';
+export { generateAuthenticationOptions, generateRegistrationOptions, MetadataService, SettingsService, verifyAuthenticationResponse, verifyRegistrationResponse, };
+import type { GenerateRegistrationOptionsOpts } from './registration/generateRegistrationOptions.js';
+import type { GenerateAuthenticationOptionsOpts } from './authentication/generateAuthenticationOptions.js';
+import type { MetadataStatement } from './metadata/mdsTypes.js';
+import type { VerifiedRegistrationResponse, VerifyRegistrationResponseOpts } from './registration/verifyRegistrationResponse.js';
+import type { VerifiedAuthenticationResponse, VerifyAuthenticationResponseOpts } from './authentication/verifyAuthenticationResponse.js';
+export type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, MetadataStatement, VerifiedAuthenticationResponse, VerifiedRegistrationResponse, VerifyAuthenticationResponseOpts, VerifyRegistrationResponseOpts, };

package/script/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRegistrationResponse = exports.verifyAuthenticationResponse = exports.SettingsService = exports.MetadataService = exports.generateRegistrationOptions = exports.generateAuthenticationOptions = void 0;
+/**
+ * @packageDocumentation
+ * @module @simplewebauthn/server
+ */
+const generateRegistrationOptions_js_1 = require("./registration/generateRegistrationOptions.js");
+Object.defineProperty(exports, "generateRegistrationOptions", { enumerable: true, get: function () { return generateRegistrationOptions_js_1.generateRegistrationOptions; } });
+const verifyRegistrationResponse_js_1 = require("./registration/verifyRegistrationResponse.js");
+Object.defineProperty(exports, "verifyRegistrationResponse", { enumerable: true, get: function () { return verifyRegistrationResponse_js_1.verifyRegistrationResponse; } });
+const generateAuthenticationOptions_js_1 = require("./authentication/generateAuthenticationOptions.js");
+Object.defineProperty(exports, "generateAuthenticationOptions", { enumerable: true, get: function () { return generateAuthenticationOptions_js_1.generateAuthenticationOptions; } });
+const verifyAuthenticationResponse_js_1 = require("./authentication/verifyAuthenticationResponse.js");
+Object.defineProperty(exports, "verifyAuthenticationResponse", { enumerable: true, get: function () { return verifyAuthenticationResponse_js_1.verifyAuthenticationResponse; } });
+const metadataService_js_1 = require("./services/metadataService.js");
+Object.defineProperty(exports, "MetadataService", { enumerable: true, get: function () { return metadataService_js_1.MetadataService; } });
+const settingsService_js_1 = require("./services/settingsService.js");
+Object.defineProperty(exports, "SettingsService", { enumerable: true, get: function () { return settingsService_js_1.SettingsService; } });