@structured-id/ui-core 4.12.0 → 4.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.12.0",
+  "version": "4.14.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,7 +42,8 @@
     "@protobuf-ts/grpcweb-transport": "^2.11.1",
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@structured-id/proto": "^0.9.0",
+    "@structured-id/ids": "^0.4.0",
+    "@structured-id/proto": "^0.12.0",
     "@structured-world/structured-email-address-ts": "^0.0.22",
     "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"

package/src/profile/components/SessionList.vue

@@ -9,7 +9,7 @@
     </div>
 
     <q-list v-else-if="sessions.length > 0" separator>
-      <q-item v-for="session in sessions" :key="session.id">
+      <q-item v-for="session in sessions" :key="session.id.toString()">
         <q-item-section avatar>
           <q-icon :name="deviceIcon(session.userAgent)" size="sm" />
         </q-item-section>
@@ -37,7 +37,7 @@
             dense
             color="negative"
             icon="sym_o_logout"
-            :loading="revoking === session.id"
+            :loading="revoking?.equals(session.id) ?? false"
             @click="$emit('revoke', session.id)"
           />
         </q-item-section>
@@ -49,23 +49,24 @@
 </template>
 
 <script setup lang="ts">
-import type { Session } from "@structured-id/proto/sid/v1/identity/identity";
+import type { SessionId } from "@structured-id/ids";
 import { Timestamp } from "@structured-id/proto/google/protobuf/timestamp";
+import type { Session } from "../composables/useIdentityApi";
 
-defineProps<{
+const props = defineProps<{
   sessions: Session[];
   loading: boolean;
   error: string | null;
-  revoking: string | null;
-  currentSessionId?: string;
+  revoking: SessionId | null;
+  currentSessionId?: SessionId;
 }>();
 
 defineEmits<{
-  revoke: [sessionId: string];
+  revoke: [sessionId: SessionId];
 }>();
 
 function isCurrentSession(session: Session): boolean {
-  return false; // Overridden via currentSessionId prop comparison
+  return props.currentSessionId?.equals(session.id) ?? false;
 }
 
 function deviceIcon(userAgent: string | undefined): string {

package/src/profile/components/SidLoginForm.vue

@@ -120,6 +120,7 @@
 
 <script setup lang="ts">
 import { computed, ref } from "vue";
+import type { SessionId } from "@structured-id/ids";
 import {
   ALL_PRINCIPAL_TYPES,
   DEFAULT_PRINCIPAL_INPUT_TEXTS,
@@ -176,7 +177,7 @@ const props = withDefaults(
       onStep?: (step: number) => void,
     ) => Promise<{
       expiresIn: number;
-      sessionId?: string;
+      sessionId?: SessionId;
     }>;
   }>(),
   {
@@ -206,7 +207,7 @@ const props = withDefaults(
 );
 
 const emit = defineEmits<{
-  success: [result: { expiresIn: number; sessionId?: string }];
+  success: [result: { expiresIn: number; sessionId?: SessionId }];
   error: [error: Error];
   "forgot-password": [];
 }>();

package/src/profile/composables/useAuth.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach, type Mock } from "vitest";
+import { CredentialId, OpaqueLoginId, SessionId } from "@structured-id/ids";
 import {
   createAuth,
   type ZkppClientApi,
@@ -51,6 +52,9 @@ const api = {
 // ── Fixtures ──
 
 const OPERATION = new Uint8Array(16).fill(7);
+const CRED = CredentialId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d01");
+const LOGIN = OpaqueLoginId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d02");
+const SESSION = SessionId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d03");
 const OWNER_DOMAIN = new Uint8Array(32).fill(1);
 const DOMAIN = new Uint8Array(32).fill(2);
 const KEY = new Uint8Array(32).fill(3);
@@ -121,10 +125,10 @@ describe("createAuth prewarm", () => {
   beforeEach(() => {
     api.loginStart.mockResolvedValue({
       credentialResponse: new Uint8Array([4]),
-      serverLoginState: "server-state",
+      loginId: LOGIN,
     });
     api.loginFinish.mockResolvedValue({
-      sessionId: "s",
+      sessionId: SESSION,
       expiresIn: 60n,
       secondFactors: [],
       enrollableFactors: [],
@@ -178,7 +182,7 @@ describe("createAuth register", () => {
     // current message no longer has.
     const fromOlderServer = {
       profileId: "profile-uuid",
-      credentialId: "cred-uuid",
+      credentialId: CRED,
     };
     api.regFinish.mockResolvedValue(fromOlderServer);
   });
@@ -214,7 +218,7 @@ describe("createAuth register", () => {
     expect(api.regFinish).toHaveBeenCalledWith(OPERATION, RECORD, WIRE_PROOF);
     // Regression: the result passed the server's Profile identifier on to
     // the application; even a server still sending one is not forwarded.
-    expect(result).toEqual({ credentialId: "cred-uuid" });
+    expect(result).toEqual({ credentialId: CRED });
   });
 
   // A password the circuit cannot hold has no history request: nothing is
@@ -366,19 +370,15 @@ describe("createAuth changePassword", () => {
   it("fixes the OPAQUE start in the challenge, executes, proves and finishes", async () => {
     const { changePassword } = createAuth(loader);
     await changePassword({
-      credentialId: "cred-1",
+      credentialId: CRED,
       newPassword: "N3wP@ssword!",
     });
 
     expect(client.registrationStart).toHaveBeenCalledOnce();
     expect(client.registrationStart).toHaveBeenCalledWith("N3wP@ssword!");
-    expect(api.challenge).toHaveBeenCalledWith("cred-1", START.request);
+    expect(api.challenge).toHaveBeenCalledWith(CRED, START.request);
     expect(client.loginStart).not.toHaveBeenCalled();
-    expect(api.execute).toHaveBeenCalledWith(
-      OPERATION,
-      "cred-1",
-      new Uint8Array(),
-    );
+    expect(api.execute).toHaveBeenCalledWith(OPERATION, CRED, new Uint8Array());
     expect(api.evaluate).toHaveBeenCalledWith(OPERATION, HISTORY.blinded);
     expect(client.prove).toHaveBeenCalledWith(
       "N3wP@ssword!",
@@ -387,7 +387,7 @@ describe("createAuth changePassword", () => {
     );
     expect(api.changeFinish).toHaveBeenCalledWith(
       OPERATION,
-      "cred-1",
+      CRED,
       RECORD,
       WIRE_PROOF,
     );
@@ -400,7 +400,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await expect(
       changePassword(
-        { credentialId: "cred-1", newPassword: "N3wP@ssword!" },
+        { credentialId: CRED, newPassword: "N3wP@ssword!" },
         (p) => {
           if (p.fraction === 1) throw new Error("gauge unmounted");
         },
@@ -420,7 +420,7 @@ describe("createAuth changePassword", () => {
     });
     const { changePassword } = createAuth(loader);
     await changePassword(
-      { credentialId: "cred-1", newPassword: "N3wP@ssword!" },
+      { credentialId: CRED, newPassword: "N3wP@ssword!" },
       (p) => {
         if (p.fraction === 0 || order.at(-1) !== `step:${p.step}`)
           order.push(`step:${p.step}`);
@@ -444,7 +444,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await changePassword(
       {
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "0ldP@ssword!",
       },
@@ -461,7 +461,7 @@ describe("createAuth changePassword", () => {
     expect(client.registrationStart).toHaveBeenCalledOnce();
     expect(client.loginStart).toHaveBeenCalledWith("0ldP@ssword!");
     expect(api.challenge).toHaveBeenCalledWith(
-      "cred-1",
+      CRED,
       START.request,
       new Uint8Array([1, 2, 3]),
     );
@@ -473,7 +473,7 @@ describe("createAuth changePassword", () => {
     );
     expect(api.execute).toHaveBeenCalledWith(
       OPERATION,
-      "cred-1",
+      CRED,
       new Uint8Array([7, 8, 9]),
     );
     expect(seen[0]).toMatchObject({ step: "protect", fraction: 0 });
@@ -499,7 +499,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await changePassword(
       {
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "0ldP@ssword!",
       },
@@ -529,7 +529,7 @@ describe("createAuth changePassword", () => {
     });
     const { changePassword } = createAuth(loader);
     await changePassword({
-      credentialId: "cred-1",
+      credentialId: CRED,
       newPassword: "N3wP@ssword!",
     });
     expect(loader).toHaveBeenCalledOnce();
@@ -552,7 +552,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await expect(
       changePassword({
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "wrong",
       }),
@@ -574,7 +574,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await expect(
       changePassword({
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "0ldP@ssword!",
       }),
@@ -595,7 +595,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await expect(
       changePassword({
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "",
       }),
@@ -619,7 +619,7 @@ describe("createAuth changePassword", () => {
     const { changePassword } = createAuth(loader);
     await expect(
       changePassword({
-        credentialId: "cred-1",
+        credentialId: CRED,
         newPassword: "N3wP@ssword!",
         currentPassword: "0ldP@ssword!",
       }),
@@ -634,7 +634,7 @@ describe("createAuth changePassword", () => {
     });
     const { changePassword } = createAuth(loader);
     await expect(
-      changePassword({ credentialId: "cred-1", newPassword: "pw" }),
+      changePassword({ credentialId: CRED, newPassword: "pw" }),
     ).rejects.toThrow(/did not prepare/);
     expect(api.execute).not.toHaveBeenCalled();
     expect(client.prove).not.toHaveBeenCalled();
@@ -644,7 +644,7 @@ describe("createAuth changePassword", () => {
     api.changeFinish.mockRejectedValue(new Error("PASSWORD_REUSED"));
     const { changePassword } = createAuth(loader);
     await expect(
-      changePassword({ credentialId: "cred-1", newPassword: "pw" }),
+      changePassword({ credentialId: CRED, newPassword: "pw" }),
     ).rejects.toThrow("PASSWORD_REUSED");
   });
 });
@@ -653,28 +653,29 @@ describe("createAuth resetPassword", () => {
   beforeEach(() => {
     api.executeReset.mockResolvedValue({ registrationResponse: RESPONSE });
     api.completeReset.mockResolvedValue({
-      sessionId: "sess-1",
+      sessionId: SESSION,
       expiresIn: 3600,
     });
   });
 
+  // The reset is named by its operation alone: the operation carries the
+  // verified reset's authority, so no reset session travels with it.
   it("executes the OPAQUE start under the reset operation and completes with the proof", async () => {
     const { resetPassword } = createAuth(loader);
-    const done = await resetPassword("reset-1", wireContext(), "N3wP@ssword!");
+    const done = await resetPassword(wireContext(), "N3wP@ssword!");
 
     expect(api.executeReset).toHaveBeenCalledWith(OPERATION, START.request);
     expect(api.completeReset).toHaveBeenCalledWith(
-      "reset-1",
       OPERATION,
       RECORD,
       WIRE_PROOF,
     );
-    expect(done.sessionId).toBe("sess-1");
+    expect(done.sessionId).toBe(SESSION);
   });
 
   it("refuses a verification that prepared no operation", async () => {
     const { resetPassword } = createAuth(loader);
-    await expect(resetPassword("reset-1", undefined, "pw")).rejects.toThrow(
+    await expect(resetPassword(undefined, "pw")).rejects.toThrow(
       /did not prepare/,
     );
     expect(client.registrationStart).not.toHaveBeenCalled();
@@ -685,16 +686,18 @@ describe("createAuth login", () => {
   beforeEach(() => {
     api.loginStart.mockResolvedValue({
       credentialResponse: new Uint8Array([4, 5, 6]),
-      serverLoginState: "server-state",
+      loginId: LOGIN,
     });
     api.loginFinish.mockResolvedValue({
-      sessionId: "sess-1",
+      sessionId: SESSION,
       expiresIn: BigInt(3600),
       secondFactors: [],
       enrollableFactors: [],
     });
   });
 
+  // The finish names the login its start began, by the identifier the start
+  // answered, not by any state of the login.
   it("signs in with the Pallas client in two round trips", async () => {
     const { login } = createAuth(loader);
     const steps: number[] = [];
@@ -714,13 +717,13 @@ describe("createAuth login", () => {
     expect(api.loginFinish).toHaveBeenCalledWith(
       "alice@test.com",
       new Uint8Array([7, 8, 9]),
-      "server-state",
+      LOGIN,
     );
     expect(steps).toEqual([1, 2, 3]);
     // The result carries no credential: the browser holds the session
     // cookie the answer set.
     expect(result).toEqual({
-      sessionId: "sess-1",
+      sessionId: SESSION,
       expiresIn: 3600,
     });
   });

package/src/profile/composables/useAuth.ts

@@ -14,6 +14,7 @@
  * `@structured-id/opaque`), keeping kernel delivery at the app layer.
  * gRPC calls go through useAuthApi wrappers.
  */
+import type { CredentialId, SessionId } from "@structured-id/ids";
 import {
   completePasswordReset,
   evaluatePasswordHistory,
@@ -25,10 +26,10 @@ import {
   passwordChangeChallenge,
   passwordChangeExecute,
   passwordChangeFinish,
-  type CompletePasswordResetResponse,
   type PasswordHistoryContext,
   type PasswordHistoryEvaluation,
   type PasswordRegistrationProof,
+  type PasswordResetResult,
 } from "./useAuthApi";
 
 // ── Types ──
@@ -38,7 +39,7 @@ import {
  * reaches page code: a browser holds the session cookie the answer set.
  */
 export interface LoginResult {
-  sessionId: string;
+  sessionId: SessionId;
   /** Seconds until the delivered credential expires. */
   expiresIn: number;
 }
@@ -48,7 +49,7 @@ export interface LoginResult {
  * signs in after registering and works through its session.
  */
 export interface RegisterResult {
-  credentialId: string;
+  credentialId: CredentialId;
 }
 
 import {
@@ -69,7 +70,7 @@ export class WrongCurrentPasswordError extends Error {
 /** A password change of the signed-in user. */
 export interface PasswordChange {
   /** The password credential to change. */
-  credentialId: string;
+  credentialId: CredentialId;
   newPassword: string;
   /** The current password, proved inside the change; required while the
    * server requires it, accepted whenever given. */
@@ -485,14 +486,14 @@ export function createAuth(loadClient: ZkppClientLoader) {
 
   /**
    * Replace the password under a verified reset: `context` is the operation
-   * the verification prepared (`VerifyPasswordResetResponse.history`).
+   * the verification prepared (`VerifyPasswordResetResponse.history`), which
+   * carries the reset's authority.
    */
   async function resetPassword(
-    resetSessionId: string,
     context: PasswordHistoryContext | undefined,
     newPassword: string,
     onProgress?: (p: PasswordOperationProgress) => void,
-  ): Promise<CompletePasswordResetResponse> {
+  ): Promise<PasswordResetResult> {
     const plan = new OperationPlan(onProgress);
     const prepared = historyContext(context);
     const done = await install(
@@ -506,7 +507,6 @@ export function createAuth(loadClient: ZkppClientLoader) {
       plan,
     );
     const completed = await completePasswordReset(
-      resetSessionId,
       done.operationId,
       done.record,
       done.proof,
@@ -539,7 +539,7 @@ export function createAuth(loadClient: ZkppClientLoader) {
     const finished = await opaqueLoginFinish(
       identifier,
       finalization,
-      started.serverLoginState,
+      started.loginId,
     );
     return {
       sessionId: finished.sessionId,

package/src/profile/composables/useAuthApi.ids.test.ts

@@ -0,0 +1,248 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  CredentialId,
+  IdError,
+  MagicLinkId,
+  MissingIdError,
+  OtpSessionId,
+  ResetSessionId,
+  SessionId,
+  StepUpChallengeId,
+} from "@structured-id/ids";
+import {
+  StepUpMethod,
+  completePasswordReset,
+  completeStepUp,
+  deleteMfaCredential,
+  finishTotpEnrollment,
+  requestMagicLink,
+  requestStepUp,
+  resendOtp,
+  verifyMagicLink,
+  verifyOtp,
+  verifyPasswordReset,
+  verifyTotp,
+  webAuthnAuthenticationFinish,
+} from "./useAuthApi";
+
+// Every AuthService method the tests call, keyed by its client method name.
+const rpc: Record<string, ReturnType<typeof vi.fn>> = {};
+
+vi.mock("../../index", () => ({
+  getTransport: vi.fn(),
+  getAccountTransport: vi.fn(),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/auth.client", () => ({
+  // Called with `new`: a constructor mock must be a `function`, not an arrow.
+  AuthServiceClient: vi.fn().mockImplementation(function () {
+    return new Proxy(
+      {},
+      { get: (_target, name: string) => (rpc[name] ??= vi.fn()) },
+    );
+  }),
+}));
+
+vi.mock("../auth", () => ({
+  authMeta: () => ({}),
+}));
+
+const SESSION = SessionId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d10");
+const CRED = CredentialId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d11");
+const OTP = OtpSessionId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d12");
+const LINK = MagicLinkId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d13");
+const CHALLENGE = StepUpChallengeId.parse(
+  "0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d14",
+);
+const RESET = ResetSessionId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d15");
+const OPERATION = new Uint8Array(16).fill(7);
+const MALFORMED = { value: new Uint8Array(15) };
+
+/** The RPC `name` answers `response` once. */
+function answers(name: string, response: object) {
+  rpc[name] ??= vi.fn();
+  rpc[name].mockResolvedValueOnce({ response });
+}
+
+/** The request the RPC `name` was last called with. */
+function sent(name: string): unknown {
+  return rpc[name].mock.calls.at(-1)?.[0];
+}
+
+beforeEach(() => {
+  for (const fn of Object.values(rpc)) fn.mockReset();
+});
+
+describe("one-time code", () => {
+  // The code is verified against the request it was sent for, named by its
+  // binary identifier; the provisional session is read only when verified.
+  it("names the request and reads the session it opened", async () => {
+    answers("verifyOtp", { verified: true, sessionId: SESSION.toWire() });
+    const result = await verifyOtp("12345678", OTP);
+    expect(sent("verifyOtp")).toEqual({
+      code: "12345678",
+      otpSessionId: { value: OTP.toBytes() },
+    });
+    expect(result.sessionId?.equals(SESSION)).toBe(true);
+  });
+
+  it("reads no session from a code that did not verify", async () => {
+    answers("verifyOtp", { verified: false });
+    expect((await verifyOtp("0", OTP)).sessionId).toBeUndefined();
+  });
+
+  it("refuses a malformed session in a verified answer", async () => {
+    answers("verifyOtp", { verified: true, sessionId: MALFORMED });
+    await expect(verifyOtp("0", OTP)).rejects.toBeInstanceOf(IdError);
+  });
+
+  it("resends for the request it names", async () => {
+    answers("resendOtp", {});
+    await resendOtp(OTP);
+    expect(sent("resendOtp")).toEqual({
+      otpSessionId: { value: OTP.toBytes() },
+    });
+  });
+});
+
+describe("second factor", () => {
+  // A present but malformed session is an error even though the field is
+  // optional: an empty message is not an absent one.
+  it("refuses a malformed session in an MFA answer", async () => {
+    answers("verifyTotp", { verified: true, sessionId: MALFORMED });
+    await expect(verifyTotp("123456")).rejects.toBeInstanceOf(IdError);
+  });
+
+  it("reads the credential a TOTP enrollment stored and refuses an answer without one", async () => {
+    answers("finishTotpEnrollment", {
+      credentialId: CRED.toWire(),
+      recoveryCodes: [],
+    });
+    expect(
+      (await finishTotpEnrollment("123456")).credentialId.equals(CRED),
+    ).toBe(true);
+    answers("finishTotpEnrollment", { recoveryCodes: [] });
+    await expect(finishTotpEnrollment("123456")).rejects.toBeInstanceOf(
+      MissingIdError,
+    );
+  });
+
+  it("deletes the MFA credential it names in binary", async () => {
+    answers("deleteMfaCredential", {});
+    await deleteMfaCredential(CRED);
+    expect(sent("deleteMfaCredential")).toEqual({
+      credentialId: { value: CRED.toBytes() },
+    });
+  });
+});
+
+describe("passkey sign-in", () => {
+  // The server finds the ceremony by the challenge the assertion signs, so
+  // no state key is sent; the answer must name its session.
+  it("sends the assertion alone and reads the session", async () => {
+    answers("webAuthnAuthenticationFinish", {
+      sessionId: SESSION.toWire(),
+      expiresIn: 60n,
+    });
+    const credential = new Uint8Array([1, 2]);
+    const result = await webAuthnAuthenticationFinish(credential, "a@b.c");
+    expect(sent("webAuthnAuthenticationFinish")).toEqual({
+      credential,
+      principal: "a@b.c",
+    });
+    expect(result.sessionId.equals(SESSION)).toBe(true);
+  });
+
+  it("refuses an answer without its session", async () => {
+    answers("webAuthnAuthenticationFinish", { expiresIn: 60n });
+    await expect(
+      webAuthnAuthenticationFinish(new Uint8Array()),
+    ).rejects.toBeInstanceOf(MissingIdError);
+  });
+});
+
+describe("magic link", () => {
+  it("reads the link it requested and refuses an answer without one", async () => {
+    answers("requestMagicLink", { magicLinkId: LINK.toWire(), expiresIn: 600 });
+    expect(
+      (
+        await requestMagicLink("a@b.c", "app", "https://app/")
+      ).magicLinkId.equals(LINK),
+    ).toBe(true);
+    answers("requestMagicLink", { expiresIn: 600 });
+    await expect(
+      requestMagicLink("a@b.c", "app", "https://app/"),
+    ).rejects.toBeInstanceOf(MissingIdError);
+  });
+
+  it("verifies the link it names and reads the session it opened", async () => {
+    answers("verifyMagicLink", { sessionId: SESSION.toWire(), expiresIn: 60n });
+    const result = await verifyMagicLink(LINK, "token");
+    expect(sent("verifyMagicLink")).toEqual({
+      magicLinkId: { value: LINK.toBytes() },
+      token: "token",
+    });
+    expect(result.sessionId.equals(SESSION)).toBe(true);
+  });
+});
+
+describe("step-up", () => {
+  // The session stepped up is the bearer token's own: it is never named in
+  // the request, and the challenge is named by its binary identifier.
+  it("requests a challenge without naming a session", async () => {
+    answers("requestStepUp", {
+      method: StepUpMethod.WEBAUTHN,
+      challengeId: CHALLENGE.toWire(),
+      challenge: { oneofKind: undefined },
+    });
+    const result = await requestStepUp(StepUpMethod.WEBAUTHN);
+    expect(sent("requestStepUp")).toEqual({ method: StepUpMethod.WEBAUTHN });
+    expect(result.challengeId?.equals(CHALLENGE)).toBe(true);
+  });
+
+  it("completes with the challenge in binary, or none for a 1-phase method", async () => {
+    answers("completeStepUp", {});
+    await completeStepUp(StepUpMethod.WEBAUTHN, CHALLENGE, {
+      webauthnAssertion: new Uint8Array([1]),
+    });
+    expect(sent("completeStepUp")).toMatchObject({
+      method: StepUpMethod.WEBAUTHN,
+      challengeId: { value: CHALLENGE.toBytes() },
+    });
+    expect(sent("completeStepUp")).not.toHaveProperty("sessionId");
+
+    answers("completeStepUp", {});
+    await completeStepUp(StepUpMethod.TOTP, undefined, { totpCode: "123456" });
+    expect(sent("completeStepUp")).toMatchObject({ challengeId: undefined });
+  });
+});
+
+describe("password reset", () => {
+  it("verifies the reset it names in binary", async () => {
+    answers("verifyPasswordReset", { expiresIn: 600 });
+    await verifyPasswordReset(RESET, "token");
+    expect(sent("verifyPasswordReset")).toEqual({
+      resetSessionId: { value: RESET.toBytes() },
+      token: "token",
+    });
+  });
+
+  // The completion is named by its operation, which carries the verified
+  // reset's authority; the session it may open is optional.
+  it("completes by the operation alone and reads the optional session", async () => {
+    answers("completePasswordReset", { sessionId: SESSION.toWire() });
+    const record = new Uint8Array([1]);
+    const done = await completePasswordReset(OPERATION, record);
+    expect(sent("completePasswordReset")).toEqual({
+      operationId: { value: OPERATION },
+      registrationRecord: record,
+      proof: undefined,
+    });
+    expect(done.sessionId?.equals(SESSION)).toBe(true);
+
+    answers("completePasswordReset", {});
+    expect(
+      (await completePasswordReset(OPERATION, record)).sessionId,
+    ).toBeUndefined();
+  });
+});