@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/passkeys/passkeys.controller.js

@@ -0,0 +1,183 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeysController = void 0;
+const common_1 = require("@nestjs/common");
+const strict_validation_pipe_1 = require("../../common/strict-validation.pipe.js");
+const request_context_1 = require("../../common/request-context.js");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const passkeys_dto_1 = require("./passkeys.dto");
+const passkeys_service_1 = require("./passkeys.service");
+const constants_1 = require("../../constants.js");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+/**
+ * Passkeys.
+ *
+ *   POST   /auth/passkeys/register/options   signed in: start adding a passkey
+ *   POST   /auth/passkeys/register/verify    signed in: finish adding it
+ *   POST   /auth/passkeys/sign-in/options    start signing in with a passkey
+ *   POST   /auth/passkeys/sign-in/verify     finish signing in
+ *   GET    /auth/passkeys                    list my passkeys
+ *   PATCH  /auth/passkeys/:id                rename
+ *   DELETE /auth/passkeys/:id                remove
+ */
+let PasskeysController = class PasskeysController {
+    passkeys;
+    constructor(passkeys) {
+        this.passkeys = passkeys;
+    }
+    /**
+     * POST /auth/passkeys/register/options — Starts adding a passkey.
+     *
+     * @param userId - From the access token.
+     * @returns Options for the device and a challenge token.
+     */
+    startRegistration(userId) {
+        return this.passkeys.startRegistration(userId);
+    }
+    /**
+     * POST /auth/passkeys/register/verify — Finishes adding a passkey.
+     *
+     * @param userId - From the access token.
+     * @param body - `{ challengeToken, response, name? }`.
+     * @param request - Who is asking.
+     * @returns The saved passkey.
+     */
+    finishRegistration(userId, body, request) {
+        return this.passkeys.finishRegistration(userId, body.challengeToken, body.response, body.name, request);
+    }
+    /**
+     * POST /auth/passkeys/sign-in/options — Starts signing in with a passkey. Public.
+     *
+     * @param request - Who is asking.
+     * @returns Options for the device and a challenge token.
+     */
+    startSignIn(request) {
+        return this.passkeys.startSignIn(request);
+    }
+    /**
+     * POST /auth/passkeys/sign-in/verify — Finishes signing in with a passkey. Public.
+     *
+     * @param body - `{ challengeToken, response }`.
+     * @param request - Who is asking.
+     * @returns Tokens.
+     */
+    finishSignIn(body, request) {
+        return this.passkeys.finishSignIn(body.challengeToken, body.response, request);
+    }
+    /**
+     * GET /auth/passkeys — The signed-in user's passkeys.
+     *
+     * @param userId - From the access token.
+     * @returns The passkeys.
+     */
+    async list(userId) {
+        return { success: true, passkeys: await this.passkeys.listPasskeys(userId) };
+    }
+    /**
+     * PATCH /auth/passkeys/:passkeyId — Renames a passkey.
+     *
+     * @param userId - From the access token.
+     * @param passkeyId - From the URL.
+     * @param body - `{ name }`.
+     * @returns `{ success: true }`.
+     */
+    rename(userId, passkeyId, body) {
+        return this.passkeys.renamePasskey(userId, passkeyId, body.name);
+    }
+    /**
+     * DELETE /auth/passkeys/:passkeyId — Removes a passkey.
+     *
+     * @param userId - From the access token.
+     * @param passkeyId - From the URL.
+     * @param request - Who is asking.
+     * @returns `{ success: true }`.
+     */
+    remove(userId, passkeyId, request) {
+        return this.passkeys.removePasskey(userId, passkeyId, request);
+    }
+};
+exports.PasskeysController = PasskeysController;
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.passkeys.registerOptions),
+    (0, auth_decorators_1.CheckSession)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "startRegistration", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.passkeys.registerVerify),
+    (0, auth_decorators_1.CheckSession)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, passkeys_dto_1.FinishPasskeyCeremonyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "finishRegistration", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.passkeys.signInOptions),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "startSignIn", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.passkeys.signInVerify),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [passkeys_dto_1.FinishPasskeyCeremonyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "finishSignIn", null);
+__decorate([
+    (0, common_1.Get)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], PasskeysController.prototype, "list", null);
+__decorate([
+    (0, common_1.Patch)(constants_1.ROUTES.passkeys.passkey),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, common_1.Param)(constants_1.ROUTE_PARAM.passkeyId, new common_1.ParseUUIDPipe())),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, passkeys_dto_1.RenamePasskeyInput]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "rename", null);
+__decorate([
+    (0, common_1.Delete)(constants_1.ROUTES.passkeys.passkey),
+    (0, auth_decorators_1.CheckSession)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, common_1.Param)(constants_1.ROUTE_PARAM.passkeyId, new common_1.ParseUUIDPipe())),
+    __param(2, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object]),
+    __metadata("design:returntype", void 0)
+], PasskeysController.prototype, "remove", null);
+exports.PasskeysController = PasskeysController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.passkeys.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.strictValidationPipe),
+    __metadata("design:paramtypes", [passkeys_service_1.PasskeysService])
+], PasskeysController);
+//# sourceMappingURL=passkeys.controller.js.map

package/dist/features/passkeys/passkeys.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.controller.js","sourceRoot":"","sources":["../../../src/features/passkeys/passkeys.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAkI;AAClI,4EAAuE;AACvE,8DAA0E;AAC1E,8DAA+E;AAC/E,iDAAgF;AAChF,yDAAqD;AACrD,2CAAkD;AAClD,wEAAkE;AAElE;;;;;;;;;;GAUG;AAII,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACA;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D;;;;;OAKG;IAIH,iBAAiB,CAAkB,MAAc;QAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IAIH,kBAAkB,CAAkB,MAAc,EAAU,IAAgC,EAAoB,OAAuB;QACrI,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IAIH,WAAW,CAAmB,OAAuB;QACnD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IAIH,YAAY,CAAS,IAAgC,EAAoB,OAAuB;QAC9F,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,IAAI,CAAkB,MAAc;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;;;OAOG;IAEH,MAAM,CAAkB,MAAc,EAAqD,SAAiB,EAAU,IAAwB;QAC5I,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IAGH,MAAM,CACa,MAAc,EACoB,SAAiB,EAClD,OAAuB;QAEzC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;CACF,CAAA;AAnGY,gDAAkB;AAY7B;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IACrC,IAAA,8BAAY,GAAE;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACL,WAAA,IAAA,+BAAa,GAAE,CAAA;;;;2DAEjC;AAaD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;IACpC,IAAA,8BAAY,GAAE;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACJ,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,gCAAc,GAAE,CAAA;;6CAA7C,yCAA0B;;4DAE3F;AAWD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;IACnC,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACX,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;qDAE5B;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAClC,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACV,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAA7C,yCAA0B;;sDAEpD;AASK;IADL,IAAA,YAAG,GAAE;IACM,WAAA,IAAA,+BAAa,GAAE,CAAA;;;;8CAE1B;AAWD;IADC,IAAA,cAAK,EAAC,kBAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;IACvB,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,uBAAW,CAAC,SAAS,EAAE,IAAI,sBAAa,EAAE,CAAC,CAAA;IAAqB,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,iCAAkB;;gDAE7I;AAYD;IAFC,IAAA,eAAM,EAAC,kBAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,IAAA,8BAAY,GAAE;IAEZ,WAAA,IAAA,+BAAa,GAAE,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,uBAAW,CAAC,SAAS,EAAE,IAAI,sBAAa,EAAE,CAAC,CAAA;IACjD,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;gDAGlB;6BAlGU,kBAAkB;IAH9B,IAAA,mBAAU,EAAC,kBAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAClC,IAAA,wCAAiB,GAAE;IACnB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAEU,kCAAe;GAD3C,kBAAkB,CAmG9B"}

package/dist/features/passkeys/passkeys.dto.d.ts

@@ -0,0 +1,13 @@
+/** POST /auth/passkeys/register/verify and POST /auth/passkeys/sign-in/verify */
+export declare class FinishPasskeyCeremonyInput {
+    /** The challengeToken returned by the matching ".../options" call. */
+    challengeToken: string;
+    /** The object returned by the browser (navigator.credentials.*) or the native passkey API, as JSON. */
+    response: Record<string, unknown>;
+    /** Only when registering: a name for the passkey, e.g. "My iPhone". */
+    name?: string;
+}
+/** PATCH /auth/passkeys/:id */
+export declare class RenamePasskeyInput {
+    name: string;
+}

package/dist/features/passkeys/passkeys.dto.js

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RenamePasskeyInput = exports.FinishPasskeyCeremonyInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/** POST /auth/passkeys/register/verify and POST /auth/passkeys/sign-in/verify */
+class FinishPasskeyCeremonyInput {
+    /** The challengeToken returned by the matching ".../options" call. */
+    challengeToken;
+    /** The object returned by the browser (navigator.credentials.*) or the native passkey API, as JSON. */
+    response;
+    /** Only when registering: a name for the passkey, e.g. "My iPhone". */
+    name;
+}
+exports.FinishPasskeyCeremonyInput = FinishPasskeyCeremonyInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], FinishPasskeyCeremonyInput.prototype, "challengeToken", void 0);
+__decorate([
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], FinishPasskeyCeremonyInput.prototype, "response", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSKEY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], FinishPasskeyCeremonyInput.prototype, "name", void 0);
+/** PATCH /auth/passkeys/:id */
+class RenamePasskeyInput {
+    name;
+}
+exports.RenamePasskeyInput = RenamePasskeyInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSKEY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], RenamePasskeyInput.prototype, "name", void 0);
+//# sourceMappingURL=passkeys.dto.js.map

package/dist/features/passkeys/passkeys.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.dto.js","sourceRoot":"","sources":["../../../src/features/passkeys/passkeys.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA4E;AAC5E,2CAAqF;AAErF,iFAAiF;AACjF,MAAa,0BAA0B;IACrC,sEAAsE;IAEtE,cAAc,CAAS;IAEvB,uGAAuG;IAEvG,QAAQ,CAA0B;IAElC,uEAAuE;IAEvE,IAAI,CAAU;CACf;AAZD,gEAYC;AATC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;kEAC9B;AAIvB;IADC,IAAA,0BAAQ,GAAE;;4DACuB;AAIlC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;wDAC/C;AAGhB,+BAA+B;AAC/B,MAAa,kBAAkB;IAE7B,IAAI,CAAS;CACd;AAHD,gDAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;gDAClC"}

package/dist/features/passkeys/passkeys.service.d.ts

@@ -0,0 +1,159 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { RequestContext } from '../../common/request-context.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInService } from '../sign-in/sign-in.service.js';
+import { SignInResult } from '../sign-in/sign-in.types.js';
+import { SignInMethodsService } from '../users/sign-in-methods.service.js';
+import { UsersService } from '../users/users.service.js';
+/** A passkey as shown to its owner. The public key is not included (nobody needs it). */
+export interface PasskeySummary {
+    id: string;
+    name: string;
+    isBackedUp: boolean;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+/**
+ * Passkeys (Face ID, Touch ID, Windows Hello, Android, security keys) through WebAuthn.
+ *
+ * Adding a passkey and signing in with one each take two requests:
+ * - ".../options": we create a random challenge and return options for the browser or app,
+ *   plus a `challengeToken` to send back with the verify request.
+ * - ".../verify": the device signed the challenge; we check the signature.
+ *
+ * Passkeys must use a fingerprint, face or PIN (user verification = required), which is why
+ * a passkey sign-in counts as two factors and skips the authenticator-app step.
+ */
+export declare class PasskeysService {
+    private readonly options;
+    private readonly settingsService;
+    private readonly users;
+    private readonly signIn;
+    private readonly signInMethods;
+    private readonly rateLimiter;
+    private readonly events;
+    private readonly database;
+    constructor(options: AuthOptions, settingsService: SettingsService, users: UsersService, signIn: SignInService, signInMethods: SignInMethodsService, rateLimiter: RateLimiterService, events: AuthEventsService);
+    /**
+     * Starts adding a passkey: creates a challenge and the options to pass to the browser
+     * (`navigator.credentials.create`, or SimpleWebAuthn's `startRegistration`).
+     *
+     * @param userId - The signed-in user.
+     * @returns `options` for the device, and a `challengeToken` to send back to finishRegistration.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED or NOT_CONFIGURED when passkeys are off or not set up.
+     * @throws AuthError VALIDATION_ERROR when the user already has the maximum number of passkeys.
+     */
+    startRegistration(userId: string): Promise<{
+        success: true;
+        challengeToken: string;
+        options: import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON;
+    }>;
+    /**
+     * Finishes adding a passkey: checks the device's response and saves the new passkey.
+     *
+     * @param userId - The signed-in user (must be the one who called startRegistration).
+     * @param challengeToken - The token from startRegistration.
+     * @param deviceResponse - What the browser returned from `navigator.credentials.create`.
+     * @param passkeyName - A label like "MacBook"; a default name is used when empty.
+     * @param request - Who is asking (for the audit log).
+     * @returns The saved passkey.
+     * @throws AuthError INVALID_TOKEN when the challenge is unknown, used or expired.
+     * @throws AuthError INVALID_PASSKEY when the response doesn't check out.
+     */
+    finishRegistration(userId: string, challengeToken: unknown, deviceResponse: any, passkeyName: string | undefined, request: RequestContext): Promise<{
+        success: true;
+        passkey: PasskeySummary;
+    }>;
+    /**
+     * Starts signing in with a passkey. No email is needed: the device offers the user's passkeys.
+     *
+     * @param request - Who is asking (for rate limits).
+     * @returns `options` for `navigator.credentials.get`, and a `challengeToken` for finishSignIn.
+     * @throws AuthError TOO_MANY_REQUESTS after too many attempts from this IP.
+     */
+    startSignIn(request: RequestContext): Promise<{
+        success: true;
+        challengeToken: string;
+        options: import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON;
+    }>;
+    /**
+     * Finishes signing in with a passkey: checks the signature and signs the user in.
+     * Passkeys count as two factors, so the authenticator-app step is skipped.
+     *
+     * @param challengeToken - The token from startSignIn.
+     * @param deviceResponse - What the browser returned from `navigator.credentials.get`.
+     * @param request - Who is asking.
+     * @returns Tokens.
+     * @throws AuthError INVALID_TOKEN when the challenge is unknown, used or expired.
+     * @throws AuthError INVALID_PASSKEY when the passkey is unknown or the signature is wrong.
+     */
+    finishSignIn(challengeToken: unknown, deviceResponse: any, request: RequestContext): Promise<SignInResult>;
+    /**
+     * @param userId - The signed-in user.
+     * @returns The user's passkeys, oldest first.
+     */
+    listPasskeys(userId: string): Promise<PasskeySummary[]>;
+    /**
+     * @param userId - The signed-in user.
+     * @param passkeyId - One of the user's passkeys.
+     * @param newName - The new label.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the passkey isn't the user's.
+     */
+    renamePasskey(userId: string, passkeyId: string, newName: string): Promise<{
+        success: true;
+    }>;
+    /**
+     * Removes one of the user's passkeys, unless it is their last way to sign in.
+     *
+     * @param userId - The signed-in user.
+     * @param passkeyId - One of the user's passkeys.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the passkey isn't the user's.
+     * @throws AuthError LAST_SIGN_IN_METHOD when it is the user's only way to sign in.
+     */
+    removePasskey(userId: string, passkeyId: string, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * @returns The current settings and the app's passkey options (relying party id, origins).
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when passkeys are turned off in settings.
+     * @throws AuthError NOT_CONFIGURED when AuthOptions.passkeys is not set.
+     */
+    private getEnabledPasskeySettings;
+    /**
+     * Stores the WebAuthn challenge until the finish request arrives, behind a "ch_..." token (only the token's hash is stored).
+     *
+     * @param purpose - Registration or sign-in.
+     * @param webauthnChallenge - The random challenge the device must sign.
+     * @param userId - The user adding a passkey, or null for sign-in.
+     * @returns The plain token for the client.
+     */
+    private saveCeremonyChallenge;
+    /**
+     * Uses up a ceremony challenge (once only, before it expires).
+     *
+     * @param challengeToken - The token from startRegistration or startSignIn.
+     * @param purpose - Registration or sign-in.
+     * @returns The user who started it (null for sign-in) and the WebAuthn challenge.
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used, expired or for another purpose.
+     */
+    private useCeremonyChallenge;
+    /**
+     * Reads the new credential from the library's result. SimpleWebAuthn v11+ nests it under
+     * `credential`; older versions used flat fields. Both are handled so an upgrade can't break sign-up.
+     *
+     * @param registrationInfo - `verification.registrationInfo` from SimpleWebAuthn.
+     * @param deviceResponse - The browser's response (fallback source for transports).
+     * @returns The credential id and public key (base64url), counter, transports and backup state.
+     */
+    private readRegisteredCredential;
+    /**
+     * @param passkey - The passkey row.
+     * @returns The passkey as shown to its owner (no public key).
+     */
+    private toSummary;
+}