@things-factory/auth-base 10.1.205 → 10.1.208

package/dist-server/controllers/passkey.d.ts

@@ -0,0 +1,35 @@
+import { type AuthenticationResponseJSON, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON, type RegistrationResponseJSON } from '@simplewebauthn/server';
+import { User } from '../service/user/user.js';
+import { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential.js';
+/** Where a ceremony runs. The relying party is the host the person reached (ADR-0156 「남기는 것」). */
+export type PasskeySite = {
+    rpID: string;
+    origin: string;
+};
+export declare function siteOf(context: any): PasskeySite;
+export declare function rememberChallenge(context: any, challenge: string): void;
+/** The session's challenge, removed - whatever the answer turns out to be. */
+export declare function takeChallenge(context: any): string;
+/** What to ask the browser when a signed-in person adds a passkey. */
+export declare function registrationOptions(user: User, rpName: string, site: PasskeySite): Promise<PublicKeyCredentialCreationOptionsJSON>;
+/**
+ * What to ask the browser when somebody signs in. No credential is named: the browser offers what
+ * it holds for this site, or a phone nearby.
+ */
+export declare function signinOptions(site: PasskeySite): Promise<PublicKeyCredentialRequestOptionsJSON>;
+/** What to ask the browser when a signed-in person confirms it is them - only their own passkeys. */
+export declare function reverifyOptions(user: User, site: PasskeySite): Promise<PublicKeyCredentialRequestOptionsJSON | null>;
+/** Keeps the passkey the browser made for `user`. `name` is the person's label for it. */
+export declare function registerPasskey(user: User, response: RegistrationResponseJSON, name: string | undefined, challenge: string, site: PasskeySite): Promise<WebAuthCredential>;
+/**
+ * Signing in with a passkey: the answer is checked, then the account goes through the same gate as
+ * a password sign-in - deleted, locked, inactive - and the sign-in is audited with its method
+ * (ADR-0156 decision 4). A passkey does not lift a lock and does not count as a failed password.
+ */
+export declare function signinWithPasskey(response: AuthenticationResponseJSON, challenge: string, site: PasskeySite, context?: any): Promise<{
+    user: User;
+    token: string;
+    domains: import("@things-factory/shell").Domain[];
+}>;
+/** A signed-in person confirming it is them, with one of their own passkeys. */
+export declare function reverifyWithPasskey(user: User, response: AuthenticationResponseJSON, challenge: string, site: PasskeySite): Promise<void>;

package/dist-server/controllers/passkey.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.siteOf = siteOf;
+exports.rememberChallenge = rememberChallenge;
+exports.takeChallenge = takeChallenge;
+exports.registrationOptions = registrationOptions;
+exports.signinOptions = signinOptions;
+exports.reverifyOptions = reverifyOptions;
+exports.registerPasskey = registerPasskey;
+exports.signinWithPasskey = signinWithPasskey;
+exports.reverifyWithPasskey = reverifyWithPasskey;
+const server_1 = require("@simplewebauthn/server");
+const shell_1 = require("@things-factory/shell");
+const auth_error_js_1 = require("../errors/auth-error.js");
+const web_auth_credential_js_1 = require("../service/web-auth-credential/web-auth-credential.js");
+const signin_js_1 = require("./signin.js");
+/**
+ * Passkeys (ADR-0156).
+ *
+ * Every ceremony asks the authenticator to verify the person - fingerprint, face or device PIN - and
+ * the server refuses an answer without that flag (decision 2). Registration leaves the authenticator
+ * to the browser, so a phone or a security key can be chosen as well as this device; that is also
+ * what lets a phone sign a computer in (decision 3).
+ *
+ * A challenge is good for one answer. It is taken out of the session before the answer is checked,
+ * so a second try with the same challenge finds none.
+ */
+const USER_VERIFICATION = 'required';
+function siteOf(context) {
+    return { rpID: context.hostname, origin: context.origin };
+}
+function rememberChallenge(context, challenge) {
+    context.session.challenge = challenge;
+}
+/** The session's challenge, removed - whatever the answer turns out to be. */
+function takeChallenge(context) {
+    const challenge = context.session?.challenge;
+    if (context.session)
+        delete context.session.challenge;
+    if (!challenge) {
+        throw new auth_error_js_1.AuthError({ errorCode: auth_error_js_1.AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED, detail: { reason: 'no challenge' } });
+    }
+    return challenge;
+}
+/** What to ask the browser when a signed-in person adds a passkey. */
+async function registrationOptions(user, rpName, site) {
+    const registered = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({ where: { user: { id: user.id } } });
+    return await (0, server_1.generateRegistrationOptions)({
+        rpName,
+        rpID: site.rpID,
+        userName: user.email,
+        userDisplayName: user.name,
+        attestationType: 'none',
+        /* The browser says so when this authenticator already holds one of this person's passkeys. */
+        excludeCredentials: registered.map(credential => ({
+            id: credential.credentialId,
+            transports: (credential.transports ?? undefined)
+        })),
+        authenticatorSelection: {
+            /* A passkey that cannot sign in without a name typed first is not taken (decision 2). */
+            residentKey: 'required',
+            userVerification: USER_VERIFICATION
+        }
+    });
+}
+/**
+ * What to ask the browser when somebody signs in. No credential is named: the browser offers what
+ * it holds for this site, or a phone nearby.
+ */
+async function signinOptions(site) {
+    return await (0, server_1.generateAuthenticationOptions)({ rpID: site.rpID, userVerification: USER_VERIFICATION });
+}
+/** What to ask the browser when a signed-in person confirms it is them - only their own passkeys. */
+async function reverifyOptions(user, site) {
+    const registered = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({ where: { user: { id: user.id } } });
+    if (registered.length === 0)
+        return null;
+    return await (0, server_1.generateAuthenticationOptions)({
+        rpID: site.rpID,
+        userVerification: USER_VERIFICATION,
+        allowCredentials: registered.map(credential => ({
+            id: credential.credentialId,
+            transports: (credential.transports ?? undefined)
+        }))
+    });
+}
+function verificationFailed(reason) {
+    return new auth_error_js_1.AuthError({ errorCode: auth_error_js_1.AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED, detail: { reason } });
+}
+/** Keeps the passkey the browser made for `user`. `name` is the person's label for it. */
+async function registerPasskey(user, response, name, challenge, site) {
+    let verification;
+    try {
+        verification = await (0, server_1.verifyRegistrationResponse)({
+            response,
+            expectedChallenge: challenge,
+            expectedOrigin: site.origin,
+            expectedRPID: site.rpID,
+            expectedType: 'webauthn.create',
+            requireUserVerification: true
+        });
+    }
+    catch (error) {
+        throw verificationFailed(error?.message || 'registration not verified');
+    }
+    if (!verification.verified || !verification.registrationInfo) {
+        throw verificationFailed('registration not verified');
+    }
+    const { credential } = verification.registrationInfo;
+    const label = name?.trim().slice(0, 64);
+    return await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).save({
+        user,
+        credentialId: credential.id,
+        publicKey: Buffer.from(credential.publicKey).toString('base64'),
+        counter: credential.counter,
+        transports: credential.transports?.length ? credential.transports : (response.response?.transports ?? null),
+        name: label || null,
+        creator: user,
+        updater: user
+    });
+}
+/**
+ * Checks an answer against the stored passkey and moves its counter on. `ownerId`, when given, is
+ * who the passkey must belong to - a confirmation is answered only by the person's own passkey.
+ * `attempt.userId` is filled as soon as the passkey is found, so a failed sign-in names its owner.
+ */
+async function verifyAssertion(response, challenge, site, attempt = {}, ownerId) {
+    const repository = (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential);
+    const credential = response?.id
+        ? await repository.findOne({ where: { credentialId: response.id }, relations: ['user', 'user.domains'] })
+        : null;
+    if (!credential?.user) {
+        throw verificationFailed('unknown credential');
+    }
+    attempt.userId = credential.user.id;
+    if (ownerId && credential.user.id !== ownerId) {
+        throw verificationFailed('credential of another user');
+    }
+    let verification;
+    try {
+        verification = await (0, server_1.verifyAuthenticationResponse)({
+            response,
+            expectedChallenge: challenge,
+            expectedOrigin: site.origin,
+            expectedRPID: site.rpID,
+            requireUserVerification: true,
+            credential: {
+                id: credential.credentialId,
+                publicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),
+                counter: credential.counter,
+                transports: (credential.transports ?? undefined)
+            }
+        });
+    }
+    catch (error) {
+        throw verificationFailed(error?.message || 'assertion not verified');
+    }
+    if (!verification.verified) {
+        throw verificationFailed('assertion not verified');
+    }
+    await repository.update({ id: credential.id }, { counter: verification.authenticationInfo.newCounter });
+    return credential;
+}
+/**
+ * Signing in with a passkey: the answer is checked, then the account goes through the same gate as
+ * a password sign-in - deleted, locked, inactive - and the sign-in is audited with its method
+ * (ADR-0156 decision 4). A passkey does not lift a lock and does not count as a failed password.
+ */
+async function signinWithPasskey(response, challenge, site, context) {
+    return await (0, signin_js_1.auditedSignin)('passkey', context, async (attempt) => {
+        const credential = await verifyAssertion(response, challenge, site, attempt);
+        const answer = await (0, signin_js_1.admitSignin)(credential.user, context, async () => { });
+        await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).update({ id: credential.id }, { lastUsedAt: new Date() });
+        return answer;
+    });
+}
+/** A signed-in person confirming it is them, with one of their own passkeys. */
+async function reverifyWithPasskey(user, response, challenge, site) {
+    const credential = await verifyAssertion(response, challenge, site, {}, user.id);
+    await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).update({ id: credential.id }, { lastUsedAt: new Date() });
+}
+//# sourceMappingURL=passkey.js.map

package/dist-server/controllers/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../server/controllers/passkey.ts"],"names":[],"mappings":";;AAoCA,wBAEC;AAED,8CAEC;AAGD,sCASC;AAGD,kDAwBC;AAMD,sCAEC;AAGD,0CAYC;AAOD,0CAsCC;AA8DD,8CASC;AAGD,kDAGC;AAlOD,mDAU+B;AAE/B,iDAAqD;AAErD,2DAAmD;AAEnD,kGAAyF;AACzF,2CAAwD;AAExD;;;;;;;;;;GAUG;AAEH,MAAM,iBAAiB,GAAG,UAAmB,CAAA;AAK7C,SAAgB,MAAM,CAAC,OAAO;IAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AAC3D,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAiB;IAC1D,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;AACvC,CAAC;AAED,8EAA8E;AAC9E,SAAgB,aAAa,CAAC,OAAO;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAA;IAC5C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAA;IAErD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,yBAAS,CAAC,EAAE,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;IACzH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,sEAAsE;AAC/D,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,MAAc,EACd,IAAiB;IAEjB,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAEpG,OAAO,MAAM,IAAA,oCAA2B,EAAC;QACvC,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,eAAe,EAAE,MAAM;QACvB,8FAA8F;QAC9F,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,SAAS,CAAmC;SACnF,CAAC,CAAC;QACH,sBAAsB,EAAE;YACtB,yFAAyF;YACzF,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,iBAAiB;SACpC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,OAAO,MAAM,IAAA,sCAA6B,EAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAA;AACtG,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,eAAe,CAAC,IAAU,EAAE,IAAiB;IACjE,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACpG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAExC,OAAO,MAAM,IAAA,sCAA6B,EAAC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gBAAgB,EAAE,iBAAiB;QACnC,gBAAgB,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9C,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,SAAS,CAAmC;SACnF,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,IAAI,yBAAS,CAAC,EAAE,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC1G,CAAC;AAED,0FAA0F;AACnF,KAAK,UAAU,eAAe,CACnC,IAAU,EACV,QAAkC,EAClC,IAAwB,EACxB,SAAiB,EACjB,IAAiB;IAEjB,IAAI,YAAoE,CAAA;IACxE,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,IAAA,mCAA0B,EAAC;YAC9C,QAAQ;YACR,iBAAiB,EAAE,SAAS;YAC5B,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,YAAY,EAAE,iBAAiB;YAC/B,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAA;IACpD,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEvC,OAAO,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI;QACJ,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3G,IAAI,EAAE,KAAK,IAAI,IAAI;QACnB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAoC,EACpC,SAAiB,EACjB,IAAiB,EACjB,UAA+B,EAAE,EACjC,OAAgB;IAEhB,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,QAAQ,EAAE,EAAE;QAC7B,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QACzG,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACtB,MAAM,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAA;IAEnC,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9C,MAAM,kBAAkB,CAAC,4BAA4B,CAAC,CAAA;IACxD,CAAC;IAED,IAAI,YAAsE,CAAA;IAC1E,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,IAAA,qCAA4B,EAAC;YAChD,QAAQ;YACR,iBAAiB,EAAE,SAAS;YAC5B,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,YAAY;gBAC3B,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,SAAS,CAAmC;aACnF;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,IAAI,wBAAwB,CAAC,CAAA;IACtE,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,CAAA;IAEvG,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAoC,EAAE,SAAiB,EAAE,IAAiB,EAAE,OAAQ;IAC1H,OAAO,MAAM,IAAA,yBAAa,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QAC7D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAW,EAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAA;QAE1E,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QAEhG,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,gFAAgF;AACzE,KAAK,UAAU,mBAAmB,CAAC,IAAU,EAAE,QAAoC,EAAE,SAAiB,EAAE,IAAiB;IAC9H,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;AAClG,CAAC","sourcesContent":["import {\n  generateAuthenticationOptions,\n  generateRegistrationOptions,\n  verifyAuthenticationResponse,\n  verifyRegistrationResponse,\n  type AuthenticationResponseJSON,\n  type AuthenticatorTransportFuture,\n  type PublicKeyCredentialCreationOptionsJSON,\n  type PublicKeyCredentialRequestOptionsJSON,\n  type RegistrationResponseJSON\n} from '@simplewebauthn/server'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { AuthError } from '../errors/auth-error.js'\nimport { User } from '../service/user/user.js'\nimport { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential.js'\nimport { admitSignin, auditedSignin } from './signin.js'\n\n/**\n * Passkeys (ADR-0156).\n *\n * Every ceremony asks the authenticator to verify the person - fingerprint, face or device PIN - and\n * the server refuses an answer without that flag (decision 2). Registration leaves the authenticator\n * to the browser, so a phone or a security key can be chosen as well as this device; that is also\n * what lets a phone sign a computer in (decision 3).\n *\n * A challenge is good for one answer. It is taken out of the session before the answer is checked,\n * so a second try with the same challenge finds none.\n */\n\nconst USER_VERIFICATION = 'required' as const\n\n/** Where a ceremony runs. The relying party is the host the person reached (ADR-0156 「남기는 것」). */\nexport type PasskeySite = { rpID: string; origin: string }\n\nexport function siteOf(context): PasskeySite {\n  return { rpID: context.hostname, origin: context.origin }\n}\n\nexport function rememberChallenge(context, challenge: string) {\n  context.session.challenge = challenge\n}\n\n/** The session's challenge, removed - whatever the answer turns out to be. */\nexport function takeChallenge(context): string {\n  const challenge = context.session?.challenge\n  if (context.session) delete context.session.challenge\n\n  if (!challenge) {\n    throw new AuthError({ errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED, detail: { reason: 'no challenge' } })\n  }\n\n  return challenge\n}\n\n/** What to ask the browser when a signed-in person adds a passkey. */\nexport async function registrationOptions(\n  user: User,\n  rpName: string,\n  site: PasskeySite\n): Promise<PublicKeyCredentialCreationOptionsJSON> {\n  const registered = await getRepository(WebAuthCredential).find({ where: { user: { id: user.id } } })\n\n  return await generateRegistrationOptions({\n    rpName,\n    rpID: site.rpID,\n    userName: user.email,\n    userDisplayName: user.name,\n    attestationType: 'none',\n    /* The browser says so when this authenticator already holds one of this person's passkeys. */\n    excludeCredentials: registered.map(credential => ({\n      id: credential.credentialId,\n      transports: (credential.transports ?? undefined) as AuthenticatorTransportFuture[]\n    })),\n    authenticatorSelection: {\n      /* A passkey that cannot sign in without a name typed first is not taken (decision 2). */\n      residentKey: 'required',\n      userVerification: USER_VERIFICATION\n    }\n  })\n}\n\n/**\n * What to ask the browser when somebody signs in. No credential is named: the browser offers what\n * it holds for this site, or a phone nearby.\n */\nexport async function signinOptions(site: PasskeySite): Promise<PublicKeyCredentialRequestOptionsJSON> {\n  return await generateAuthenticationOptions({ rpID: site.rpID, userVerification: USER_VERIFICATION })\n}\n\n/** What to ask the browser when a signed-in person confirms it is them - only their own passkeys. */\nexport async function reverifyOptions(user: User, site: PasskeySite): Promise<PublicKeyCredentialRequestOptionsJSON | null> {\n  const registered = await getRepository(WebAuthCredential).find({ where: { user: { id: user.id } } })\n  if (registered.length === 0) return null\n\n  return await generateAuthenticationOptions({\n    rpID: site.rpID,\n    userVerification: USER_VERIFICATION,\n    allowCredentials: registered.map(credential => ({\n      id: credential.credentialId,\n      transports: (credential.transports ?? undefined) as AuthenticatorTransportFuture[]\n    }))\n  })\n}\n\nfunction verificationFailed(reason: string): AuthError {\n  return new AuthError({ errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED, detail: { reason } })\n}\n\n/** Keeps the passkey the browser made for `user`. `name` is the person's label for it. */\nexport async function registerPasskey(\n  user: User,\n  response: RegistrationResponseJSON,\n  name: string | undefined,\n  challenge: string,\n  site: PasskeySite\n): Promise<WebAuthCredential> {\n  let verification: Awaited<ReturnType<typeof verifyRegistrationResponse>>\n  try {\n    verification = await verifyRegistrationResponse({\n      response,\n      expectedChallenge: challenge,\n      expectedOrigin: site.origin,\n      expectedRPID: site.rpID,\n      expectedType: 'webauthn.create',\n      requireUserVerification: true\n    })\n  } catch (error) {\n    throw verificationFailed(error?.message || 'registration not verified')\n  }\n\n  if (!verification.verified || !verification.registrationInfo) {\n    throw verificationFailed('registration not verified')\n  }\n\n  const { credential } = verification.registrationInfo\n  const label = name?.trim().slice(0, 64)\n\n  return await getRepository(WebAuthCredential).save({\n    user,\n    credentialId: credential.id,\n    publicKey: Buffer.from(credential.publicKey).toString('base64'),\n    counter: credential.counter,\n    transports: credential.transports?.length ? credential.transports : (response.response?.transports ?? null),\n    name: label || null,\n    creator: user,\n    updater: user\n  })\n}\n\n/**\n * Checks an answer against the stored passkey and moves its counter on. `ownerId`, when given, is\n * who the passkey must belong to - a confirmation is answered only by the person's own passkey.\n * `attempt.userId` is filled as soon as the passkey is found, so a failed sign-in names its owner.\n */\nasync function verifyAssertion(\n  response: AuthenticationResponseJSON,\n  challenge: string,\n  site: PasskeySite,\n  attempt: { userId?: string } = {},\n  ownerId?: string\n): Promise<WebAuthCredential> {\n  const repository = getRepository(WebAuthCredential)\n  const credential = response?.id\n    ? await repository.findOne({ where: { credentialId: response.id }, relations: ['user', 'user.domains'] })\n    : null\n\n  if (!credential?.user) {\n    throw verificationFailed('unknown credential')\n  }\n\n  attempt.userId = credential.user.id\n\n  if (ownerId && credential.user.id !== ownerId) {\n    throw verificationFailed('credential of another user')\n  }\n\n  let verification: Awaited<ReturnType<typeof verifyAuthenticationResponse>>\n  try {\n    verification = await verifyAuthenticationResponse({\n      response,\n      expectedChallenge: challenge,\n      expectedOrigin: site.origin,\n      expectedRPID: site.rpID,\n      requireUserVerification: true,\n      credential: {\n        id: credential.credentialId,\n        publicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),\n        counter: credential.counter,\n        transports: (credential.transports ?? undefined) as AuthenticatorTransportFuture[]\n      }\n    })\n  } catch (error) {\n    throw verificationFailed(error?.message || 'assertion not verified')\n  }\n\n  if (!verification.verified) {\n    throw verificationFailed('assertion not verified')\n  }\n\n  await repository.update({ id: credential.id }, { counter: verification.authenticationInfo.newCounter })\n\n  return credential\n}\n\n/**\n * Signing in with a passkey: the answer is checked, then the account goes through the same gate as\n * a password sign-in - deleted, locked, inactive - and the sign-in is audited with its method\n * (ADR-0156 decision 4). A passkey does not lift a lock and does not count as a failed password.\n */\nexport async function signinWithPasskey(response: AuthenticationResponseJSON, challenge: string, site: PasskeySite, context?) {\n  return await auditedSignin('passkey', context, async attempt => {\n    const credential = await verifyAssertion(response, challenge, site, attempt)\n    const answer = await admitSignin(credential.user, context, async () => {})\n\n    await getRepository(WebAuthCredential).update({ id: credential.id }, { lastUsedAt: new Date() })\n\n    return answer\n  })\n}\n\n/** A signed-in person confirming it is them, with one of their own passkeys. */\nexport async function reverifyWithPasskey(user: User, response: AuthenticationResponseJSON, challenge: string, site: PasskeySite) {\n  const credential = await verifyAssertion(response, challenge, site, {}, user.id)\n  await getRepository(WebAuthCredential).update({ id: credential.id }, { lastUsedAt: new Date() })\n}\n"]}

package/dist-server/controllers/signin.d.ts

@@ -1,4 +1,8 @@
 import { User } from '../service/user/user.js';
+export type SigninMethod = 'password' | 'passkey';
+export type SigninAttempt = {
+    userId?: string;
+};
 /**
  * A sign-in, and its audit (ADR-0141 §3.3): a success or a failure with its code. A failure is
  * written on its own and stays when the request fails (§4-3). An account that does not exist leaves
@@ -12,3 +16,23 @@ export declare function signin(attrs: {
     token: string;
     domains: import("@things-factory/shell").Domain[];
 }>;
+/**
+ * The audit around one way of signing in. `run` puts the person in `attempt` as soon as it knows
+ * who it is, so a failure after that names them. `detail.method` tells a password from a passkey
+ * (ADR-0156 decision 4).
+ */
+export declare function auditedSignin<T extends {
+    user: User;
+}>(method: SigninMethod, context: any, run: (attempt: SigninAttempt) => Promise<T>): Promise<T>;
+/**
+ * The account gate every way of signing in goes through (ADR-0156 decision 4): deleted, locked -
+ * and a lock that has run out lifts here - then the secret, then inactive. Only `verifySecret`
+ * differs between a password and a passkey; a passkey arrives already verified and passes nothing.
+ *
+ * `user` must carry `domains`.
+ */
+export declare function admitSignin(user: User, context: any, verifySecret: () => Promise<void>): Promise<{
+    user: User;
+    token: string;
+    domains: import("@things-factory/shell").Domain[];
+}>;

package/dist-server/controllers/signin.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signin = signin;
+exports.auditedSignin = auditedSignin;
+exports.admitSignin = admitSignin;
 const typeorm_1 = require("typeorm");
 const shell_1 = require("@things-factory/shell");
 const unlock_user_js_1 = require("../controllers/unlock-user.js");
@@ -16,24 +18,32 @@ const audit_target_js_1 = require("../service/audit/audit-target.js");
  * no actor - the name typed in is not a person.
  */
 async function signin(attrs, context) {
+    return await auditedSignin('password', context, attempt => signinOnce(attrs, context, attempt));
+}
+/**
+ * The audit around one way of signing in. `run` puts the person in `attempt` as soon as it knows
+ * who it is, so a failure after that names them. `detail.method` tells a password from a passkey
+ * (ADR-0156 decision 4).
+ */
+async function auditedSignin(method, context, run) {
     const attempt = {};
     const domainId = context?.state?.domain?.id ?? null;
+    const detail = { method };
     /*
      * Not awaited: the answer does not wait on its record, and a write that fails is counted, never
      * thrown (`recordAuditAction` without a transaction).
      */
     try {
-        const answer = await signinOnce(attrs, context, attempt);
-        void (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.signin', outcome: 'ok' }, { actorId: answer.user.id, domainId });
+        const answer = await run(attempt);
+        void (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.signin', outcome: 'ok', detail }, { actorId: answer.user.id, domainId });
         return answer;
     }
     catch (error) {
-        void (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.signin', outcome: 'error', code: (0, audit_target_js_1.errorCodeOf)(error) }, { actorId: attempt.userId ?? null, domainId });
+        void (0, audit_recorder_js_1.recordAuditAction)({ kind: 'auth.signin', outcome: 'error', code: (0, audit_target_js_1.errorCodeOf)(error), detail }, { actorId: attempt.userId ?? null, domainId });
         throw error;
     }
 }
 async function signinOnce(attrs, context, attempt) {
-    const { domain } = context?.state || {};
     const { username } = attrs;
     const repository = (0, shell_1.getRepository)(user_js_1.User);
     var user = await repository.findOne({
@@ -53,6 +63,54 @@ async function signinOnce(attrs, context, attempt) {
             errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_NOT_FOUND
         });
     attempt.userId = user.id;
+    return await admitSignin(user, context, async () => {
+        if (!user_js_1.User.verify(user.password, attrs.password, user.salt)) {
+            user.failCount++;
+            if (user.failCount >= 5) {
+                user.status = user_js_1.UserStatus.LOCKED;
+                /* 언제 풀리나를 계산할 수 있게 시각을 남긴다. 이 칸이 비면 판정 규칙이
+                   잠금을 유지하는 쪽으로 기운다. */
+                user.lockedAt = new Date();
+            }
+            await repository.save(user);
+            if (user.status == user_js_1.UserStatus.LOCKED) {
+                (0, unlock_user_js_1.sendUnlockUserEmail)({
+                    user,
+                    context
+                });
+                throw new auth_error_js_1.AuthError({
+                    errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
+                    detail: {
+                        username: user.username,
+                        email: user.email
+                    }
+                });
+            }
+            throw new auth_error_js_1.AuthError({
+                errorCode: auth_error_js_1.AuthError.ERROR_CODES.PASSWORD_NOT_MATCHED,
+                detail: {
+                    username: user.username,
+                    email: user.email,
+                    failCount: user.failCount
+                }
+            });
+        }
+        else {
+            user.failCount = 0;
+            await repository.save(user);
+        }
+    });
+}
+/**
+ * The account gate every way of signing in goes through (ADR-0156 decision 4): deleted, locked -
+ * and a lock that has run out lifts here - then the secret, then inactive. Only `verifySecret`
+ * differs between a password and a passkey; a passkey arrives already verified and passes nothing.
+ *
+ * `user` must carry `domains`.
+ */
+async function admitSignin(user, context, verifySecret) {
+    const { domain } = context?.state || {};
+    const repository = (0, shell_1.getRepository)(user_js_1.User);
     if (user.status == user_js_1.UserStatus.DELETED) {
         throw new auth_error_js_1.AuthError({
             errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_DELETED
@@ -86,41 +144,7 @@ async function signinOnce(attrs, context, attempt) {
         user.lockedAt = null;
         await repository.save(user);
     }
-    if (!user_js_1.User.verify(user.password, attrs.password, user.salt)) {
-        user.failCount++;
-        if (user.failCount >= 5) {
-            user.status = user_js_1.UserStatus.LOCKED;
-            /* 언제 풀리나를 계산할 수 있게 시각을 남긴다. 이 칸이 비면 판정 규칙이
-               잠금을 유지하는 쪽으로 기운다. */
-            user.lockedAt = new Date();
-        }
-        await repository.save(user);
-        if (user.status == user_js_1.UserStatus.LOCKED) {
-            (0, unlock_user_js_1.sendUnlockUserEmail)({
-                user,
-                context
-            });
-            throw new auth_error_js_1.AuthError({
-                errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
-                detail: {
-                    username: user.username,
-                    email: user.email
-                }
-            });
-        }
-        throw new auth_error_js_1.AuthError({
-            errorCode: auth_error_js_1.AuthError.ERROR_CODES.PASSWORD_NOT_MATCHED,
-            detail: {
-                username: user.username,
-                email: user.email,
-                failCount: user.failCount
-            }
-        });
-    }
-    else {
-        user.failCount = 0;
-        await repository.save(user);
-    }
+    await verifySecret();
     if (user.status == user_js_1.UserStatus.INACTIVE) {
         throw new auth_error_js_1.AuthError({
             errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_NOT_ACTIVATED,

package/dist-server/controllers/signin.js.map

@@ -1 +1 @@
-{"version":3,"file":"signin.js","sourceRoot":"","sources":["../../server/controllers/signin.ts"],"names":[],"mappings":";;AAgBA,wBAgBC;AAhCD,qCAA+B;AAC/B,iDAAqD;AAErD,kEAAmE;AACnE,2DAAmD;AACnD,qDAA0D;AAC1D,wEAA+D;AAC/D,gEAA+D;AAC/D,0EAAsE;AACtE,sEAA8D;AAE9D;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,KAA6C,EAAE,OAAQ;IAClF,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAEnD;;;OAGG;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACxD,KAAK,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACrG,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAA,6BAAW,EAAC,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1I,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAA6C,EAAE,OAAO,EAAE,OAA4B;IAC5G,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAA;IACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE1B,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE;gBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;aACvB;YACD,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;SAChD,CAAC,CAAA;IAEJ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IAExB,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;SAC9C,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,EAAE,CAAC;QACrC,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,IAAI,IAAA,sCAAe,EAAC,IAAI,EAAE,GAAG,EAAE,IAAA,sCAAmB,GAAE,CAAC,EAAE,CAAC;YACtD,IAAA,oCAAmB,EAAC;gBAClB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;gBAC5C,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;aACF,CAAC,CAAA;QACJ,CAAC;QAED;;;;;;WAMG;QACH,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAClC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QAEpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAA;QAChB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,MAAM,CAAA;YAC/B;mCACuB;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,EAAE,CAAC;YACrC,IAAA,oCAAmB,EAAC;gBAClB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;gBAC5C,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;aACF,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,oBAAoB;YACrD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;YACnD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAA;AACH,CAAC","sourcesContent":["import { ILike } from 'typeorm'\nimport { getRepository } from '@things-factory/shell'\n\nimport { sendUnlockUserEmail } from '../controllers/unlock-user.js'\nimport { AuthError } from '../errors/auth-error.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { isAccountLocked } from '../utils/account-lock-rule.js'\nimport { lockDurationMinutes } from '../utils/lock-duration.js'\nimport { recordAuditAction } from '../service/audit/audit-recorder.js'\nimport { errorCodeOf } from '../service/audit/audit-target.js'\n\n/**\n * A sign-in, and its audit (ADR-0141 §3.3): a success or a failure with its code. A failure is\n * written on its own and stays when the request fails (§4-3). An account that does not exist leaves\n * no actor - the name typed in is not a person.\n */\nexport async function signin(attrs: { username: string; password: string }, context?) {\n  const attempt: { userId?: string } = {}\n  const domainId = context?.state?.domain?.id ?? null\n\n  /*\n   * Not awaited: the answer does not wait on its record, and a write that fails is counted, never\n   * thrown (`recordAuditAction` without a transaction).\n   */\n  try {\n    const answer = await signinOnce(attrs, context, attempt)\n    void recordAuditAction({ kind: 'auth.signin', outcome: 'ok' }, { actorId: answer.user.id, domainId })\n    return answer\n  } catch (error) {\n    void recordAuditAction({ kind: 'auth.signin', outcome: 'error', code: errorCodeOf(error) }, { actorId: attempt.userId ?? null, domainId })\n    throw error\n  }\n}\n\nasync function signinOnce(attrs: { username: string; password: string }, context, attempt: { userId?: string }) {\n  const { domain } = context?.state || {}\n  const { username } = attrs\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n    user = await repository.findOne({\n      where: {\n        email: ILike(username)\n      },\n      relations: ['domains']\n    })\n  }\n\n  if (!user)\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n    })\n\n  attempt.userId = user.id\n\n  if (user.status == UserStatus.DELETED) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_DELETED\n    })\n  }\n\n  if (user.status == UserStatus.LOCKED) {\n    /* 시계는 한 번만 읽는다 — 두 번 읽으면 경계에 걸린 잠금이 두 판정 사이에서 갈린다. */\n    const now = new Date()\n\n    if (isAccountLocked(user, now, lockDurationMinutes())) {\n      sendUnlockUserEmail({\n        user,\n        context\n      })\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n        detail: {\n          username: user.username,\n          email: user.email\n        }\n      })\n    }\n\n    /*\n     * 시간이 지나 스스로 풀렸다 — 그 자리에서 행을 되돌리고 계속 진행한다. 주기 작업으로\n     * 풀지 않는 이유는 `account-lock-rule.ts` 에 있다(계정이 10만이면 그것이 따로 일이 된다).\n     *\n     * `failCount` 도 함께 0 으로 둔다. 그래서 **잠금이 곧 실패 셈의 창**이 된다 — 이 계정이\n     * 다시 잠기려면 지금부터 다섯 번을 틀려야 한다.\n     */\n    user.status = UserStatus.ACTIVATED\n    user.failCount = 0\n    user.lockedAt = null\n\n    await repository.save(user)\n  }\n\n  if (!User.verify(user.password, attrs.password, user.salt)) {\n    user.failCount++\n    if (user.failCount >= 5) {\n      user.status = UserStatus.LOCKED\n      /* 언제 풀리나를 계산할 수 있게 시각을 남긴다. 이 칸이 비면 판정 규칙이\n         잠금을 유지하는 쪽으로 기운다. */\n      user.lockedAt = new Date()\n    }\n    await repository.save(user)\n    if (user.status == UserStatus.LOCKED) {\n      sendUnlockUserEmail({\n        user,\n        context\n      })\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n        detail: {\n          username: user.username,\n          email: user.email\n        }\n      })\n    }\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.PASSWORD_NOT_MATCHED,\n      detail: {\n        username: user.username,\n        email: user.email,\n        failCount: user.failCount\n      }\n    })\n  } else {\n    user.failCount = 0\n    await repository.save(user)\n  }\n\n  if (user.status == UserStatus.INACTIVE) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n      detail: {\n        username: user.username,\n        email: user.email\n      }\n    })\n  }\n\n  return {\n    user,\n    token: await user.sign({ subdomain: domain?.subdomain }),\n    domains: user.domains || []\n  }\n}\n"]}
+{"version":3,"file":"signin.js","sourceRoot":"","sources":["../../server/controllers/signin.ts"],"names":[],"mappings":";;AAoBA,wBAEC;AAOD,sCAqBC;AAyED,kCA2DC;AAtLD,qCAA+B;AAC/B,iDAAqD;AAErD,kEAAmE;AACnE,2DAAmD;AACnD,qDAA0D;AAC1D,wEAA+D;AAC/D,gEAA+D;AAC/D,0EAAsE;AACtE,sEAA8D;AAM9D;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,KAA6C,EAAE,OAAQ;IAClF,OAAO,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AACjG,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,MAAoB,EACpB,OAAO,EACP,GAA2C;IAE3C,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IACnD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,CAAA;IAEzB;;;OAGG;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,KAAK,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7G,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAA,6BAAW,EAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAClJ,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAA6C,EAAE,OAAO,EAAE,OAAsB;IACtG,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE1B,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE;gBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;aACvB;YACD,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;SAChD,CAAC,CAAA;IAEJ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IAExB,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QACjD,IAAI,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,SAAS,EAAE,CAAA;YAChB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,MAAM,CAAA;gBAC/B;uCACuB;gBACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAA;YAC5B,CAAC;YACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,EAAE,CAAC;gBACrC,IAAA,oCAAmB,EAAC;oBAClB,IAAI;oBACJ,OAAO;iBACR,CAAC,CAAA;gBACF,MAAM,IAAI,yBAAS,CAAC;oBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;oBAC5C,MAAM,EAAE;wBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;qBAClB;iBACF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,oBAAoB;gBACrD,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;YAClB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,OAAO,EAAE,YAAiC;IACtF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAA;IACvC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;SAC9C,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,MAAM,EAAE,CAAC;QACrC,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,IAAI,IAAA,sCAAe,EAAC,IAAI,EAAE,GAAG,EAAE,IAAA,sCAAmB,GAAE,CAAC,EAAE,CAAC;YACtD,IAAA,oCAAmB,EAAC;gBAClB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YACF,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;gBAC5C,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;aACF,CAAC,CAAA;QACJ,CAAC;QAED;;;;;;WAMG;QACH,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAClC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QAEpB,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,MAAM,YAAY,EAAE,CAAA;IAEpB,IAAI,IAAI,CAAC,MAAM,IAAI,oBAAU,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,yBAAS,CAAC;YAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;YACnD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAA;AACH,CAAC","sourcesContent":["import { ILike } from 'typeorm'\nimport { getRepository } from '@things-factory/shell'\n\nimport { sendUnlockUserEmail } from '../controllers/unlock-user.js'\nimport { AuthError } from '../errors/auth-error.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { isAccountLocked } from '../utils/account-lock-rule.js'\nimport { lockDurationMinutes } from '../utils/lock-duration.js'\nimport { recordAuditAction } from '../service/audit/audit-recorder.js'\nimport { errorCodeOf } from '../service/audit/audit-target.js'\n\nexport type SigninMethod = 'password' | 'passkey'\n\nexport type SigninAttempt = { userId?: string }\n\n/**\n * A sign-in, and its audit (ADR-0141 §3.3): a success or a failure with its code. A failure is\n * written on its own and stays when the request fails (§4-3). An account that does not exist leaves\n * no actor - the name typed in is not a person.\n */\nexport async function signin(attrs: { username: string; password: string }, context?) {\n  return await auditedSignin('password', context, attempt => signinOnce(attrs, context, attempt))\n}\n\n/**\n * The audit around one way of signing in. `run` puts the person in `attempt` as soon as it knows\n * who it is, so a failure after that names them. `detail.method` tells a password from a passkey\n * (ADR-0156 decision 4).\n */\nexport async function auditedSignin<T extends { user: User }>(\n  method: SigninMethod,\n  context,\n  run: (attempt: SigninAttempt) => Promise<T>\n): Promise<T> {\n  const attempt: SigninAttempt = {}\n  const domainId = context?.state?.domain?.id ?? null\n  const detail = { method }\n\n  /*\n   * Not awaited: the answer does not wait on its record, and a write that fails is counted, never\n   * thrown (`recordAuditAction` without a transaction).\n   */\n  try {\n    const answer = await run(attempt)\n    void recordAuditAction({ kind: 'auth.signin', outcome: 'ok', detail }, { actorId: answer.user.id, domainId })\n    return answer\n  } catch (error) {\n    void recordAuditAction({ kind: 'auth.signin', outcome: 'error', code: errorCodeOf(error), detail }, { actorId: attempt.userId ?? null, domainId })\n    throw error\n  }\n}\n\nasync function signinOnce(attrs: { username: string; password: string }, context, attempt: SigninAttempt) {\n  const { username } = attrs\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n    user = await repository.findOne({\n      where: {\n        email: ILike(username)\n      },\n      relations: ['domains']\n    })\n  }\n\n  if (!user)\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n    })\n\n  attempt.userId = user.id\n\n  return await admitSignin(user, context, async () => {\n    if (!User.verify(user.password, attrs.password, user.salt)) {\n      user.failCount++\n      if (user.failCount >= 5) {\n        user.status = UserStatus.LOCKED\n        /* 언제 풀리나를 계산할 수 있게 시각을 남긴다. 이 칸이 비면 판정 규칙이\n           잠금을 유지하는 쪽으로 기운다. */\n        user.lockedAt = new Date()\n      }\n      await repository.save(user)\n      if (user.status == UserStatus.LOCKED) {\n        sendUnlockUserEmail({\n          user,\n          context\n        })\n        throw new AuthError({\n          errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n          detail: {\n            username: user.username,\n            email: user.email\n          }\n        })\n      }\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.PASSWORD_NOT_MATCHED,\n        detail: {\n          username: user.username,\n          email: user.email,\n          failCount: user.failCount\n        }\n      })\n    } else {\n      user.failCount = 0\n      await repository.save(user)\n    }\n  })\n}\n\n/**\n * The account gate every way of signing in goes through (ADR-0156 decision 4): deleted, locked -\n * and a lock that has run out lifts here - then the secret, then inactive. Only `verifySecret`\n * differs between a password and a passkey; a passkey arrives already verified and passes nothing.\n *\n * `user` must carry `domains`.\n */\nexport async function admitSignin(user: User, context, verifySecret: () => Promise<void>) {\n  const { domain } = context?.state || {}\n  const repository = getRepository(User)\n\n  if (user.status == UserStatus.DELETED) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_DELETED\n    })\n  }\n\n  if (user.status == UserStatus.LOCKED) {\n    /* 시계는 한 번만 읽는다 — 두 번 읽으면 경계에 걸린 잠금이 두 판정 사이에서 갈린다. */\n    const now = new Date()\n\n    if (isAccountLocked(user, now, lockDurationMinutes())) {\n      sendUnlockUserEmail({\n        user,\n        context\n      })\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n        detail: {\n          username: user.username,\n          email: user.email\n        }\n      })\n    }\n\n    /*\n     * 시간이 지나 스스로 풀렸다 — 그 자리에서 행을 되돌리고 계속 진행한다. 주기 작업으로\n     * 풀지 않는 이유는 `account-lock-rule.ts` 에 있다(계정이 10만이면 그것이 따로 일이 된다).\n     *\n     * `failCount` 도 함께 0 으로 둔다. 그래서 **잠금이 곧 실패 셈의 창**이 된다 — 이 계정이\n     * 다시 잠기려면 지금부터 다섯 번을 틀려야 한다.\n     */\n    user.status = UserStatus.ACTIVATED\n    user.failCount = 0\n    user.lockedAt = null\n\n    await repository.save(user)\n  }\n\n  await verifySecret()\n\n  if (user.status == UserStatus.INACTIVE) {\n    throw new AuthError({\n      errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n      detail: {\n        username: user.username,\n        email: user.email\n      }\n    })\n  }\n\n  return {\n    user,\n    token: await user.sign({ subdomain: domain?.subdomain }),\n    domains: user.domains || []\n  }\n}\n"]}

package/dist-server/middlewares/index.d.ts

@@ -3,5 +3,4 @@ export declare function initMiddlewares(app: Koa): void;
 export * from './jwt-authenticate-middleware.js';
 export * from './domain-authenticate-middleware.js';
 export * from './signin-middleware.js';
-export * from './webauthn-middleware.js';
 export * from './authenticate-401-middleware.js';

package/dist-server/middlewares/index.js

@@ -57,6 +57,5 @@ process.on('bootstrap-module-subscription', (app, subscriptionMiddleware) => {
 tslib_1.__exportStar(require("./jwt-authenticate-middleware.js"), exports);
 tslib_1.__exportStar(require("./domain-authenticate-middleware.js"), exports);
 tslib_1.__exportStar(require("./signin-middleware.js"), exports);
-tslib_1.__exportStar(require("./webauthn-middleware.js"), exports);
 tslib_1.__exportStar(require("./authenticate-401-middleware.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist-server/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/middlewares/index.ts"],"names":[],"mappings":";;AAmBA,0CAgDC;;AAlED,sEAAiC;AACjC,wEAAmC;AAEnC,6CAA4C;AAC5C,0DAA+C;AAE/C,qFAA4E;AAC5E,2FAAkF;AAClF,6FAAoF;AACpF,qFAA4E;AAC5E,+EAAsE;AACtE,2EAAkE;AAElE,qDAA8C;AAC9C,wDAAiD;AAEjD,MAAM,uBAAuB,GAAG,YAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;AAE5E,SAAgB,eAAe,CAAC,GAAQ;IACtC,4GAA4G;IAC5G,GAAG,CAAC,GAAG,CAAC,gDAAoB,CAAC,CAAA;IAE7B,IAAI,uBAAuB,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,oDAAsB,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IAED,yDAAyD;IACzD,GAAG,CAAC,IAAI,GAAG,CAAC,sBAAM,CAAC,CAAA;IACnB,GAAG,CAAC,GAAG,CACL,IAAA,qBAAO,EACL;QACE,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,oBAAO;QACf,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;KACb,EACD,GAAG,CACJ,CACF,CAAA;IAED,sBAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sBAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IAE9B,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IAE3B,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,0DAAyB,CAAC,CAAA;IAElC;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,kEAA6B,CAAC,CAAA;AACxC,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,+BAAsC,EAAE,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE;IACjF,sBAAsB,CAAC,IAAI,CAAC,0DAAyB,EAAE,gEAA4B,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,2EAAgD;AAChD,8EAAmD;AACnD,iEAAsC;AACtC,mEAAwC;AACxC,2EAAgD","sourcesContent":["import Koa from 'koa'\nimport session from 'koa-session'\nimport passport from 'koa-passport'\n\nimport { config } from '@things-factory/env'\nimport { SECRET } from '../utils/get-secret.js'\n\nimport { authenticate401Middleware } from './authenticate-401-middleware.js'\nimport { domainAuthenticateMiddleware } from './domain-authenticate-middleware.js'\nimport { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware.js'\nimport { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware.js'\nimport { bypassSigninMiddleware } from './bypass-signin-middleware.js'\nimport { auditScopeMiddleware } from './audit-scope-middleware.js'\n\nimport { User } from '../service/user/user.js'\nimport { MAX_AGE } from '../constants/max-age.js'\n\nconst bypassUserSigninProcess = config.get('bypassUserSigninProcess', false)\n\nexport function initMiddlewares(app: Koa) {\n  /* Before everything else here, so sign-in and the GraphQL authentication run inside the request's audit. */\n  app.use(auditScopeMiddleware)\n\n  if (bypassUserSigninProcess) {\n    app.use(bypassSigninMiddleware)\n    return\n  }\n\n  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */\n  app.keys = [SECRET]\n  app.use(\n    session(\n      {\n        key: 'tfsession',\n        maxAge: MAX_AGE,\n        overwrite: true,\n        httpOnly: true,\n        signed: true,\n        rolling: false,\n        renew: false\n      },\n      app\n    )\n  )\n\n  passport.serializeUser((profile, done) => {\n    done(null, profile)\n  })\n\n  passport.deserializeUser(async (profile, done) => {\n    done(null, await User.checkAuth(profile))\n  })\n\n  /* passport initialize */\n  app.use(passport.initialize())\n\n  /* passport use session - for oauth transaction */\n  app.use(passport.session())\n\n  /* authentication error handling */\n  app.use(authenticate401Middleware)\n\n  /*\n   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.\n   * graphql app을 router에 적용하지 못하기 때문임.\n   */\n  app.use(graphqlAuthenticateMiddleware)\n}\n\nprocess.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {\n  subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)\n})\n\nexport * from './jwt-authenticate-middleware.js'\nexport * from './domain-authenticate-middleware.js'\nexport * from './signin-middleware.js'\nexport * from './webauthn-middleware.js'\nexport * from './authenticate-401-middleware.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/middlewares/index.ts"],"names":[],"mappings":";;AAmBA,0CAgDC;;AAlED,sEAAiC;AACjC,wEAAmC;AAEnC,6CAA4C;AAC5C,0DAA+C;AAE/C,qFAA4E;AAC5E,2FAAkF;AAClF,6FAAoF;AACpF,qFAA4E;AAC5E,+EAAsE;AACtE,2EAAkE;AAElE,qDAA8C;AAC9C,wDAAiD;AAEjD,MAAM,uBAAuB,GAAG,YAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;AAE5E,SAAgB,eAAe,CAAC,GAAQ;IACtC,4GAA4G;IAC5G,GAAG,CAAC,GAAG,CAAC,gDAAoB,CAAC,CAAA;IAE7B,IAAI,uBAAuB,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,oDAAsB,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IAED,yDAAyD;IACzD,GAAG,CAAC,IAAI,GAAG,CAAC,sBAAM,CAAC,CAAA;IACnB,GAAG,CAAC,GAAG,CACL,IAAA,qBAAO,EACL;QACE,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,oBAAO;QACf,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;KACb,EACD,GAAG,CACJ,CACF,CAAA;IAED,sBAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sBAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IAE9B,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IAE3B,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,0DAAyB,CAAC,CAAA;IAElC;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,kEAA6B,CAAC,CAAA;AACxC,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,+BAAsC,EAAE,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE;IACjF,sBAAsB,CAAC,IAAI,CAAC,0DAAyB,EAAE,gEAA4B,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,2EAAgD;AAChD,8EAAmD;AACnD,iEAAsC;AACtC,2EAAgD","sourcesContent":["import Koa from 'koa'\nimport session from 'koa-session'\nimport passport from 'koa-passport'\n\nimport { config } from '@things-factory/env'\nimport { SECRET } from '../utils/get-secret.js'\n\nimport { authenticate401Middleware } from './authenticate-401-middleware.js'\nimport { domainAuthenticateMiddleware } from './domain-authenticate-middleware.js'\nimport { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware.js'\nimport { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware.js'\nimport { bypassSigninMiddleware } from './bypass-signin-middleware.js'\nimport { auditScopeMiddleware } from './audit-scope-middleware.js'\n\nimport { User } from '../service/user/user.js'\nimport { MAX_AGE } from '../constants/max-age.js'\n\nconst bypassUserSigninProcess = config.get('bypassUserSigninProcess', false)\n\nexport function initMiddlewares(app: Koa) {\n  /* Before everything else here, so sign-in and the GraphQL authentication run inside the request's audit. */\n  app.use(auditScopeMiddleware)\n\n  if (bypassUserSigninProcess) {\n    app.use(bypassSigninMiddleware)\n    return\n  }\n\n  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */\n  app.keys = [SECRET]\n  app.use(\n    session(\n      {\n        key: 'tfsession',\n        maxAge: MAX_AGE,\n        overwrite: true,\n        httpOnly: true,\n        signed: true,\n        rolling: false,\n        renew: false\n      },\n      app\n    )\n  )\n\n  passport.serializeUser((profile, done) => {\n    done(null, profile)\n  })\n\n  passport.deserializeUser(async (profile, done) => {\n    done(null, await User.checkAuth(profile))\n  })\n\n  /* passport initialize */\n  app.use(passport.initialize())\n\n  /* passport use session - for oauth transaction */\n  app.use(passport.session())\n\n  /* authentication error handling */\n  app.use(authenticate401Middleware)\n\n  /*\n   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.\n   * graphql app을 router에 적용하지 못하기 때문임.\n   */\n  app.use(graphqlAuthenticateMiddleware)\n}\n\nprocess.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {\n  subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)\n})\n\nexport * from './jwt-authenticate-middleware.js'\nexport * from './domain-authenticate-middleware.js'\nexport * from './signin-middleware.js'\nexport * from './authenticate-401-middleware.js'\n"]}

package/dist-server/router/auth-signin-router.js

@@ -48,6 +48,7 @@ exports.authSigninRouter.post('/auth/signin', async (ctx, next) => {
     }
     var redirectTo = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`;
     (0, access_token_cookie_js_1.setAccessTokenCookie)(context, token);
-    context.redirect(redirectTo);
+    /* A person who typed a password is offered a passkey on the way in (ADR-0156 decision 5). */
+    context.redirect(`/auth/passkey-offer?redirect_to=${encodeURIComponent(redirectTo)}`);
 });
 //# sourceMappingURL=auth-signin-router.js.map

package/dist-server/router/auth-signin-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-signin-router.js","sourceRoot":"","sources":["../../server/router/auth-signin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,sDAA0D;AAC1D,oDAA6C;AAC7C,4EAAsE;AAEtE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAS,CAAC,CAAA;AAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACtC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC;KAC1C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;IACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAES,QAAA,gBAAgB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE5C,wBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC3D,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE/C,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,QAAQ;YAClB,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,wBAAgB,CAAC,IAAI,CACnB,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAClB,6FAA6F;IAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,EACD,2BAAgB,EAChB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACvC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAEzC,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CACrG,OAAO,CAAC,UAAU,IAAI,GAAG,CAC1B,EAAE,CAAA;IAEH,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { signinMiddleware } from '../middlewares/index.js'\nimport { accepts } from '../utils/accepts.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\nconst SSOConfig = config.get('sso', {} as any)\nconst SSOLinks = Object.values(SSOConfig)\n  .filter(({ link, title }) => link && title)\n  .map(({ link, title }) => {\n    return { link, title }\n  })\n\nexport const authSigninRouter = new Router()\n\nauthSigninRouter.get('/auth/signin', async (context, next) => {\n  const { redirect_to, username } = context.query\n\n  await context.render('auth-page', {\n    pageElement: 'auth-signin',\n    elementScript: '/auth/signin.js',\n    data: {\n      username,\n      redirectTo: redirect_to,\n      ssoLinks: SSOLinks,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthSigninRouter.post(\n  '/auth/signin',\n  async (ctx, next) => {\n    /* For backward compatibility, cover the case of logging in with email instead of username */\n    if (!ctx.request.body.username && ctx.request.body.email) {\n      ctx.request.body.username = ctx.request.body.email\n    }\n    await next()\n  },\n  signinMiddleware,\n  async (context, next) => {\n    const { request, t } = context\n    const { token, domain } = context.state\n    const { body: reqBody, header } = request\n\n    if (!accepts(header.accept, ['text/html', '*/*'])) {\n      context.body = token\n      return\n    }\n\n    var redirectTo = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(\n      reqBody.redirectTo || '/'\n    )}`\n\n    setAccessTokenCookie(context, token)\n\n    context.redirect(redirectTo)\n  }\n)\n"]}
+{"version":3,"file":"auth-signin-router.js","sourceRoot":"","sources":["../../server/router/auth-signin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,sDAA0D;AAC1D,oDAA6C;AAC7C,4EAAsE;AAEtE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAS,CAAC,CAAA;AAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACtC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC;KAC1C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;IACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAES,QAAA,gBAAgB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE5C,wBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC3D,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE/C,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,QAAQ;YAClB,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,wBAAgB,CAAC,IAAI,CACnB,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAClB,6FAA6F;IAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,EACD,2BAAgB,EAChB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACvC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAEzC,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CACrG,OAAO,CAAC,UAAU,IAAI,GAAG,CAC1B,EAAE,CAAA;IAEH,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;AACvF,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { signinMiddleware } from '../middlewares/index.js'\nimport { accepts } from '../utils/accepts.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\nconst SSOConfig = config.get('sso', {} as any)\nconst SSOLinks = Object.values(SSOConfig)\n  .filter(({ link, title }) => link && title)\n  .map(({ link, title }) => {\n    return { link, title }\n  })\n\nexport const authSigninRouter = new Router()\n\nauthSigninRouter.get('/auth/signin', async (context, next) => {\n  const { redirect_to, username } = context.query\n\n  await context.render('auth-page', {\n    pageElement: 'auth-signin',\n    elementScript: '/auth/signin.js',\n    data: {\n      username,\n      redirectTo: redirect_to,\n      ssoLinks: SSOLinks,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthSigninRouter.post(\n  '/auth/signin',\n  async (ctx, next) => {\n    /* For backward compatibility, cover the case of logging in with email instead of username */\n    if (!ctx.request.body.username && ctx.request.body.email) {\n      ctx.request.body.username = ctx.request.body.email\n    }\n    await next()\n  },\n  signinMiddleware,\n  async (context, next) => {\n    const { request, t } = context\n    const { token, domain } = context.state\n    const { body: reqBody, header } = request\n\n    if (!accepts(header.accept, ['text/html', '*/*'])) {\n      context.body = token\n      return\n    }\n\n    var redirectTo = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(\n      reqBody.redirectTo || '/'\n    )}`\n\n    setAccessTokenCookie(context, token)\n\n    /* A person who typed a password is offered a passkey on the way in (ADR-0156 decision 5). */\n    context.redirect(`/auth/passkey-offer?redirect_to=${encodeURIComponent(redirectTo)}`)\n  }\n)\n"]}