@things-factory/auth-base 8.0.0-alpha.18 → 8.0.0-alpha.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "8.0.0-alpha.18",
+  "version": "8.0.0-alpha.19",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -32,9 +32,9 @@
   "dependencies": {
     "@simplewebauthn/browser": "^10.0.0",
     "@simplewebauthn/server": "^10.0.0",
-    "@things-factory/email-base": "^8.0.0-alpha.18",
+    "@things-factory/email-base": "^8.0.0-alpha.19",
     "@things-factory/env": "^8.0.0-alpha.8",
-    "@things-factory/shell": "^8.0.0-alpha.18",
+    "@things-factory/shell": "^8.0.0-alpha.19",
     "@things-factory/utils": "^8.0.0-alpha.14",
     "@types/webappsec-credential-management": "^0.6.8",
     "jsonwebtoken": "^9.0.0",
@@ -46,5 +46,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "983da8f678924a0545762f012a7408faafd71226"
+  "gitHead": "9519b20f754d4e3cf0d21cf65660af7a4f50c4e0"
 }

package/server/middlewares/webauthn-middleware.ts

@@ -3,7 +3,6 @@ import { Strategy as CustomStrategy } from 'passport-custom'
 
 import { getRepository } from '@things-factory/shell'
 
-import { User } from '../service/user/user'
 import { AuthError } from '../errors/auth-error'
 
 import { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'
@@ -57,23 +56,23 @@ passport.use(
       const { body, session, origin, hostname } = context as any
 
       const challenge = session.challenge
-  
+
       const assertionResponse = body as {
         id: string
         response: AuthenticatorAssertionResponse
       }
-  
+
       const credential = await getRepository(WebAuthCredential).findOne({
         where: {
           credentialId: assertionResponse.id
         },
         relations: ['user']
       })
-  
+
       if (!credential) {
         return done(null, false)
       }
-  
+
       const verification = await verifyAuthenticationResponse({
         response: body,
         expectedChallenge: challenge,
@@ -86,18 +85,18 @@ passport.use(
           counter: credential.counter
         }
       })
-  
+
       if (verification.verified) {
         const { authenticationInfo } = verification
         credential.counter = authenticationInfo.newCounter
         await getRepository(WebAuthCredential).save(credential)
-  
+
         const user = credential.user
         return done(null, user)
       } else {
         return done(verification, false)
       }
-    } catch(error) {
+    } catch (error) {
       return done(error, false)
     }
   })

package/server/router/webauthn-router.ts

@@ -5,17 +5,75 @@ import { appPackage } from '@things-factory/env'
 import { generateRegistrationOptions, generateAuthenticationOptions } from '@simplewebauthn/server'
 
 import { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'
-import {
-  PublicKeyCredentialCreationOptionsJSON,
-} from '@simplewebauthn/server/script/deps'
+import { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server/script/deps'
 import { setAccessTokenCookie } from '../utils/access-token-cookie'
-import { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware';
+import { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware'
 
 export const webAuthnGlobalPublicRouter = new Router()
 export const webAuthnGlobalPrivateRouter = new Router()
 
 const { name: rpName } = appPackage as any
 
+// Generate authentication challenge for the currently logged-in user
+webAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async (context, next) => {
+  const { user } = context.state
+  const rpID = context.hostname
+
+  if (!user) {
+    context.status = 401
+    context.body = { error: 'User not authenticated' }
+    return
+  }
+
+  const webAuthCredentials = await getRepository(WebAuthCredential).find({
+    where: { user: { id: user.id } }
+  })
+
+  if (webAuthCredentials.length === 0) {
+    context.status = 400
+    context.body = { error: 'No biometric credentials registered for this user' }
+    return
+  }
+
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: 'preferred',
+    allowCredentials: webAuthCredentials.map(credential => ({
+      id: credential.credentialId,
+      type: 'public-key'
+    }))
+  })
+
+  context.session.challenge = options.challenge
+  context.body = options
+})
+
+// Verify biometric authentication
+webAuthnGlobalPrivateRouter.post(
+  '/auth/verify-webauthn',
+  /* reuse webauthn-login as webauthn-verify strategy */
+  createWebAuthnMiddleware('webauthn-login'),
+  async (context, next) => {
+    const { user } = context.state
+    const { request } = context
+    const { body: reqBody } = request
+
+    if (!user) {
+      context.status = 401
+      context.body = { verified: false, message: 'User not authenticated' }
+      return
+    }
+
+    context.body = {
+      verified: true,
+      message: 'Biometric authentication successful'
+    }
+
+    await next()
+  }
+)
+
+// Generate registration challenge for the currently logged-in user
 webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {
   const { user } = context.state
   const rpID = context.hostname
@@ -53,8 +111,10 @@ webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (cont
   context.body = options
 })
 
-webAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'));
+// Verify registration
+webAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'))
 
+// Generate sign-in challenge
 webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {
   const rpID = context.hostname
 
@@ -67,10 +127,12 @@ webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context
   context.body = options
 })
 
+// Sign in with biometric authentication
 webAuthnGlobalPublicRouter.post(
-  '/auth/signin-webauthn', createWebAuthnMiddleware('webauthn-login'),
+  '/auth/signin-webauthn',
+  createWebAuthnMiddleware('webauthn-login'),
   async (context, next) => {
-    const { domain, user } = context. state
+    const { domain, user } = context.state
     const { request } = context
     const { body: reqBody } = request
 
@@ -79,9 +141,9 @@ webAuthnGlobalPublicRouter.post(
 
     var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`
 
-    /* 2단계 인터렉션 때문에 브라우저에서 fetch(...)로 진행될 것이므로, redirect(3xx) 응답으로 처리할 수 없다. 따라서, 데이타로 redirectURL를 응답한다. */
+    /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */
     context.body = { redirectURL, verified: true }
 
-    await next();
+    await next()
   }
 )