@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/identity.otp/source/authenticate.ts

@@ -0,0 +1,70 @@
+import type { Context } from './lib/index.js'
+
+export async function effect(input: Input, context: Context): Promise<Output | Error> {
+  const { authority, credentials } = input
+  const [username, code] = Buffer.from(credentials, 'base64').toString().split(':')
+
+  if (code === undefined) return ERR_INVALID_CREDENTIALS
+
+  const attempts = `${authority}:${username}:attempts`
+  const attempt = await context.stash.incr(attempts)
+
+  if (attempt === 1) await context.stash.expire(attempts, context.configuration.lifetime)
+
+  if (attempt > context.configuration.attempts) {
+    context.logs.debug('OTP attempts exceeded', { authority, username, attempt })
+
+    return ERR_TOO_MANY_ATTEMPTS
+  }
+
+  const key = `${authority}:${username}:${code}`
+  const n = await context.stash.del(key)
+
+  if (n === 0) {
+    context.logs.debug('OTP code not found', { authority, username, attempt })
+
+    return ERR_EXPIRED
+  }
+
+  await context.stash.del(attempts)
+
+  const entry = await context.local.ensure({
+    entity: {
+      authority,
+      username
+    }
+  })
+
+  if (entry === null) return ERR_NOT_FOUND
+
+  const id = entry.identity ?? entry.id // identity inception
+
+  return { identity: { id } }
+}
+
+const ERR_INVALID_CREDENTIALS = new (class InvalidCredentialsError extends Error {
+  public readonly code = 'INVALID_CREDENTIALS'
+})()
+
+const ERR_EXPIRED = new (class ExpiredError extends Error {
+  public readonly code = 'EXPIRED'
+})()
+
+const ERR_TOO_MANY_ATTEMPTS = new (class TooManyAttemptsError extends Error {
+  public readonly code = 'TOO_MANY_ATTEMPTS'
+})()
+
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+interface Input {
+  authority: string
+  credentials: string
+}
+
+interface Output {
+  identity: {
+    id: string
+  }
+}

package/components/identity.otp/source/issue.ts

@@ -0,0 +1,35 @@
+import { randomInt } from 'node:crypto'
+import type { Context } from './lib/index.js'
+
+export async function effect(input: Input, context: Context): Promise<Output> {
+  const { authority, username, identity } = input
+  const code = randomInt(100000, 1000000).toString()
+  const key = `${authority}:${username}:${code}`
+  const lifetime = input.lifetime ?? context.configuration.lifetime
+
+  if (identity !== undefined)
+    await context.local.ensure({
+      entity: {
+        authority,
+        username,
+        identity
+      }
+    })
+
+  context.logs.debug('Issue OTP', { authority, username, identity, lifetime })
+
+  await context.stash.set(key, 1, 'EX', lifetime)
+
+  return { code }
+}
+
+interface Input {
+  authority: string
+  username: string
+  identity?: string
+  lifetime?: number
+}
+
+interface Output {
+  code: string
+}

package/components/identity.otp/source/lib/Context.ts

@@ -0,0 +1,17 @@
+import type { Call, Observation } from '@toa.io/core/types'
+import type { Stash } from '@toa.io/extensions.stash'
+import type { Logs } from '@toa.io/extensions.telemetry'
+import type { Entity } from './Entity.js'
+
+export interface Context {
+  stash: Stash
+  logs: Logs
+  local: {
+    observe: Observation<Entity>
+    ensure: Call<Entity>
+  }
+  configuration: {
+    lifetime: number
+    attempts: number
+  }
+}

package/components/identity.otp/source/lib/Entity.ts

@@ -0,0 +1,6 @@
+export interface Entity {
+  id: string
+  authority: string
+  username: string
+  identity?: string
+}

package/components/identity.otp/source/lib/index.ts

@@ -0,0 +1 @@
+export type { Context } from './Context.js'

package/components/identity.otp/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.otp/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.otp/types/toa.d.ts

@@ -0,0 +1,57 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Stash } from '@toa.io/extensions.stash'
+import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  authority: string
+  username: string
+  identity?: string
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type IssueInput = {
+  authority: string
+  username: string
+  identity?: string
+  /** OTP expiration time in seconds */
+  lifetime?: number
+}
+
+export type AuthenticateInput = {
+  authority: string
+  credentials: string
+}
+
+export type AuthenticateOutput = {
+  identity?: {
+    id?: string
+  }
+}
+
+export interface Component {
+  issue: (request: { input: IssueInput, task?: boolean }, options?: Options) => Promise<unknown>
+  authenticate: (request: { input: AuthenticateInput, task?: boolean }, options?: Options) => Promise<AuthenticateOutput | RemoteError<"INVALID_CREDENTIALS" | "EXPIRED" | "TOO_MANY_ATTEMPTS" | "NOT_FOUND">>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}
+
+export interface Configuration {
+  /** OTP expiration time in seconds */
+  lifetime?: number
+  /** Failed authentication attempts allowed per username within `lifetime` */
+  attempts?: number
+}

package/components/identity.passkeys/manifest.toa.yaml

@@ -0,0 +1,302 @@
+namespace: identity
+name: passkeys
+
+entity:
+  properties:
+    authority:
+      type: string
+    identity:
+      type: string
+    kid:
+      type: string
+    aid:
+      description: AAGUID
+      type: string
+    synced:
+      description: credentialBackedUp
+      type: boolean
+    key:
+      description: Base64-encoded Uint8Array
+      type: string
+    counter:
+      type: number
+      minimum: 0
+    transports:
+      type: array
+      items:
+        type: string
+    label:
+      type: string
+      minLength: 1
+      maxLength: 64
+  required:
+    - authority
+    - identity
+    - kid
+    - aid
+    - synced
+    - key
+    - counter
+    - CREATED
+  blank:
+    counter: 0
+
+operations:
+  challenge:
+    input:
+      type: object
+      properties:
+        type:
+          type: string
+          enum:
+            - creation
+            - request
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - type
+        - authority
+  create:
+    query: false
+    errors: [FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        origin:
+          type: string
+        identity:
+          type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            id:
+              type: string
+            response:
+              type: object
+              properties:
+                attestationObject:
+                  type: string
+                clientDataJSON:
+                  type: string
+                transports:
+                  type: array
+                  items:
+                    type: string
+                publicKeyAlgorithm:
+                  type: number
+                publicKey:
+                  type: string
+                authenticatorData:
+                  type: string
+              required:
+                - authenticatorData
+                - attestationObject
+                - clientDataJSON
+                - transports
+                - publicKeyAlgorithm
+                - publicKey
+        authenticatorAttachment:
+          type: string
+          nullable: true
+        clientExtensionResults:
+          type: object
+      required:
+        - authority
+        - identity
+        - origin
+        - label
+        - id
+        - type
+        - response
+  use:
+    concurrency: retry
+    query: true
+    errors: [FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        origin:
+          type: string
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            authenticatorData:
+              type: string
+            clientDataJSON:
+              type: string
+            signature:
+              type: string
+            userHandle:
+              type: string
+        authenticatorAttachment:
+          type: string
+        clientExtensionResults:
+          type: object
+      required:
+        - origin
+        - id
+        - response
+  authenticate:
+    # `use` is what verifies the signature, and what it refuses with is answered as it is
+    errors: [MISS, FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        origin:
+          type: string
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            authenticatorData:
+              type: string
+            clientDataJSON:
+              type: string
+            signature:
+              type: string
+            userHandle:
+              type: string
+        authenticatorAttachment:
+          type: string
+        clientExtensionResults:
+          type: object
+      required:
+        - authority
+        - origin
+        - id
+        - response
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+  delete:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        id:
+          type: string
+      required:
+        - authority
+        - identity
+        - id
+
+exposition:
+  /:
+    POST:
+      auth:incept: identity
+      map:authority: authority
+      map:headers:
+        origin: origin
+      io:output: [identity]
+      endpoint: authenticate
+    /challenges:
+      auth:anonymous: true
+      POST:
+        map:authority: authority
+        io:output: &challenge
+          - identity
+          - challenge
+          - timeout
+          - userVerification
+          - authenticatorSelection
+          - pubKeyCredParams
+          - allowCredentials
+          - excludeCredentials
+        auth:incept: identity
+        endpoint: challenge
+      /:identity:
+        POST:
+          map:authority: authority
+          map:segments:
+            identity: identity
+          io:output: *challenge
+          endpoint: challenge
+    /:identity:
+      auth:id: identity
+      POST:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        map:headers:
+          origin: origin
+        io:output: [id, aid, synced, label, CREATED, UPDATED]
+        endpoint: create
+      GET:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        io:output: [id, aid, synced, label, CREATED, UPDATED]
+        endpoint: list
+      /:id:
+        DELETE:
+          map:authority: authority
+          map:segments:
+            identity: identity
+            id: id
+          io:output: false
+          endpoint: delete
+
+configuration:
+  schema:
+    type: object
+    properties:
+      algorithms:
+        type: array
+        items:
+          type: number
+      timeout:
+        type: integer
+      verification:
+        description: AuthenticatorSelectionCriteria.userVerification
+        type: string
+        enum:
+          - required
+          - preferred
+          - discouraged
+      residence:
+        description: AuthenticatorSelectionCriteria.residentKey
+        type: string
+        enum:
+          - required
+          - preferred
+          - discouraged
+  defaults:
+    algorithms:
+    - -7
+    - -257
+    timeout: 60000
+    residence: required
+
+stash: ~

package/components/identity.passkeys/migrations/0002-indexes.yaml

@@ -0,0 +1,11 @@
+- index:
+    name: index_list
+    keys:
+      authority: asc
+      identity: asc
+      CREATED: desc
+- index:
+    name: index_key
+    keys:
+      authority: asc
+      kid: asc

package/components/identity.passkeys/operations/authenticate.js

@@ -0,0 +1,32 @@
+import { quote } from '@toa.io/generic';
+export class Effect {
+    use;
+    logs;
+    mount(context) {
+        this.use = context.local.use;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { authority, ...response } = input;
+        const identity = await this.use({
+            query: {
+                criteria: `authority==${quote(authority)};kid==${quote(response.id)}`
+            },
+            input: response
+        });
+        if (identity === null) {
+            this.logs.debug('Passkey not found', {
+                authority,
+                id: response.id
+            });
+            return ERR_MISS;
+        }
+        if (identity instanceof Error)
+            return identity;
+        return { identity };
+    }
+}
+const ERR_MISS = new (class MissError extends Error {
+    code = 'MISS';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFLdkMsTUFBTSxPQUFPLE1BQU07SUFDVCxHQUFHLENBQTBCO0lBQzdCLElBQUksQ0FBa0I7SUFFdkIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUE7UUFDNUIsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLFFBQVEsRUFBRSxHQUFHLEtBQUssQ0FBQTtRQUV4QyxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDOUIsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxFQUFFO2FBQ3RFO1lBQ0QsS0FBSyxFQUFFLFFBQVE7U0FDaEIsQ0FBQyxDQUFBO1FBRUYsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdEIsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsbUJBQW1CLEVBQUU7Z0JBQ25DLFNBQVM7Z0JBQ1QsRUFBRSxFQUFFLFFBQVEsQ0FBQyxFQUFFO2FBQ2hCLENBQUMsQ0FBQTtZQUVGLE9BQU8sUUFBUSxDQUFBO1FBQ2pCLENBQUM7UUFFRCxJQUFJLFFBQVEsWUFBWSxLQUFLO1lBQUUsT0FBTyxRQUFRLENBQUE7UUFFOUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFBO0lBQ3JCLENBQUM7Q0FDRjtBQUVELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLFNBQVUsU0FBUSxLQUFLO0lBQ2pDLElBQUksR0FBRyxNQUFNLENBQUE7Q0FDOUIsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.passkeys/operations/challenge.js

@@ -0,0 +1,72 @@
+import { randomBytes } from 'node:crypto';
+import { newid, quote } from '@toa.io/generic';
+import { MAX_KEYS } from './lib/const.js';
+export class Effect {
+    timeout;
+    authenticator;
+    credParams;
+    enumerate;
+    stash;
+    logs;
+    mount(context) {
+        this.timeout = context.configuration.timeout;
+        this.credParams = context.configuration.algorithms.map((alg) => ({
+            type: 'public-key',
+            alg
+        }));
+        if (context.configuration.verification !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.userVerification = context.configuration.verification;
+        }
+        if (context.configuration.residence !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.residentKey = context.configuration.residence;
+            if (context.configuration.residence === 'required')
+                this.authenticator.requireResidentKey = true;
+        }
+        this.enumerate = context.local.enumerate;
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { type, identity, authority } = input;
+        const challenge = await this.createChallenge(authority);
+        const options = {
+            challenge,
+            timeout: this.timeout
+        };
+        if (type === 'creation')
+            options.identity = identity ?? newid();
+        const keys = identity === undefined || identity === null
+            ? []
+            : await this.enumerate({
+                query: {
+                    criteria: `identity==${quote(identity)}`,
+                    projection: ['kid', 'transports'],
+                    limit: MAX_KEYS
+                }
+            });
+        if (type === 'creation')
+            return {
+                ...options,
+                excludeCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                pubKeyCredParams: this.credParams,
+                authenticatorSelection: this.authenticator
+            };
+        else
+            return {
+                ...options,
+                allowCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                userVerification: this.authenticator?.userVerification
+            };
+    }
+    async createChallenge(authority) {
+        const challenge = randomBytes(32).toString('base64url');
+        const key = `challenge:${authority}:${challenge}`;
+        this.logs.debug('Creating challenge', { key });
+        await this.stash.set(key, 1, 'EX', (this.timeout / 1000) * EX_GAP);
+        return challenge;
+    }
+}
+const EX_GAP = 1.5;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NoYWxsZW5nZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3pDLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDOUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSXpDLE1BQU0sT0FBTyxNQUFNO0lBQ1QsT0FBTyxDQUFTO0lBQ2hCLGFBQWEsQ0FBaUM7SUFDOUMsVUFBVSxDQUFrQztJQUM1QyxTQUFTLENBQWdDO0lBQ3pDLEtBQUssQ0FBbUI7SUFDeEIsSUFBSSxDQUFrQjtJQUV2QixLQUFLLENBQUMsT0FBZ0I7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQTtRQUM1QyxJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUMvRCxJQUFJLEVBQUUsWUFBWTtZQUNsQixHQUFHO1NBQ0osQ0FBQyxDQUFDLENBQUE7UUFFSCxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3JELElBQUksQ0FBQyxhQUFhLEtBQUssRUFBRSxDQUFBO1lBQ3pCLElBQUksQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUE7UUFDMUUsQ0FBQztRQUVELElBQUksT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbEQsSUFBSSxDQUFDLGFBQWEsS0FBSyxFQUFFLENBQUE7WUFDekIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7WUFFaEUsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsS0FBSyxVQUFVO2dCQUNoRCxJQUFJLENBQUMsYUFBYSxDQUFDLGtCQUFrQixHQUFHLElBQUksQ0FBQTtRQUNoRCxDQUFDO1FBRUQsSUFBSSxDQUFDLFNBQVMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUN4QyxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUE7UUFDMUIsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBQzNDLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQTtRQUV2RCxNQUFNLE9BQU8sR0FBVztZQUN0QixTQUFTO1lBQ1QsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1NBQ3RCLENBQUE7UUFFRCxJQUFJLElBQUksS0FBSyxVQUFVO1lBQUUsT0FBTyxDQUFDLFFBQVEsR0FBRyxRQUFRLElBQUksS0FBSyxFQUFFLENBQUE7UUFFL0QsTUFBTSxJQUFJLEdBQ1IsUUFBUSxLQUFLLFNBQVMsSUFBSSxRQUFRLEtBQUssSUFBSTtZQUN6QyxDQUFDLENBQUMsRUFBRTtZQUNKLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQ25CLEtBQUssRUFBRTtvQkFDTCxRQUFRLEVBQUUsYUFBYSxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUU7b0JBQ3hDLFVBQVUsRUFBRSxDQUFDLEtBQUssRUFBRSxZQUFZLENBQUM7b0JBQ2pDLEtBQUssRUFBRSxRQUFRO2lCQUNoQjthQUNGLENBQUMsQ0FBQTtRQUVSLElBQUksSUFBSSxLQUFLLFVBQVU7WUFDckIsT0FBTztnQkFDTCxHQUFHLE9BQU87Z0JBQ1Ysa0JBQWtCLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDakMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLGFBQWE7YUFDakIsQ0FBQTs7WUFFM0IsT0FBTztnQkFDTCxHQUFHLE9BQU87Z0JBQ1YsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUM5RSxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLGdCQUFnQjthQUM5QixDQUFBO0lBQzlCLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQWlCO1FBQzdDLE1BQU0sU0FBUyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDdkQsTUFBTSxHQUFHLEdBQUcsYUFBYSxTQUFTLElBQUksU0FBUyxFQUFFLENBQUE7UUFFakQsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFBO1FBRTlDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFBO1FBRWxFLE9BQU8sU0FBUyxDQUFBO0lBQ2xCLENBQUM7Q0FDRjtBQUVELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.passkeys/operations/create.js

@@ -0,0 +1,57 @@
+import { verifyRegistrationResponse } from '@simplewebauthn/server';
+// https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/registration/verifyRegistrationResponse.ts#L51
+export class Transition {
+    algorithms;
+    stash;
+    logs;
+    verification;
+    presence;
+    mount(context) {
+        this.algorithms = context.configuration.algorithms;
+        this.verification = context.configuration.verification === 'required';
+        this.presence = context.configuration.residence === 'required';
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input, object) {
+        const { authority, identity, label, ...response } = input;
+        // rawId is not sent from the client
+        response.rawId = response.id;
+        const verified = await verifyRegistrationResponse({
+            response,
+            expectedOrigin: input.origin,
+            expectedChallenge: async (challenge) => this.verifyChallenge(authority, challenge),
+            supportedAlgorithmIDs: this.algorithms,
+            requireUserVerification: this.verification,
+            requireUserPresence: this.presence
+        }).catch((e) => {
+            this.logs.info('Failed to verify registration response', { message: e.message });
+            return ERR_FAILED;
+        });
+        if (verified instanceof Error)
+            return verified;
+        if (!verified.verified || verified.registrationInfo?.credential === undefined)
+            return ERR_INVALID;
+        const reg = verified.registrationInfo;
+        object.authority = authority;
+        object.identity = identity;
+        object.kid = reg.credential.id;
+        object.aid = reg.aaguid;
+        object.synced = reg.credentialBackedUp;
+        object.key = Buffer.from(reg.credential.publicKey).toString('base64url');
+        object.transports = reg.credential.transports;
+        object.label = label;
+        return object;
+    }
+    async verifyChallenge(authority, challenge) {
+        const n = await this.stash.del(`challenge:${authority}:${challenge}`);
+        return n === 1;
+    }
+}
+const ERR_FAILED = new (class FailedError extends Error {
+    code = 'FAILED';
+})();
+const ERR_INVALID = new (class InvalidError extends Error {
+    code = 'INVALID';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NyZWF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsMEJBQTBCLEVBRTNCLE1BQU0sd0JBQXdCLENBQUE7QUFJL0IsOEhBQThIO0FBRTlILE1BQU0sT0FBTyxVQUFVO0lBQ2IsVUFBVSxDQUFXO0lBQ3JCLEtBQUssQ0FBbUI7SUFDeEIsSUFBSSxDQUFrQjtJQUN0QixZQUFZLENBQVU7SUFDdEIsUUFBUSxDQUFVO0lBRW5CLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFBO1FBQ2xELElBQUksQ0FBQyxZQUFZLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFBO1FBQ3JFLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFBO1FBQzlELElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQTtRQUMxQixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUE7SUFDMUIsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBWSxFQUFFLE1BQWU7UUFDaEQsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsUUFBUSxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRXpELG9DQUFvQztRQUNwQyxRQUFRLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQyxFQUFFLENBQUE7UUFFNUIsTUFBTSxRQUFRLEdBQUcsTUFBTSwwQkFBMEIsQ0FBQztZQUNoRCxRQUFRO1lBQ1IsY0FBYyxFQUFFLEtBQUssQ0FBQyxNQUFNO1lBQzVCLGlCQUFpQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQztZQUNsRixxQkFBcUIsRUFBRSxJQUFJLENBQUMsVUFBVTtZQUN0Qyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsWUFBWTtZQUMxQyxtQkFBbUIsRUFBRSxJQUFJLENBQUMsUUFBUTtTQUNuQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDYixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyx3Q0FBd0MsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUVoRixPQUFPLFVBQW1CLENBQUE7UUFDNUIsQ0FBQyxDQUFDLENBQUE7UUFFRixJQUFJLFFBQVEsWUFBWSxLQUFLO1lBQUUsT0FBTyxRQUFRLENBQUE7UUFFOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsS0FBSyxTQUFTO1lBQzNFLE9BQU8sV0FBVyxDQUFBO1FBRXBCLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQTtRQUVyQyxNQUFNLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQTtRQUM1QixNQUFNLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQTtRQUMxQixNQUFNLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFBO1FBQzlCLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQTtRQUN2QixNQUFNLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQTtRQUN0QyxNQUFNLENBQUMsR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDeEUsTUFBTSxDQUFDLFVBQVUsR0FBRyxHQUFHLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQTtRQUM3QyxNQUFNLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQTtRQUVwQixPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQWlCLEVBQUUsU0FBaUI7UUFDaEUsTUFBTSxDQUFDLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxhQUFhLFNBQVMsSUFBSSxTQUFTLEVBQUUsQ0FBQyxDQUFBO1FBRXJFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNoQixDQUFDO0NBQ0Y7QUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0NBQ2hDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLE1BQU0sWUFBYSxTQUFRLEtBQUs7SUFDdkMsSUFBSSxHQUFHLFNBQVMsQ0FBQTtDQUNqQyxDQUFDLEVBQUUsQ0FBQSJ9