@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.passkeys/manifest.toa.yaml

@@ -0,0 +1,302 @@
+namespace: identity
+name: passkeys
+
+entity:
+  properties:
+    authority:
+      type: string
+    identity:
+      type: string
+    kid:
+      type: string
+    aid:
+      description: AAGUID
+      type: string
+    synced:
+      description: credentialBackedUp
+      type: boolean
+    key:
+      description: Base64-encoded Uint8Array
+      type: string
+    counter:
+      type: number
+      minimum: 0
+    transports:
+      type: array
+      items:
+        type: string
+    label:
+      type: string
+      minLength: 1
+      maxLength: 64
+  required:
+    - authority
+    - identity
+    - kid
+    - aid
+    - synced
+    - key
+    - counter
+    - CREATED
+  blank:
+    counter: 0
+
+operations:
+  challenge:
+    input:
+      type: object
+      properties:
+        type:
+          type: string
+          enum:
+            - creation
+            - request
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - type
+        - authority
+  create:
+    query: false
+    errors: [FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        origin:
+          type: string
+        identity:
+          type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            id:
+              type: string
+            response:
+              type: object
+              properties:
+                attestationObject:
+                  type: string
+                clientDataJSON:
+                  type: string
+                transports:
+                  type: array
+                  items:
+                    type: string
+                publicKeyAlgorithm:
+                  type: number
+                publicKey:
+                  type: string
+                authenticatorData:
+                  type: string
+              required:
+                - authenticatorData
+                - attestationObject
+                - clientDataJSON
+                - transports
+                - publicKeyAlgorithm
+                - publicKey
+        authenticatorAttachment:
+          type: string
+          nullable: true
+        clientExtensionResults:
+          type: object
+      required:
+        - authority
+        - identity
+        - origin
+        - label
+        - id
+        - type
+        - response
+  use:
+    concurrency: retry
+    query: true
+    errors: [FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        origin:
+          type: string
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            authenticatorData:
+              type: string
+            clientDataJSON:
+              type: string
+            signature:
+              type: string
+            userHandle:
+              type: string
+        authenticatorAttachment:
+          type: string
+        clientExtensionResults:
+          type: object
+      required:
+        - origin
+        - id
+        - response
+  authenticate:
+    # `use` is what verifies the signature, and what it refuses with is answered as it is
+    errors: [MISS, FAILED, INVALID]
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        origin:
+          type: string
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            authenticatorData:
+              type: string
+            clientDataJSON:
+              type: string
+            signature:
+              type: string
+            userHandle:
+              type: string
+        authenticatorAttachment:
+          type: string
+        clientExtensionResults:
+          type: object
+      required:
+        - authority
+        - origin
+        - id
+        - response
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+  delete:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        id:
+          type: string
+      required:
+        - authority
+        - identity
+        - id
+
+exposition:
+  /:
+    POST:
+      auth:incept: identity
+      map:authority: authority
+      map:headers:
+        origin: origin
+      io:output: [identity]
+      endpoint: authenticate
+    /challenges:
+      auth:anonymous: true
+      POST:
+        map:authority: authority
+        io:output: &challenge
+          - identity
+          - challenge
+          - timeout
+          - userVerification
+          - authenticatorSelection
+          - pubKeyCredParams
+          - allowCredentials
+          - excludeCredentials
+        auth:incept: identity
+        endpoint: challenge
+      /:identity:
+        POST:
+          map:authority: authority
+          map:segments:
+            identity: identity
+          io:output: *challenge
+          endpoint: challenge
+    /:identity:
+      auth:id: identity
+      POST:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        map:headers:
+          origin: origin
+        io:output: [id, aid, synced, label, CREATED, UPDATED]
+        endpoint: create
+      GET:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        io:output: [id, aid, synced, label, CREATED, UPDATED]
+        endpoint: list
+      /:id:
+        DELETE:
+          map:authority: authority
+          map:segments:
+            identity: identity
+            id: id
+          io:output: false
+          endpoint: delete
+
+configuration:
+  schema:
+    type: object
+    properties:
+      algorithms:
+        type: array
+        items:
+          type: number
+      timeout:
+        type: integer
+      verification:
+        description: AuthenticatorSelectionCriteria.userVerification
+        type: string
+        enum:
+          - required
+          - preferred
+          - discouraged
+      residence:
+        description: AuthenticatorSelectionCriteria.residentKey
+        type: string
+        enum:
+          - required
+          - preferred
+          - discouraged
+  defaults:
+    algorithms:
+    - -7
+    - -257
+    timeout: 60000
+    residence: required
+
+stash: ~

package/components/identity.passkeys/migrations/0002-indexes.yaml

@@ -0,0 +1,11 @@
+- index:
+    name: index_list
+    keys:
+      authority: asc
+      identity: asc
+      CREATED: desc
+- index:
+    name: index_key
+    keys:
+      authority: asc
+      kid: asc

package/components/identity.passkeys/operations/authenticate.js

@@ -0,0 +1,32 @@
+import { quote } from '@toa.io/generic';
+export class Effect {
+    use;
+    logs;
+    mount(context) {
+        this.use = context.local.use;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { authority, ...response } = input;
+        const identity = await this.use({
+            query: {
+                criteria: `authority==${quote(authority)};kid==${quote(response.id)}`
+            },
+            input: response
+        });
+        if (identity === null) {
+            this.logs.debug('Passkey not found', {
+                authority,
+                id: response.id
+            });
+            return ERR_MISS;
+        }
+        if (identity instanceof Error)
+            return identity;
+        return { identity };
+    }
+}
+const ERR_MISS = new (class MissError extends Error {
+    code = 'MISS';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFLdkMsTUFBTSxPQUFPLE1BQU07SUFDVCxHQUFHLENBQTBCO0lBQzdCLElBQUksQ0FBa0I7SUFFdkIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUE7UUFDNUIsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLFFBQVEsRUFBRSxHQUFHLEtBQUssQ0FBQTtRQUV4QyxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDOUIsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxFQUFFO2FBQ3RFO1lBQ0QsS0FBSyxFQUFFLFFBQVE7U0FDaEIsQ0FBQyxDQUFBO1FBRUYsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdEIsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsbUJBQW1CLEVBQUU7Z0JBQ25DLFNBQVM7Z0JBQ1QsRUFBRSxFQUFFLFFBQVEsQ0FBQyxFQUFFO2FBQ2hCLENBQUMsQ0FBQTtZQUVGLE9BQU8sUUFBUSxDQUFBO1FBQ2pCLENBQUM7UUFFRCxJQUFJLFFBQVEsWUFBWSxLQUFLO1lBQUUsT0FBTyxRQUFRLENBQUE7UUFFOUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFBO0lBQ3JCLENBQUM7Q0FDRjtBQUVELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLFNBQVUsU0FBUSxLQUFLO0lBQ2pDLElBQUksR0FBRyxNQUFNLENBQUE7Q0FDOUIsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.passkeys/operations/challenge.js

@@ -0,0 +1,72 @@
+import { randomBytes } from 'node:crypto';
+import { newid, quote } from '@toa.io/generic';
+import { MAX_KEYS } from './lib/const.js';
+export class Effect {
+    timeout;
+    authenticator;
+    credParams;
+    enumerate;
+    stash;
+    logs;
+    mount(context) {
+        this.timeout = context.configuration.timeout;
+        this.credParams = context.configuration.algorithms.map((alg) => ({
+            type: 'public-key',
+            alg
+        }));
+        if (context.configuration.verification !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.userVerification = context.configuration.verification;
+        }
+        if (context.configuration.residence !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.residentKey = context.configuration.residence;
+            if (context.configuration.residence === 'required')
+                this.authenticator.requireResidentKey = true;
+        }
+        this.enumerate = context.local.enumerate;
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { type, identity, authority } = input;
+        const challenge = await this.createChallenge(authority);
+        const options = {
+            challenge,
+            timeout: this.timeout
+        };
+        if (type === 'creation')
+            options.identity = identity ?? newid();
+        const keys = identity === undefined || identity === null
+            ? []
+            : await this.enumerate({
+                query: {
+                    criteria: `identity==${quote(identity)}`,
+                    projection: ['kid', 'transports'],
+                    limit: MAX_KEYS
+                }
+            });
+        if (type === 'creation')
+            return {
+                ...options,
+                excludeCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                pubKeyCredParams: this.credParams,
+                authenticatorSelection: this.authenticator
+            };
+        else
+            return {
+                ...options,
+                allowCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                userVerification: this.authenticator?.userVerification
+            };
+    }
+    async createChallenge(authority) {
+        const challenge = randomBytes(32).toString('base64url');
+        const key = `challenge:${authority}:${challenge}`;
+        this.logs.debug('Creating challenge', { key });
+        await this.stash.set(key, 1, 'EX', (this.timeout / 1000) * EX_GAP);
+        return challenge;
+    }
+}
+const EX_GAP = 1.5;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NoYWxsZW5nZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3pDLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDOUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSXpDLE1BQU0sT0FBTyxNQUFNO0lBQ1QsT0FBTyxDQUFTO0lBQ2hCLGFBQWEsQ0FBaUM7SUFDOUMsVUFBVSxDQUFrQztJQUM1QyxTQUFTLENBQWdDO0lBQ3pDLEtBQUssQ0FBbUI7SUFDeEIsSUFBSSxDQUFrQjtJQUV2QixLQUFLLENBQUMsT0FBZ0I7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQTtRQUM1QyxJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUMvRCxJQUFJLEVBQUUsWUFBWTtZQUNsQixHQUFHO1NBQ0osQ0FBQyxDQUFDLENBQUE7UUFFSCxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3JELElBQUksQ0FBQyxhQUFhLEtBQUssRUFBRSxDQUFBO1lBQ3pCLElBQUksQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUE7UUFDMUUsQ0FBQztRQUVELElBQUksT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbEQsSUFBSSxDQUFDLGFBQWEsS0FBSyxFQUFFLENBQUE7WUFDekIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7WUFFaEUsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsS0FBSyxVQUFVO2dCQUNoRCxJQUFJLENBQUMsYUFBYSxDQUFDLGtCQUFrQixHQUFHLElBQUksQ0FBQTtRQUNoRCxDQUFDO1FBRUQsSUFBSSxDQUFDLFNBQVMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUN4QyxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUE7UUFDMUIsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBQzNDLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQTtRQUV2RCxNQUFNLE9BQU8sR0FBVztZQUN0QixTQUFTO1lBQ1QsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1NBQ3RCLENBQUE7UUFFRCxJQUFJLElBQUksS0FBSyxVQUFVO1lBQUUsT0FBTyxDQUFDLFFBQVEsR0FBRyxRQUFRLElBQUksS0FBSyxFQUFFLENBQUE7UUFFL0QsTUFBTSxJQUFJLEdBQ1IsUUFBUSxLQUFLLFNBQVMsSUFBSSxRQUFRLEtBQUssSUFBSTtZQUN6QyxDQUFDLENBQUMsRUFBRTtZQUNKLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQ25CLEtBQUssRUFBRTtvQkFDTCxRQUFRLEVBQUUsYUFBYSxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUU7b0JBQ3hDLFVBQVUsRUFBRSxDQUFDLEtBQUssRUFBRSxZQUFZLENBQUM7b0JBQ2pDLEtBQUssRUFBRSxRQUFRO2lCQUNoQjthQUNGLENBQUMsQ0FBQTtRQUVSLElBQUksSUFBSSxLQUFLLFVBQVU7WUFDckIsT0FBTztnQkFDTCxHQUFHLE9BQU87Z0JBQ1Ysa0JBQWtCLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDakMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLGFBQWE7YUFDakIsQ0FBQTs7WUFFM0IsT0FBTztnQkFDTCxHQUFHLE9BQU87Z0JBQ1YsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUM5RSxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLGdCQUFnQjthQUM5QixDQUFBO0lBQzlCLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQWlCO1FBQzdDLE1BQU0sU0FBUyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDdkQsTUFBTSxHQUFHLEdBQUcsYUFBYSxTQUFTLElBQUksU0FBUyxFQUFFLENBQUE7UUFFakQsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFBO1FBRTlDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFBO1FBRWxFLE9BQU8sU0FBUyxDQUFBO0lBQ2xCLENBQUM7Q0FDRjtBQUVELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.passkeys/operations/create.js

@@ -0,0 +1,57 @@
+import { verifyRegistrationResponse } from '@simplewebauthn/server';
+// https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/registration/verifyRegistrationResponse.ts#L51
+export class Transition {
+    algorithms;
+    stash;
+    logs;
+    verification;
+    presence;
+    mount(context) {
+        this.algorithms = context.configuration.algorithms;
+        this.verification = context.configuration.verification === 'required';
+        this.presence = context.configuration.residence === 'required';
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input, object) {
+        const { authority, identity, label, ...response } = input;
+        // rawId is not sent from the client
+        response.rawId = response.id;
+        const verified = await verifyRegistrationResponse({
+            response,
+            expectedOrigin: input.origin,
+            expectedChallenge: async (challenge) => this.verifyChallenge(authority, challenge),
+            supportedAlgorithmIDs: this.algorithms,
+            requireUserVerification: this.verification,
+            requireUserPresence: this.presence
+        }).catch((e) => {
+            this.logs.info('Failed to verify registration response', { message: e.message });
+            return ERR_FAILED;
+        });
+        if (verified instanceof Error)
+            return verified;
+        if (!verified.verified || verified.registrationInfo?.credential === undefined)
+            return ERR_INVALID;
+        const reg = verified.registrationInfo;
+        object.authority = authority;
+        object.identity = identity;
+        object.kid = reg.credential.id;
+        object.aid = reg.aaguid;
+        object.synced = reg.credentialBackedUp;
+        object.key = Buffer.from(reg.credential.publicKey).toString('base64url');
+        object.transports = reg.credential.transports;
+        object.label = label;
+        return object;
+    }
+    async verifyChallenge(authority, challenge) {
+        const n = await this.stash.del(`challenge:${authority}:${challenge}`);
+        return n === 1;
+    }
+}
+const ERR_FAILED = new (class FailedError extends Error {
+    code = 'FAILED';
+})();
+const ERR_INVALID = new (class InvalidError extends Error {
+    code = 'INVALID';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NyZWF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsMEJBQTBCLEVBRTNCLE1BQU0sd0JBQXdCLENBQUE7QUFJL0IsOEhBQThIO0FBRTlILE1BQU0sT0FBTyxVQUFVO0lBQ2IsVUFBVSxDQUFXO0lBQ3JCLEtBQUssQ0FBbUI7SUFDeEIsSUFBSSxDQUFrQjtJQUN0QixZQUFZLENBQVU7SUFDdEIsUUFBUSxDQUFVO0lBRW5CLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFBO1FBQ2xELElBQUksQ0FBQyxZQUFZLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFBO1FBQ3JFLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFBO1FBQzlELElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQTtRQUMxQixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUE7SUFDMUIsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBWSxFQUFFLE1BQWU7UUFDaEQsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsUUFBUSxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRXpELG9DQUFvQztRQUNwQyxRQUFRLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQyxFQUFFLENBQUE7UUFFNUIsTUFBTSxRQUFRLEdBQUcsTUFBTSwwQkFBMEIsQ0FBQztZQUNoRCxRQUFRO1lBQ1IsY0FBYyxFQUFFLEtBQUssQ0FBQyxNQUFNO1lBQzVCLGlCQUFpQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQztZQUNsRixxQkFBcUIsRUFBRSxJQUFJLENBQUMsVUFBVTtZQUN0Qyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsWUFBWTtZQUMxQyxtQkFBbUIsRUFBRSxJQUFJLENBQUMsUUFBUTtTQUNuQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDYixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyx3Q0FBd0MsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUVoRixPQUFPLFVBQW1CLENBQUE7UUFDNUIsQ0FBQyxDQUFDLENBQUE7UUFFRixJQUFJLFFBQVEsWUFBWSxLQUFLO1lBQUUsT0FBTyxRQUFRLENBQUE7UUFFOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsS0FBSyxTQUFTO1lBQzNFLE9BQU8sV0FBVyxDQUFBO1FBRXBCLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQTtRQUVyQyxNQUFNLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQTtRQUM1QixNQUFNLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQTtRQUMxQixNQUFNLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFBO1FBQzlCLE1BQU0sQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQTtRQUN2QixNQUFNLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQTtRQUN0QyxNQUFNLENBQUMsR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDeEUsTUFBTSxDQUFDLFVBQVUsR0FBRyxHQUFHLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQTtRQUM3QyxNQUFNLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQTtRQUVwQixPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQWlCLEVBQUUsU0FBaUI7UUFDaEUsTUFBTSxDQUFDLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxhQUFhLFNBQVMsSUFBSSxTQUFTLEVBQUUsQ0FBQyxDQUFBO1FBRXJFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNoQixDQUFDO0NBQ0Y7QUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0NBQ2hDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLE1BQU0sWUFBYSxTQUFRLEtBQUs7SUFDdkMsSUFBSSxHQUFHLFNBQVMsQ0FBQTtDQUNqQyxDQUFDLEVBQUUsQ0FBQSJ9

package/components/identity.passkeys/operations/delete.js

@@ -0,0 +1,9 @@
+import { quote } from '@toa.io/generic';
+export async function effect({ authority, identity, id }, context) {
+    return await context.local.terminate({
+        query: {
+            criteria: `authority==${quote(authority)};identity==${quote(identity)};id==${quote(id)}`
+        }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlbGV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFHdkMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQzFCLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQVMsRUFDbEMsT0FBZ0I7SUFFaEIsT0FBTyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ25DLEtBQUssRUFBRTtZQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxTQUFTLENBQUMsY0FBYyxLQUFLLENBQUMsUUFBUSxDQUFDLFFBQVEsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFO1NBQ3pGO0tBQ0YsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/components/identity.passkeys/operations/lib/const.js

@@ -0,0 +1,2 @@
+export const MAX_KEYS = 128;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2NvbnN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE1BQU0sQ0FBQyxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUEifQ==

package/components/identity.passkeys/operations/list.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+import { MAX_KEYS } from './lib/const.js';
+export async function computation({ authority, identity }, context) {
+    return await context.local.enumerate({
+        query: {
+            criteria: `authority==${quote(authority)};identity==${quote(identity)}`,
+            projection: ['aid', 'synced', 'label'],
+            limit: MAX_KEYS
+        }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUN2QyxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHekMsTUFBTSxDQUFDLEtBQUssVUFBVSxXQUFXLENBQy9CLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBUyxFQUM5QixPQUFnQjtJQUVoQixPQUFPLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDbkMsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUN2RSxVQUFVLEVBQUUsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQztZQUN0QyxLQUFLLEVBQUUsUUFBUTtTQUNoQjtLQUNGLENBQUMsQ0FBQTtBQUNKLENBQUMifQ==

package/components/identity.passkeys/operations/types/Configuration.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9Db25maWd1cmF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.passkeys/operations/types/Context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9Db250ZXh0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.passkeys/operations/types/Passkey.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUGFzc2tleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9QYXNza2V5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.passkeys/operations/types/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.passkeys/operations/use.js

@@ -0,0 +1,56 @@
+import { verifyAuthenticationResponse } from '@simplewebauthn/server';
+export class Transition {
+    stash;
+    logs;
+    verification;
+    presence;
+    mount(context) {
+        this.stash = context.stash;
+        this.logs = context.logs;
+        this.verification = context.configuration.verification === 'required';
+        this.presence = context.configuration.residence === 'required';
+    }
+    async execute(input, object) {
+        const { origin, ...rest } = input;
+        const response = { ...rest, rawId: input.id };
+        const credential = toCredential(object);
+        const verified = await verifyAuthenticationResponse({
+            response,
+            credential,
+            expectedOrigin: origin,
+            expectedRPID: new URL(origin).hostname,
+            expectedChallenge: async (challenge) => this.verifyChallenge(object.authority, challenge),
+            requireUserVerification: this.verification
+        }).catch((e) => {
+            this.logs.info('Failed to verify authentication response', { message: e.message });
+            return ERR_FAILED;
+        });
+        if (verified instanceof Error)
+            return verified;
+        if (!verified.verified)
+            return ERR_INVALID;
+        object.counter = verified.authenticationInfo.newCounter;
+        return object.identity;
+    }
+    async verifyChallenge(authority, challenge) {
+        const key = `challenge:${authority}:${challenge}`;
+        const n = await this.stash.del(`challenge:${authority}:${challenge}`);
+        this.logs.debug(n === 1 ? 'Challenge verified' : 'Challenge not found', { key, n });
+        return n === 1;
+    }
+}
+function toCredential(passkey) {
+    return {
+        id: passkey.id,
+        publicKey: new Uint8Array(Buffer.from(passkey.key, 'base64url')),
+        counter: passkey.counter,
+        transports: passkey.transports
+    };
+}
+const ERR_FAILED = new (class FailedError extends Error {
+    code = 'FAILED';
+})();
+const ERR_INVALID = new (class InvalidError extends Error {
+    code = 'INVALID';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3VzZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQTtBQVFyRSxNQUFNLE9BQU8sVUFBVTtJQUNiLEtBQUssQ0FBbUI7SUFDeEIsSUFBSSxDQUFrQjtJQUN0QixZQUFZLENBQVU7SUFDdEIsUUFBUSxDQUFVO0lBRW5CLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUE7UUFDMUIsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFBO1FBQ3hCLElBQUksQ0FBQyxZQUFZLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFBO1FBQ3JFLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFBO0lBQ2hFLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVksRUFBRSxNQUFlO1FBQ2hELE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFDakMsTUFBTSxRQUFRLEdBQStCLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQTtRQUN6RSxNQUFNLFVBQVUsR0FBRyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUE7UUFFdkMsTUFBTSxRQUFRLEdBQUcsTUFBTSw0QkFBNEIsQ0FBQztZQUNsRCxRQUFRO1lBQ1IsVUFBVTtZQUNWLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFlBQVksRUFBRSxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRO1lBQ3RDLGlCQUFpQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRSxDQUNyQyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDO1lBQ25ELHVCQUF1QixFQUFFLElBQUksQ0FBQyxZQUFZO1NBQzNDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtZQUNiLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLDBDQUEwQyxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFBO1lBRWxGLE9BQU8sVUFBbUIsQ0FBQTtRQUM1QixDQUFDLENBQUMsQ0FBQTtRQUVGLElBQUksUUFBUSxZQUFZLEtBQUs7WUFBRSxPQUFPLFFBQVEsQ0FBQTtRQUU5QyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVE7WUFBRSxPQUFPLFdBQVcsQ0FBQTtRQUUxQyxNQUFNLENBQUMsT0FBTyxHQUFHLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLENBQUE7UUFFdkQsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFBO0lBQ3hCLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQWlCLEVBQUUsU0FBaUI7UUFDaEUsTUFBTSxHQUFHLEdBQUcsYUFBYSxTQUFTLElBQUksU0FBUyxFQUFFLENBQUE7UUFDakQsTUFBTSxDQUFDLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxhQUFhLFNBQVMsSUFBSSxTQUFTLEVBQUUsQ0FBQyxDQUFBO1FBRXJFLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxxQkFBcUIsRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFBO1FBRW5GLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNoQixDQUFDO0NBQ0Y7QUFFRCxTQUFTLFlBQVksQ0FBQyxPQUFnQjtJQUNwQyxPQUFPO1FBQ0wsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFO1FBQ2QsU0FBUyxFQUFFLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNoRSxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87UUFDeEIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO0tBQy9CLENBQUE7QUFDSCxDQUFDO0FBRUQsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLE1BQU0sV0FBWSxTQUFRLEtBQUs7SUFDckMsSUFBSSxHQUFHLFFBQVEsQ0FBQTtDQUNoQyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxNQUFNLFlBQWEsU0FBUSxLQUFLO0lBQ3ZDLElBQUksR0FBRyxTQUFTLENBQUE7Q0FDakMsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.passkeys/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "identity.passkeys",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@simplewebauthn/server": "14.0.0"
+  }
+}

package/components/identity.passkeys/source/authenticate.ts

@@ -0,0 +1,49 @@
+import { quote } from '@toa.io/generic'
+import type { Context } from './types/index.ts'
+import type { AuthenticationResponseJSON } from '@simplewebauthn/server'
+import type { Operation } from '@toa.io/bridges.node'
+
+export class Effect implements Operation {
+  private use!: Context['local']['use']
+  private logs!: Context['logs']
+
+  public mount(context: Context): void {
+    this.use = context.local.use
+    this.logs = context.logs
+  }
+
+  public async execute(input: Input): Promise<Output> {
+    const { authority, ...response } = input
+
+    const identity = await this.use({
+      query: {
+        criteria: `authority==${quote(authority)};kid==${quote(response.id)}`
+      },
+      input: response
+    })
+
+    if (identity === null) {
+      this.logs.debug('Passkey not found', {
+        authority,
+        id: response.id
+      })
+
+      return ERR_MISS
+    }
+
+    if (identity instanceof Error) return identity
+
+    return { identity }
+  }
+}
+
+const ERR_MISS = new (class MissError extends Error {
+  public readonly code = 'MISS'
+})()
+
+export interface Input extends Omit<AuthenticationResponseJSON, 'rawId'> {
+  authority: string
+  origin: string
+}
+
+export type Output = { identity: string } | Error