@touchque/web 0.1.0

package/dist/index.mjs

@@ -0,0 +1,383 @@
+import { browserSupportsWebAuthn, platformAuthenticatorIsAvailable, startRegistration, startAuthentication } from '@simplewebauthn/browser';
+
+// src/errors.ts
+var TouchQueWebError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TouchQueWebError";
+  }
+};
+var PasskeyDismissedError = class extends TouchQueWebError {
+  constructor(message = "The passkey prompt was dismissed before it completed.") {
+    super(message);
+    this.name = "PasskeyDismissedError";
+  }
+};
+var PasskeyNotRegisteredError = class extends TouchQueWebError {
+  constructor(message = "No passkey is registered for this account.") {
+    super(message);
+    this.name = "PasskeyNotRegisteredError";
+  }
+};
+var PasskeyDisabledError = class extends TouchQueWebError {
+  constructor(message = "Passwordless sign-in is not enabled for this account.") {
+    super(message);
+    this.name = "PasskeyDisabledError";
+  }
+};
+var TouchQueWebAPIError = class extends TouchQueWebError {
+  status;
+  body;
+  constructor(status, body, message) {
+    super(message || `Relay request failed with HTTP ${status}`);
+    this.name = "TouchQueWebAPIError";
+    this.status = status;
+    this.body = body;
+  }
+};
+
+// src/http.ts
+var RelayHttp = class {
+  baseUrl;
+  credentials;
+  headers;
+  fetchImpl;
+  constructor(config) {
+    if (!config.baseUrl) {
+      throw new Error("createTouchQueWeb: `baseUrl` is required.");
+    }
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.credentials = config.credentials ?? "same-origin";
+    this.headers = config.headers ?? {};
+    const f = config.fetch ?? (typeof fetch !== "undefined" ? fetch : void 0);
+    if (!f) {
+      throw new Error("createTouchQueWeb: no `fetch` available \u2014 pass `fetch` in the config.");
+    }
+    this.fetchImpl = f.bind(globalThis);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  del(path) {
+    return this.request("DELETE", path);
+  }
+  async request(method, path, body) {
+    const res = await this.fetchImpl(this.baseUrl + path, {
+      method,
+      credentials: this.credentials,
+      headers: {
+        Accept: "application/json",
+        ...body !== void 0 ? { "Content-Type": "application/json" } : {},
+        ...this.headers
+      },
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    const text = await res.text();
+    let parsed = void 0;
+    if (text) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        parsed = text;
+      }
+    }
+    if (!res.ok) {
+      const errCode = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : void 0;
+      if (errCode === "no_passkey_registered" || res.status === 404 && !errCode) {
+        throw new PasskeyNotRegisteredError();
+      }
+      if (errCode === "passwordless_login_disabled" || res.status === 403 && !errCode) {
+        throw new PasskeyDisabledError();
+      }
+      const message = parsed && typeof parsed === "object" && "message" in parsed ? String(parsed.message) : errCode;
+      throw new TouchQueWebAPIError(res.status, parsed, message);
+    }
+    return parsed;
+  }
+};
+function isDismissal(err) {
+  const name = err?.name;
+  return name === "NotAllowedError" || name === "AbortError";
+}
+async function ceremony(run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (isDismissal(err)) throw new PasskeyDismissedError();
+    if (err instanceof TouchQueWebError) throw err;
+    throw new TouchQueWebError(
+      `WebAuthn ceremony failed: ${err?.message ?? String(err)}`
+    );
+  }
+}
+function unwrapOptions(body) {
+  if (body && typeof body === "object" && "options" in body) {
+    const b = body;
+    return { attemptId: b.attemptId, options: b.options };
+  }
+  return { options: body ?? {} };
+}
+var Passkeys = class {
+  constructor(http, paths) {
+    this.http = http;
+    this.paths = paths;
+  }
+  http;
+  paths;
+  /**
+   * Register a passkey for the currently signed-in user.
+   *
+   * `extra` is merged into the verify request body — use it for a device
+   * label, for example: `register({ label: 'MacBook Touch ID' })`.
+   */
+  async register(extra = {}) {
+    const optionsBody = await this.http.post(this.paths.registerOptions, {});
+    const { options } = unwrapOptions(optionsBody);
+    const response = await ceremony(() => startRegistration({ optionsJSON: options }));
+    return this.http.post(this.paths.registerVerify, { response, ...extra });
+  }
+  /**
+   * Passwordless-primary sign-in: authenticate a user from zero with a
+   * passkey. `context` is merged into both relay calls (pass OAuth params,
+   * a redirect URI, etc.).
+   *
+   * Inspect the result: `ok` = signed in; `requiresStepUp` = start a push /
+   * number-match flow; `pending2fa` = continue a pending 2FA flow. `raw` is
+   * the relay's untouched response.
+   */
+  async authenticate(input) {
+    const context = input.context ?? {};
+    const optionsBody = await this.http.post(this.paths.authenticateOptions, {
+      email: input.email,
+      ...context
+    });
+    const { attemptId, options } = unwrapOptions(optionsBody);
+    const response = await ceremony(() => startAuthentication({ optionsJSON: options }));
+    const raw = await this.http.post(this.paths.authenticateVerify, {
+      ...attemptId !== void 0 ? { attemptId } : {},
+      response,
+      ...context
+    });
+    const requiresStepUp = raw.requiresStepUp === true;
+    const pending2fa = raw.status === "pending_2fa";
+    const ok = !requiresStepUp && !pending2fa && (raw.success === true || raw.status === "success");
+    return { ok, requiresStepUp, pending2fa, raw };
+  }
+  /**
+   * Approve an already-pending login request (second-factor flow) with a
+   * passkey, instead of the mobile push.
+   */
+  async approveLogin(input) {
+    const optionsBody = await this.http.post(this.paths.approveOptions, {
+      requestId: input.requestId
+    });
+    const { options } = unwrapOptions(optionsBody);
+    const response = await ceremony(() => startAuthentication({ optionsJSON: options }));
+    return this.http.post(this.paths.approveVerify, {
+      requestId: input.requestId,
+      response
+    });
+  }
+  /** List the signed-in user's registered passkeys (metadata only). */
+  async list() {
+    const body = await this.http.get(this.paths.list);
+    return body.credentials ?? [];
+  }
+  /** Remove one of the signed-in user's passkeys by its record id. */
+  async remove(id) {
+    return this.http.del(
+      `${this.paths.remove}/${encodeURIComponent(id)}`
+    );
+  }
+};
+function isPasskeySupported() {
+  return browserSupportsWebAuthn();
+}
+function isPlatformAuthenticatorAvailable() {
+  return platformAuthenticatorIsAvailable();
+}
+
+// src/behavioral/tracker.ts
+function createBehavioralTracker(containerEl, opts = {}) {
+  const sampleIntervalMs = opts.sampleIntervalMs || 1e3;
+  const keystrokeMaxGapMs = opts.keystrokeMaxGapMs || 2e3;
+  let running = false;
+  let distance = 0;
+  let jitterCount = 0;
+  let clickCount = 0;
+  let lastPos = { x: 0, y: 0 };
+  let lastKeyTime = null;
+  let keyIntervals = [];
+  let intervalHandle = null;
+  function handleMouseMove(e) {
+    const { clientX, clientY } = e;
+    if (lastPos.x !== 0 && lastPos.y !== 0) {
+      const dx = clientX - lastPos.x;
+      const dy = clientY - lastPos.y;
+      distance += Math.sqrt(dx * dx + dy * dy);
+      if (dx !== 0 && dy !== 0 && Math.abs(dx / dy) > 0.1) {
+        jitterCount += 1;
+      }
+    }
+    lastPos = { x: clientX, y: clientY };
+  }
+  function handleClick() {
+    clickCount += 1;
+  }
+  function handleKeyDown() {
+    const now = Date.now();
+    if (lastKeyTime !== null) {
+      const diff = now - lastKeyTime;
+      if (diff < keystrokeMaxGapMs) {
+        keyIntervals.push(diff);
+      }
+    }
+    lastKeyTime = now;
+  }
+  function getMetrics() {
+    const avgSpeed = keyIntervals.length ? keyIntervals.reduce((a, b) => a + b, 0) / keyIntervals.length : 0;
+    return {
+      mouseDistance: Math.floor(distance),
+      mouseJitter: jitterCount,
+      clicks: clickCount,
+      keystrokes: keyIntervals.length,
+      keystrokeSpeedAvg: Math.floor(avgSpeed)
+    };
+  }
+  function start() {
+    if (running || !containerEl) return;
+    running = true;
+    containerEl.addEventListener("mousemove", handleMouseMove);
+    containerEl.addEventListener("click", handleClick);
+    containerEl.addEventListener("keydown", handleKeyDown);
+    intervalHandle = setInterval(() => {
+      if (typeof opts.onSample === "function") opts.onSample(getMetrics());
+    }, sampleIntervalMs);
+  }
+  function stop() {
+    if (!running) return;
+    running = false;
+    containerEl.removeEventListener("mousemove", handleMouseMove);
+    containerEl.removeEventListener("click", handleClick);
+    containerEl.removeEventListener("keydown", handleKeyDown);
+    if (intervalHandle) clearInterval(intervalHandle);
+    intervalHandle = null;
+  }
+  function reset() {
+    distance = 0;
+    jitterCount = 0;
+    clickCount = 0;
+    keyIntervals = [];
+    lastPos = { x: 0, y: 0 };
+    lastKeyTime = null;
+  }
+  return { start, stop, reset, getMetrics };
+}
+
+// src/behavioral/fingerprint.ts
+function generateDeviceFingerprint() {
+  try {
+    const canvas = document.createElement("canvas");
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return "no-canvas";
+    ctx.textBaseline = "top";
+    ctx.font = "14px 'Arial'";
+    ctx.textBaseline = "alphabetic";
+    ctx.fillStyle = "#f60";
+    ctx.fillRect(125, 1, 62, 20);
+    ctx.fillStyle = "#069";
+    ctx.fillText("TouchQue Behavioral Widget Fingerprint", 2, 15);
+    ctx.fillStyle = "rgba(102, 204, 0, 0.7)";
+    ctx.fillText("TouchQue Behavioral Widget Fingerprint", 4, 17);
+    const canvasData = canvas.toDataURL();
+    const screenData = `${window.screen.width}x${window.screen.height}-${window.screen.colorDepth}`;
+    const browserData = `${navigator.userAgent}-${navigator.language}-${navigator.platform}-${navigator.hardwareConcurrency || 1}`;
+    const raw = canvasData + screenData + browserData;
+    let hash = 5381;
+    for (let i = 0; i < raw.length; i++) {
+      hash = (hash << 5) + hash + raw.charCodeAt(i);
+    }
+    return `tq_fp_${Math.abs(hash).toString(16)}`;
+  } catch {
+    return "fp_error";
+  }
+}
+
+// src/behavioral/index.ts
+function resolveContainer(target) {
+  if (typeof target === "string") return document.querySelector(target);
+  return target || null;
+}
+function attachBehavioral(target, options) {
+  const containerEl = resolveContainer(target);
+  if (!containerEl) {
+    throw new Error("attachBehavioral: container not found");
+  }
+  if (!options.telemetryToken || !options.requestId) {
+    throw new Error("attachBehavioral: telemetryToken and requestId are required");
+  }
+  const apiBaseUrl = (options.apiBaseUrl || "").replace(/\/+$/, "");
+  const fetchImpl = options.fetch ?? (typeof fetch !== "undefined" ? fetch : void 0);
+  if (!fetchImpl) {
+    throw new Error("attachBehavioral: no `fetch` available \u2014 pass `fetch` in the options.");
+  }
+  const doFetch = fetchImpl.bind(globalThis);
+  const tracker = createBehavioralTracker(containerEl, {
+    sampleIntervalMs: options.sampleIntervalMs
+  });
+  let fingerprint = null;
+  if (options.collectDeviceFingerprint === true) {
+    fingerprint = generateDeviceFingerprint();
+  }
+  tracker.start();
+  async function submit() {
+    const metrics = tracker.getMetrics();
+    const body = fingerprint ? { ...metrics, deviceFingerprint: fingerprint } : metrics;
+    try {
+      await doFetch(`${apiBaseUrl}/login/${encodeURIComponent(options.requestId)}/telemetry`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${options.telemetryToken}`
+        },
+        body: JSON.stringify(body)
+      });
+    } catch {
+    }
+  }
+  return {
+    stop: () => tracker.stop(),
+    reset: () => tracker.reset(),
+    submit
+  };
+}
+
+// src/index.ts
+var DEFAULT_PATHS = {
+  registerOptions: "/passkey/register/options",
+  registerVerify: "/passkey/register/verify",
+  authenticateOptions: "/passkey/authenticate/options",
+  authenticateVerify: "/passkey/authenticate/verify",
+  approveOptions: "/passkey/login/options",
+  approveVerify: "/passkey/login/verify",
+  list: "/passkey/credentials",
+  remove: "/passkey/credentials"
+};
+function createTouchQueWeb(config) {
+  const http = new RelayHttp(config);
+  const paths = { ...DEFAULT_PATHS, ...config.paths ?? {} };
+  const passkeys = new Passkeys(http, paths);
+  return {
+    passkeys,
+    behavioral: {
+      attach: (target, options) => attachBehavioral(target, { fetch: config.fetch, ...options })
+    },
+    isPasskeySupported,
+    isPlatformAuthenticatorAvailable
+  };
+}
+
+export { PasskeyDisabledError, PasskeyDismissedError, PasskeyNotRegisteredError, TouchQueWebAPIError, TouchQueWebError, attachBehavioral, createTouchQueWeb, isPasskeySupported, isPlatformAuthenticatorAvailable };

package/dist/touchque-behavioral.global.js

@@ -0,0 +1 @@
+var TouchQueBehavioral=(function(exports){'use strict';function M(t,e={}){let u=e.sampleIntervalMs||1e3,h=e.keystrokeMaxGapMs||2e3,a=false,o=0,r=0,n=0,i={x:0,y:0},s=null,l=[],f=null;function g(v){let{clientX:c,clientY:d}=v;if(i.x!==0&&i.y!==0){let p=c-i.x,m=d-i.y;o+=Math.sqrt(p*p+m*m),p!==0&&m!==0&&Math.abs(p/m)>.1&&(r+=1);}i={x:c,y:d};}function y(){n+=1;}function k(){let v=Date.now();if(s!==null){let c=v-s;c<h&&l.push(c);}s=v;}function B(){let v=l.length?l.reduce((c,d)=>c+d,0)/l.length:0;return {mouseDistance:Math.floor(o),mouseJitter:r,clicks:n,keystrokes:l.length,keystrokeSpeedAvg:Math.floor(v)}}function w(){a||!t||(a=true,t.addEventListener("mousemove",g),t.addEventListener("click",y),t.addEventListener("keydown",k),f=setInterval(()=>{typeof e.onSample=="function"&&e.onSample(B());},u));}function T(){a&&(a=false,t.removeEventListener("mousemove",g),t.removeEventListener("click",y),t.removeEventListener("keydown",k),f&&clearInterval(f),f=null);}function I(){o=0,r=0,n=0,l=[],i={x:0,y:0},s=null;}return {start:w,stop:T,reset:I,getMetrics:B}}function x(){try{let t=document.createElement("canvas"),e=t.getContext("2d");if(!e)return "no-canvas";e.textBaseline="top",e.font="14px 'Arial'",e.textBaseline="alphabetic",e.fillStyle="#f60",e.fillRect(125,1,62,20),e.fillStyle="#069",e.fillText("TouchQue Behavioral Widget Fingerprint",2,15),e.fillStyle="rgba(102, 204, 0, 0.7)",e.fillText("TouchQue Behavioral Widget Fingerprint",4,17);let u=t.toDataURL(),h=`${window.screen.width}x${window.screen.height}-${window.screen.colorDepth}`,a=`${navigator.userAgent}-${navigator.language}-${navigator.platform}-${navigator.hardwareConcurrency||1}`,o=u+h+a,r=5381;for(let n=0;n<o.length;n++)r=(r<<5)+r+o.charCodeAt(n);return `tq_fp_${Math.abs(r).toString(16)}`}catch{return "fp_error"}}function D(t){return typeof t=="string"?document.querySelector(t):t||null}function b(t,e){let u=D(t);if(!u)throw new Error("attachBehavioral: container not found");if(!e.telemetryToken||!e.requestId)throw new Error("attachBehavioral: telemetryToken and requestId are required");let h=(e.apiBaseUrl||"").replace(/\/+$/,""),a=e.fetch??(typeof fetch<"u"?fetch:void 0);if(!a)throw new Error("attachBehavioral: no `fetch` available \u2014 pass `fetch` in the options.");let o=a.bind(globalThis),r=M(u,{sampleIntervalMs:e.sampleIntervalMs}),n=null;e.collectDeviceFingerprint===true&&(n=x()),r.start();async function i(){let s=r.getMetrics(),l=n?{...s,deviceFingerprint:n}:s;try{await o(`${h}/login/${encodeURIComponent(e.requestId)}/telemetry`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${e.telemetryToken}`},body:JSON.stringify(l)});}catch{}}return {stop:()=>r.stop(),reset:()=>r.reset(),submit:i}}var F=b;exports.attach=F;return exports;})({});

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@touchque/web",
+  "version": "0.1.0",
+  "description": "Browser SDK for TouchQue Authenticator — passkey ceremonies and behavioral telemetry",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Touchque/touchque-sdks",
+    "directory": "touchque-web"
+  },
+  "homepage": "https://touchque.com",
+  "license": "MIT",
+  "author": "TouchQue",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "keywords": [
+    "touchque",
+    "passkey",
+    "webauthn",
+    "fido2",
+    "passwordless",
+    "browser",
+    "2fa",
+    "authentication"
+  ],
+  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0"
+  },
+  "devDependencies": {
+    "@touchque/node": "file:../touchque-node",
+    "jsdom": "^25.0.1",
+    "tsup": "^8.0.2",
+    "typescript": "^5.4.5",
+    "vitest": "^2.1.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}