@unchainedshop/core-users 3.0.0-alpha6 → 3.0.0-rc.11

package/src/module/configureUsersModule.ts

@@ -1,99 +1,39 @@
-import bcrypt from 'bcryptjs';
-import { ModuleInput } from '@unchainedshop/mongodb';
-import { User, UserQuery, Email, UserLastLogin, UserProfile, UserData } from '../types.js';
-import { emit, registerEvents } from '@unchainedshop/events';
+import * as bcrypt from '@node-rs/bcrypt';
 import {
+  ModuleInput,
+  Address,
+  Contact,
   generateDbFilterById,
   buildSortOptions,
   mongodb,
   generateDbObjectId,
 } from '@unchainedshop/mongodb';
-import { systemLocale } from '@unchainedshop/utils';
-import { FileDirector } from '@unchainedshop/file-upload';
-import { SortDirection, SortOption } from '@unchainedshop/utils';
-import { UsersCollection } from '../db/UsersCollection.js';
+import {
+  User,
+  UserQuery,
+  Email,
+  UserLastLogin,
+  UserProfile,
+  UsersCollection,
+} from '../db/UsersCollection.js';
+import { emit, registerEvents } from '@unchainedshop/events';
+import { systemLocale, SortDirection, SortOption, sha256 } from '@unchainedshop/utils';
 import addMigrations from './addMigrations.js';
 import { userSettings, UserSettingsOptions } from '../users-settings.js';
-import { configureUsersWebAuthnModule, UsersWebAuthnModule } from './configureUsersWebAuthnModule.js';
+import { configureUsersWebAuthnModule } from './configureUsersWebAuthnModule.js';
 import * as pbkdf2 from './pbkdf2.js';
-import * as sha256 from './sha256.js';
-import type { Address, Contact } from '@unchainedshop/mongodb';
-import { UserServices } from '../services/userServices.js';
-import { FileServices, FilesModule } from '@unchainedshop/core-files';
-
-export type UsersModule = {
-  // Submodules
-  webAuthn: UsersWebAuthnModule;
-
-  // Queries
-  count: (query: UserQuery) => Promise<number>;
-  findUserById: (userId: string) => Promise<User>;
-  findUserByToken: (hashedToken?: string) => Promise<User>;
-  findUserByResetToken: (token: string) => Promise<User>;
-  findUnverifiedEmailToken: (token: string) => Promise<{
-    userId: string;
-    address: string;
-    when: Date;
-  }>;
-  findUserByEmail(email: string): Promise<User>;
-  findUserByUsername(username: string): Promise<User>;
-  findUser: (
-    selector: UserQuery & { sort?: Array<SortOption> },
-    options?: mongodb.FindOptions,
-  ) => Promise<User>;
-  findUsers: (
-    query: UserQuery & {
-      sort?: Array<SortOption>;
-      limit?: number;
-      offset?: number;
-    },
-  ) => Promise<Array<User>>;
-  userExists: (query: { userId: string }) => Promise<boolean>;
-  // Transformations
-  primaryEmail: (user: User) => Email;
-  userLocale: (user: User) => Intl.Locale;
-
-  // Mutations
-  createUser: (
-    userData: UserData,
-    options: { skipMessaging?: boolean; skipPasswordEnrollment?: boolean },
-  ) => Promise<string>;
-  addEmail: (userId: string, email: string) => Promise<void>;
-  removeEmail: (userId: string, email: string) => Promise<void>;
-  sendVerificationEmail: (userId: string, email: string) => Promise<void>;
-  sendResetPasswordEmail: (userId: string, email: string, isEnrollment?: boolean) => Promise<void>;
-  verifyEmail: (userId: string, email: string) => Promise<void>;
-  setUsername: (userId: string, newUsername: string) => Promise<void>;
-  setPassword: (userId: string, newPassword?: string) => Promise<void>;
-  verifyPassword: (hashObject: Record<string, string>, password: string) => Promise<boolean>;
-  addRoles: (userId: string, roles: Array<string>) => Promise<number>;
-  updateAvatar: (_id: string, fileId: string) => Promise<User>;
-  updateGuest: (user: User, guest: boolean) => Promise<void>;
-  updateHeartbeat: (userId: string, doc: UserLastLogin) => Promise<User>;
-  updateLastBillingAddress: (_id: string, lastAddress: Address) => Promise<User>;
-  updateLastContact: (_id: string, lastContact: Contact) => Promise<User>;
-  updateProfile: (
-    _id: string,
-    { profile, meta }: { profile?: UserProfile; meta?: any },
-  ) => Promise<User>;
-  delete: (userId: string) => Promise<User>;
-  updateRoles: (_id: string, roles: Array<string>) => Promise<User>;
-  updateTags: (_id: string, tags: Array<string>) => Promise<User>;
-  updateUser: (
-    selector: mongodb.Filter<User>,
-    modifier: mongodb.UpdateFilter<User>,
-    options: mongodb.FindOneAndUpdateOptions,
-  ) => Promise<User>;
-  addPushSubscription: (
-    userId: string,
-    subscription: any,
-    options?: {
-      userAgent: string;
-      unsubscribeFromOtherUsers: boolean;
-    },
-  ) => Promise<void>;
-  removePushSubscription: (userId: string, p256dh: string) => Promise<void>;
-};
+
+export interface UserData {
+  email?: string;
+  guest?: boolean;
+  initialPassword?: boolean;
+  lastBillingAddress?: User['lastBillingAddress'];
+  password: string | null;
+  webAuthnPublicKeyCredentials?: any;
+  profile?: UserProfile;
+  roles?: Array<string>;
+  username?: string;
+}
 
 const USER_EVENTS = [
   'USER_ACCOUNT_ACTION',
@@ -118,36 +58,44 @@ export const removeConfidentialServiceHashes = (rawUser: User): User => {
   return user;
 };
 
-export const buildFindSelector = ({ includeGuests, queryString, ...rest }: UserQuery) => {
+export const buildFindSelector = ({
+  includeGuests,
+  queryString,
+  emailVerified,
+  lastLogin,
+  ...rest
+}: UserQuery) => {
   const selector: mongodb.Filter<User> = { ...rest, deleted: null };
   if (!includeGuests) selector.guest = { $in: [false, null] };
+  if (emailVerified === true) {
+    selector['emails.verified'] = true;
+  }
+  if (emailVerified === false) {
+    // We need to use $ne here else we'd also find users with many emails where one is
+    // unverified
+    selector['emails.verified'] = { $ne: true };
+  }
+  if (lastLogin?.start) {
+    selector['lastLogin.timestamp'] = { $exists: true };
+  }
+  if (lastLogin?.end) {
+    selector['lastLogin.timestamp'].$lte = new Date(lastLogin.end);
+  }
+  if (lastLogin?.start) {
+    selector['lastLogin.timestamp'].$gte = new Date(lastLogin.start);
+  }
   if (queryString) {
     (selector as any).$text = { $search: queryString };
   }
   return selector;
 };
 
-FileDirector.registerFileUploadCallback<{
-  services: {
-    users: UserServices;
-    files: FileServices;
-  };
-  modules: {
-    users: UsersModule;
-    files: FilesModule;
-  };
-}>('user-avatars', async (file, context) => {
-  const { services } = context;
-  return services.users.updateUserAvatarAfterUpload({ file }, context);
-});
-
 export const configureUsersModule = async ({
   db,
   options,
   migrationRepository,
 }: ModuleInput<UserSettingsOptions>) => {
   userSettings.configureSettings(options || {}, db);
-
   registerEvents(USER_EVENTS);
   const Users = await UsersCollection(db);
 
@@ -185,13 +133,13 @@ export const configureUsersModule = async ({
       when: Date;
     }> {
       if (!plainToken) return null;
-      const token = await sha256.hash(plainToken);
+      const token = await sha256(plainToken);
       const user = await Users.findOne(
         {
           'services.email.verificationTokens': {
             $elemMatch: {
               token,
-              when: { $gt: new Date().getTime() },
+              when: { $gt: new Date(new Date().getTime() - 1000 * 60 * 60) },
             },
           },
         },
@@ -206,48 +154,59 @@ export const configureUsersModule = async ({
     },
 
     async verifyEmail(userId: string, address: string): Promise<void> {
-      await Users.updateOne(
-        { _id: userId },
+      const updated = await Users.updateOne(
+        {
+          _id: userId,
+          emails: { $elemMatch: { address: { $regex: address, $options: 'i' }, verified: false } },
+        },
         {
           $set: {
-            'emails.$[email].verified': true,
+            'emails.$.verified': true,
           },
           $pull: {
             'services.email.verificationTokens': {
-              address,
+              address: { $regex: address, $options: 'i' },
             },
           },
         },
-        {
-          arrayFilters: [{ 'email.address': address }],
-        },
       );
 
-      await emit('USER_ACCOUNT_ACTION', {
-        action: 'email-verified',
-        address,
-        userId,
-      });
+      if (updated.modifiedCount > 0) {
+        await emit('USER_ACCOUNT_ACTION', {
+          action: 'email-verified',
+          address,
+          userId,
+        });
+      }
     },
 
-    async findUserByResetToken(plainToken: string): Promise<User> {
-      const token = await sha256.hash(plainToken);
+    async findResetToken(plainToken: string): Promise<{
+      userId: string;
+      address: string;
+      when: Date;
+    }> {
+      const token = await sha256(plainToken);
       const user = await Users.findOne(
         {
           'services.password.reset': {
             $elemMatch: {
               token,
-              when: { $gt: new Date().getTime() },
+              when: { $gt: new Date(new Date().getTime() - 1000 * 60 * 60) },
             },
           },
         },
         {},
       );
-      return user;
+      if (!user) return null;
+      const resetToken = user.services.password.reset.find((v) => v.token === token);
+      return {
+        userId: user._id,
+        ...resetToken,
+      };
     },
 
-    async findUserByToken(plainToken?: string): Promise<User> {
-      const token = await sha256.hash(plainToken);
+    async findUserByToken(plainToken: string): Promise<User> {
+      const token = await sha256(plainToken);
 
       if (token) {
         return Users.findOne({
@@ -276,7 +235,7 @@ export const configureUsersModule = async ({
       offset?: number;
     }): Promise<Array<User>> {
       const defaultSort = [{ key: 'created', value: SortDirection.ASC }] as SortOption[];
-      const selector = buildFindSelector(query);
+      const selector = buildFindSelector({ ...query });
 
       if (query.queryString) {
         return Users.find(selector, {
@@ -295,22 +254,24 @@ export const configureUsersModule = async ({
     },
 
     async userExists({ userId }: { userId: string }): Promise<boolean> {
-      const selector = generateDbFilterById<User>(userId);
-      selector.deleted = null; // skip deleted users when checked for existance!
-      const userCount = await Users.countDocuments(selector, { limit: 1 });
+      const userCount = await Users.countDocuments({ _id: userId, deleted: null }, { limit: 1 });
       return userCount === 1;
     },
 
     // Transformations
     primaryEmail(user: User): Email {
-      return (user.emails || []).sort(
+      return (user.emails || []).toSorted(
         (left, right) => Number(right.verified) - Number(left.verified),
       )?.[0];
     },
 
     userLocale(user: User): Intl.Locale {
       if (!user?.lastLogin?.locale) return systemLocale;
-      return new Intl.Locale(user.lastLogin.locale);
+      try {
+        return new Intl.Locale(user.lastLogin.locale);
+      } catch {
+        return systemLocale;
+      }
     },
 
     // Mutations
@@ -359,6 +320,7 @@ export const configureUsersModule = async ({
         _id: normalizedUserData._id || generateDbObjectId(),
         roles: roles || [],
         initialPassword: Boolean(initialPassword),
+        services,
         emails: email ? [{ address: email, verified: false }] : [],
         created: new Date(),
       };
@@ -398,7 +360,9 @@ export const configureUsersModule = async ({
       return userId;
     },
 
-    async hashPassword(password) {
+    async hashPassword(password: string): Promise<{
+      pbkdf2: string;
+    }> {
       const salt = pbkdf2.generateSalt();
       const hashedPassword = await pbkdf2.getDerivedKey(salt, password);
       return { pbkdf2: `${salt}:${hashedPassword}` };
@@ -409,7 +373,7 @@ export const configureUsersModule = async ({
       plainPassword: string,
     ): Promise<boolean> {
       if (bcryptHash) {
-        const password = await sha256.hash(plainPassword);
+        const password = await sha256(plainPassword);
         return bcrypt.compare(password, bcryptHash);
       }
       if (pbkdf2SaltAndHash) {
@@ -450,9 +414,9 @@ export const configureUsersModule = async ({
     async sendResetPasswordEmail(userId: string, email: string, isEnrollment?: boolean): Promise<void> {
       const plainToken = crypto.randomUUID();
       const resetToken = {
-        token: await sha256.hash(plainToken),
+        token: await sha256(plainToken),
         address: email,
-        when: new Date().getTime() + 1000 * 60 * 60, // 1 hour
+        when: new Date(),
       };
 
       await Users.updateOne(
@@ -475,9 +439,9 @@ export const configureUsersModule = async ({
     async sendVerificationEmail(userId: string, email: string): Promise<void> {
       const plainToken = crypto.randomUUID();
       const verificationToken = {
-        token: await sha256.hash(plainToken),
+        token: await sha256(plainToken),
         address: email,
-        when: new Date().getTime() + 1000 * 60 * 60, // 1 hour
+        when: new Date(),
       };
 
       await Users.updateOne(
@@ -529,12 +493,12 @@ export const configureUsersModule = async ({
       });
     },
 
-    async setPassword(userId: string, plainPassword: string) {
+    async setPassword(userId: string, plainPassword: string): Promise<User> {
       if (!(await userSettings.validatePassword(plainPassword))) {
         throw new Error(`Password ***** is invalid`, { cause: 'PASSWORD_INVALID' });
       }
       const password = plainPassword || crypto.randomUUID().split('-').pop();
-      await Users.updateOne(
+      const user = await Users.findOneAndUpdate(
         { _id: userId },
         {
           $set: {
@@ -544,11 +508,28 @@ export const configureUsersModule = async ({
             ),
           },
         },
+        { returnDocument: 'after' },
       );
-      const user = await Users.findOne({ _id: userId }, {});
       await emit('USER_UPDATE_PASSWORD', {
         user: removeConfidentialServiceHashes(user),
       });
+      return user;
+    },
+
+    async resetPassword(token: string, newPassword: string): Promise<User> {
+      const resetToken = await this.findResetToken(token);
+      if (!resetToken) return null;
+      const updatedUser = await this.setPassword(resetToken.userId, newPassword);
+      if (updatedUser) {
+        // Now invalidate the reset token
+        await emit('USER_ACCOUNT_ACTION', {
+          action: 'password-resetted',
+          userId: updatedUser._id,
+        });
+
+        await this.verifyEmail(updatedUser._id, resetToken.address);
+      }
+      return updatedUser;
     },
 
     updateAvatar: async (_id: string, fileId: string): Promise<User> => {
@@ -601,42 +582,38 @@ export const configureUsersModule = async ({
       return user;
     },
 
-    delete: async (userId: string): Promise<User> => {
-      const userFilter = generateDbFilterById(userId);
-
-      const existingUser = await Users.findOne(userFilter, {
-        projection: { emails: true, username: true },
-      });
-      if (!existingUser) return null;
-
-      const uuid = crypto.randomUUID();
-      const obfuscatedEmails = existingUser.emails?.flatMap(({ address, verified }) => {
-        if (!verified) return [];
-        return [
-          {
-            address: `${address}@${uuid}.unchained.local`,
-            verified: true,
+    markDeleted: async (userId: string): Promise<User> => {
+      const user = await Users.findOneAndUpdate(
+        { _id: userId },
+        {
+          $set: {
+            username: `deleted-${Date.now()}`,
+            deleted: new Date(),
+            emails: [],
+            roles: [],
+            profile: null,
+            lastBillingAddress: null,
+            services: {},
+            pushSubscriptions: [],
+            avatarId: null,
+            initialPassword: false,
+            lastContact: null,
+            lastLogin: null,
           },
-        ];
-      });
-
-      const obfuscatedUsername = existingUser.username ? `${existingUser.username}-${uuid}` : null;
-
-      Users.updateOne(userFilter, {
-        $set: {
-          emails: obfuscatedEmails,
-          username: obfuscatedUsername,
-          services: {},
         },
-      });
+        { returnDocument: 'after' },
+      );
 
-      const user = await Users.findOneAndDelete(userFilter);
       await emit('USER_REMOVE', {
-        user: removeConfidentialServiceHashes(user),
+        user,
       });
       return user;
     },
 
+    deletePermanently: async ({ userId }: { userId: string }): Promise<User> => {
+      return Users.findOneAndDelete({ _id: userId });
+    },
+
     updateProfile: async (
       userId: string,
       updatedData: { profile?: UserProfile; meta?: any },
@@ -679,6 +656,8 @@ export const configureUsersModule = async ({
       const userFilter = generateDbFilterById(_id);
       const user = await Users.findOne(userFilter, {});
 
+      if (!lastBillingAddress) return user;
+
       const modifier = {
         $set: {
           lastBillingAddress,
@@ -701,9 +680,12 @@ export const configureUsersModule = async ({
         returnDocument: 'after',
       });
 
-      await emit('USER_UPDATE_BILLING_ADDRESS', {
-        user: removeConfidentialServiceHashes(user),
-      });
+      if (updatedUser) {
+        await emit('USER_UPDATE_BILLING_ADDRESS', {
+          user: removeConfidentialServiceHashes(updatedUser),
+        });
+      }
+
       return updatedUser;
     },
 
@@ -829,3 +811,5 @@ export const configureUsersModule = async ({
     },
   };
 };
+
+export type UsersModule = Awaited<ReturnType<typeof configureUsersModule>>;

package/src/module/configureUsersWebAuthnModule.ts

@@ -1,30 +1,8 @@
-/// <reference lib="dom" />
 import { ModuleInput } from '@unchainedshop/mongodb';
-import {
-  Fido2Lib,
-  PublicKeyCredentialCreationOptions,
-  PublicKeyCredentialRequestOptions,
-} from 'fido2-lib';
 import { createLogger } from '@unchainedshop/logger';
 import { WebAuthnCredentialsCreationRequestsCollection } from '../db/WebAuthnCredentialsCreationRequestsCollection.js';
 
-export interface UsersWebAuthnModule {
-  findMDSMetadataForAAGUID: (aaguid: string) => Promise<any>;
-
-  createCredentialCreationOptions: (
-    origin: string,
-    username: string,
-    extensionOptions?: any,
-  ) => Promise<any>;
-  verifyCredentialCreation: (username: string, credentials: any) => Promise<any>;
-
-  createCredentialRequestOptions: (
-    origin: string,
-    username?: string,
-    extensionOptions?: any,
-  ) => Promise<any>;
-  verifyCredentialRequest: (userPublicKeys: any[], username: string, credentials: any) => Promise<any>;
-}
+import type { PublicKeyCredentialCreationOptions, PublicKeyCredentialRequestOptions } from 'fido2-lib';
 
 const logger = createLogger('unchained:core-users');
 
@@ -40,6 +18,9 @@ const setupMDSCollection = async () => {
   try {
     const tocResult = await fetch('https://mds.fidoalliance.org');
     const tocBase64 = await tocResult.text();
+    // eslint-disable-next-line
+    // @ts-ignore
+    const { Fido2Lib } = await import('fido2-lib');
     const mc = (Fido2Lib as any).createMdsCollection('FIDO MDS v3'); // createMdsCollection exists but not typed in official package!
     const tocObj = await mc.addToc(tocBase64);
     return tocObj.entries;
@@ -66,24 +47,30 @@ export function buf2hex(buffer) {
     .join('');
 }
 
-export const configureUsersWebAuthnModule = async ({
-  db,
-}: ModuleInput<any>): Promise<UsersWebAuthnModule> => {
-  const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
-
-  const thisDomain = new URL(ROOT_URL).hostname;
-
-  const f2l = new Fido2Lib({
-    rpId: thisDomain,
-    rpName: EMAIL_WEBSITE_NAME,
-    rpIcon:
-      'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
-    challengeSize: 128,
-    attestation: 'none',
-  });
+const initF2L = async () => {
+  try {
+    const thisDomain = new URL(ROOT_URL).hostname;
+    const { Fido2Lib } = await import('fido2-lib');
+    const f2l = new Fido2Lib({
+      rpId: thisDomain,
+      rpName: EMAIL_WEBSITE_NAME,
+      rpIcon:
+        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
+      challengeSize: 128,
+      attestation: 'none',
+    });
+    return f2l;
+  } catch {
+    logger.warn(`optional peer npm package 'fido2-lib' not installed, WebAuthn will not work`);
+    return null;
+  }
+};
 
+export const configureUsersWebAuthnModule = async ({ db }: ModuleInput<any>) => {
+  const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
+  const f2l = await initF2L();
   return {
-    findMDSMetadataForAAGUID: async (aaguid) => {
+    findMDSMetadataForAAGUID: async (aaguid: string) => {
       const mdsCollection = await fetchMDS();
       const foundEntry = mdsCollection.find((entry) => {
         return entry.aaguid === aaguid;
@@ -91,7 +78,13 @@ export const configureUsersWebAuthnModule = async ({
       return foundEntry?.metadataStatement;
     },
 
-    createCredentialCreationOptions: async (origin, username, extensionOptions) => {
+    createCredentialCreationOptions: async (
+      origin: string,
+      username: string,
+      extensionOptions?: any,
+    ) => {
+      if (!f2l) return null;
+
       const registrationOptions = await f2l.attestationOptions(extensionOptions);
       const challenge = Buffer.from(registrationOptions.challenge).toString('base64');
       const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
@@ -109,7 +102,13 @@ export const configureUsersWebAuthnModule = async ({
       } as SerializedOptions<PublicKeyCredentialCreationOptions>;
     },
 
-    createCredentialRequestOptions: async (origin, username, extensionOptions) => {
+    createCredentialRequestOptions: async (
+      origin: string,
+      username?: string,
+      extensionOptions?: any,
+    ) => {
+      if (!f2l) return null;
+
       const loginOptions = await f2l.assertionOptions(extensionOptions);
       const challenge = Buffer.from(loginOptions.challenge).toString('base64');
       const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
@@ -127,7 +126,9 @@ export const configureUsersWebAuthnModule = async ({
       } as SerializedOptions<PublicKeyCredentialRequestOptions>;
     },
 
-    verifyCredentialCreation: async (username, credentials) => {
+    verifyCredentialCreation: async (username: string, credentials: any) => {
+      if (!f2l) return null;
+
       const request = await WebAuthnCredentialsCreationRequests.findOne(
         {
           username,
@@ -174,7 +175,9 @@ export const configureUsersWebAuthnModule = async ({
       return { publicKey, counter, id: credentials.id, aaguid, created: new Date() };
     },
 
-    verifyCredentialRequest: async (userPublicKeys, username, credentials) => {
+    verifyCredentialRequest: async (userPublicKeys: any[], username: string, credentials: any) => {
+      if (!f2l) return null;
+
       const request = await WebAuthnCredentialsCreationRequests.findOne(
         {
           _id: credentials.requestId,
@@ -193,7 +196,7 @@ export const configureUsersWebAuthnModule = async ({
           return credentials.id === publicCredentials.id;
         }) || {};
 
-      if (!publicKey) throw new Error('WebAuthn not setup');
+      if (!publicKey) return null;
 
       const assertionExpectations = {
         challenge: request.challenge,

package/src/module/pbkdf2.ts

@@ -4,7 +4,7 @@ const PBKDF2_KEY_LENGTH = 256; // Bytes
 const PBKDF2_SALT_LENGTH = 16; // Bytes
 
 export function generateSalt(saltLength = PBKDF2_SALT_LENGTH) {
-  const array = new Uint32Array(saltLength);
+  const array = new Uint8Array(saltLength);
   return Buffer.from(crypto.getRandomValues(array)).toString('hex');
 }
 

package/src/module/removeConfidentialServiceHashes.test.ts

@@ -1,6 +1,6 @@
-import { User } from '../types.js';
 import { removeConfidentialServiceHashes } from './configureUsersModule.js';
 import user from '../../tests/mock/user-mock.js';
+import { User } from '../db/UsersCollection.js';
 
 describe('removeConfidentialServiceHashes', () => {
   it('Should remove sensitive user credentials ', () => {