@unchainedshop/core-users 4.3.5 → 4.5.0

package/lib/module/configureUsersWebAuthnModule.js

@@ -1,42 +1,48 @@
 import { createLogger } from '@unchainedshop/logger';
-import { WebAuthnCredentialsCreationRequestsCollection } from '../db/WebAuthnCredentialsCreationRequestsCollection.js';
+import pMemoize from 'p-memoize';
+import ExpiryMap from 'expiry-map';
+import { server as webauthnServer } from '@passwordless-id/webauthn';
+import { WebAuthnCredentialsCreationRequestsCollection } from "../db/WebAuthnCredentialsCreationRequestsCollection.js";
 const logger = createLogger('unchained:core-users');
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
 const { ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_NAME = 'Unchained' } = process.env;
-let Fido2Lib;
-try {
-    const fido2LibPackage = await import('fido2-lib');
-    Fido2Lib = fido2LibPackage.Fido2Lib;
-}
-catch {
-    logger.warn(`optional peer npm package 'fido2-lib' not installed, WebAuthn will not work`);
-}
-let setupMDSPromise;
-const setupMDSCollection = async () => {
+async function fetchMDSEntriesImpl() {
+    const cache = new Map();
     try {
-        const tocResult = await fetch('https://mds.fidoalliance.org');
-        const tocBase64 = await tocResult.text();
-        const mc = Fido2Lib.createMdsCollection('FIDO MDS v3');
-        // eslint-disable-next-line
-        // @ts-ignore
-        const tocObj = await mc.addToc(tocBase64);
-        return tocObj.entries;
+        const response = await fetch('https://mds.fidoalliance.org/');
+        if (!response.ok) {
+            logger.warn('Failed to fetch FIDO MDS', { status: response.status });
+            return cache;
+        }
+        const jwtBlob = await response.text();
+        const parts = jwtBlob.split('.');
+        if (parts.length !== 3) {
+            logger.warn('Invalid MDS JWT format');
+            return cache;
+        }
+        const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const decoded = Buffer.from(payload, 'base64').toString('utf-8');
+        const mdsData = JSON.parse(decoded);
+        if (Array.isArray(mdsData.entries)) {
+            for (const entry of mdsData.entries) {
+                if (entry.aaguid) {
+                    cache.set(entry.aaguid.toLowerCase(), entry);
+                }
+            }
+        }
+        logger.debug(`Loaded ${cache.size} MDS entries`);
     }
-    catch (e) {
-        logger.error(e);
-        return [];
+    catch (error) {
+        logger.warn('Error fetching MDS', { error: error.message });
     }
-};
-const fetchMDS = async () => {
-    if (setupMDSPromise)
-        return setupMDSPromise;
-    setupMDSPromise = setupMDSCollection();
-    return setupMDSPromise;
-};
+    return cache;
+}
+const mdsCache = new ExpiryMap(ONE_DAY_MS);
+const fetchMDSEntries = pMemoize(fetchMDSEntriesImpl, { cache: mdsCache });
 export function toArrayBuffer(buffer) {
     return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
 }
 export function buf2hex(buffer) {
-    // buffer is an ArrayBuffer
     return Array.prototype.map
         .call(new Uint8Array(buffer), (x) => `00${x.toString(16)}`.slice(-2))
         .join('');
@@ -44,128 +50,137 @@ export function buf2hex(buffer) {
 export const configureUsersWebAuthnModule = async ({ db }) => {
     const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
     const thisDomain = new URL(ROOT_URL).hostname;
-    const f2l = Fido2Lib &&
-        new Fido2Lib({
-            rpId: thisDomain,
-            rpName: EMAIL_WEBSITE_NAME,
-            rpIcon: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
-            challengeSize: 128,
-            attestation: 'none',
-        });
+    const thisOrigin = new URL(ROOT_URL).origin;
     return {
         findMDSMetadataForAAGUID: async (aaguid) => {
-            const mdsCollection = await fetchMDS();
-            const foundEntry = mdsCollection.find((entry) => {
-                return entry.aaguid === aaguid;
-            });
-            return foundEntry?.metadataStatement;
+            const mdsEntries = await fetchMDSEntries();
+            const entry = mdsEntries.get(aaguid.toLowerCase());
+            return entry?.metadataStatement || null;
         },
         createCredentialCreationOptions: async (origin, username, extensionOptions) => {
-            if (!f2l)
-                return null;
-            const registrationOptions = await f2l.attestationOptions(extensionOptions);
-            // Convert challenge to base64 without using Buffer
-            const challenge = btoa(String.fromCharCode(...new Uint8Array(registrationOptions.challenge)));
+            const challenge = webauthnServer.randomChallenge();
             const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
                 _id: new Date().getTime(),
                 challenge,
                 origin,
-                factor: registrationOptions.factor || 'either',
+                factor: 'either',
                 username,
             });
             return {
-                ...registrationOptions,
                 challenge,
                 requestId: insertedId,
+                rp: {
+                    id: thisDomain,
+                    name: EMAIL_WEBSITE_NAME,
+                },
+                user: {
+                    id: username,
+                    name: username,
+                    displayName: username,
+                },
+                pubKeyCredParams: [
+                    { type: 'public-key', alg: -7 },
+                    { type: 'public-key', alg: -257 },
+                ],
+                timeout: extensionOptions?.timeout || 60000,
+                attestation: 'none',
+                authenticatorSelection: extensionOptions?.authenticatorSelection || {
+                    userVerification: 'preferred',
+                },
             };
         },
         createCredentialRequestOptions: async (origin, username, extensionOptions) => {
-            if (!f2l)
-                return null;
-            const loginOptions = await f2l.assertionOptions(extensionOptions);
-            // Convert challenge to base64 without using Buffer
-            const challenge = btoa(String.fromCharCode(...new Uint8Array(loginOptions.challenge)));
+            const challenge = webauthnServer.randomChallenge();
             const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
                 _id: new Date().getTime(),
                 challenge,
                 origin,
-                factor: loginOptions.factor || 'either',
+                factor: 'either',
                 username,
             });
             return {
-                ...loginOptions,
                 challenge,
                 requestId: insertedId,
+                rpId: thisDomain,
+                timeout: extensionOptions?.timeout || 60000,
+                userVerification: extensionOptions?.userVerification || 'preferred',
+                allowCredentials: extensionOptions?.allowCredentials,
             };
         },
         verifyCredentialCreation: async (username, credentials) => {
-            if (!f2l)
-                return null;
             const request = await WebAuthnCredentialsCreationRequests.findOne({
                 username,
             }, { sort: { _id: -1 } });
-            if (!request)
+            if (!request) {
+                logger.error('WebAuthn: No credential creation request found for username', { username });
                 return null;
-            const attestationExpectations = {
-                challenge: request.challenge,
-                origin: request.origin,
-                factor: request.factor,
-            };
-            const id = Buffer.from(credentials.id, 'base64');
-            const attestationObject = Buffer.from(credentials.response.attestationObject, 'base64');
-            const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-            const attestationResponse = {
-                id: toArrayBuffer(id),
-                response: {
-                    attestationObject: toArrayBuffer(attestationObject),
-                    clientDataJSON: toArrayBuffer(clientDataJSON),
-                },
-            };
-            const registrationOptions = await f2l.attestationResult(attestationResponse, attestationExpectations);
-            const publicKey = registrationOptions?.authnrData?.get('credentialPublicKeyPem');
-            const aaguidArrayBuffer = registrationOptions?.authnrData?.get('aaguid'); // ArrayBuffer Uint8...
-            const counter = registrationOptions?.authnrData?.get('counter');
-            const aaguidConcatenated = buf2hex(aaguidArrayBuffer);
-            const aaguid = `${aaguidConcatenated.slice(0, 8)}-${aaguidConcatenated.slice(8, 12)}-${aaguidConcatenated.slice(12, 16)}-${aaguidConcatenated.slice(16, 20)}-${aaguidConcatenated.slice(20)}`;
-            return { publicKey, counter, id: credentials.id, aaguid, created: new Date() };
+            }
+            const expectedOrigin = request.origin || thisOrigin;
+            logger.info('WebAuthn: Verifying credential creation', {
+                username,
+                expectedOrigin,
+                expectedChallenge: request.challenge,
+                credentialId: credentials.id,
+            });
+            try {
+                const registrationInfo = await webauthnServer.verifyRegistration(credentials, {
+                    challenge: request.challenge,
+                    origin: expectedOrigin,
+                });
+                logger.info('WebAuthn: Credential creation verified successfully', {
+                    username,
+                    credentialId: registrationInfo.credential.id,
+                });
+                return {
+                    id: registrationInfo.credential.id,
+                    publicKey: registrationInfo.credential.publicKey,
+                    algorithm: registrationInfo.credential.algorithm,
+                    aaguid: registrationInfo.authenticator.aaguid,
+                    counter: registrationInfo.authenticator.counter,
+                    created: new Date(),
+                };
+            }
+            catch (error) {
+                logger.error('WebAuthn credential creation verification failed', {
+                    error: error.message,
+                    username,
+                    expectedOrigin,
+                    expectedChallenge: request.challenge,
+                });
+                return null;
+            }
         },
         verifyCredentialRequest: async (userPublicKeys, username, credentials) => {
-            if (!f2l)
-                return null;
             const request = await WebAuthnCredentialsCreationRequests.findOne({
                 _id: credentials.requestId,
             }, { sort: { _id: -1 } });
             if (!request)
                 return null;
-            const id = Buffer.from(credentials.id, 'base64');
-            const authenticatorData = Buffer.from(credentials.response.authenticatorData, 'base64');
-            const signature = Buffer.from(credentials.response.signature, 'base64');
-            const userHandle = Buffer.from(credentials.response.userHandle, 'base64');
-            const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-            const { publicKey, counter } = userPublicKeys.find((publicCredentials) => {
-                return credentials.id === publicCredentials.id;
-            }) || {};
-            if (!publicKey)
+            const matchingKey = userPublicKeys.find((key) => key.id === credentials.id);
+            if (!matchingKey)
                 return null;
-            const assertionExpectations = {
-                challenge: request.challenge,
-                origin: request.origin,
-                factor: request.factor,
-                prevCounter: counter,
-                publicKey,
-                userHandle: toArrayBuffer(Buffer.from(username)),
-            };
-            const assertionResponse = {
-                id: toArrayBuffer(id),
-                response: {
-                    authenticatorData: toArrayBuffer(authenticatorData),
-                    clientDataJSON: toArrayBuffer(clientDataJSON),
-                    signature: toArrayBuffer(signature),
-                    userHandle: toArrayBuffer(userHandle),
-                },
-            };
-            const loginResult = await f2l.assertionResult(assertionResponse, assertionExpectations);
-            return { userHandle: loginResult?.authnrData?.get('userHandle') };
+            try {
+                const credentialKey = {
+                    id: matchingKey.id,
+                    publicKey: matchingKey.publicKey,
+                    algorithm: matchingKey.algorithm || 'ES256',
+                    transports: matchingKey.transports || [],
+                };
+                const authenticationInfo = await webauthnServer.verifyAuthentication(credentials, credentialKey, {
+                    challenge: request.challenge,
+                    origin: request.origin || thisOrigin,
+                    userVerified: false,
+                    counter: matchingKey.counter,
+                });
+                return {
+                    userHandle: credentials.response.userHandle || username,
+                    counter: authenticationInfo.counter,
+                };
+            }
+            catch (error) {
+                logger.debug('WebAuthn credential request verification failed', { error: error.message });
+                return null;
+            }
         },
         deleteUserWebAuthnCredentials: async (username) => {
             const { deletedCount } = await WebAuthnCredentialsCreationRequests.deleteMany({
@@ -175,4 +190,3 @@ export const configureUsersWebAuthnModule = async ({ db }) => {
         },
     };
 };
-//# sourceMappingURL=configureUsersWebAuthnModule.js.map

package/lib/module/pbkdf2.d.ts

@@ -1,4 +1,3 @@
 export declare function generateSalt(saltLength?: number): string;
 export declare function getDerivedKey(salt: string, password: string, iterations?: number, keyLength?: number): Promise<string>;
 export declare function compare(password: string, hash: string, salt: string): Promise<boolean>;
-//# sourceMappingURL=pbkdf2.d.ts.map

package/lib/module/pbkdf2.js

@@ -1,11 +1,9 @@
-// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
-const PBKDF2_ITERATIONS = 300000; // Iterations, > 210'000
-const PBKDF2_KEY_LENGTH = 256; // Bytes
-const PBKDF2_SALT_LENGTH = 16; // Bytes
+const PBKDF2_ITERATIONS = 300000;
+const PBKDF2_KEY_LENGTH = 256;
+const PBKDF2_SALT_LENGTH = 16;
 export function generateSalt(saltLength = PBKDF2_SALT_LENGTH) {
     const array = new Uint8Array(saltLength);
     crypto.getRandomValues(array);
-    // Convert to hex string without using Buffer
     return Array.from(array)
         .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
@@ -22,7 +20,6 @@ export async function getDerivedKey(salt, password, iterations = PBKDF2_ITERATIO
         salt: textEncoder.encode(salt),
         iterations,
     }, importedKey, keyLength);
-    // Convert ArrayBuffer to hex string without using Buffer
     return Array.from(new Uint8Array(bits))
         .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
@@ -31,4 +28,3 @@ export async function compare(password, hash, salt) {
     const comparableHash = await getDerivedKey(salt, password);
     return comparableHash === hash;
 }
-//# sourceMappingURL=pbkdf2.js.map

package/lib/users-index.d.ts

@@ -1,6 +1,5 @@
-export * from './db/UsersCollection.js';
-export * from './db/WebAuthnCredentialsCreationRequestsCollection.js';
-export * from './module/configureUsersModule.js';
-export * from './module/configureUsersWebAuthnModule.js';
-export * from './users-settings.js';
-//# sourceMappingURL=users-index.d.ts.map
+export * from './db/UsersCollection.ts';
+export * from './db/WebAuthnCredentialsCreationRequestsCollection.ts';
+export * from './module/configureUsersModule.ts';
+export * from './module/configureUsersWebAuthnModule.ts';
+export * from './users-settings.ts';

package/lib/users-index.js

@@ -1,6 +1,5 @@
-export * from './db/UsersCollection.js';
-export * from './db/WebAuthnCredentialsCreationRequestsCollection.js';
-export * from './module/configureUsersModule.js';
-export * from './module/configureUsersWebAuthnModule.js';
-export * from './users-settings.js';
-//# sourceMappingURL=users-index.js.map
+export * from "./db/UsersCollection.js";
+export * from "./db/WebAuthnCredentialsCreationRequestsCollection.js";
+export * from "./module/configureUsersModule.js";
+export * from "./module/configureUsersWebAuthnModule.js";
+export * from "./users-settings.js";

package/lib/users-settings.d.ts

@@ -1,21 +1,22 @@
-import { mongodb } from '@unchainedshop/mongodb';
-import { User } from './db/UsersCollection.js';
+import { type mongodb } from '@unchainedshop/mongodb';
+import type { User } from './db/UsersCollection.ts';
 export interface UserRegistrationData extends Partial<User> {
     email?: string;
     password: string | null;
     webAuthnPublicKeyCredentials?: any;
 }
-export declare enum UserAccountAction {
-    RESET_PASSWORD = "reset-password",
-    VERIFY_EMAIL = "verify-email",
-    ENROLL_ACCOUNT = "enroll-account",
-    PASSWORD_RESETTED = "password-resetted",
-    EMAIL_VERIFIED = "email-verified"
-}
+export declare const UserAccountAction: {
+    readonly RESET_PASSWORD: "reset-password";
+    readonly VERIFY_EMAIL: "verify-email";
+    readonly ENROLL_ACCOUNT: "enroll-account";
+    readonly PASSWORD_RESETTED: "password-resetted";
+    readonly EMAIL_VERIFIED: "email-verified";
+};
+export type UserAccountAction = (typeof UserAccountAction)[keyof typeof UserAccountAction];
 export interface UserSettings {
     mergeUserCartsOnLogin: boolean;
     autoMessagingAfterUserCreation: boolean;
-    earliestValidTokenDate: (type: UserAccountAction.VERIFY_EMAIL | UserAccountAction.RESET_PASSWORD) => Date;
+    earliestValidTokenDate: (type: typeof UserAccountAction.VERIFY_EMAIL | typeof UserAccountAction.RESET_PASSWORD) => Date;
     validateEmail: (email: string) => Promise<boolean>;
     validateUsername: (username: string) => Promise<boolean>;
     validateNewUser: (user: UserRegistrationData) => Promise<UserRegistrationData>;
@@ -24,4 +25,3 @@ export interface UserSettings {
 }
 export type UserSettingsOptions = Omit<Partial<UserSettings>, 'configureSettings'>;
 export declare const userSettings: UserSettings;
-//# sourceMappingURL=users-settings.d.ts.map

package/lib/users-settings.js

@@ -1,16 +1,14 @@
 import { insensitiveTrimmedRegexOperator } from '@unchainedshop/mongodb';
-export var UserAccountAction;
-(function (UserAccountAction) {
-    UserAccountAction["RESET_PASSWORD"] = "reset-password";
-    UserAccountAction["VERIFY_EMAIL"] = "verify-email";
-    UserAccountAction["ENROLL_ACCOUNT"] = "enroll-account";
-    UserAccountAction["PASSWORD_RESETTED"] = "password-resetted";
-    UserAccountAction["EMAIL_VERIFIED"] = "email-verified";
-})(UserAccountAction || (UserAccountAction = {}));
+export const UserAccountAction = {
+    RESET_PASSWORD: 'reset-password',
+    VERIFY_EMAIL: 'verify-email',
+    ENROLL_ACCOUNT: 'enroll-account',
+    PASSWORD_RESETTED: 'password-resetted',
+    EMAIL_VERIFIED: 'email-verified',
+};
 const defaultAutoMessagingAfterUserCreation = true;
 const defaultMergeUserCartsOnLogin = true;
 const defaultEarliestValidTokenDate = () => {
-    // 1 hour ago
     return new Date(new Date().getTime() - 1000 * 60 * 60);
 };
 const defaultValidateNewUser = async (user) => {
@@ -63,4 +61,3 @@ export const userSettings = {
         userSettings.validatePassword = validatePassword || defaultValidatePassword;
     },
 };
-//# sourceMappingURL=users-settings.js.map

package/lib/utils/web3-verification.d.ts

@@ -0,0 +1 @@
+export declare function verifyWeb3Signature(nonce: string, signature: `0x${string}`, expectedAddress: string): Promise<boolean>;

package/lib/utils/web3-verification.js

@@ -0,0 +1,81 @@
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:core-users');
+let secp256k1;
+let keccak_256;
+let bytesToHex;
+let hexToBytes;
+async function loadNoblePackages() {
+    try {
+        const curves = await import('@noble/curves/secp256k1.js');
+        const hashes = await import('@noble/hashes/sha3.js');
+        const utils = await import('@noble/hashes/utils.js');
+        if (!curves || !hashes || !utils) {
+            throw new Error('Missing required @noble packages for Web3 signature verification');
+        }
+        secp256k1 = curves.secp256k1;
+        keccak_256 = hashes.keccak_256;
+        bytesToHex = utils.bytesToHex;
+        hexToBytes = utils.hexToBytes;
+        return true;
+    }
+    catch (error) {
+        logger.warn('Failed to load @noble packages for Web3 verification', { error: error.message });
+        return false;
+    }
+}
+function fromRPCSig(sig) {
+    const bytes = hexToBytes(sig.startsWith('0x') ? sig.slice(2) : sig);
+    if (bytes.length !== 65)
+        throw new Error('Invalid signature length');
+    const r = bytes.slice(0, 32);
+    const s = bytes.slice(32, 64);
+    let v = BigInt(bytes[64]);
+    if (v >= 35n) {
+        v = v - 35n - 2n * 1n;
+    }
+    else if (v >= 27n) {
+        v = v - 27n;
+    }
+    return { v, r, s };
+}
+function hashPersonalMessage(message) {
+    const prefix = new TextEncoder().encode('\x19Ethereum Signed Message:\n');
+    const lengthBytes = new TextEncoder().encode(message.length.toString());
+    const combined = new Uint8Array(prefix.length + lengthBytes.length + message.length);
+    combined.set(prefix, 0);
+    combined.set(lengthBytes, prefix.length);
+    combined.set(message, prefix.length + lengthBytes.length);
+    return keccak_256(combined);
+}
+function ecrecover(msgHash, v, r, s) {
+    const recovery = Number(v);
+    const signature = new Uint8Array(64);
+    signature.set(r, 0);
+    signature.set(s, 32);
+    const publicKey = secp256k1.Signature.fromBytes(signature)
+        .addRecoveryBit(recovery)
+        .recoverPublicKey(msgHash);
+    return publicKey.toBytes(false).slice(1);
+}
+function publicToAddress(publicKey) {
+    const hash = keccak_256(publicKey);
+    return hash.slice(-20);
+}
+export async function verifyWeb3Signature(nonce, signature, expectedAddress) {
+    const packagesLoaded = await loadNoblePackages();
+    if (!packagesLoaded) {
+        throw new Error('Web3 signature verification is not available. Please install the required @noble packages: @noble/curves, @noble/hashes');
+    }
+    try {
+        const messageHash = hashPersonalMessage(hexToBytes(Buffer.from(nonce, 'utf8').toString('hex')));
+        const sigParams = fromRPCSig(signature);
+        const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+        const sender = publicToAddress(publicKey);
+        const recoveredAddr = `0x${bytesToHex(sender)}`;
+        return recoveredAddr.toLowerCase() === expectedAddress.toLowerCase();
+    }
+    catch (error) {
+        logger.debug('Web3 signature verification failed', { error: error.message });
+        return false;
+    }
+}

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@unchainedshop/core-users",
-  "version": "4.3.5",
+  "version": "4.5.0",
   "main": "lib/users-index.js",
   "types": "lib/users-index.d.ts",
   "type": "module",
+  "sideEffects": false,
   "scripts": {
     "clean": "tsc -b --clean",
     "build": "tsc -b",
     "prepublishOnly": "npm run clean && npm run build",
     "watch": "tsc -w",
-    "test": "tsx --test",
-    "test:watch": "tsx --test --watch"
+    "test": "node --test",
+    "test:watch": "node --test --watch"
   },
   "repository": {
     "type": "git",
@@ -22,8 +23,10 @@
     "core"
   ],
   "authors": [
-    "Joël Meiller",
-    "Pascal Kaufmann"
+    "Pascal Kaufmann",
+    "Mikael Araya",
+    "Vedran Rudelj",
+    "Joël Meiller"
   ],
   "license": "EUPL-1.2",
   "bugs": {
@@ -31,26 +34,33 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
+    "@passwordless-id/webauthn": "^2.3.1",
+    "@unchainedshop/events": "^4.5.0",
+    "@unchainedshop/file-upload": "^4.5.0",
+    "@unchainedshop/logger": "^4.5.0",
+    "@unchainedshop/mongodb": "^4.5.0",
+    "@unchainedshop/roles": "^4.5.0",
+    "@unchainedshop/utils": "^4.5.0",
     "bcryptjs": "^3.0.2",
-    "@unchainedshop/events": "^4.3.0",
-    "@unchainedshop/file-upload": "^4.3.0",
-    "@unchainedshop/logger": "^4.3.0",
-    "@unchainedshop/mongodb": "^4.3.0",
-    "@unchainedshop/roles": "^4.3.0",
-    "@unchainedshop/utils": "^4.3.0"
+    "expiry-map": "^2.0.0",
+    "p-memoize": "^8.0.0"
   },
   "peerDependencies": {
-    "fido2-lib": ">= 3.5 < 4"
+    "@noble/curves": "^2.0.0",
+    "@noble/hashes": "^2.0.0"
   },
   "peerDependenciesMeta": {
-    "fido2-lib": {
+    "@noble/curves": {
+      "optional": true
+    },
+    "@noble/hashes": {
       "optional": true
     }
   },
   "devDependencies": {
-    "@types/node": "^24.0.13",
-    "fido2-lib": "^3.5.3",
-    "tsx": "^4.20.3",
+    "@noble/curves": "^2.0.0",
+    "@noble/hashes": "^2.0.0",
+    "@types/node": "^25.0.0",
     "typescript": "^5.8.3"
   }
 }

package/lib/db/UsersCollection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UsersCollection.d.ts","sourceRoot":"","sources":["../../src/db/UsersCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,OAAO,EACP,OAAO,EACP,OAAO,EAGR,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,IAAI,GAAG;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,GAAG,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,GAAG,eAAe,CAAC;AAEpB,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,eAAe,GAAU,IAAI,OAAO,CAAC,EAAE,sCAyGnD,CAAC"}

package/lib/db/UsersCollection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UsersCollection.js","sourceRoot":"","sources":["../../src/db/UsersCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,cAAc,EACd,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AA6DhC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,EAAc,EAAE,EAAE;IACtD,MAAM,KAAK,GAAG,EAAE,CAAC,UAAU,CAAO,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,6BAA6B,EAAE,EAAE,CAAC;QACrC,MAAM,cAAc,CAAO,KAAK,EAAE;YAChC;gBACE,KAAK,EAAE;oBACL,GAAG,EAAE,MAAM;oBACX,QAAQ,EAAE,MAAM;oBAChB,gBAAgB,EAAE,MAAM;oBACxB,qBAAqB,EAAE,MAAM;oBAC7B,8BAA8B,EAAE,MAAM;oBACtC,6BAA6B,EAAE,MAAM;oBACrC,4BAA4B,EAAE,MAAM;oBACpC,gCAAgC,EAAE,MAAM;oBACxC,iCAAiC,EAAE,MAAM;iBACnC;gBACR,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP,GAAG,EAAE,CAAC;wBACN,gBAAgB,EAAE,CAAC;wBACnB,qBAAqB,EAAE,CAAC;wBACxB,8BAA8B,EAAE,CAAC;wBACjC,6BAA6B,EAAE,CAAC;wBAChC,4BAA4B,EAAE,CAAC;wBAC/B,gCAAgC,EAAE,CAAC;wBACnC,iCAAiC,EAAE,CAAC;qBACrC;oBACD,IAAI,EAAE,sBAAsB;iBAC7B;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,CAAO,KAAK,EAAE;QAChC;YACE,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,CAAC;aACT;YACD,OAAO,EAAE,EAAE;SACZ;QACD;YACE,KAAK,EAAE;gBACL,KAAK,EAAE,CAAC;aACT;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;aACb;SACF;QACD;YACE,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC;aACX;YACD,OAAO,EAAE,EAAE;SACZ;QACD;YACE,KAAK,EAAE;gBACL,QAAQ,EAAE,CAAC;aACZ;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI;aACb;SACF;QACD;YACE,KAAK,EAAE;gBACL,gBAAgB,EAAE,CAAC;aACb;YACR,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI;aACb;SACF;QAED;YACE,KAAK,EAAE;gBACL,yCAAyC,EAAE,CAAC;aACtC;YACR,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;aACb;SACF;QAED;YACE,KAAK,EAAE;gBACL,+BAA+B,EAAE,CAAC;aAC5B;YACR,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;aACb;SACF;QAED;YACE,KAAK,EAAE;gBACL,uBAAuB,EAAE,CAAC;aAC3B;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI;aACb;SACF;KACF,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/lib/db/WebAuthnCredentialsCreationRequestsCollection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"WebAuthnCredentialsCreationRequestsCollection.d.ts","sourceRoot":"","sources":["../../src/db/WebAuthnCredentialsCreationRequestsCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAkB,MAAM,wBAAwB,CAAC;AAEjE,MAAM,WAAW,kCAAkC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACvC;AAED,KAAK,UAAU,GAAG,kCAAkC,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,eAAO,MAAM,6CAA6C,GAAU,IAAI,OAAO,CAAC,EAAE,4CAcjF,CAAC"}

package/lib/db/WebAuthnCredentialsCreationRequestsCollection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"WebAuthnCredentialsCreationRequestsCollection.js","sourceRoot":"","sources":["../../src/db/WebAuthnCredentialsCreationRequestsCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAWjE,MAAM,CAAC,MAAM,6CAA6C,GAAG,KAAK,EAAE,EAAc,EAAE,EAAE;IACpF,MAAM,mCAAmC,GAAG,EAAE,CAAC,UAAU,CACvD,iDAAiD,CAClD,CAAC;IAEF,MAAM,cAAc,CAAa,mCAAmC,EAAE;QACpE;YACE,KAAK,EAAE;gBACL,QAAQ,EAAE,CAAC;aACZ;SACF;KACF,CAAC,CAAC;IAEH,OAAO,mCAAmC,CAAC;AAC7C,CAAC,CAAC"}

package/lib/module/configureUsersModule.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"configureUsersModule.d.ts","sourceRoot":"","sources":["../../src/module/configureUsersModule.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,OAAO,EACP,OAAO,EAGP,OAAO,EAIR,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,IAAI,EACJ,SAAS,EACT,KAAK,EACL,aAAa,EACb,WAAW,EAEZ,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAA+B,UAAU,EAAU,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAEL,oBAAoB,EAEpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAqB9B,eAAO,MAAM,+BAA+B,GAAI,SAAS,IAAI,KAAG,IAI/D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,yFAQ/B,SAAS,yBA6BX,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,aAAa,WAAW,CAAC,mBAAmB,CAAC;;;;;;;;;;;;;;;;;;;;;;;iBAUjE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;yBAKnB,MAAM;iCAKE,MAAM;2BAKZ,MAAM;yCAKQ,MAAM,GAAG,OAAO,CAAC;QAC1D,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,CAAC;KACZ,GAAG,IAAI,CAAC;wBAsBiB,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;+BA2BhC,MAAM,GAAG,OAAO,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,CAAC;KACZ,GAAG,IAAI,CAAC;gCAqByB,MAAM;oBAYlB,SAAS,GAAG;QAAE,IAAI,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,gBAAgB,OAAO,CAAC,WAAW;2CASzF,SAAS,GAAG;QACb,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;2BAoBU;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;uBAS/C,IAAI,GAAG,KAAK;qBAMd,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM;4BAW3B,oBAAoB,+CAI9B;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/D,OAAO,CAAC,MAAM,CAAC;2BAiFW,MAAM,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;sEAOmD;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,iBACxE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;qBAYI,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;wBAiBpC,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;mCAW5B,MAAM,SAAS,MAAM,iBAAiB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;kCAyB9D,MAAM,SAAS,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;uBAyBhD,MAAM,SAAS,MAAM,EAAE;wBAmBtB,MAAM,YAAY,MAAM;wBAoBxB,MAAM,iBAAiB,MAAM;yBAwB5B,MAAM,eAAe,MAAM;wBA4B5B,MAAM,UAAU,MAAM;wBAoBtB,IAAI,SAAS,OAAO;8BAkBd,MAAM,aAAa,aAAa;0BAsBpC,MAAM;oCAkCI;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;4BAI1B,MAAM,eAAe;QAAE,OAAO,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE;oCAoClD,MAAM,sBAAsB,OAAO;6BAmC1C,MAAM,eAAe,OAAO;uBA8BlC,MAAM,SAAS,MAAM,EAAE;sBAkBxB,MAAM,QAAQ,MAAM,EAAE;2BAqBlC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,YACpB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,kBACpB,OAAO,CAAC,uBAAuB;kCAcvC,MAAM,gBACA,GAAG,wBACK;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,yBAAyB,EAAE,OAAO,CAAC;KACpC,KACA,OAAO,CAAC,IAAI,CAAC;qCAyBuB,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;wBAWrD,OAAO,CAAC,MAAM,EAAE,CAAC;EAQ5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC"}