@unchainedshop/core-users 4.4.0 → 4.6.0

package/README.md

@@ -120,6 +120,37 @@ await usersModule.updateProfile(userId, {
 | `USER_UPDATE_ROLES` | Roles changed |
 | `USER_ACCOUNT_ACTION` | Account action triggered |
 
+## Security
+
+This module implements security best practices for user authentication and data protection.
+
+### Password Security
+
+- **Algorithm**: PBKDF2 with SHA-512
+- **Iterations**: 300,000 (exceeds OWASP recommendation)
+- **Salt**: 16 bytes, cryptographically random per password
+- **Key Length**: 256 bytes
+- **FIPS 140-3**: Compatible when running on FIPS-enabled Node.js
+
+### Token Security
+
+- **Generation**: `crypto.randomUUID()` (CSPRNG-based)
+- **Storage**: SHA-256 hashed before database storage
+- **Expiration**: Time-limited (configurable, default 1 hour)
+- **Single-use**: Tokens invalidated after verification
+
+### WebAuthn/FIDO2
+
+Full support for passwordless authentication via hardware security keys and platform authenticators, providing phishing-resistant authentication.
+
+### Data Protection
+
+- Sensitive data (password hashes, tokens) stripped from event emissions via `removeConfidentialServiceHashes()`
+- Soft delete preserves audit trail while removing PII
+- Email addresses and profile data access-controlled via RBAC
+
+See [SECURITY.md](../../SECURITY.md) for complete security documentation.
+
 ## License
 
 EUPL-1.2

package/lib/db/UsersCollection.d.ts

@@ -30,7 +30,7 @@ export interface Email {
 }
 export type User = {
     _id: string;
-    deleted?: Date;
+    deleted?: Date | null;
     avatarId?: string;
     emails: Email[];
     guest: boolean;
@@ -46,11 +46,15 @@ export type User = {
     username?: string;
     meta?: any;
 } & TimestampFields;
-export type UserQuery = mongodb.Filter<User> & {
+export interface UserQuery {
     includeGuests?: boolean;
     includeDeleted?: boolean;
     queryString?: string;
     emailVerified?: boolean;
     lastLogin?: DateFilterInput;
-};
+    tags?: string[];
+    userIds?: string[];
+    username?: string;
+    web3Verified?: boolean;
+}
 export declare const UsersCollection: (db: mongodb.Db) => Promise<mongodb.Collection<User>>;

package/lib/db/WebAuthnCredentialsCreationRequestsCollection.d.ts

@@ -6,7 +6,7 @@ export interface WebAuthnCredentialsCreationRequest {
     factor: 'first' | 'second' | 'either';
 }
 type Collection = WebAuthnCredentialsCreationRequest & {
-    _id: number;
+    _id: string;
 };
 export declare const WebAuthnCredentialsCreationRequestsCollection: (db: mongodb.Db) => Promise<mongodb.Collection<Collection>>;
 export {};

package/lib/migrations/20241218092300-convert-locale.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationRepository } from '@unchainedshop/mongodb';
+export default function convertUserLocale(repository: MigrationRepository): void;

package/lib/migrations/20241218092300-convert-locale.js

@@ -0,0 +1,36 @@
+import { UsersCollection } from "../db/UsersCollection.js";
+import { systemLocale } from '@unchainedshop/utils';
+export default function convertUserLocale(repository) {
+    repository?.register({
+        id: 20241218092300,
+        name: 'Convert user.lastLogin.locale',
+        up: async () => {
+            const Users = await UsersCollection(repository.db);
+            const users = await Users.find({
+                'lastLogin.locale': { $exists: true },
+            }, { projection: { _id: true, lastLogin: true } }).toArray();
+            for (const user of users) {
+                let newLocale;
+                const currentLocale = user.lastLogin?.locale;
+                if (!currentLocale)
+                    continue;
+                try {
+                    newLocale = new Intl.Locale(currentLocale).baseName;
+                }
+                catch {
+                    try {
+                        newLocale = new Intl.Locale(currentLocale.split('_').join('-')).baseName;
+                    }
+                    catch {
+                        newLocale = systemLocale.baseName;
+                    }
+                }
+                await Users.updateOne({
+                    _id: user._id,
+                }, {
+                    $set: { 'lastLogin.locale': newLocale },
+                });
+            }
+        },
+    });
+}

package/lib/module/configureUsersModule.d.ts

@@ -3,27 +3,40 @@ import { type User, type UserQuery, type Email, type UserLastLogin, type UserPro
 import { type SortOption } from '@unchainedshop/utils';
 import { type UserRegistrationData, type UserSettingsOptions } from '../users-settings.ts';
 export declare const removeConfidentialServiceHashes: (rawUser: User) => User;
-export declare const buildFindSelector: ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, ...rest }: UserQuery) => mongodb.Filter<User>;
+export declare const buildFindSelector: ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, web3Verified, }: UserQuery) => mongodb.Filter<User>;
 export declare const configureUsersModule: (moduleInput: ModuleInput<UserSettingsOptions>) => Promise<{
     webAuthn: {
-        findMDSMetadataForAAGUID: (aaguid: string) => Promise<any>;
-        createCredentialCreationOptions: (origin: string, username: string, extensionOptions?: any) => Promise<(Omit<import("fido2-lib").PublicKeyCredentialCreationOptions, "challenge" | "requestId"> & {
-            challenge: string;
-            requestId: number;
-        }) | null>;
-        createCredentialRequestOptions: (origin: string, username: string, extensionOptions?: any) => Promise<(Omit<import("fido2-lib").PublicKeyCredentialRequestOptions, "challenge" | "requestId"> & {
-            challenge: string;
-            requestId: number;
-        }) | null>;
-        verifyCredentialCreation: (username: string, credentials: any) => Promise<{
-            publicKey: any;
-            counter: any;
-            id: any;
-            aaguid: string;
-            created: Date;
+        findMDSMetadataForAAGUID: (aaguid: string) => Promise<{
+            [key: string]: unknown;
+            description?: string;
+            icon?: string;
+            authenticatorGetInfo?: {
+                versions?: string[];
+                extensions?: string[];
+                options?: Record<string, boolean>;
+            };
         } | null>;
-        verifyCredentialRequest: (userPublicKeys: any[], username: string, credentials: any) => Promise<{
-            userHandle: any;
+        createCredentialCreationOptions: (origin: string, username: string, extensionOptions?: {
+            timeout?: number;
+            authenticatorSelection?: import("./configureUsersWebAuthnModule.ts").WebAuthnCredentialCreationOptions["authenticatorSelection"];
+        }) => Promise<import("./configureUsersWebAuthnModule.ts").WebAuthnCredentialCreationOptions>;
+        createCredentialRequestOptions: (origin: string, username: string, extensionOptions?: {
+            timeout?: number;
+            userVerification?: "required" | "preferred" | "discouraged";
+            allowCredentials?: import("./configureUsersWebAuthnModule.ts").WebAuthnCredentialRequestOptions["allowCredentials"];
+        }) => Promise<import("./configureUsersWebAuthnModule.ts").WebAuthnCredentialRequestOptions>;
+        verifyCredentialCreation: (username: string, credentials: import("@passwordless-id/webauthn/dist/esm/types.js").RegistrationJSON) => Promise<import("./configureUsersWebAuthnModule.ts").WebAuthnCredential | null>;
+        verifyCredentialRequest: (userPublicKeys: {
+            id: string;
+            publicKey: string;
+            algorithm?: import("@passwordless-id/webauthn/dist/esm/types.js").NamedAlgo;
+            counter?: number;
+            transports?: import("@passwordless-id/webauthn/dist/esm/types.js").ExtendedAuthenticatorTransport[];
+        }[], username: string, credentials: import("@passwordless-id/webauthn/dist/esm/types.js").AuthenticationJSON & {
+            requestId: string;
+        }) => Promise<{
+            userHandle: string;
+            counter: number;
         } | null>;
         deleteUserWebAuthnCredentials: (username: string) => Promise<number>;
     };
@@ -69,6 +82,28 @@ export declare const configureUsersModule: (moduleInput: ModuleInput<UserSetting
     }, plainPassword: string): Promise<boolean>;
     addEmail(userId: string, address: string): Promise<void>;
     removeEmail(userId: string, address: string): Promise<void>;
+    addWeb3Address(userId: string, address: string): Promise<User | null>;
+    removeWeb3Address(userId: string, address: string): Promise<User | null>;
+    findWeb3Address(user: User, address: string): {
+        address: string;
+        nonce?: string;
+        verified?: boolean;
+    } | null;
+    addWebAuthnCredential(userId: string, webAuthnService: {
+        id: string;
+        publicKey: string;
+        created: Date;
+    }): Promise<User | null>;
+    removeWebAuthnCredential(userId: string, credentialsId: string): Promise<User | null>;
+    createAccessToken(username: string): Promise<{
+        user: User;
+        token: string;
+    } | null>;
+    setAccessToken(username: string, plainSecret: string): Promise<User | null>;
+    verifyWeb3SignatureAndUpdate(user: User, credentials: {
+        address: string;
+        nonce: string;
+    }, signature: `0x${string}`): Promise<User | null>;
     sendResetPasswordEmail(userId: string, email: string, isEnrollment?: boolean): Promise<void>;
     sendVerificationEmail(userId: string, email: string): Promise<void>;
     addRoles: (userId: string, roles: string[]) => Promise<mongodb.WithId<User> | null>;

package/lib/module/configureUsersModule.js

@@ -6,6 +6,8 @@ import { systemLocale, SortDirection, sha256 } from '@unchainedshop/utils';
 import { UserAccountAction, userSettings, } from "../users-settings.js";
 import { configureUsersWebAuthnModule } from "./configureUsersWebAuthnModule.js";
 import * as pbkdf2 from "./pbkdf2.js";
+import { verifyWeb3Signature } from "../utils/web3-verification.js";
+import convertUserLocale from "../migrations/20241218092300-convert-locale.js";
 const USER_EVENTS = [
     'USER_ACCOUNT_ACTION',
     'USER_CREATE',
@@ -21,6 +23,7 @@ const USER_EVENTS = [
     'USER_UPDATE_HEARTBEAT',
     'USER_UPDATE_BILLING_ADDRESS',
     'USER_UPDATE_LAST_CONTACT',
+    'USER_UPDATE_WEB3_ADDRESS',
     'USER_REMOVE',
 ];
 export const removeConfidentialServiceHashes = (rawUser) => {
@@ -28,12 +31,18 @@ export const removeConfidentialServiceHashes = (rawUser) => {
     delete user?.services;
     return user;
 };
-export const buildFindSelector = ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, ...rest }) => {
-    const selector = { ...rest };
+export const buildFindSelector = ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, web3Verified, }) => {
+    const selector = {};
     if (!includeDeleted)
         selector.deleted = null;
     if (!includeGuests)
         selector.guest = { $ne: true };
+    if (userIds) {
+        selector._id = { $in: userIds };
+    }
+    if (username) {
+        selector.username = insensitiveTrimmedRegexOperator(username);
+    }
     if (emailVerified === true) {
         selector['emails.verified'] = true;
     }
@@ -43,6 +52,9 @@ export const buildFindSelector = ({ includeGuests, includeDeleted, queryString,
     if (emailVerified === false) {
         selector['emails.verified'] = { $ne: true };
     }
+    if (web3Verified === true) {
+        selector['services.web3.verified'] = true;
+    }
     if (lastLogin?.start) {
         selector['lastLogin.timestamp'] = { $exists: true };
     }
@@ -59,7 +71,8 @@ export const buildFindSelector = ({ includeGuests, includeDeleted, queryString,
     return selector;
 };
 export const configureUsersModule = async (moduleInput) => {
-    const { db, options } = moduleInput;
+    const { db, options, migrationRepository } = moduleInput;
+    convertUserLocale(migrationRepository);
     userSettings.configureSettings(options || {}, db);
     registerEvents(USER_EVENTS);
     const Users = await UsersCollection(db);
@@ -176,7 +189,7 @@ export const configureUsersModule = async (moduleInput) => {
             }).toArray();
         },
         async userExists({ userId }) {
-            const userCount = await Users.countDocuments({ _id: userId, deleted: { $exists: false } }, { limit: 1 });
+            const userCount = await Users.countDocuments({ _id: userId, deleted: null }, { limit: 1 });
             return userCount === 1;
         },
         primaryEmail(user) {
@@ -196,6 +209,9 @@ export const configureUsersModule = async (moduleInput) => {
             const { password, email, username, initialPassword, roles, webAuthnPublicKeyCredentials, ...userData } = await userSettings.validateNewUser(rawUserData);
             const webAuthnService = webAuthnPublicKeyCredentials &&
                 (await this.webAuthn.verifyCredentialCreation(username, webAuthnPublicKeyCredentials));
+            if (webAuthnPublicKeyCredentials && !webAuthnService) {
+                throw new Error('WebAuthn credential verification failed', { cause: 'WEBAUTHN_INVALID' });
+            }
             const services = {};
             if (email) {
                 if (!(await userSettings.validateEmail(email))) {
@@ -288,6 +304,122 @@ export const configureUsersModule = async (moduleInput) => {
                 },
             });
         },
+        async addWeb3Address(userId, address) {
+            const user = await Users.findOne(generateDbFilterById(userId), {});
+            if (!user)
+                return null;
+            const existingEntry = user.services?.web3?.find((service) => service.address.toLowerCase() === address.toLowerCase());
+            if (existingEntry)
+                return user;
+            const nonce = crypto.randomUUID();
+            const updatedUser = await Users.findOneAndUpdate(generateDbFilterById(userId), {
+                $push: {
+                    'services.web3': {
+                        address,
+                        nonce,
+                    },
+                },
+            }, { returnDocument: 'after' });
+            if (!updatedUser)
+                return null;
+            await emit('USER_UPDATE_WEB3_ADDRESS', {
+                action: 'add',
+                address,
+                user: removeConfidentialServiceHashes(updatedUser),
+            });
+            return updatedUser;
+        },
+        async removeWeb3Address(userId, address) {
+            const user = await Users.findOne(generateDbFilterById(userId), {});
+            if (!user)
+                return null;
+            const existingEntry = user.services?.web3?.find((service) => service.address.toLowerCase() === address.toLowerCase());
+            if (!existingEntry)
+                return null;
+            const updatedUser = await Users.findOneAndUpdate(generateDbFilterById(userId), {
+                $pull: {
+                    'services.web3': { address: existingEntry.address },
+                },
+            }, { returnDocument: 'after' });
+            if (!updatedUser)
+                return null;
+            await emit('USER_UPDATE_WEB3_ADDRESS', {
+                action: 'remove',
+                address: existingEntry.address,
+                user: removeConfidentialServiceHashes(updatedUser),
+            });
+            return updatedUser;
+        },
+        findWeb3Address(user, address) {
+            return (user.services?.web3?.find((service) => service.address.toLowerCase() === address.toLowerCase()) || null);
+        },
+        async addWebAuthnCredential(userId, webAuthnService) {
+            const updatedUser = await Users.findOneAndUpdate(generateDbFilterById(userId), {
+                $push: {
+                    'services.webAuthn': webAuthnService,
+                },
+            }, { returnDocument: 'after' });
+            return updatedUser;
+        },
+        async removeWebAuthnCredential(userId, credentialsId) {
+            const updatedUser = await Users.findOneAndUpdate(generateDbFilterById(userId), {
+                $pull: {
+                    'services.webAuthn': { id: credentialsId },
+                },
+            }, { returnDocument: 'after' });
+            return updatedUser;
+        },
+        async createAccessToken(username) {
+            const plainToken = crypto.randomUUID();
+            const secret = await sha256(plainToken);
+            const updatedUser = await Users.findOneAndUpdate({ username: insensitiveTrimmedRegexOperator(username) }, {
+                $set: {
+                    'services.token': { secret },
+                },
+            }, { returnDocument: 'after' });
+            if (!updatedUser)
+                return null;
+            return { user: updatedUser, token: plainToken };
+        },
+        async setAccessToken(username, plainSecret) {
+            const secret = await sha256(plainSecret);
+            const updatedUser = await Users.findOneAndUpdate({ username: insensitiveTrimmedRegexOperator(username) }, {
+                $set: {
+                    'services.token': { secret },
+                },
+            }, { returnDocument: 'after' });
+            return updatedUser;
+        },
+        async verifyWeb3SignatureAndUpdate(user, credentials, signature) {
+            const isValid = await verifyWeb3Signature(credentials.nonce, signature, credentials.address);
+            if (!isValid)
+                return null;
+            const web3Services = user.services?.web3?.map((service) => {
+                if (service.address.toLowerCase() === credentials.address.toLowerCase()) {
+                    return {
+                        ...service,
+                        nonce: undefined,
+                        verified: true,
+                    };
+                }
+                return service;
+            });
+            if (!web3Services)
+                return null;
+            const updatedUser = await Users.findOneAndUpdate(generateDbFilterById(user._id), {
+                $set: {
+                    'services.web3': web3Services,
+                },
+            }, { returnDocument: 'after' });
+            if (!updatedUser)
+                return null;
+            await emit('USER_UPDATE_WEB3_ADDRESS', {
+                action: 'verify',
+                address: credentials.address,
+                user: removeConfidentialServiceHashes(updatedUser),
+            });
+            return updatedUser;
+        },
         async sendResetPasswordEmail(userId, email, isEnrollment) {
             const plainToken = crypto.randomUUID();
             const resetToken = {
@@ -636,7 +768,7 @@ export const configureUsersModule = async (moduleInput) => {
         existingTags: async () => {
             const tags = (await Users.distinct('tags', {
                 tags: { $exists: true },
-                deleted: { $exists: false },
+                deleted: null,
             }));
             return tags.filter(Boolean).toSorted();
         },

package/lib/module/configureUsersWebAuthnModule.d.ts

@@ -1,25 +1,85 @@
-import type { ModuleInput } from '@unchainedshop/mongodb';
-import type { PublicKeyCredentialCreationOptions, PublicKeyCredentialRequestOptions } from 'fido2-lib';
-type SerializedOptions<T> = Omit<T, 'challenge' | 'requestId'> & {
+import { type ModuleInput } from '@unchainedshop/mongodb';
+import type { RegistrationJSON, AuthenticationJSON, CredentialInfo, NamedAlgo, ExtendedAuthenticatorTransport } from '@passwordless-id/webauthn/dist/esm/types.js';
+export type { RegistrationJSON, AuthenticationJSON, CredentialInfo, NamedAlgo, ExtendedAuthenticatorTransport, };
+export declare function toArrayBuffer(buffer: Buffer): ArrayBuffer;
+export declare function buf2hex(buffer: ArrayBuffer): string;
+export interface WebAuthnCredentialCreationOptions {
     challenge: string;
-    requestId: number;
-};
-export declare function toArrayBuffer(buffer: any): any;
-export declare function buf2hex(buffer: any): string;
-export declare const configureUsersWebAuthnModule: ({ db }: ModuleInput<any>) => Promise<{
-    findMDSMetadataForAAGUID: (aaguid: string) => Promise<any>;
-    createCredentialCreationOptions: (origin: string, username: string, extensionOptions?: any) => Promise<SerializedOptions<PublicKeyCredentialCreationOptions> | null>;
-    createCredentialRequestOptions: (origin: string, username: string, extensionOptions?: any) => Promise<SerializedOptions<PublicKeyCredentialRequestOptions> | null>;
-    verifyCredentialCreation: (username: string, credentials: any) => Promise<{
-        publicKey: any;
-        counter: any;
-        id: any;
-        aaguid: string;
-        created: Date;
+    requestId: string;
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    pubKeyCredParams: {
+        type: 'public-key';
+        alg: number;
+    }[];
+    timeout: number;
+    attestation: 'none' | 'indirect' | 'direct';
+    authenticatorSelection?: {
+        authenticatorAttachment?: 'platform' | 'cross-platform';
+        requireResidentKey?: boolean;
+        userVerification?: 'required' | 'preferred' | 'discouraged';
+    };
+}
+export interface WebAuthnCredentialRequestOptions {
+    challenge: string;
+    requestId: string;
+    rpId: string;
+    timeout: number;
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+    allowCredentials?: {
+        id: string;
+        type: 'public-key';
+        transports?: ('usb' | 'nfc' | 'ble' | 'internal')[];
+    }[];
+}
+export interface WebAuthnCredential {
+    id: string;
+    publicKey: string;
+    algorithm: NamedAlgo;
+    aaguid: string;
+    counter: number;
+    created: Date;
+}
+export declare const configureUsersWebAuthnModule: ({ db }: ModuleInput<Record<string, any>>) => Promise<{
+    findMDSMetadataForAAGUID: (aaguid: string) => Promise<{
+        [key: string]: unknown;
+        description?: string;
+        icon?: string;
+        authenticatorGetInfo?: {
+            versions?: string[];
+            extensions?: string[];
+            options?: Record<string, boolean>;
+        };
     } | null>;
-    verifyCredentialRequest: (userPublicKeys: any[], username: string, credentials: any) => Promise<{
-        userHandle: any;
+    createCredentialCreationOptions: (origin: string, username: string, extensionOptions?: {
+        timeout?: number;
+        authenticatorSelection?: WebAuthnCredentialCreationOptions["authenticatorSelection"];
+    }) => Promise<WebAuthnCredentialCreationOptions>;
+    createCredentialRequestOptions: (origin: string, username: string, extensionOptions?: {
+        timeout?: number;
+        userVerification?: "required" | "preferred" | "discouraged";
+        allowCredentials?: WebAuthnCredentialRequestOptions["allowCredentials"];
+    }) => Promise<WebAuthnCredentialRequestOptions>;
+    verifyCredentialCreation: (username: string, credentials: RegistrationJSON) => Promise<WebAuthnCredential | null>;
+    verifyCredentialRequest: (userPublicKeys: {
+        id: string;
+        publicKey: string;
+        algorithm?: NamedAlgo;
+        counter?: number;
+        transports?: ExtendedAuthenticatorTransport[];
+    }[], username: string, credentials: AuthenticationJSON & {
+        requestId: string;
+    }) => Promise<{
+        userHandle: string;
+        counter: number;
     } | null>;
     deleteUserWebAuthnCredentials: (username: string) => Promise<number>;
 }>;
-export {};
+export type UsersWebAuthnModule = Awaited<ReturnType<typeof configureUsersWebAuthnModule>>;

package/lib/module/configureUsersWebAuthnModule.js

@@ -1,35 +1,44 @@
+import { generateDbObjectId } from '@unchainedshop/mongodb';
 import { createLogger } from '@unchainedshop/logger';
+import pMemoize from 'p-memoize';
+import ExpiryMap from 'expiry-map';
+import { server as webauthnServer } from '@passwordless-id/webauthn';
 import { WebAuthnCredentialsCreationRequestsCollection } from "../db/WebAuthnCredentialsCreationRequestsCollection.js";
 const logger = createLogger('unchained:core-users');
-const { ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_NAME = 'Unchained' } = process.env;
-let Fido2Lib;
-try {
-    const fido2LibPackage = await import('fido2-lib');
-    Fido2Lib = fido2LibPackage.Fido2Lib;
-}
-catch {
-    logger.warn(`optional peer npm package 'fido2-lib' not installed, WebAuthn will not work`);
-}
-let setupMDSPromise;
-const setupMDSCollection = async () => {
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+async function fetchMDSEntriesImpl() {
+    const cache = new Map();
     try {
-        const tocResult = await fetch('https://mds.fidoalliance.org');
-        const tocBase64 = await tocResult.text();
-        const mc = Fido2Lib.createMdsCollection('FIDO MDS v3');
-        const tocObj = await mc.addToc(tocBase64);
-        return tocObj.entries;
+        const response = await fetch('https://mds.fidoalliance.org/');
+        if (!response.ok) {
+            logger.warn('Failed to fetch FIDO MDS', { status: response.status });
+            return cache;
+        }
+        const jwtBlob = await response.text();
+        const parts = jwtBlob.split('.');
+        if (parts.length !== 3) {
+            logger.warn('Invalid MDS JWT format');
+            return cache;
+        }
+        const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const decoded = Buffer.from(payload, 'base64').toString('utf-8');
+        const mdsData = JSON.parse(decoded);
+        if (Array.isArray(mdsData.entries)) {
+            for (const entry of mdsData.entries) {
+                if (entry.aaguid) {
+                    cache.set(entry.aaguid.toLowerCase(), entry);
+                }
+            }
+        }
+        logger.debug(`Loaded ${cache.size} MDS entries`);
     }
-    catch (e) {
-        logger.error(e);
-        return [];
+    catch (error) {
+        logger.warn('Error fetching MDS', { error: error.message });
     }
-};
-const fetchMDS = async () => {
-    if (setupMDSPromise)
-        return setupMDSPromise;
-    setupMDSPromise = setupMDSCollection();
-    return setupMDSPromise;
-};
+    return cache;
+}
+const mdsCache = new ExpiryMap(ONE_DAY_MS);
+const fetchMDSEntries = pMemoize(fetchMDSEntriesImpl, { cache: mdsCache });
 export function toArrayBuffer(buffer) {
     return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
 }
@@ -39,128 +48,140 @@ export function buf2hex(buffer) {
         .join('');
 }
 export const configureUsersWebAuthnModule = async ({ db }) => {
+    const { ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_NAME = 'Unchained' } = process.env;
     const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
     const thisDomain = new URL(ROOT_URL).hostname;
-    const f2l = Fido2Lib &&
-        new Fido2Lib({
-            rpId: thisDomain,
-            rpName: EMAIL_WEBSITE_NAME,
-            rpIcon: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
-            challengeSize: 128,
-            attestation: 'none',
-        });
+    const thisOrigin = new URL(ROOT_URL).origin;
     return {
         findMDSMetadataForAAGUID: async (aaguid) => {
-            const mdsCollection = await fetchMDS();
-            const foundEntry = mdsCollection.find((entry) => {
-                return entry.aaguid === aaguid;
-            });
-            return foundEntry?.metadataStatement;
+            const mdsEntries = await fetchMDSEntries();
+            const entry = mdsEntries.get(aaguid.toLowerCase());
+            return entry?.metadataStatement || null;
         },
         createCredentialCreationOptions: async (origin, username, extensionOptions) => {
-            if (!f2l)
-                return null;
-            const registrationOptions = await f2l.attestationOptions(extensionOptions);
-            const challenge = btoa(String.fromCharCode(...new Uint8Array(registrationOptions.challenge)));
+            const challenge = webauthnServer.randomChallenge();
             const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
-                _id: new Date().getTime(),
+                _id: generateDbObjectId(),
                 challenge,
                 origin,
-                factor: registrationOptions.factor || 'either',
+                factor: 'either',
                 username,
             });
             return {
-                ...registrationOptions,
                 challenge,
                 requestId: insertedId,
+                rp: {
+                    id: thisDomain,
+                    name: EMAIL_WEBSITE_NAME,
+                },
+                user: {
+                    id: username,
+                    name: username,
+                    displayName: username,
+                },
+                pubKeyCredParams: [
+                    { type: 'public-key', alg: -7 },
+                    { type: 'public-key', alg: -257 },
+                ],
+                timeout: extensionOptions?.timeout || 60000,
+                attestation: 'none',
+                authenticatorSelection: extensionOptions?.authenticatorSelection || {
+                    userVerification: 'preferred',
+                },
             };
         },
         createCredentialRequestOptions: async (origin, username, extensionOptions) => {
-            if (!f2l)
-                return null;
-            const loginOptions = await f2l.assertionOptions(extensionOptions);
-            const challenge = btoa(String.fromCharCode(...new Uint8Array(loginOptions.challenge)));
+            const challenge = webauthnServer.randomChallenge();
             const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
-                _id: new Date().getTime(),
+                _id: generateDbObjectId(),
                 challenge,
                 origin,
-                factor: loginOptions.factor || 'either',
+                factor: 'either',
                 username,
             });
             return {
-                ...loginOptions,
                 challenge,
                 requestId: insertedId,
+                rpId: thisDomain,
+                timeout: extensionOptions?.timeout || 60000,
+                userVerification: extensionOptions?.userVerification || 'preferred',
+                allowCredentials: extensionOptions?.allowCredentials,
             };
         },
         verifyCredentialCreation: async (username, credentials) => {
-            if (!f2l)
-                return null;
             const request = await WebAuthnCredentialsCreationRequests.findOne({
                 username,
             }, { sort: { _id: -1 } });
-            if (!request)
+            if (!request) {
+                logger.error('WebAuthn: No credential creation request found for username', { username });
                 return null;
-            const attestationExpectations = {
-                challenge: request.challenge,
-                origin: request.origin,
-                factor: request.factor,
-            };
-            const id = Buffer.from(credentials.id, 'base64');
-            const attestationObject = Buffer.from(credentials.response.attestationObject, 'base64');
-            const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-            const attestationResponse = {
-                id: toArrayBuffer(id),
-                response: {
-                    attestationObject: toArrayBuffer(attestationObject),
-                    clientDataJSON: toArrayBuffer(clientDataJSON),
-                },
-            };
-            const registrationOptions = await f2l.attestationResult(attestationResponse, attestationExpectations);
-            const publicKey = registrationOptions?.authnrData?.get('credentialPublicKeyPem');
-            const aaguidArrayBuffer = registrationOptions?.authnrData?.get('aaguid');
-            const counter = registrationOptions?.authnrData?.get('counter');
-            const aaguidConcatenated = buf2hex(aaguidArrayBuffer);
-            const aaguid = `${aaguidConcatenated.slice(0, 8)}-${aaguidConcatenated.slice(8, 12)}-${aaguidConcatenated.slice(12, 16)}-${aaguidConcatenated.slice(16, 20)}-${aaguidConcatenated.slice(20)}`;
-            return { publicKey, counter, id: credentials.id, aaguid, created: new Date() };
+            }
+            const expectedOrigin = request.origin || thisOrigin;
+            logger.info('WebAuthn: Verifying credential creation', {
+                username,
+                expectedOrigin,
+                expectedChallenge: request.challenge,
+                credentialId: credentials.id,
+            });
+            try {
+                const registrationInfo = await webauthnServer.verifyRegistration(credentials, {
+                    challenge: request.challenge,
+                    origin: expectedOrigin,
+                });
+                logger.info('WebAuthn: Credential creation verified successfully', {
+                    username,
+                    credentialId: registrationInfo.credential.id,
+                });
+                return {
+                    id: registrationInfo.credential.id,
+                    publicKey: registrationInfo.credential.publicKey,
+                    algorithm: registrationInfo.credential.algorithm,
+                    aaguid: registrationInfo.authenticator.aaguid,
+                    counter: registrationInfo.authenticator.counter,
+                    created: new Date(),
+                };
+            }
+            catch (error) {
+                logger.error('WebAuthn credential creation verification failed', {
+                    error: error.message,
+                    username,
+                    expectedOrigin,
+                    expectedChallenge: request.challenge,
+                });
+                return null;
+            }
         },
         verifyCredentialRequest: async (userPublicKeys, username, credentials) => {
-            if (!f2l)
-                return null;
             const request = await WebAuthnCredentialsCreationRequests.findOne({
                 _id: credentials.requestId,
             }, { sort: { _id: -1 } });
             if (!request)
                 return null;
-            const id = Buffer.from(credentials.id, 'base64');
-            const authenticatorData = Buffer.from(credentials.response.authenticatorData, 'base64');
-            const signature = Buffer.from(credentials.response.signature, 'base64');
-            const userHandle = Buffer.from(credentials.response.userHandle, 'base64');
-            const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-            const { publicKey, counter } = userPublicKeys.find((publicCredentials) => {
-                return credentials.id === publicCredentials.id;
-            }) || {};
-            if (!publicKey)
+            const matchingKey = userPublicKeys.find((key) => key.id === credentials.id);
+            if (!matchingKey)
                 return null;
-            const assertionExpectations = {
-                challenge: request.challenge,
-                origin: request.origin,
-                factor: request.factor,
-                prevCounter: counter,
-                publicKey,
-                userHandle: toArrayBuffer(Buffer.from(username)),
-            };
-            const assertionResponse = {
-                id: toArrayBuffer(id),
-                response: {
-                    authenticatorData: toArrayBuffer(authenticatorData),
-                    clientDataJSON: toArrayBuffer(clientDataJSON),
-                    signature: toArrayBuffer(signature),
-                    userHandle: toArrayBuffer(userHandle),
-                },
-            };
-            const loginResult = await f2l.assertionResult(assertionResponse, assertionExpectations);
-            return { userHandle: loginResult?.authnrData?.get('userHandle') };
+            try {
+                const credentialKey = {
+                    id: matchingKey.id,
+                    publicKey: matchingKey.publicKey,
+                    algorithm: matchingKey.algorithm || 'ES256',
+                    transports: matchingKey.transports || [],
+                };
+                const authenticationInfo = await webauthnServer.verifyAuthentication(credentials, credentialKey, {
+                    challenge: request.challenge,
+                    origin: request.origin || thisOrigin,
+                    userVerified: false,
+                    counter: matchingKey.counter,
+                });
+                return {
+                    userHandle: credentials.response.userHandle || username,
+                    counter: authenticationInfo.counter,
+                };
+            }
+            catch (error) {
+                logger.debug('WebAuthn credential request verification failed', { error: error.message });
+                return null;
+            }
         },
         deleteUserWebAuthnCredentials: async (username) => {
             const { deletedCount } = await WebAuthnCredentialsCreationRequests.deleteMany({

package/lib/module/pbkdf2.js

@@ -1,3 +1,4 @@
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const PBKDF2_ITERATIONS = 300000;
 const PBKDF2_KEY_LENGTH = 256;
 const PBKDF2_SALT_LENGTH = 16;
@@ -26,5 +27,5 @@ export async function getDerivedKey(salt, password, iterations = PBKDF2_ITERATIO
 }
 export async function compare(password, hash, salt) {
     const comparableHash = await getDerivedKey(salt, password);
-    return comparableHash === hash;
+    return timingSafeStringEqual(comparableHash, hash);
 }

package/lib/utils/web3-verification.d.ts

@@ -0,0 +1 @@
+export declare function verifyWeb3Signature(nonce: string, signature: `0x${string}`, expectedAddress: string): Promise<boolean>;

package/lib/utils/web3-verification.js

@@ -0,0 +1,81 @@
+import { createLogger } from '@unchainedshop/logger';
+const logger = createLogger('unchained:core-users');
+let secp256k1;
+let keccak_256;
+let bytesToHex;
+let hexToBytes;
+async function loadNoblePackages() {
+    try {
+        const curves = await import('@noble/curves/secp256k1.js');
+        const hashes = await import('@noble/hashes/sha3.js');
+        const utils = await import('@noble/hashes/utils.js');
+        if (!curves || !hashes || !utils) {
+            throw new Error('Missing required @noble packages for Web3 signature verification');
+        }
+        secp256k1 = curves.secp256k1;
+        keccak_256 = hashes.keccak_256;
+        bytesToHex = utils.bytesToHex;
+        hexToBytes = utils.hexToBytes;
+        return true;
+    }
+    catch (error) {
+        logger.warn('Failed to load @noble packages for Web3 verification', { error: error.message });
+        return false;
+    }
+}
+function fromRPCSig(sig) {
+    const bytes = hexToBytes(sig.startsWith('0x') ? sig.slice(2) : sig);
+    if (bytes.length !== 65)
+        throw new Error('Invalid signature length');
+    const r = bytes.slice(0, 32);
+    const s = bytes.slice(32, 64);
+    let v = BigInt(bytes[64]);
+    if (v >= 35n) {
+        v = v - 35n - 2n * 1n;
+    }
+    else if (v >= 27n) {
+        v = v - 27n;
+    }
+    return { v, r, s };
+}
+function hashPersonalMessage(message) {
+    const prefix = new TextEncoder().encode('\x19Ethereum Signed Message:\n');
+    const lengthBytes = new TextEncoder().encode(message.length.toString());
+    const combined = new Uint8Array(prefix.length + lengthBytes.length + message.length);
+    combined.set(prefix, 0);
+    combined.set(lengthBytes, prefix.length);
+    combined.set(message, prefix.length + lengthBytes.length);
+    return keccak_256(combined);
+}
+function ecrecover(msgHash, v, r, s) {
+    const recovery = Number(v);
+    const signature = new Uint8Array(64);
+    signature.set(r, 0);
+    signature.set(s, 32);
+    const publicKey = secp256k1.Signature.fromBytes(signature)
+        .addRecoveryBit(recovery)
+        .recoverPublicKey(msgHash);
+    return publicKey.toBytes(false).slice(1);
+}
+function publicToAddress(publicKey) {
+    const hash = keccak_256(publicKey);
+    return hash.slice(-20);
+}
+export async function verifyWeb3Signature(nonce, signature, expectedAddress) {
+    const packagesLoaded = await loadNoblePackages();
+    if (!packagesLoaded) {
+        throw new Error('Web3 signature verification is not available. Please install the required @noble packages: @noble/curves, @noble/hashes');
+    }
+    try {
+        const messageHash = hashPersonalMessage(hexToBytes(Buffer.from(nonce, 'utf8').toString('hex')));
+        const sigParams = fromRPCSig(signature);
+        const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+        const sender = publicToAddress(publicKey);
+        const recoveredAddr = `0x${bytesToHex(sender)}`;
+        return recoveredAddr.toLowerCase() === expectedAddress.toLowerCase();
+    }
+    catch (error) {
+        logger.debug('Web3 signature verification failed', { error: error.message });
+        return false;
+    }
+}

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "@unchainedshop/core-users",
-  "version": "4.4.0",
+  "description": "User management module for the Unchained Engine with authentication support",
+  "version": "4.6.0",
   "main": "lib/users-index.js",
   "types": "lib/users-index.d.ts",
   "type": "module",
+  "sideEffects": false,
   "scripts": {
     "clean": "tsc -b --clean",
     "build": "tsc -b",
@@ -33,25 +35,33 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
+    "@passwordless-id/webauthn": "^2.3.1",
+    "@unchainedshop/events": "^4.6.0",
+    "@unchainedshop/file-upload": "^4.6.0",
+    "@unchainedshop/logger": "^4.6.0",
+    "@unchainedshop/mongodb": "^4.6.0",
+    "@unchainedshop/roles": "^4.6.0",
+    "@unchainedshop/utils": "^4.6.0",
     "bcryptjs": "^3.0.2",
-    "@unchainedshop/events": "^4.4.0",
-    "@unchainedshop/file-upload": "^4.4.0",
-    "@unchainedshop/logger": "^4.4.0",
-    "@unchainedshop/mongodb": "^4.4.0",
-    "@unchainedshop/roles": "^4.4.0",
-    "@unchainedshop/utils": "^4.4.0"
+    "expiry-map": "^2.0.0",
+    "p-memoize": "^8.0.0"
   },
   "peerDependencies": {
-    "fido2-lib": ">= 3.5 < 4"
+    "@noble/curves": "^2.0.0",
+    "@noble/hashes": "^2.0.0"
   },
   "peerDependenciesMeta": {
-    "fido2-lib": {
+    "@noble/curves": {
+      "optional": true
+    },
+    "@noble/hashes": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@noble/curves": "^2.0.0",
+    "@noble/hashes": "^2.0.0",
     "@types/node": "^25.0.0",
-    "fido2-lib": "^3.5.3",
     "typescript": "^5.8.3"
   }
 }