@vex-chat/spire 1.5.0 → 1.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +2 -0
  2. package/dist/ClientManager.d.ts +1 -0
  3. package/dist/ClientManager.js +32 -4
  4. package/dist/ClientManager.js.map +1 -1
  5. package/dist/server/passkey.js +12 -2
  6. package/dist/server/passkey.js.map +1 -1
  7. package/dist/server/wellKnown.d.ts +25 -0
  8. package/dist/server/wellKnown.js +42 -0
  9. package/dist/server/wellKnown.js.map +1 -1
  10. package/package.json +3 -3
  11. package/src/ClientManager.ts +32 -4
  12. package/src/__tests__/wellKnown.spec.ts +24 -0
  13. package/src/server/passkey.ts +14 -2
  14. package/src/server/wellKnown.ts +44 -0
package/README.md CHANGED
@@ -84,6 +84,8 @@ Spire reads configuration from environment variables. **Docker Compose:** put th
84
84
 
85
85
  The `/auth/passkey/*`, `/user/:id/passkeys/*`, and `/passkey/*` routes are gated on `SPIRE_PASSKEY_RP_ID` and `SPIRE_PASSKEY_ORIGINS`; without them those endpoints return `500 Passkeys are not configured`. See [`.env.example`](./.env.example) for the full set, including the optional `SPIRE_PASSKEY_IOS_APP_IDS`, `SPIRE_PASSKEY_ANDROID_PACKAGE`, and `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` triple that makes spire serve the WebAuthn well-known association files (`/.well-known/apple-app-site-association`, `/.well-known/assetlinks.json`) directly. Those endpoints 404 when their env vars aren't set, so a non-passkey deployment is indistinguishable from one that hasn't enrolled an app.
86
86
 
87
+ The same `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` value is reused by `getRpConfig()` to derive `android:apk-key-hash:<base64url>` entries, which it merges into the WebAuthn `expectedOrigin` allowlist. Native Android Credential Manager sets `clientDataJSON.origin` to that string instead of the RP host, so without those entries simplewebauthn rejects every native-Android assertion at the origin check (the mobile UI surfaces this as a generic "RP failed" error). Operators only have to publish the cert fingerprints; the base64url math is handled server-side.
88
+
87
89
  ### Sample `.env`
88
90
 
89
91
  ```sh
package/dist/ClientManager.d.ts CHANGED
@@ -21,6 +21,7 @@ export declare class ClientManager extends EventEmitter {
21
21
  private db;
22
22
  private device;
23
23
  private failed;
24
+ private missedPongs;
24
25
  private notify;
25
26
  private user;
26
27
  private userDetails;
package/dist/ClientManager.js CHANGED
@@ -22,6 +22,24 @@ function emptyHeader() {
22
22
  return new Uint8Array(32);
23
23
  }
24
24
  const MAX_MSG_SIZE = 2048;
25
+ // How many ping cycles in a row are allowed to go without a pong
26
+ // before we declare the connection dead. With a 5s ping interval
27
+ // this gives ~15s of grace, which is enough to absorb a normal
28
+ // mobile native modal (biometric prompt, file picker, share sheet,
29
+ // expensive crypto on the JS thread) without killing an otherwise
30
+ // healthy session and forcing the client through a Noise+login
31
+ // reconnect. A genuinely dead TCP flow still gets cleaned up at
32
+ // most a couple of pings later, which is well inside the
33
+ // upstream nginx/proxy idle window we have to live within anyway.
34
+ //
35
+ // The previous behaviour ("a single missed pong fails the
36
+ // connection") was the root cause of the stream of `ws:disconnect`
37
+ // → `connection:recover:start` → `INVALID_STATE_ERR` cycles seen
38
+ // during passkey registration on Android: the system biometric
39
+ // prompt routinely paused the JS thread past 5s, the pong handler
40
+ // couldn't run, and we'd kill the socket out from under the user.
41
+ const MAX_MISSED_PONGS = 3;
42
+ const PING_INTERVAL_MS = 5000;
25
43
  export class ClientManager extends EventEmitter {
26
44
  alive = true;
27
45
  authed = false;
@@ -30,6 +48,7 @@ export class ClientManager extends EventEmitter {
30
48
  db;
31
49
  device;
32
50
  failed = false;
51
+ missedPongs = 0;
33
52
  notify;
34
53
  user;
35
54
  userDetails;
@@ -134,6 +153,7 @@ export class ClientManager extends EventEmitter {
134
153
  break;
135
154
  case "pong":
136
155
  this.setAlive(true);
156
+ this.missedPongs = 0;
137
157
  break;
138
158
  case "receipt":
139
159
  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed by msg.type
@@ -188,17 +208,25 @@ export class ClientManager extends EventEmitter {
188
208
  }
189
209
  ping() {
190
210
  if (!this.alive) {
191
- this.fail();
192
- return;
211
+ this.missedPongs++;
212
+ if (this.missedPongs >= MAX_MISSED_PONGS) {
213
+ this.fail();
214
+ return;
215
+ }
216
+ // Don't reset alive=false → we keep counting up until a
217
+ // pong actually arrives or we hit the cap.
218
+ }
219
+ else {
220
+ this.missedPongs = 0;
221
+ this.setAlive(false);
193
222
  }
194
- this.setAlive(false);
195
223
  const p = { transmissionID: crypto.randomUUID(), type: "ping" };
196
224
  this.send(p);
197
225
  }
198
226
  async pingLoop() {
199
227
  while (!this.failed) {
200
228
  this.ping();
201
- await sleep(5000);
229
+ await sleep(PING_INTERVAL_MS);
202
230
  }
203
231
  }
204
232
  pong(transmissionID) {
package/dist/ClientManager.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"ClientManager.js","sourceRoot":"","sources":["../src/ClientManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,MAAM,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;CACb,CAAC;AAEF,SAAS,WAAW;IAChB,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,MAAM,OAAO,aAAc,SAAQ,YAAY;IACnC,KAAK,GAAY,IAAI,CAAC;IACtB,MAAM,GAAY,KAAK,CAAC;IACxB,WAAW,GAAe,eAAe,EAAE,CAAC;IAC5C,IAAI,CAAY;IAChB,EAAE,CAAW;IACb,MAAM,CAAgB;IACtB,MAAM,GAAY,KAAK,CAAC;IACxB,MAAM,CAMJ;IACF,IAAI,CAAoB;IACxB,WAAW,CAAO;IAE1B,YACI,EAAa,EACb,EAAY,EACZ,MAAuE,EACvE,WAAiB;QAEjB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;IAEM,SAAS;QACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAEM,OAAO;QACV,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAEM,IAAI,CAAC,GAAY,EAAE,MAAmB;QACzC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,IAAa,EAAE,CAAC;YACrB,2BAA2B;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAEe,QAAQ;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,mBAAmB,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtE,CAAC;IAEO,SAAS,CAAC,cAAsB;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAEO,SAAS;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAa;YACxB,SAAS,EAAE,IAAI,CAAC,WAAW;YAC3B,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,IAAI,EAAE,WAAW;SACpB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,IAAI;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAe;QACvC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,UAAU,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC;YACL,CAAC,EAAE,YAAY,CAAC,CAAC;YACjB,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CACR,sCAAsC,EACtC,oCAAoC;oBAChC,MAAM,CAAC,IAAI,CAAC;oBACZ,qBAAqB;oBACrB,MAAM,CAAC,YAAY,CAAC,CAC3B,CAAC;gBACF,OAAO;YACX,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAE7C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC9D,OAAO;YACX,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,EACnB,sDAAsD,CACzD,CAAC;gBACF,OAAO;YACX,CAAC;YAED,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM;oBACP,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC9B,MAAM;gBACV,KAAK,MAAM;oBACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM;gBACV,KAAK,SAAS;oBACV,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,aAAa,CAAC,GAAiB,CAAC,CAAC;oBAC3C,MAAM;gBACV,KAAK,UAAU;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACf,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,4BAA4B,CAC/B,CAAC;wBACF,MAAM;oBACV,CAAC;oBACD,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAkB,EAAE,MAAM,CAAC,CAAC;oBACvD,MAAM;gBACV,KAAK,UAAU;oBACX,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,cAAc,CAAC,GAAc,CAAC,CAAC;oBACzC,MAAM;gBACV;oBACI,MAAM;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAgB,EAAE,MAAkB;QAC/D,QAAQ,GAAG,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,MAAM;gBACP,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;wBACtB,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,wBAAwB;4BACpB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAC9C,CAAC;wBACF,OAAO;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;oBAE7B,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAClB,IAAI,EACJ,MAAM,EACN,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EACzB,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CACxB,CAAC;wBACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,cAAc,CAC9C,IAAI,CAAC,SAAS,CACjB,CAAC;wBACF,IAAI,CAAC,aAAa,EAAE,CAAC;4BACjB,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,6CAA6C,CAChD,CAAC;4BACF,OAAO;wBACX,CAAC;wBAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;wBAC3C,IAAI,CAAC,MAAM,CACP,aAAa,CAAC,KAAK,EACnB,MAAM,EACN,GAAG,CAAC,cAAc,EAClB,IAAI,EACJ,IAAI,CAAC,SAAS,CACjB,CAAC;oBACN,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClD,CAAC;gBACL,CAAC;gBACD,MAAM;YACV;gBACI,MAAM;QACd,CAAC;IACL,CAAC;IAEO,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ;QAClB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,cAAsB;QAC/B,8BAA8B;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAEO,iBAAiB,CAAC,cAAsB;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAEO,aAAa,CAAC,KAAuB;QACzC,MAAM,GAAG,GAAG;YACR,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,IAAI,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAEO,OAAO,CAAC,cAAsB,EAAE,OAAe,EAAE,IAAc;QACnE,MAAM,KAAK,GAAW;YAClB,IAAI;YACJ,KAAK,EAAE,OAAO;YACd,cAAc;YACd,IAAI,EAAE,OAAO;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAEO,WAAW,CACf,cAAsB,EACtB,IAAa,EACb,MAAmB,EACnB,SAAkB;QAElB,MAAM,GAAG,GAAe;YACpB,IAAI;YACJ,SAAS;YACT,cAAc;YACd,IAAI,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,QAAQ,CAAC,MAAe;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAY;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACtC,GAAG,CAAC,MAAM,EACV,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CACnC,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACX,OAAO,GAAG,QAAQ,CAAC;oBACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,OAAO;YACX,CAAC;YAED,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,MAAmB;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,iGAAiG;IACjG,MAAM,IAAI,GAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}
1
+ {"version":3,"file":"ClientManager.js","sourceRoot":"","sources":["../src/ClientManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,MAAM,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;CACb,CAAC;AAEF,SAAS,WAAW;IAChB,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,iEAAiE;AACjE,iEAAiE;AACjE,+DAA+D;AAC/D,mEAAmE;AACnE,kEAAkE;AAClE,+DAA+D;AAC/D,gEAAgE;AAChE,yDAAyD;AACzD,kEAAkE;AAClE,EAAE;AACF,0DAA0D;AAC1D,mEAAmE;AACnE,iEAAiE;AACjE,+DAA+D;AAC/D,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,aAAc,SAAQ,YAAY;IACnC,KAAK,GAAY,IAAI,CAAC;IACtB,MAAM,GAAY,KAAK,CAAC;IACxB,WAAW,GAAe,eAAe,EAAE,CAAC;IAC5C,IAAI,CAAY;IAChB,EAAE,CAAW;IACb,MAAM,CAAgB;IACtB,MAAM,GAAY,KAAK,CAAC;IACxB,WAAW,GAAW,CAAC,CAAC;IACxB,MAAM,CAMJ;IACF,IAAI,CAAoB;IACxB,WAAW,CAAO;IAE1B,YACI,EAAa,EACb,EAAY,EACZ,MAAuE,EACvE,WAAiB;QAEjB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC;IAEM,SAAS;QACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAEM,OAAO;QACV,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAEM,IAAI,CAAC,GAAY,EAAE,MAAmB;QACzC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,IAAa,EAAE,CAAC;YACrB,2BAA2B;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAEe,QAAQ;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,mBAAmB,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtE,CAAC;IAEO,SAAS,CAAC,cAAsB;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAEO,SAAS;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAa;YACxB,SAAS,EAAE,IAAI,CAAC,WAAW;YAC3B,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,IAAI,EAAE,WAAW;SACpB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,IAAI;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAe;QACvC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,UAAU,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC;YACL,CAAC,EAAE,YAAY,CAAC,CAAC;YACjB,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAe,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAExC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CACR,sCAAsC,EACtC,oCAAoC;oBAChC,MAAM,CAAC,IAAI,CAAC;oBACZ,qBAAqB;oBACrB,MAAM,CAAC,YAAY,CAAC,CAC3B,CAAC;gBACF,OAAO;YACX,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAE7C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;gBAC9D,OAAO;YACX,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,EACnB,sDAAsD,CACzD,CAAC;gBACF,OAAO;YACX,CAAC;YAED,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM;oBACP,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC9B,MAAM;gBACV,KAAK,MAAM;oBACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACpB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACV,KAAK,SAAS;oBACV,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,aAAa,CAAC,GAAiB,CAAC,CAAC;oBAC3C,MAAM;gBACV,KAAK,UAAU;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACf,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,4BAA4B,CAC/B,CAAC;wBACF,MAAM;oBACV,CAAC;oBACD,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAkB,EAAE,MAAM,CAAC,CAAC;oBACvD,MAAM;gBACV,KAAK,UAAU;oBACX,+FAA+F;oBAC/F,KAAK,IAAI,CAAC,cAAc,CAAC,GAAc,CAAC,CAAC;oBACzC,MAAM;gBACV;oBACI,MAAM;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAgB,EAAE,MAAkB;QAC/D,QAAQ,GAAG,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,MAAM;gBACP,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;wBACtB,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,wBAAwB;4BACpB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAC9C,CAAC;wBACF,OAAO;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;oBAE7B,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAClB,IAAI,EACJ,MAAM,EACN,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EACzB,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CACxB,CAAC;wBACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,cAAc,CAC9C,IAAI,CAAC,SAAS,CACjB,CAAC;wBACF,IAAI,CAAC,aAAa,EAAE,CAAC;4BACjB,IAAI,CAAC,OAAO,CACR,GAAG,CAAC,cAAc,EAClB,6CAA6C,CAChD,CAAC;4BACF,OAAO;wBACX,CAAC;wBAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;wBAC3C,IAAI,CAAC,MAAM,CACP,aAAa,CAAC,KAAK,EACnB,MAAM,EACN,GAAG,CAAC,cAAc,EAClB,IAAI,EACJ,IAAI,CAAC,SAAS,CACjB,CAAC;oBACN,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClD,CAAC;gBACL,CAAC;gBACD,MAAM;YACV;gBACI,MAAM;QACd,CAAC;IACL,CAAC;IAEO,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,WAAW,IAAI,gBAAgB,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,OAAO;YACX,CAAC;YACD,wDAAwD;YACxD,2CAA2C;QAC/C,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ;QAClB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,cAAsB;QAC/B,8BAA8B;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAEO,iBAAiB,CAAC,cAAsB;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAEO,aAAa,CAAC,KAAuB;QACzC,MAAM,GAAG,GAAG;YACR,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE;YACnC,IAAI,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAEO,OAAO,CAAC,cAAsB,EAAE,OAAe,EAAE,IAAc;QACnE,MAAM,KAAK,GAAW;YAClB,IAAI;YACJ,KAAK,EAAE,OAAO;YACd,cAAc;YACd,IAAI,EAAE,OAAO;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAEO,WAAW,CACf,cAAsB,EACtB,IAAa,EACb,MAAmB,EACnB,SAAkB;QAElB,MAAM,GAAG,GAAe;YACpB,IAAI;YACJ,SAAS;YACT,cAAc;YACd,IAAI,EAAE,SAAS;SAClB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,QAAQ,CAAC,MAAe;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAY;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,GAAsB,IAAI,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACtC,GAAG,CAAC,MAAM,EACV,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CACnC,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACX,OAAO,GAAG,QAAQ,CAAC;oBACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,OAAO;YACX,CAAC;YAED,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,MAAmB;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,iGAAiG;IACjG,MAAM,IAAI,GAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}
package/dist/server/passkey.js CHANGED
@@ -14,6 +14,7 @@ import { msgpack } from "../utils/msgpack.js";
14
14
  import { AppError } from "./errors.js";
15
15
  import { authLimiter } from "./rateLimit.js";
16
16
  import { censorUser, getParam, getUser } from "./utils.js";
17
+ import { buildAndroidApkKeyHashOrigins } from "./wellKnown.js";
17
18
  import { protect } from "./index.js";
18
19
  const REGISTRATION_TTL_MS = 5 * 60 * 1000; // 5 min
19
20
  const AUTHENTICATION_TTL_MS = 5 * 60 * 1000;
@@ -33,6 +34,14 @@ const pendingAuthentications = new Map();
33
34
  * client origins (e.g. `https://app.vex.wtf,tauri://localhost,
34
35
  * http://localhost:5173`). Required: WebAuthn binds an assertion
35
36
  * to its origin and we must check it explicitly.
37
+ *
38
+ * The returned `expectedOrigin` list also includes any
39
+ * `android:apk-key-hash:<base64url>` entries derived from
40
+ * `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` (see
41
+ * `buildAndroidApkKeyHashOrigins`). Native Android Credential
42
+ * Manager sets `clientDataJSON.origin` to that string instead of the
43
+ * RP host, so we accept it implicitly whenever the operator has
44
+ * already advertised the cert via the assetlinks file.
36
45
  */
37
46
  function getRpConfig() {
38
47
  const rpID = process.env["SPIRE_PASSKEY_RP_ID"]?.trim();
@@ -43,13 +52,14 @@ function getRpConfig() {
43
52
  if (!originsRaw) {
44
53
  throw new AppError(500, "Passkeys are not configured on this server (SPIRE_PASSKEY_ORIGINS is unset).");
45
54
  }
46
- const expectedOrigin = originsRaw
55
+ const explicitOrigins = originsRaw
47
56
  .split(",")
48
57
  .map((o) => o.trim())
49
58
  .filter((o) => o.length > 0);
50
- if (expectedOrigin.length === 0) {
59
+ if (explicitOrigins.length === 0) {
51
60
  throw new AppError(500, "SPIRE_PASSKEY_ORIGINS is empty.");
52
61
  }
62
+ const expectedOrigin = Array.from(new Set([...explicitOrigins, ...buildAndroidApkKeyHashOrigins()]));
53
63
  return {
54
64
  expectedOrigin,
55
65
  rpID,
package/dist/server/passkey.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACH,8BAA8B,EAC9B,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,GACxC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACH,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAejC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,SAAS,WAAW;IAKhB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,8EAA8E,CACjF,CAAC;IACN,CAAC;IACD,MAAM,cAAc,GAAG,UAAU;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACH,cAAc;QACd,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK;KAChE,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAClD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG;IACrB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACmD,CAAC;AAE7D,SAAS,gBAAgB,CAAC,CAAS;IAC/B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAGzB;IACG,OAAO,GAAG,CAAC,IAAI,CACX;QACI,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,SAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,EACD,YAAY,EAAE,EACd,EAAE,SAAS,EAAE,kBAAkB,EAAE,CACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACP,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,2DAA2D;QAC3D,sDAAsD;QACtD,yDAAyD;QACzD,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B;gBACrC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC9C,eAAe,EAAE,MAAM;YACvB,sBAAsB,EAAE;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAChC;YACD,kBAAkB,EAAE,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ;YACrC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,kBAAkB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM;SACT,CAAC,CAAC;QAEH,uDAAuD;QACvD,wDAAwD;QACxD,qDAAqD;QACrD,sDAAsD;QACtD,yDAAyD;QACzD,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,oCAAoC,EACpC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC3D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,kBAAkB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,4DAA4D;QAC5D,2CAA2C;QAC3C,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,sDAAsD;YACtD,kDAAkD;YAClD,oDAAoD;YACpD,uDAAuD;YACvD,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;YACpD,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,yHAAyH;gBACzH,QAAQ,EAAE,WAAuC;aACpD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GACT,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+BAA+B,GAAG,OAAO;aACnD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;aACrD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAClC,MAAM,EACN,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,EAAE,EACb,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,uDAAuD;QACvD,qDAAqD;QACrD,sDAAsD;QACtD,gDAAgD;QAChD,uDAAuD;QACvD,mDAAmD;QACnD,gCAAgC;QAChC,CAAC,EACD,UAAU,CACb,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACT,+BAA+B,EAC/B,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,sDAAsD;YACtD,wDAAwD;YACxD,wDAAwD;YACxD,oBAAoB;YACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO;gBACH,EAAE,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;gBAChC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAClD,IAAI,EAAE,YAAqB;aAC9B,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAChD,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjE,IAAI;YACJ,gBAAgB,EAAE,WAAW;SAChC,CAAC,CAAC;QAEH,oBAAoB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,oBAAoB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,gDAAgD;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,cAAc;QACd,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,8DAA8D;QAC9D,0DAA0D;QAC1D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;QACrD,yHAAyH;QACzH,MAAM,SAAS,GAAG,YAA0C,CAAC;QAC7D,MAAM,YAAY,GACd,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,6DAA6D;QAC7D,0DAA0D;QAC1D,mCAAmC;QACnC,MAAM,mBAAmB,GAAG,IAAI,UAAU,CACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CACzC,CAAC;QAEF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,UAAU,EAAE;oBACR,OAAO,EAAE,UAAU,CAAC,SAAS;oBAC7B,EAAE,EAAE,UAAU,CAAC,YAAY;oBAC3B,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,UAAU,CAAC,UAAU;yBAC5B,KAAK,CAAC,GAAG,CAAC;yBACV,MAAM,CAAC,gBAAgB,CAAC;iBAChC;gBACD,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B,GAAG,OAAO;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IACI,UAAU,KAAK,CAAC;YAChB,UAAU,CAAC,SAAS,KAAK,CAAC;YAC1B,UAAU,IAAI,UAAU,CAAC,SAAS,EACpC,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK;YACL,IAAI,EAAE,QAAQ;SACjB,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
1
+ {"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACH,8BAA8B,EAC9B,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,GACxC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACH,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAejC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,WAAW;IAKhB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,8EAA8E,CACjF,CAAC;IACN,CAAC;IACD,MAAM,eAAe,GAAG,UAAU;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAC,CACpE,CAAC;IACF,OAAO;QACH,cAAc;QACd,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK;KAChE,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAClD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG;IACrB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACmD,CAAC;AAE7D,SAAS,gBAAgB,CAAC,CAAS;IAC/B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAGzB;IACG,OAAO,GAAG,CAAC,IAAI,CACX;QACI,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,SAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,EACD,YAAY,EAAE,EACd,EAAE,SAAS,EAAE,kBAAkB,EAAE,CACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACP,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,2DAA2D;QAC3D,sDAAsD;QACtD,yDAAyD;QACzD,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B;gBACrC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC9C,eAAe,EAAE,MAAM;YACvB,sBAAsB,EAAE;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAChC;YACD,kBAAkB,EAAE,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ;YACrC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,kBAAkB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM;SACT,CAAC,CAAC;QAEH,uDAAuD;QACvD,wDAAwD;QACxD,qDAAqD;QACrD,sDAAsD;QACtD,yDAAyD;QACzD,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,oCAAoC,EACpC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC3D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,kBAAkB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,4DAA4D;QAC5D,2CAA2C;QAC3C,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,sDAAsD;YACtD,kDAAkD;YAClD,oDAAoD;YACpD,uDAAuD;YACvD,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;YACpD,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,yHAAyH;gBACzH,QAAQ,EAAE,WAAuC;aACpD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GACT,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+BAA+B,GAAG,OAAO;aACnD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;aACrD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAClC,MAAM,EACN,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,EAAE,EACb,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,uDAAuD;QACvD,qDAAqD;QACrD,sDAAsD;QACtD,gDAAgD;QAChD,uDAAuD;QACvD,mDAAmD;QACnD,gCAAgC;QAChC,CAAC,EACD,UAAU,CACb,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACT,+BAA+B,EAC/B,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,sDAAsD;YACtD,wDAAwD;YACxD,wDAAwD;YACxD,oBAAoB;YACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO;gBACH,EAAE,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;gBAChC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAClD,IAAI,EAAE,YAAqB;aAC9B,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAChD,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjE,IAAI;YACJ,gBAAgB,EAAE,WAAW;SAChC,CAAC,CAAC;QAEH,oBAAoB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,OAAO;YACP,SAAS;SACZ,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,oBAAoB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,gDAAgD;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,cAAc;QACd,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,8DAA8D;QAC9D,0DAA0D;QAC1D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;QACrD,yHAAyH;QACzH,MAAM,SAAS,GAAG,YAA0C,CAAC;QAC7D,MAAM,YAAY,GACd,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,6DAA6D;QAC7D,0DAA0D;QAC1D,mCAAmC;QACnC,MAAM,mBAAmB,GAAG,IAAI,UAAU,CACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CACzC,CAAC;QAEF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,UAAU,EAAE;oBACR,OAAO,EAAE,UAAU,CAAC,SAAS;oBAC7B,EAAE,EAAE,UAAU,CAAC,YAAY;oBAC3B,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,UAAU,CAAC,UAAU;yBAC5B,KAAK,CAAC,GAAG,CAAC;yBACV,MAAM,CAAC,gBAAgB,CAAC;iBAChC;gBACD,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B,GAAG,OAAO;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IACI,UAAU,KAAK,CAAC;YAChB,UAAU,CAAC,SAAS,KAAK,CAAC;YAC1B,UAAU,IAAI,UAAU,CAAC,SAAS,EACpC,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CACJ,OAAO,CAAC,MAAM,CAAC;YACX,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK;YACL,IAAI,EAAE,QAAQ;SACjB,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
package/dist/server/wellKnown.d.ts CHANGED
@@ -4,6 +4,31 @@
4
4
  * Commercial licenses available at vex.wtf
5
5
  */
6
6
  import express from "express";
7
+ /**
8
+ * Build the WebAuthn `expectedOrigin` entries for native Android
9
+ * clients from the same fingerprints used to publish the Digital
10
+ * Asset Links file.
11
+ *
12
+ * Android's Credential Manager sets `clientDataJSON.origin` to
13
+ * `android:apk-key-hash:<base64url(sha256-cert)>` for native
14
+ * ceremonies, not to the RP host's HTTPS origin. simplewebauthn
15
+ * therefore needs that exact string in its `expectedOrigin` list
16
+ * or it rejects the assertion before any of our application logic
17
+ * runs ("Unexpected registration response origin", presented to the
18
+ * client as a generic "RP failed" error).
19
+ *
20
+ * Operators already advertise the same SHA-256 fingerprints via
21
+ * `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` for the assetlinks file, so
22
+ * we derive the apk-key-hash form here and merge it into the origin
23
+ * allowlist automatically. That keeps the well-known file and the
24
+ * server-side origin check in lock-step from a single source of
25
+ * truth and saves operators from having to compute base64url of a
26
+ * raw SHA-256 by hand.
27
+ *
28
+ * Returns an empty array when no fingerprints are configured or
29
+ * none of them parse as valid SHA-256 hex.
30
+ */
31
+ export declare function buildAndroidApkKeyHashOrigins(): string[];
7
32
  /**
8
33
  * Build the Apple App Site Association body, or `null` when the
9
34
  * server isn't configured to advertise any iOS apps.
package/dist/server/wellKnown.js CHANGED
@@ -5,6 +5,48 @@
5
5
  */
6
6
  import express from "express";
7
7
  const HEX_FINGERPRINT = /^[0-9a-fA-F]{2}(?::?[0-9a-fA-F]{2}){31}$/;
8
+ /**
9
+ * Build the WebAuthn `expectedOrigin` entries for native Android
10
+ * clients from the same fingerprints used to publish the Digital
11
+ * Asset Links file.
12
+ *
13
+ * Android's Credential Manager sets `clientDataJSON.origin` to
14
+ * `android:apk-key-hash:<base64url(sha256-cert)>` for native
15
+ * ceremonies, not to the RP host's HTTPS origin. simplewebauthn
16
+ * therefore needs that exact string in its `expectedOrigin` list
17
+ * or it rejects the assertion before any of our application logic
18
+ * runs ("Unexpected registration response origin", presented to the
19
+ * client as a generic "RP failed" error).
20
+ *
21
+ * Operators already advertise the same SHA-256 fingerprints via
22
+ * `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` for the assetlinks file, so
23
+ * we derive the apk-key-hash form here and merge it into the origin
24
+ * allowlist automatically. That keeps the well-known file and the
25
+ * server-side origin check in lock-step from a single source of
26
+ * truth and saves operators from having to compute base64url of a
27
+ * raw SHA-256 by hand.
28
+ *
29
+ * Returns an empty array when no fingerprints are configured or
30
+ * none of them parse as valid SHA-256 hex.
31
+ */
32
+ export function buildAndroidApkKeyHashOrigins() {
33
+ const fingerprintsRaw = parseList(process.env["SPIRE_PASSKEY_ANDROID_FINGERPRINTS"]);
34
+ const out = [];
35
+ for (const raw of fingerprintsRaw) {
36
+ const norm = normalizeFingerprint(raw);
37
+ if (norm == null)
38
+ continue;
39
+ const hex = norm.replace(/:/g, "");
40
+ const bytes = Buffer.from(hex, "hex");
41
+ const b64u = bytes
42
+ .toString("base64")
43
+ .replace(/\+/g, "-")
44
+ .replace(/\//g, "_")
45
+ .replace(/=+$/, "");
46
+ out.push(`android:apk-key-hash:${b64u}`);
47
+ }
48
+ return out;
49
+ }
8
50
  /**
9
51
  * Build the Apple App Site Association body, or `null` when the
10
52
  * server isn't configured to advertise any iOS apps.
package/dist/server/wellKnown.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"wellKnown.js","sourceRoot":"","sources":["../../src/server/wellKnown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAGxC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAU3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,eAAe,GAAG,SAAS,CAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACH;YACI,QAAQ,EAAE;gBACN,4CAA4C;gBAC5C,4CAA4C;aAC/C;YACD,MAAM,EAAE;gBACJ,SAAS,EAAE,aAAa;gBACxB,YAAY,EAAE,WAAW;gBACzB,wBAAwB,EAAE,YAAY;aACzC;SACJ;KACJ,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,QAA4B;IAC3C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAmB,EAAE;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,4BAA4B,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
1
+ {"version":3,"file":"wellKnown.js","sourceRoot":"","sources":["../../src/server/wellKnown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B;IACzC,MAAM,eAAe,GAAG,SAAS,CAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CACpD,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK;aACb,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAGxC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAU3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,eAAe,GAAG,SAAS,CAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACH;YACI,QAAQ,EAAE;gBACN,4CAA4C;gBAC5C,4CAA4C;aAC/C;YACD,MAAM,EAAE;gBACJ,SAAS,EAAE,aAAa;gBACxB,YAAY,EAAE,WAAW;gBACzB,wBAAwB,EAAE,YAAY;aACzC;SACJ;KACJ,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,QAA4B;IAC3C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAmB,EAAE;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,4BAA4B,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@vex-chat/spire",
3
- "version": "1.5.0",
3
+ "version": "1.6.1",
4
4
  "description": "Vex server implementation in NodeJS.",
5
5
  "type": "module",
6
6
  "files": [
@@ -55,8 +55,8 @@
55
55
  "typescript": "6.0.2",
56
56
  "typescript-eslint": "8.58.1",
57
57
  "vitest": "4.1.4",
58
- "@vex-chat/libvex": "^6.2.0",
59
- "@vex-chat/eslint-config": "0.0.1"
58
+ "@vex-chat/eslint-config": "0.0.1",
59
+ "@vex-chat/libvex": "^6.2.1"
60
60
  },
61
61
  "typeCoverage": {
62
62
  "atLeast": 95,
package/src/ClientManager.ts CHANGED
@@ -45,6 +45,25 @@ function emptyHeader() {
45
45
 
46
46
  const MAX_MSG_SIZE = 2048;
47
47
 
48
+ // How many ping cycles in a row are allowed to go without a pong
49
+ // before we declare the connection dead. With a 5s ping interval
50
+ // this gives ~15s of grace, which is enough to absorb a normal
51
+ // mobile native modal (biometric prompt, file picker, share sheet,
52
+ // expensive crypto on the JS thread) without killing an otherwise
53
+ // healthy session and forcing the client through a Noise+login
54
+ // reconnect. A genuinely dead TCP flow still gets cleaned up at
55
+ // most a couple of pings later, which is well inside the
56
+ // upstream nginx/proxy idle window we have to live within anyway.
57
+ //
58
+ // The previous behaviour ("a single missed pong fails the
59
+ // connection") was the root cause of the stream of `ws:disconnect`
60
+ // → `connection:recover:start` → `INVALID_STATE_ERR` cycles seen
61
+ // during passkey registration on Android: the system biometric
62
+ // prompt routinely paused the JS thread past 5s, the pong handler
63
+ // couldn't run, and we'd kill the socket out from under the user.
64
+ const MAX_MISSED_PONGS = 3;
65
+ const PING_INTERVAL_MS = 5000;
66
+
48
67
  export class ClientManager extends EventEmitter {
49
68
  private alive: boolean = true;
50
69
  private authed: boolean = false;
@@ -53,6 +72,7 @@ export class ClientManager extends EventEmitter {
53
72
  private db: Database;
54
73
  private device: Device | null;
55
74
  private failed: boolean = false;
75
+ private missedPongs: number = 0;
56
76
  private notify: (
57
77
  userID: string,
58
78
  event: string,
@@ -189,6 +209,7 @@ export class ClientManager extends EventEmitter {
189
209
  break;
190
210
  case "pong":
191
211
  this.setAlive(true);
212
+ this.missedPongs = 0;
192
213
  break;
193
214
  case "receipt":
194
215
  // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed by msg.type
@@ -268,10 +289,17 @@ export class ClientManager extends EventEmitter {
268
289
 
269
290
  private ping() {
270
291
  if (!this.alive) {
271
- this.fail();
272
- return;
292
+ this.missedPongs++;
293
+ if (this.missedPongs >= MAX_MISSED_PONGS) {
294
+ this.fail();
295
+ return;
296
+ }
297
+ // Don't reset alive=false → we keep counting up until a
298
+ // pong actually arrives or we hit the cap.
299
+ } else {
300
+ this.missedPongs = 0;
301
+ this.setAlive(false);
273
302
  }
274
- this.setAlive(false);
275
303
  const p = { transmissionID: crypto.randomUUID(), type: "ping" };
276
304
  this.send(p);
277
305
  }
@@ -279,7 +307,7 @@ export class ClientManager extends EventEmitter {
279
307
  private async pingLoop() {
280
308
  while (!this.failed) {
281
309
  this.ping();
282
- await sleep(5000);
310
+ await sleep(PING_INTERVAL_MS);
283
311
  }
284
312
  }
285
313
 
package/src/__tests__/wellKnown.spec.ts CHANGED
@@ -7,6 +7,7 @@
7
7
  import { afterEach, describe, expect, it } from "vitest";
8
8
 
9
9
  import {
10
+ buildAndroidApkKeyHashOrigins,
10
11
  buildAppleAppSiteAssociation,
11
12
  buildAssetLinks,
12
13
  normalizeFingerprint,
@@ -111,3 +112,26 @@ describe("buildAssetLinks", () => {
111
112
  expect(buildAssetLinks()).toBeNull();
112
113
  });
113
114
  });
115
+
116
+ describe("buildAndroidApkKeyHashOrigins", () => {
117
+ it("returns an empty list when no fingerprints are configured", () => {
118
+ expect(buildAndroidApkKeyHashOrigins()).toEqual([]);
119
+ });
120
+
121
+ it("derives base64url apk-key-hash origins from configured fingerprints", () => {
122
+ process.env["SPIRE_PASSKEY_ANDROID_FINGERPRINTS"] =
123
+ "7D:94:DB:DF:C9:2D:A8:BB:A1:A7:9B:64:E1:17:AD:70:0A:69:DA:A5:A0:EB:00:A9:12:A4:4E:FC:5F:6B:7C:42, 5c13f0e4ee1167a49c04ebc8033e058f4450bdae36aa15b64f837cac240fd282";
124
+ expect(buildAndroidApkKeyHashOrigins()).toEqual([
125
+ "android:apk-key-hash:fZTb38ktqLuhp5tk4RetcApp2qWg6wCpEqRO_F9rfEI",
126
+ "android:apk-key-hash:XBPw5O4RZ6ScBOvIAz4Fj0RQva42qhW2T4N8rCQP0oI",
127
+ ]);
128
+ });
129
+
130
+ it("silently drops malformed fingerprints", () => {
131
+ process.env["SPIRE_PASSKEY_ANDROID_FINGERPRINTS"] =
132
+ "7D:94:DB:DF:C9:2D:A8:BB:A1:A7:9B:64:E1:17:AD:70:0A:69:DA:A5:A0:EB:00:A9:12:A4:4E:FC:5F:6B:7C:42, not-a-hash";
133
+ expect(buildAndroidApkKeyHashOrigins()).toEqual([
134
+ "android:apk-key-hash:fZTb38ktqLuhp5tk4RetcApp2qWg6wCpEqRO_F9rfEI",
135
+ ]);
136
+ });
137
+ });
package/src/server/passkey.ts CHANGED
@@ -37,6 +37,7 @@ import { msgpack } from "../utils/msgpack.ts";
37
37
  import { AppError } from "./errors.ts";
38
38
  import { authLimiter } from "./rateLimit.ts";
39
39
  import { censorUser, getParam, getUser } from "./utils.ts";
40
+ import { buildAndroidApkKeyHashOrigins } from "./wellKnown.ts";
40
41
 
41
42
  import { protect } from "./index.ts";
42
43
 
@@ -73,6 +74,14 @@ const pendingAuthentications = new Map<string, PendingAuthentication>();
73
74
  * client origins (e.g. `https://app.vex.wtf,tauri://localhost,
74
75
  * http://localhost:5173`). Required: WebAuthn binds an assertion
75
76
  * to its origin and we must check it explicitly.
77
+ *
78
+ * The returned `expectedOrigin` list also includes any
79
+ * `android:apk-key-hash:<base64url>` entries derived from
80
+ * `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` (see
81
+ * `buildAndroidApkKeyHashOrigins`). Native Android Credential
82
+ * Manager sets `clientDataJSON.origin` to that string instead of the
83
+ * RP host, so we accept it implicitly whenever the operator has
84
+ * already advertised the cert via the assetlinks file.
76
85
  */
77
86
  function getRpConfig(): {
78
87
  expectedOrigin: string[];
@@ -93,13 +102,16 @@ function getRpConfig(): {
93
102
  "Passkeys are not configured on this server (SPIRE_PASSKEY_ORIGINS is unset).",
94
103
  );
95
104
  }
96
- const expectedOrigin = originsRaw
105
+ const explicitOrigins = originsRaw
97
106
  .split(",")
98
107
  .map((o) => o.trim())
99
108
  .filter((o) => o.length > 0);
100
- if (expectedOrigin.length === 0) {
109
+ if (explicitOrigins.length === 0) {
101
110
  throw new AppError(500, "SPIRE_PASSKEY_ORIGINS is empty.");
102
111
  }
112
+ const expectedOrigin = Array.from(
113
+ new Set([...explicitOrigins, ...buildAndroidApkKeyHashOrigins()]),
114
+ );
103
115
  return {
104
116
  expectedOrigin,
105
117
  rpID,
package/src/server/wellKnown.ts CHANGED
@@ -8,6 +8,50 @@ import express from "express";
8
8
 
9
9
  const HEX_FINGERPRINT = /^[0-9a-fA-F]{2}(?::?[0-9a-fA-F]{2}){31}$/;
10
10
 
11
+ /**
12
+ * Build the WebAuthn `expectedOrigin` entries for native Android
13
+ * clients from the same fingerprints used to publish the Digital
14
+ * Asset Links file.
15
+ *
16
+ * Android's Credential Manager sets `clientDataJSON.origin` to
17
+ * `android:apk-key-hash:<base64url(sha256-cert)>` for native
18
+ * ceremonies, not to the RP host's HTTPS origin. simplewebauthn
19
+ * therefore needs that exact string in its `expectedOrigin` list
20
+ * or it rejects the assertion before any of our application logic
21
+ * runs ("Unexpected registration response origin", presented to the
22
+ * client as a generic "RP failed" error).
23
+ *
24
+ * Operators already advertise the same SHA-256 fingerprints via
25
+ * `SPIRE_PASSKEY_ANDROID_FINGERPRINTS` for the assetlinks file, so
26
+ * we derive the apk-key-hash form here and merge it into the origin
27
+ * allowlist automatically. That keeps the well-known file and the
28
+ * server-side origin check in lock-step from a single source of
29
+ * truth and saves operators from having to compute base64url of a
30
+ * raw SHA-256 by hand.
31
+ *
32
+ * Returns an empty array when no fingerprints are configured or
33
+ * none of them parse as valid SHA-256 hex.
34
+ */
35
+ export function buildAndroidApkKeyHashOrigins(): string[] {
36
+ const fingerprintsRaw = parseList(
37
+ process.env["SPIRE_PASSKEY_ANDROID_FINGERPRINTS"],
38
+ );
39
+ const out: string[] = [];
40
+ for (const raw of fingerprintsRaw) {
41
+ const norm = normalizeFingerprint(raw);
42
+ if (norm == null) continue;
43
+ const hex = norm.replace(/:/g, "");
44
+ const bytes = Buffer.from(hex, "hex");
45
+ const b64u = bytes
46
+ .toString("base64")
47
+ .replace(/\+/g, "-")
48
+ .replace(/\//g, "_")
49
+ .replace(/=+$/, "");
50
+ out.push(`android:apk-key-hash:${b64u}`);
51
+ }
52
+ return out;
53
+ }
54
+
11
55
  /**
12
56
  * Build the Apple App Site Association body, or `null` when the
13
57
  * server isn't configured to advertise any iOS apps.