@vex-chat/spire 2.3.3 → 2.4.0

package/src/server/passkey.ts

@@ -32,12 +32,12 @@ import jwt from "jsonwebtoken";
 
 import { JWT_EXPIRY_PASSKEY } from "../Spire.ts";
 import { getJwtSecret } from "../utils/jwtSecret.ts";
-import { msgpack } from "../utils/msgpack.ts";
 
 import { AppError } from "./errors.ts";
 import { authLimiter } from "./rateLimit.ts";
 import { censorUser, getParam, getUser } from "./utils.ts";
 import { buildAndroidApkKeyHashOrigins } from "./wellKnown.ts";
+import { sendWireResponse } from "./wireResponse.ts";
 
 import { protect } from "./index.ts";
 
@@ -257,12 +257,10 @@ export const getPasskeyRouter = (db: Database) => {
             // shared types package doesn't take a runtime dep on
             // SimpleWebAuthn). The wire shape is identical — both
             // sides hand the JSON straight to navigator.credentials.
-            res.send(
-                msgpack.encode({
-                    options,
-                    requestID,
-                }),
-            );
+            sendWireResponse(req, res, {
+                options,
+                requestID,
+            });
         },
     );
 
@@ -379,7 +377,7 @@ export const getPasskeyRouter = (db: Database) => {
                 transports,
             );
 
-            res.send(msgpack.encode(created));
+            sendWireResponse(req, res, created);
         },
     );
 
@@ -391,7 +389,7 @@ export const getPasskeyRouter = (db: Database) => {
             return;
         }
         const list: Passkey[] = await db.retrievePasskeysByUser(userID);
-        res.send(msgpack.encode(list));
+        sendWireResponse(req, res, list);
     });
 
     router.delete(
@@ -477,12 +475,10 @@ export const getPasskeyRouter = (db: Database) => {
             userID: user.userID,
         });
 
-        res.send(
-            msgpack.encode({
-                options,
-                requestID,
-            }),
-        );
+        sendWireResponse(req, res, {
+            options,
+            requestID,
+        });
     });
 
     router.post("/auth/passkey/finish", authLimiter, async (req, res) => {
@@ -596,13 +592,11 @@ export const getPasskeyRouter = (db: Database) => {
             passkeyID: passkeyRow.passkeyID,
             user: censored,
         });
-        res.send(
-            msgpack.encode({
-                passkeyID: passkeyRow.passkeyID,
-                token,
-                user: censored,
-            }),
-        );
+        sendWireResponse(req, res, {
+            passkeyID: passkeyRow.passkeyID,
+            token,
+            user: censored,
+        });
     });
 
     return router;

package/src/server/passkeyDevices.ts

@@ -8,13 +8,12 @@ import type { Database } from "../Database.ts";
 
 import express from "express";
 
-import { msgpack } from "../utils/msgpack.ts";
-
 import {
     recoverDeviceEnrollmentRequest,
     resolveDeviceEnrollmentRequest,
 } from "./user.ts";
 import { getParam, getUser } from "./utils.ts";
+import { sendWireResponse } from "./wireResponse.ts";
 
 import { protectPasskey } from "./index.ts";
 
@@ -60,7 +59,7 @@ export const getPasskeyDeviceRouter = (
                 return;
             }
             const list = await db.retrieveUserDeviceList([userID]);
-            res.send(msgpack.encode(list));
+            sendWireResponse(req, res, list);
         },
     );
 
@@ -126,7 +125,7 @@ export const getPasskeyDeviceRouter = (
             if (result.kind === "ok") {
                 notify(userID, "deviceListChanged", crypto.randomUUID());
                 disconnectDevices?.(result.revokedDeviceIDs);
-                res.send(msgpack.encode(result.device));
+                sendWireResponse(req, res, result.device);
                 return;
             }
             res.status(result.status).send({ error: result.error });

package/src/server/wireResponse.ts

@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type express from "express";
+
+import { msgpack } from "../utils/msgpack.ts";
+
+/**
+ * Normal SDK clients expect msgpack from Spire. Browser-only helpers
+ * can opt into JSON with `?format=json` so they do not need to ship a
+ * msgpack codec just to complete a short WebAuthn bridge ceremony.
+ */
+export function sendWireResponse(
+    req: express.Request,
+    res: express.Response,
+    payload: unknown,
+): void {
+    if (req.query["format"] === "json") {
+        res.json(payload);
+        return;
+    }
+    res.send(msgpack.encode(payload));
+}