@vex-chat/spire 4.0.0 → 4.1.0

package/dist/server/serverIcon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverIcon.js","sourceRoot":"","sources":["../../src/server/serverIcon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAExC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE;CAC7E,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO;IAC5B,MAAM,GAAG;SACJ,MAAM,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAC3C,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,EAAY,EACZ,kBAAsC,EACxC,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,eAAe,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;;gBACrC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B;gBACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACP,YAAY,EACZ,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI;YAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,KAAK,UAAU,eAAe,CAC1B,EAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,QAAQ,CACnB,GAAoB,EACpB,GAAqB,EACrB,EAAY,EACZ,kBAAsC,EACtC,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC5C,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE,iEAAiE;SAC3E,CAAC,CAAC;QACH,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC;IAChD,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI;YAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAwB,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vex-chat/spire",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Vex server implementation in NodeJS.",
   "type": "module",
   "files": [
@@ -55,7 +55,7 @@
     "typescript-eslint": "8.58.1",
     "vitest": "4.1.4",
     "@vex-chat/eslint-config": "0.0.1",
-    "@vex-chat/libvex": "^9.0.0"
+    "@vex-chat/libvex": "^9.1.0"
   },
   "typeCoverage": {
     "atLeast": 95,

package/src/Database.ts

@@ -478,6 +478,44 @@ export class Database extends EventEmitter {
             .execute();
     }
 
+    /** Delete a channel while preserving the invariant that a server has one. */
+    public async deleteChannelIfNotLast(channelID: string): Promise<boolean> {
+        return this.db.transaction().execute(async (trx) => {
+            const channel = await trx
+                .selectFrom("channels")
+                .selectAll()
+                .where("channelID", "=", channelID)
+                .executeTakeFirst();
+            if (!channel) {
+                return false;
+            }
+
+            const siblings = await trx
+                .selectFrom("channels")
+                .select("channelID")
+                .where("serverID", "=", channel.serverID)
+                .limit(2)
+                .execute();
+            if (siblings.length <= 1) {
+                return false;
+            }
+
+            await trx
+                .deleteFrom("permissions")
+                .where("resourceID", "=", channelID)
+                .execute();
+            await trx
+                .deleteFrom("mail")
+                .where("group", "=", channelID)
+                .execute();
+            await trx
+                .deleteFrom("channels")
+                .where("channelID", "=", channelID)
+                .execute();
+            return true;
+        });
+    }
+
     public async deleteDevice(deviceID: string): Promise<void> {
         await this.db.transaction().execute(async (trx) => {
             await trx
@@ -1704,6 +1742,51 @@ export class Database extends EventEmitter {
         });
     }
 
+    public async updateChannel(
+        channelID: string,
+        name: string,
+    ): Promise<Channel | null> {
+        const result = await this.db
+            .updateTable("channels")
+            .set({ name })
+            .where("channelID", "=", channelID)
+            .executeTakeFirst();
+        if (Number(result.numUpdatedRows) === 0) {
+            return null;
+        }
+        return this.retrieveChannel(channelID);
+    }
+
+    public async updatePermissionPowerLevel(
+        permissionID: string,
+        powerLevel: number,
+    ): Promise<null | Permission> {
+        const result = await this.db
+            .updateTable("permissions")
+            .set({ powerLevel })
+            .where("permissionID", "=", permissionID)
+            .executeTakeFirst();
+        if (Number(result.numUpdatedRows) === 0) {
+            return null;
+        }
+        return this.retrievePermission(permissionID);
+    }
+
+    public async updateServer(
+        serverID: string,
+        update: { icon?: null | string; name?: string },
+    ): Promise<null | Server> {
+        const result = await this.db
+            .updateTable("servers")
+            .set(update)
+            .where("serverID", "=", serverID)
+            .executeTakeFirst();
+        if (Number(result.numUpdatedRows) === 0) {
+            return null;
+        }
+        return this.retrieveServer(serverID);
+    }
+
     public async upsertStoreSubscription(
         input: StoreSubscriptionUpsertInput,
     ): Promise<BillingSubscription> {

package/src/Spire.ts

@@ -188,7 +188,7 @@ const notificationSubscribePayload = z.object({
     token: z.string().min(1).max(4096),
 });
 
-const directories = ["files", "avatars", "emoji"];
+const directories = ["files", "avatars", "emoji", "server-icons"];
 for (const dir of directories) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir);

package/src/__tests__/browserPasskeyAuthentication.spec.ts

@@ -0,0 +1,192 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Passkey, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getPasskeyRouter } from "../server/passkey.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-browser-auth",
+    username: "alice",
+};
+
+const passkey: Passkey = {
+    createdAt: new Date(0).toISOString(),
+    lastUsedAt: null,
+    name: "MacBook Touch ID",
+    passkeyID: "passkey-browser-auth",
+    transports: ["internal"],
+    userID: user.userID,
+};
+
+const originalRpID = process.env["SPIRE_PASSKEY_RP_ID"];
+const originalOrigins = process.env["SPIRE_PASSKEY_ORIGINS"];
+
+beforeEach(() => {
+    process.env["SPIRE_PASSKEY_RP_ID"] = "vex.example";
+    process.env["SPIRE_PASSKEY_ORIGINS"] = "https://vex.example";
+});
+
+afterEach(() => {
+    restoreEnv("SPIRE_PASSKEY_RP_ID", originalRpID);
+    restoreEnv("SPIRE_PASSKEY_ORIGINS", originalOrigins);
+});
+
+describe("browser passkey authentication", () => {
+    it("returns an HTTPS assertion to the original authentication request", async () => {
+        const db = {
+            retrievePasskeyInternal: vi.fn(() =>
+                Promise.resolve({ credentialID: "credential-browser-auth" }),
+            ),
+            retrievePasskeysByUser: vi.fn(() => Promise.resolve([passkey])),
+            retrieveUser: vi.fn(() => Promise.resolve(user)),
+        } as unknown as Database;
+        const app = express();
+        app.use(express.json());
+        app.use(getPasskeyRouter(db));
+        const server = await listen(app);
+
+        try {
+            const baseUrl = serverBaseUrl(server);
+            const authBeginResponse = await post(
+                `${baseUrl}/auth/passkey/begin?format=json`,
+                { username: user.username },
+            );
+            const authBegin = (await authBeginResponse.json()) as {
+                options: {
+                    challenge: string;
+                    rpId: string;
+                    vexBrowserHandoff: {
+                        browserToken: string;
+                        expiresAt: string;
+                        requestID: string;
+                    };
+                };
+                requestID: string;
+            };
+            const handoff = authBegin.options.vexBrowserHandoff;
+
+            expect(authBeginResponse.status).toBe(200);
+            expect(authBegin.options.rpId).toBe("vex.example");
+            expect(handoff.browserToken.length).toBeGreaterThanOrEqual(32);
+            expect(handoff.requestID).not.toBe(authBegin.requestID);
+
+            const wrongTokenResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/begin?format=json`,
+                { token: "x".repeat(43) },
+            );
+            expect(wrongTokenResponse.status).toBe(401);
+
+            const pendingResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(pendingResponse.status).toBe(202);
+
+            const browserBeginResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/begin?format=json`,
+                { token: handoff.browserToken },
+            );
+            const browserBegin = (await browserBeginResponse.json()) as {
+                options: {
+                    challenge: string;
+                    vexBrowserHandoff?: unknown;
+                };
+            };
+            expect(browserBeginResponse.status).toBe(200);
+            expect(browserBegin.options.challenge).toBe(
+                authBegin.options.challenge,
+            );
+            expect(browserBegin.options.vexBrowserHandoff).toBeUndefined();
+
+            const assertion = {
+                id: "credential-browser-auth",
+                response: { signature: "browser-assertion" },
+                type: "public-key",
+            };
+            const browserFinishResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/finish?format=json`,
+                { response: assertion, token: handoff.browserToken },
+            );
+            expect(browserFinishResponse.status).toBe(200);
+
+            const readyResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(readyResponse.status).toBe(200);
+            await expect(readyResponse.json()).resolves.toEqual({
+                response: assertion,
+            });
+
+            const consumeResponse = await post(
+                `${baseUrl}/auth/passkey/finish?format=json`,
+                { requestID: authBegin.requestID, response: {} },
+            );
+            expect(consumeResponse.status).toBe(400);
+
+            const replayResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(replayResponse.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+function post(url: string, body: unknown): Promise<Response> {
+    return fetch(url, {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+    });
+}
+
+function restoreEnv(name: string, value: string | undefined): void {
+    if (value === undefined) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- restores the process environment exactly
+        delete process.env[name];
+        return;
+    }
+    process.env[name] = value;
+}
+
+function serverBaseUrl(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/__tests__/browserPasskeyRegistration.spec.ts

@@ -0,0 +1,182 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getPasskeyRouter } from "../server/passkey.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+const device: Device = {
+    deleted: false,
+    deviceID: "device-a",
+    lastLogin: new Date(0).toISOString(),
+    name: "desktop",
+    owner: user.userID,
+    signKey: "a".repeat(64),
+};
+
+const originalRpID = process.env["SPIRE_PASSKEY_RP_ID"];
+const originalOrigins = process.env["SPIRE_PASSKEY_ORIGINS"];
+
+beforeEach(() => {
+    process.env["SPIRE_PASSKEY_RP_ID"] = "vex.example";
+    process.env["SPIRE_PASSKEY_ORIGINS"] = "https://vex.example";
+});
+
+afterEach(() => {
+    restoreEnv("SPIRE_PASSKEY_RP_ID", originalRpID);
+    restoreEnv("SPIRE_PASSKEY_ORIGINS", originalOrigins);
+});
+
+describe("browser passkey registration", () => {
+    it("issues a scoped browser handoff from an authenticated registration", async () => {
+        let approvedDevice: Device | null = device;
+        const db = {
+            retrieveDevice: vi.fn(() => Promise.resolve(approvedDevice)),
+            retrievePasskeysByUser: vi.fn(() => Promise.resolve([])),
+        } as unknown as Database;
+        const app = express();
+        app.use(express.json());
+        app.use((req, _res, next) => {
+            req.device = device;
+            req.user = user;
+            next();
+        });
+        app.use(getPasskeyRouter(db));
+        const server = await listen(app);
+
+        try {
+            const baseUrl = serverBaseUrl(server);
+            const createResponse = await fetch(
+                `${baseUrl}/user/${user.userID}/passkeys/register/begin?format=json`,
+                {
+                    body: JSON.stringify({ name: "MacBook Touch ID" }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const created = (await createResponse.json()) as {
+                options: {
+                    rp: { id: string };
+                    vexBrowserHandoff: {
+                        browserToken: string;
+                        expiresAt: string;
+                        requestID: string;
+                    };
+                };
+                requestID: string;
+            };
+            const handoff = created.options.vexBrowserHandoff;
+
+            expect(createResponse.status).toBe(200);
+            expect(created.options.rp.id).toBe("vex.example");
+            expect(handoff.browserToken.length).toBeGreaterThanOrEqual(32);
+            expect(new Date(handoff.expiresAt).getTime()).toBeGreaterThan(
+                Date.now(),
+            );
+            expect(handoff.requestID).not.toBe(created.requestID);
+
+            const wrongTokenResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: "x".repeat(43) }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(wrongTokenResponse.status).toBe(401);
+
+            const beginResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: handoff.browserToken }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const begin = (await beginResponse.json()) as {
+                options: { rp: { id: string } };
+            };
+            expect(beginResponse.status).toBe(200);
+            expect(begin.options.rp.id).toBe("vex.example");
+
+            const nativeFinishResponse = await fetch(
+                `${baseUrl}/user/${user.userID}/passkeys/register/finish?format=json`,
+                {
+                    body: JSON.stringify({
+                        name: "MacBook Touch ID",
+                        requestID: created.requestID,
+                        response: {},
+                    }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(nativeFinishResponse.status).toBe(404);
+
+            approvedDevice = null;
+            const revokedDeviceResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: handoff.browserToken }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(revokedDeviceResponse.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+function restoreEnv(name: string, value: string | undefined): void {
+    if (value === undefined) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- restores the process environment exactly
+        delete process.env[name];
+        return;
+    }
+    process.env[name] = value;
+}
+
+function serverBaseUrl(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/__tests__/cliPasskeyPage.spec.ts

@@ -47,6 +47,12 @@ describe("CLI passkey page", () => {
         expect(html).toContain("Continue with your passkey.");
         expect(html).toContain("resolveTrustedApiBase");
         expect(html).toContain("Passkey link API origin is not trusted.");
+        expect(html).toContain("window.history.replaceState");
+        expect(html).toContain('mode === "register-handoff"');
+        expect(html).toContain('mode === "authenticate-handoff"');
+        expect(html).toContain('"/auth/passkey/browser-registration/"');
+        expect(html).toContain('"/auth/passkey/browser-authentication/"');
+        expect(html).toContain("action.disabled = nextBusy || completed");
         expect(html).toContain("navigator.credentials.create");
         expect(html).toContain("navigator.credentials.get");
     });