@virtonetwork/authenticators-webauthn 1.0.0 → 1.0.2

package/dist/cjs/index.js

@@ -37,26 +37,8 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebAuthn = exports.KREIVO_AUTHORITY_ID = void 0;
-/**
- * WebAuthn pass‑key authenticator for Virto Network.
- *
- * Exposes a browser‑side implementation of {@link Authenticator} that creates,
- * stores, and uses WebAuthn resident credentials ("passkeys") while producing
- * SCALE‑encoded data structures understood by the Kreivo signer pallet.
- *
- * Responsibilities
- * ─────────────────────────────────────────────────────────
- * • Derive a deterministic `deviceId` from the raw credential id
- * • Emit `TAttestation<number>` during registration
- * • Emit `TPassAuthenticate` during authentication
- * • Never persist the credential mapping; that is delegated to the caller
- *
- * @module WebAuthn
- */
-var signer_1 = require("@virtonetwork/signer");
 var substrate_bindings_1 = require("@polkadot-api/substrate-bindings");
 var types_ts_1 = require("./types.js");
-var utils_1 = require("polkadot-api/utils");
 /** Fixed authority id for Kreivo pass‑key attestors. */
 exports.KREIVO_AUTHORITY_ID = substrate_bindings_1.Binary.fromText("kreivo_p".padEnd(32, "\0"));
 /**
@@ -76,8 +58,9 @@ var WebAuthn = /** @class */ (function () {
      * @param [credentialId] - Raw credential id obtained from a previous
      *   registration flow; omit it if the user must enrol a new pass‑key.
      */
-    function WebAuthn(userId, credentialId) {
+    function WebAuthn(userId, getChallenge, credentialId) {
         this.userId = userId;
+        this.getChallenge = getChallenge;
         this.credentialId = credentialId;
         /**
          * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
@@ -143,9 +126,9 @@ var WebAuthn = /** @class */ (function () {
      * @throws Error If this instance already has a credential id.
      * @returns {Promise<TAttestation<number>>} SCALE‑encoded attestation object.
      */
-    WebAuthn.prototype.register = function (blockNumber_1, blockHash_1) {
-        return __awaiter(this, arguments, void 0, function (blockNumber, blockHash, displayName) {
-            var challenger, challenge, credentials, _a, attestationObject, clientDataJSON, getPublicKey, publicKey;
+    WebAuthn.prototype.register = function (blockNumber_1) {
+        return __awaiter(this, arguments, void 0, function (blockNumber, displayName) {
+            var challenge, credentials, _a, attestationObject, clientDataJSON, getPublicKey, publicKey;
             var _b, _c;
             if (displayName === void 0) { displayName = this.userId; }
             return __generator(this, function (_d) {
@@ -154,8 +137,9 @@ var WebAuthn = /** @class */ (function () {
                         if (this.credentialId) {
                             throw new Error("Already have a credentialId; no need to register");
                         }
-                        challenger = new signer_1.KreivoBlockChallenger();
-                        challenge = challenger.generate((0, utils_1.fromHex)(blockHash), new Uint8Array());
+                        return [4 /*yield*/, this.getChallenge(blockNumber, new Uint8Array([]))];
+                    case 1:
+                        challenge = _d.sent();
                         return [4 /*yield*/, navigator.credentials.create({
                                 publicKey: {
                                     challenge: challenge,
@@ -171,7 +155,7 @@ var WebAuthn = /** @class */ (function () {
                                     timeout: 60000,
                                 },
                             })];
-                    case 1:
+                    case 2:
                         credentials = (_d.sent());
                         _a = credentials.response, attestationObject = _a.attestationObject, clientDataJSON = _a.clientDataJSON, getPublicKey = _a.getPublicKey;
                         // Save raw credential id for future auth calls
@@ -182,15 +166,15 @@ var WebAuthn = /** @class */ (function () {
                         }
                         _b = {};
                         _c = {
-                            authorityId: exports.KREIVO_AUTHORITY_ID
+                            authority_id: exports.KREIVO_AUTHORITY_ID
                         };
                         return [4 /*yield*/, WebAuthn.getDeviceId(this)];
-                    case 2: return [2 /*return*/, (_b.meta = (_c.deviceId = _d.sent(),
+                    case 3: return [2 /*return*/, (_b.meta = (_c.device_id = _d.sent(),
                             _c.context = blockNumber,
                             _c),
-                            _b.authenticatorData = substrate_bindings_1.Binary.fromBytes(new Uint8Array(attestationObject)),
-                            _b.clientData = substrate_bindings_1.Binary.fromBytes(new Uint8Array(clientDataJSON)),
-                            _b.publicKey = substrate_bindings_1.Binary.fromBytes(new Uint8Array(publicKey)),
+                            _b.authenticator_data = substrate_bindings_1.Binary.fromBytes(new Uint8Array(attestationObject)),
+                            _b.client_data = substrate_bindings_1.Binary.fromBytes(new Uint8Array(clientDataJSON)),
+                            _b.public_key = substrate_bindings_1.Binary.fromBytes(new Uint8Array(publicKey)),
                             _b)];
                 }
             });
@@ -206,9 +190,9 @@ var WebAuthn = /** @class */ (function () {
      * @returns SCALE‑encoded authentication payload.
      * @throws Error If no credential id is available.
      */
-    WebAuthn.prototype.authenticate = function (challenge, context) {
+    WebAuthn.prototype.authenticate = function (context, xtc) {
         return __awaiter(this, void 0, void 0, function () {
-            var publicKey, cred, _a, authenticatorData, clientDataJSON, signature, assertion;
+            var challenge, publicKey, cred, _a, authenticatorData, clientDataJSON, signature, assertion;
             var _b;
             return __generator(this, function (_c) {
                 switch (_c.label) {
@@ -216,6 +200,9 @@ var WebAuthn = /** @class */ (function () {
                         if (!this.credentialId) {
                             throw new Error("credentialId unknown – call register() first or inject it via constructor/setCredentialId()");
                         }
+                        return [4 /*yield*/, this.getChallenge(context, xtc)];
+                    case 1:
+                        challenge = _c.sent();
                         publicKey = {
                             challenge: challenge,
                             allowCredentials: [
@@ -231,22 +218,22 @@ var WebAuthn = /** @class */ (function () {
                         return [4 /*yield*/, navigator.credentials.get({
                                 publicKey: publicKey,
                             })];
-                    case 1:
+                    case 2:
                         cred = (_c.sent());
                         _a = cred.response, authenticatorData = _a.authenticatorData, clientDataJSON = _a.clientDataJSON, signature = _a.signature;
                         assertion = {
                             meta: {
-                                authorityId: exports.KREIVO_AUTHORITY_ID,
-                                userId: substrate_bindings_1.Binary.fromBytes(this.hashedUserId),
+                                authority_id: exports.KREIVO_AUTHORITY_ID,
+                                user_id: substrate_bindings_1.Binary.fromBytes(this.hashedUserId),
                                 context: context,
                             },
-                            authenticatorData: substrate_bindings_1.Binary.fromBytes(new Uint8Array(authenticatorData)),
-                            clientData: substrate_bindings_1.Binary.fromBytes(new Uint8Array(clientDataJSON)),
+                            authenticator_data: substrate_bindings_1.Binary.fromBytes(new Uint8Array(authenticatorData)),
+                            client_data: substrate_bindings_1.Binary.fromBytes(new Uint8Array(clientDataJSON)),
                             signature: substrate_bindings_1.Binary.fromBytes(new Uint8Array(signature)),
                         };
                         _b = {};
                         return [4 /*yield*/, WebAuthn.getDeviceId(this)];
-                    case 2: return [2 /*return*/, (_b.deviceId = _c.sent(),
+                    case 3: return [2 /*return*/, (_b.deviceId = _c.sent(),
                             _b.credentials = {
                                 tag: "WebAuthn",
                                 value: types_ts_1.Assertion.enc(assertion),

package/dist/cjs/types.js

@@ -4,24 +4,24 @@ exports.Assertion = exports.Attestation = void 0;
 var substrate_bindings_1 = require("@polkadot-api/substrate-bindings");
 var scale_ts_1 = require("scale-ts");
 var AttestationMeta = (0, scale_ts_1.Struct)({
-    authorityId: (0, substrate_bindings_1.Bin)(32),
-    deviceId: (0, substrate_bindings_1.Bin)(32),
+    authority_id: (0, substrate_bindings_1.Bin)(32),
+    device_id: (0, substrate_bindings_1.Bin)(32),
     context: scale_ts_1.u32,
 });
 exports.Attestation = (0, scale_ts_1.Struct)({
     meta: AttestationMeta,
-    authenticatorData: (0, substrate_bindings_1.Bin)(),
-    clientData: (0, substrate_bindings_1.Bin)(),
-    publicKey: (0, substrate_bindings_1.Bin)(),
+    authenticator_data: (0, substrate_bindings_1.Bin)(),
+    client_data: (0, substrate_bindings_1.Bin)(),
+    public_key: (0, substrate_bindings_1.Bin)(),
 });
 var AssertionMeta = (0, scale_ts_1.Struct)({
-    authorityId: (0, substrate_bindings_1.Bin)(32),
-    userId: (0, substrate_bindings_1.Bin)(32),
+    authority_id: (0, substrate_bindings_1.Bin)(32),
+    user_id: (0, substrate_bindings_1.Bin)(32),
     context: scale_ts_1.u32,
 });
 exports.Assertion = (0, scale_ts_1.Struct)({
     meta: AssertionMeta,
-    authenticatorData: (0, substrate_bindings_1.Bin)(),
-    clientData: (0, substrate_bindings_1.Bin)(),
+    authenticator_data: (0, substrate_bindings_1.Bin)(),
+    client_data: (0, substrate_bindings_1.Bin)(),
     signature: (0, substrate_bindings_1.Bin)(),
 });

package/dist/esm/index.d.ts

@@ -16,7 +16,7 @@
  */
 import { Authenticator, DeviceId } from "@virtonetwork/signer";
 import { Binary } from "@polkadot-api/substrate-bindings";
-import type { BlockHash, TAttestation } from "./types.ts";
+import type { TAttestation } from "./types.ts";
 import type { TPassAuthenticate } from "@virtonetwork/signer";
 /** Fixed authority id for Kreivo pass‑key attestors. */
 export declare const KREIVO_AUTHORITY_ID: Binary;
@@ -31,6 +31,7 @@ export declare const KREIVO_AUTHORITY_ID: Binary;
  */
 export declare class WebAuthn implements Authenticator<number> {
     readonly userId: string;
+    getChallenge: (context: number, xtc: Uint8Array) => Promise<Uint8Array>;
     credentialId?: Uint8Array | undefined;
     /**
      * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
@@ -44,7 +45,7 @@ export declare class WebAuthn implements Authenticator<number> {
      * @param [credentialId] - Raw credential id obtained from a previous
      *   registration flow; omit it if the user must enrol a new pass‑key.
      */
-    constructor(userId: string, credentialId?: Uint8Array | undefined);
+    constructor(userId: string, getChallenge: (context: number, xtc: Uint8Array) => Promise<Uint8Array>, credentialId?: Uint8Array | undefined);
     /**
      * Deterministic identifier of the hardware/software authenticator
      * (`deviceId = Blake2‑256(credentialId)`).
@@ -77,7 +78,7 @@ export declare class WebAuthn implements Authenticator<number> {
      * @throws Error If this instance already has a credential id.
      * @returns {Promise<TAttestation<number>>} SCALE‑encoded attestation object.
      */
-    register(blockNumber: number, blockHash: BlockHash, displayName?: string): Promise<TAttestation<number>>;
+    register(blockNumber: number, displayName?: string): Promise<TAttestation<number>>;
     /**
      * Signs an arbitrary challenge with the pass‑key and produces a
      * {@link TPassAuthenticate} payload understood by `PassSigner`.
@@ -88,5 +89,5 @@ export declare class WebAuthn implements Authenticator<number> {
      * @returns SCALE‑encoded authentication payload.
      * @throws Error If no credential id is available.
      */
-    authenticate(challenge: Uint8Array, context: number): Promise<TPassAuthenticate>;
+    authenticate(context: number, xtc: Uint8Array): Promise<TPassAuthenticate>;
 }

package/dist/esm/index.js

@@ -1,23 +1,5 @@
-/**
- * WebAuthn pass‑key authenticator for Virto Network.
- *
- * Exposes a browser‑side implementation of {@link Authenticator} that creates,
- * stores, and uses WebAuthn resident credentials ("passkeys") while producing
- * SCALE‑encoded data structures understood by the Kreivo signer pallet.
- *
- * Responsibilities
- * ─────────────────────────────────────────────────────────
- * • Derive a deterministic `deviceId` from the raw credential id
- * • Emit `TAttestation<number>` during registration
- * • Emit `TPassAuthenticate` during authentication
- * • Never persist the credential mapping; that is delegated to the caller
- *
- * @module WebAuthn
- */
-import { KreivoBlockChallenger, } from "@virtonetwork/signer";
 import { Binary, Blake2256 } from "@polkadot-api/substrate-bindings";
 import { Assertion } from "./types.js";
-import { fromHex } from "polkadot-api/utils";
 /** Fixed authority id for Kreivo pass‑key attestors. */
 export const KREIVO_AUTHORITY_ID = Binary.fromText("kreivo_p".padEnd(32, "\0"));
 /**
@@ -31,6 +13,7 @@ export const KREIVO_AUTHORITY_ID = Binary.fromText("kreivo_p".padEnd(32, "\0"));
  */
 export class WebAuthn {
     userId;
+    getChallenge;
     credentialId;
     /**
      * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
@@ -44,8 +27,9 @@ export class WebAuthn {
      * @param [credentialId] - Raw credential id obtained from a previous
      *   registration flow; omit it if the user must enrol a new pass‑key.
      */
-    constructor(userId, credentialId) {
+    constructor(userId, getChallenge, credentialId) {
         this.userId = userId;
+        this.getChallenge = getChallenge;
         this.credentialId = credentialId;
     }
     /**
@@ -90,12 +74,11 @@ export class WebAuthn {
      * @throws Error If this instance already has a credential id.
      * @returns {Promise<TAttestation<number>>} SCALE‑encoded attestation object.
      */
-    async register(blockNumber, blockHash, displayName = this.userId) {
+    async register(blockNumber, displayName = this.userId) {
         if (this.credentialId) {
             throw new Error("Already have a credentialId; no need to register");
         }
-        const challenger = new KreivoBlockChallenger();
-        const challenge = challenger.generate(fromHex(blockHash), new Uint8Array());
+        const challenge = await this.getChallenge(blockNumber, new Uint8Array([]));
         const credentials = (await navigator.credentials.create({
             publicKey: {
                 challenge,
@@ -121,13 +104,13 @@ export class WebAuthn {
         }
         return {
             meta: {
-                authorityId: KREIVO_AUTHORITY_ID,
-                deviceId: await WebAuthn.getDeviceId(this),
+                authority_id: KREIVO_AUTHORITY_ID,
+                device_id: await WebAuthn.getDeviceId(this),
                 context: blockNumber,
             },
-            authenticatorData: Binary.fromBytes(new Uint8Array(attestationObject)),
-            clientData: Binary.fromBytes(new Uint8Array(clientDataJSON)),
-            publicKey: Binary.fromBytes(new Uint8Array(publicKey)),
+            authenticator_data: Binary.fromBytes(new Uint8Array(attestationObject)),
+            client_data: Binary.fromBytes(new Uint8Array(clientDataJSON)),
+            public_key: Binary.fromBytes(new Uint8Array(publicKey)),
         };
     }
     /**
@@ -140,10 +123,11 @@ export class WebAuthn {
      * @returns SCALE‑encoded authentication payload.
      * @throws Error If no credential id is available.
      */
-    async authenticate(challenge, context) {
+    async authenticate(context, xtc) {
         if (!this.credentialId) {
             throw new Error("credentialId unknown – call register() first or inject it via constructor/setCredentialId()");
         }
+        const challenge = await this.getChallenge(context, xtc);
         const publicKey = {
             challenge,
             allowCredentials: [
@@ -162,12 +146,12 @@ export class WebAuthn {
         const { authenticatorData, clientDataJSON, signature } = cred.response;
         const assertion = {
             meta: {
-                authorityId: KREIVO_AUTHORITY_ID,
-                userId: Binary.fromBytes(this.hashedUserId),
+                authority_id: KREIVO_AUTHORITY_ID,
+                user_id: Binary.fromBytes(this.hashedUserId),
                 context,
             },
-            authenticatorData: Binary.fromBytes(new Uint8Array(authenticatorData)),
-            clientData: Binary.fromBytes(new Uint8Array(clientDataJSON)),
+            authenticator_data: Binary.fromBytes(new Uint8Array(authenticatorData)),
+            client_data: Binary.fromBytes(new Uint8Array(clientDataJSON)),
             signature: Binary.fromBytes(new Uint8Array(signature)),
         };
         return {

package/dist/esm/types.d.ts

@@ -3,26 +3,26 @@ import { Binary, HexString } from "@polkadot-api/substrate-bindings";
 import { Codec } from "scale-ts";
 export type BlockHash = HexString;
 export type TAttestationMeta<Cx> = {
-    authorityId: AuthorityId;
-    deviceId: DeviceId;
+    authority_id: AuthorityId;
+    device_id: DeviceId;
     context: Cx;
 };
 export type TAttestation<Cx> = {
     meta: TAttestationMeta<Cx>;
-    authenticatorData: Binary;
-    clientData: Binary;
-    publicKey: Binary;
+    authenticator_data: Binary;
+    client_data: Binary;
+    public_key: Binary;
 };
 export declare const Attestation: Codec<TAttestation<number>>;
 export type TAssertionMeta<Cx> = {
-    authorityId: AuthorityId;
-    userId: HashedUserId;
+    authority_id: AuthorityId;
+    user_id: HashedUserId;
     context: Cx;
 };
 export type TAssertion<Cx> = {
     meta: TAssertionMeta<Cx>;
-    authenticatorData: Binary;
-    clientData: Binary;
+    authenticator_data: Binary;
+    client_data: Binary;
     signature: Binary;
 };
 export declare const Assertion: Codec<TAssertion<number>>;

package/dist/esm/types.js

@@ -1,24 +1,24 @@
 import { Bin } from "@polkadot-api/substrate-bindings";
 import { Struct, u32 } from "scale-ts";
 const AttestationMeta = Struct({
-    authorityId: Bin(32),
-    deviceId: Bin(32),
+    authority_id: Bin(32),
+    device_id: Bin(32),
     context: u32,
 });
 export const Attestation = Struct({
     meta: AttestationMeta,
-    authenticatorData: Bin(),
-    clientData: Bin(),
-    publicKey: Bin(),
+    authenticator_data: Bin(),
+    client_data: Bin(),
+    public_key: Bin(),
 });
 const AssertionMeta = Struct({
-    authorityId: Bin(32),
-    userId: Bin(32),
+    authority_id: Bin(32),
+    user_id: Bin(32),
     context: u32,
 });
 export const Assertion = Struct({
     meta: AssertionMeta,
-    authenticatorData: Bin(),
-    clientData: Bin(),
+    authenticator_data: Bin(),
+    client_data: Bin(),
     signature: Bin(),
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@virtonetwork/authenticators-webauthn",
   "description": "An Authenticator compatible with KreivoPassSigner that uses the WebAuthn standard",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "files": [
     "dist"
@@ -52,4 +52,4 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   }
-}
+}