@voltro/plugin-auth 0.1.0

package/dist/webauthn.d.ts

@@ -0,0 +1,75 @@
+export declare type AssertionOutcome = {
+    readonly ok: true;
+    readonly result: AssertionResult;
+} | {
+    readonly ok: false;
+    readonly error: WebAuthnError;
+};
+
+export declare interface AssertionResult {
+    /** The new signature counter to persist. */
+    readonly newCounter: number;
+}
+
+export declare interface AssertionVerifyInput {
+    readonly clientDataJSON: string;
+    readonly authenticatorData: string;
+    /** base64url signature over `authenticatorData ‖ sha256(clientDataJSON)`. */
+    readonly signature: string;
+    readonly expectedChallenge: string;
+    readonly expectedOrigin: string;
+    readonly rpId: string;
+    /** The stored COSE public key (base64url) for the asserted credential. */
+    readonly storedPublicKey: string;
+    /** The stored signature counter for the credential. */
+    readonly storedCounter: number;
+}
+
+/** Mint a fresh WebAuthn challenge (base64url, 32 random bytes). The
+ *  server stashes it (keyed by user / ceremony) and hands it to the
+ *  browser; `verifyRegistration` / `verifyAssertion` check it back. */
+export declare const generateChallenge: () => string;
+
+export declare type RegistrationOutcome = {
+    readonly ok: true;
+    readonly result: RegistrationResult;
+} | {
+    readonly ok: false;
+    readonly error: WebAuthnError;
+};
+
+export declare interface RegistrationResult {
+    /** base64url credential id to store. */
+    readonly credentialId: string;
+    /** base64url COSE public key to store. */
+    readonly publicKey: string;
+    /** Initial signature counter. */
+    readonly counter: number;
+}
+
+export declare interface RegistrationVerifyInput {
+    /** base64url clientDataJSON from `navigator.credentials.create`. */
+    readonly clientDataJSON: string;
+    /** base64url authenticatorData (or attestationObject's authData — see
+     *  the client helper, which forwards the raw authenticatorData). */
+    readonly authenticatorData: string;
+    /** The challenge the server issued for this ceremony (base64url). */
+    readonly expectedChallenge: string;
+    /** The exact origin the ceremony must have run on (e.g.
+     *  `https://app.example.com`). */
+    readonly expectedOrigin: string;
+    /** The relying-party id (registrable domain, e.g. `example.com`). */
+    readonly rpId: string;
+}
+
+/** Verify a passkey assertion (sign-in). */
+export declare const verifyAssertion: (input: AssertionVerifyInput) => AssertionOutcome;
+
+/** Verify a passkey registration. Attestation is intentionally NOT
+ *  checked (90% path); everything binding the credential to this
+ *  origin/rpId IS. */
+export declare const verifyRegistration: (input: RegistrationVerifyInput) => RegistrationOutcome;
+
+export declare type WebAuthnError = 'bad-client-data' | 'wrong-type' | 'challenge-mismatch' | 'origin-mismatch' | 'rpid-mismatch' | 'user-not-present' | 'bad-auth-data' | 'no-credential' | 'unsupported-key' | 'bad-signature' | 'counter-replay';
+
+export { }

package/dist/webauthn.js

@@ -0,0 +1,318 @@
+import { createHash as e, createPublicKey as t, createVerify as n, randomBytes as r, timingSafeEqual as i, verify as a } from "node:crypto";
+//#region src/webauthn.ts
+var o = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, s = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), c = (t) => e("sha256").update(t).digest(), l = (e) => {
+	try {
+		let t = JSON.parse(o(e).toString("utf8"));
+		return typeof t.type != "string" || typeof t.challenge != "string" || typeof t.origin != "string" ? null : {
+			type: t.type,
+			challenge: t.challenge,
+			origin: t.origin
+		};
+	} catch {
+		return null;
+	}
+}, u = 1, d = 64, f = (e) => {
+	if (e.length < 37) return null;
+	let t = e.subarray(0, 32), n = e[32], r = e.readUInt32BE(33);
+	if ((n & d) === 0) return {
+		rpIdHash: t,
+		flags: n,
+		signCount: r
+	};
+	if (e.length < 55) return null;
+	let i = 55 + e.readUInt16BE(53);
+	return e.length < i ? null : {
+		rpIdHash: t,
+		flags: n,
+		signCount: r,
+		credentialId: e.subarray(55, i),
+		cosePublicKey: e.subarray(i)
+	};
+}, p = (e, t) => {
+	if (t >= e.length) return null;
+	let n = e[t], r = n >> 5, i = n & 31, a = (t) => i < 24 ? {
+		len: i,
+		next: t + 1
+	} : i === 24 ? e.length > t + 1 ? {
+		len: e[t + 1],
+		next: t + 2
+	} : null : i === 25 ? e.length > t + 2 ? {
+		len: e.readUInt16BE(t + 1),
+		next: t + 3
+	} : null : i === 26 && e.length > t + 4 ? {
+		len: e.readUInt32BE(t + 1),
+		next: t + 5
+	} : null;
+	switch (r) {
+		case 0: {
+			let e = a(t);
+			return e ? {
+				value: e.len,
+				next: e.next
+			} : null;
+		}
+		case 1: {
+			let e = a(t);
+			return e ? {
+				value: -1 - e.len,
+				next: e.next
+			} : null;
+		}
+		case 2: {
+			let n = a(t);
+			if (!n) return null;
+			let r = n.next + n.len;
+			return r > e.length ? null : {
+				value: e.subarray(n.next, r),
+				next: r
+			};
+		}
+		case 5: {
+			let n = a(t);
+			if (!n) return null;
+			let r = /* @__PURE__ */ new Map(), i = n.next;
+			for (let t = 0; t < n.len; t++) {
+				let t = p(e, i);
+				if (!t) return null;
+				let n = p(e, t.next);
+				if (!n) return null;
+				r.set(typeof t.value == "number" ? t.value : JSON.stringify(t.value), n.value), i = n.next;
+			}
+			return {
+				value: r,
+				next: i
+			};
+		}
+		default: return null;
+	}
+}, m = (e) => {
+	let t = p(e, 0);
+	if (!t || !(t.value instanceof Map)) return null;
+	let n = t.value, r = (e) => {
+		let t = n.get(e);
+		return typeof t == "number" ? t : void 0;
+	}, i = (e) => {
+		let t = n.get(e);
+		return t instanceof Buffer ? t : void 0;
+	}, a = r(1), o = r(3);
+	if (a === void 0 || o === void 0) return null;
+	let s = r(-1), c = i(-2), l = i(-3), u = a === 3 ? i(-1) : void 0, d = a === 3 ? i(-2) : void 0;
+	return {
+		kty: a,
+		alg: o,
+		...s === void 0 ? {} : { crv: s },
+		...c === void 0 ? {} : { x: c },
+		...l === void 0 ? {} : { y: l },
+		...u === void 0 ? {} : { n: u },
+		...d === void 0 ? {} : { e: d }
+	};
+}, h = (e) => {
+	let n = m(e);
+	if (!n) return null;
+	if (n.kty === 2 && n.crv === 1 && n.x && n.y) {
+		let e = x(n.x, n.y);
+		try {
+			return {
+				key: t({
+					key: e,
+					format: "der",
+					type: "spki"
+				}),
+				alg: n.alg
+			};
+		} catch {
+			return null;
+		}
+	}
+	if (n.kty === 3 && n.n && n.e) {
+		let e = S(n.n, n.e);
+		try {
+			return {
+				key: t({
+					key: e,
+					format: "der",
+					type: "spki"
+				}),
+				alg: n.alg
+			};
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}, g = (e) => {
+	if (e < 128) return Buffer.from([e]);
+	let t = [], n = e;
+	for (; n > 0;) t.unshift(n & 255), n >>= 8;
+	return Buffer.from([128 | t.length, ...t]);
+}, _ = (...e) => {
+	let t = Buffer.concat(e);
+	return Buffer.concat([
+		Buffer.from([48]),
+		g(t.length),
+		t
+	]);
+}, v = (e) => {
+	let t = Buffer.concat([Buffer.from([0]), e]);
+	return Buffer.concat([
+		Buffer.from([3]),
+		g(t.length),
+		t
+	]);
+}, y = (e) => {
+	let t = e;
+	for (; t.length > 1 && t[0] === 0;) t = t.subarray(1);
+	return t[0] & 128 && (t = Buffer.concat([Buffer.from([0]), t])), Buffer.concat([
+		Buffer.from([2]),
+		g(t.length),
+		t
+	]);
+}, b = (e) => Buffer.concat([
+	Buffer.from([6]),
+	g(e.length),
+	Buffer.from(e)
+]), x = (e, t) => {
+	let n = Buffer.concat([
+		Buffer.from([4]),
+		e,
+		t
+	]);
+	return _(_(b([
+		42,
+		134,
+		72,
+		206,
+		61,
+		2,
+		1
+	]), b([
+		42,
+		134,
+		72,
+		206,
+		61,
+		3,
+		1,
+		7
+	])), v(n));
+}, S = (e, t) => _(_(b([
+	42,
+	134,
+	72,
+	134,
+	247,
+	13,
+	1,
+	1,
+	1
+]), Buffer.from([5, 0])), v(_(y(e), y(t)))), C = (e) => {
+	let t = l(e.clientDataJSON);
+	if (!t) return {
+		ok: !1,
+		error: "bad-client-data"
+	};
+	if (t.type !== "webauthn.create") return {
+		ok: !1,
+		error: "wrong-type"
+	};
+	if (!E(t.challenge, e.expectedChallenge)) return {
+		ok: !1,
+		error: "challenge-mismatch"
+	};
+	if (t.origin !== e.expectedOrigin) return {
+		ok: !1,
+		error: "origin-mismatch"
+	};
+	let n = f(o(e.authenticatorData));
+	return n ? n.rpIdHash.equals(c(Buffer.from(e.rpId, "utf8"))) ? (n.flags & u) === 0 ? {
+		ok: !1,
+		error: "user-not-present"
+	} : !n.credentialId || !n.cosePublicKey ? {
+		ok: !1,
+		error: "no-credential"
+	} : h(n.cosePublicKey) ? {
+		ok: !0,
+		result: {
+			credentialId: s(n.credentialId),
+			publicKey: s(n.cosePublicKey),
+			counter: n.signCount
+		}
+	} : {
+		ok: !1,
+		error: "unsupported-key"
+	} : {
+		ok: !1,
+		error: "rpid-mismatch"
+	} : {
+		ok: !1,
+		error: "bad-auth-data"
+	};
+}, w = (e) => {
+	let t = l(e.clientDataJSON);
+	if (!t) return {
+		ok: !1,
+		error: "bad-client-data"
+	};
+	if (t.type !== "webauthn.get") return {
+		ok: !1,
+		error: "wrong-type"
+	};
+	if (!E(t.challenge, e.expectedChallenge)) return {
+		ok: !1,
+		error: "challenge-mismatch"
+	};
+	if (t.origin !== e.expectedOrigin) return {
+		ok: !1,
+		error: "origin-mismatch"
+	};
+	let n = o(e.authenticatorData), r = f(n);
+	if (!r) return {
+		ok: !1,
+		error: "bad-auth-data"
+	};
+	if (!r.rpIdHash.equals(c(Buffer.from(e.rpId, "utf8")))) return {
+		ok: !1,
+		error: "rpid-mismatch"
+	};
+	if ((r.flags & u) === 0) return {
+		ok: !1,
+		error: "user-not-present"
+	};
+	let i = h(o(e.storedPublicKey));
+	if (!i) return {
+		ok: !1,
+		error: "unsupported-key"
+	};
+	let a = Buffer.concat([n, c(o(e.clientDataJSON))]), s = o(e.signature);
+	return T(i.key, i.alg, a, s) ? !(r.signCount === 0 && e.storedCounter === 0) && r.signCount <= e.storedCounter ? {
+		ok: !1,
+		error: "counter-replay"
+	} : {
+		ok: !0,
+		result: { newCounter: r.signCount }
+	} : {
+		ok: !1,
+		error: "bad-signature"
+	};
+}, T = (e, t, r, i) => {
+	try {
+		if (t === -7) {
+			let t = n("SHA256");
+			return t.update(r), t.end(), t.verify({
+				key: e,
+				dsaEncoding: "der"
+			}, i);
+		}
+		return t === -257 && a("RSA-SHA256", r, e, i);
+	} catch {
+		return !1;
+	}
+}, E = (e, t) => {
+	let n = Buffer.from(e), r = Buffer.from(t);
+	return n.length === r.length && i(n, r);
+}, D = () => s(r(32));
+//#endregion
+export { D as generateChallenge, w as verifyAssertion, C as verifyRegistration };

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@voltro/plugin-auth",
+  "version": "0.1.0",
+  "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./password": {
+      "types": "./dist/password.d.ts",
+      "import": "./dist/password.js",
+      "default": "./dist/password.js"
+    },
+    "./session": {
+      "types": "./dist/session.d.ts",
+      "import": "./dist/session.js",
+      "default": "./dist/session.js"
+    },
+    "./strategy": {
+      "types": "./dist/strategy.d.ts",
+      "import": "./dist/strategy.js",
+      "default": "./dist/strategy.js"
+    },
+    "./plugin": {
+      "types": "./dist/plugin.d.ts",
+      "import": "./dist/plugin.js",
+      "default": "./dist/plugin.js"
+    },
+    "./webauthn": {
+      "types": "./dist/webauthn.d.ts",
+      "import": "./dist/webauthn.js",
+      "default": "./dist/webauthn.js"
+    },
+    "./tokens": {
+      "types": "./dist/tokens.d.ts",
+      "import": "./dist/tokens.js",
+      "default": "./dist/tokens.js"
+    },
+    "./csrf": {
+      "types": "./dist/csrf.d.ts",
+      "import": "./dist/csrf.js",
+      "default": "./dist/csrf.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "import": "./dist/schema.js",
+      "default": "./dist/schema.js"
+    },
+    "./web": {
+      "types": "./dist/web.d.ts",
+      "import": "./dist/web.js",
+      "default": "./dist/web.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@effect/sql": "^0.51.1",
+    "@voltro/database": "0.1.0",
+    "@voltro/protocol": "0.1.0"
+  },
+  "peerDependencies": {
+    "effect": "^3.21.4",
+    "react": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}