@warlock.js/auth 5.12.0 → 5.14.0

package/esm/otp/otp.mjs

@@ -0,0 +1,105 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { authService } from "../services/auth.service.mjs";
+import { InvalidOneTimeTokenError } from "../errors/invalid-one-time-token.error.mjs";
+import { oneTimeTokenModel } from "../services/one-time-tokens.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { safeEqual } from "../utils/safe-equal.mjs";
+import { createHmac, randomBytes, randomInt } from "node:crypto";
+
+//#region ../auth/src/otp/otp.ts
+const CODE_PATTERN = /^\d{6}$/;
+/** One error for every rejection: unknown phone, no code, wrong, expired, used, over the cap. */
+function invalidCode() {
+	return new InvalidOneTimeTokenError("Invalid or expired code.");
+}
+/**
+* Keyed hash of a code. A plain SHA-256 of a 6-digit code is reversed by
+* trying all million values, so the MAC key (derived from the access-token
+* secret) is what keeps a leaked table useless. `salt` makes each stored
+* value unique.
+*/
+function macCode(user, salt, code) {
+	return createHmac("sha256", createHmac("sha256", authConfig.accessToken.secret()).update("@warlock.js/auth:otp").digest()).update(`${salt}:${user.userType}:${user.id}:${code}`).digest("base64url");
+}
+/** Stored form: `<salt>.<mac>` — 16 + 1 + 43 chars, inside the 64-char `token_hash` column. */
+function storedCodeHash(user, code) {
+	const salt = randomBytes(12).toString("base64url");
+	return `${salt}.${macCode(user, salt, code)}`;
+}
+function codeMatches(user, stored, code) {
+	const [salt, mac] = stored.split(".");
+	return !!salt && !!mac && safeEqual(mac, macCode(user, salt, code));
+}
+/**
+* Resolve how a code is sent: `auth.otp.send`, else the app's notifications
+* channel. Resolved BEFORE the user lookup, so a missing notifications package
+* fails identically for known and unknown phones.
+*/
+async function resolveDelivery(channel) {
+	const custom = authConfig.otp.send();
+	if (custom) return custom;
+	const { notify } = await loadOptionalPeer("@warlock.js/notifications", "notifications");
+	return (phone, message, channelName) => notify.channel(channelName).send(phone, message);
+}
+/**
+* Send a 6-digit login code to the account whose `auth.otp.phoneField`
+* (default `phone`) equals `phone`, through the notifications channel named by
+* `options.channel` / `auth.otp.channel` (default `"sms"`). Auth ships no
+* SMS/WhatsApp driver — the app registers that channel.
+*
+* The code is stored only as a keyed hash in `one_time_tokens` (purpose
+* `otp`), expires after `auth.otp.expiresIn` (default 5m), and replaces any
+* earlier unused code. **Anti-enumeration:** an unknown phone resolves the same
+* way and sends nothing. Throttle the route with `otpRequestThrottleMiddleware()`.
+*
+* @throws AuthProviderSdkMissingError when `@warlock.js/notifications` is not
+*   installed and no `auth.otp.send` is configured.
+*/
+async function requestOtp(Model, phone, options = {}) {
+	const channel = options.channel ?? authConfig.otp.channel();
+	const deliver = await resolveDelivery(channel);
+	if (typeof phone !== "string" || phone.length === 0) return;
+	const user = await Model.first({ [authConfig.otp.phoneField()]: phone });
+	if (!user) return;
+	const code = String(randomInt(0, 1e6)).padStart(6, "0");
+	const expiresAt = new Date(Date.now() + authConfig.otp.expiresInMs());
+	const TokenModel = oneTimeTokenModel();
+	await TokenModel.invalidateActiveFor(user, "otp");
+	await TokenModel.issue(user, "otp", storedCodeHash(user, code), expiresAt);
+	await deliver(phone, {
+		body: authConfig.otp.message(code),
+		code,
+		expiresAt
+	}, channel);
+}
+/**
+* Verify a phone login code and log the user in through
+* `authService.completeLogin` — the same outcome as password login.
+*
+* Each check first counts an attempt atomically; once `auth.otp.maxAttempts`
+* (default 5) have been counted the code is invalidated, so it is compared at
+* most that many times even under concurrent guesses. A correct code is
+* consumed single-use. Throttle the route with `otpVerifyThrottleMiddleware()`.
+*
+* @throws InvalidOneTimeTokenError (400, EC008) — the same for an unknown
+*   phone, a wrong, expired, used or exhausted code.
+*/
+async function verifyOtp(Model, phone, code, deviceInfo) {
+	if (typeof phone !== "string" || phone.length === 0) throw invalidCode();
+	if (typeof code !== "string" || !CODE_PATTERN.test(code)) throw invalidCode();
+	const user = await Model.first({ [authConfig.otp.phoneField()]: phone });
+	if (!user) throw invalidCode();
+	const row = await oneTimeTokenModel().findActiveFor(user, "otp");
+	if (!row || row.isConsumed || row.isExpired) throw invalidCode();
+	if (!await row.recordAttempt(authConfig.otp.maxAttempts())) {
+		await row.consumeIfActive();
+		throw invalidCode();
+	}
+	if (!codeMatches(user, String(row.get("token_hash") ?? ""), code)) throw invalidCode();
+	if (!await row.consumeIfActive()) throw invalidCode();
+	return authService.completeLogin(user, deviceInfo);
+}
+
+//#endregion
+export { requestOtp, verifyOtp };
+//# sourceMappingURL=otp.mjs.map

package/esm/otp/otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.mjs","names":[],"sources":["../../../../../../../auth/src/otp/otp.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport { createHmac, randomBytes, randomInt } from \"node:crypto\";\nimport type { OtpMessage, OtpSender } from \"../contracts/providers\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidOneTimeTokenError } from \"../errors/invalid-one-time-token.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport { oneTimeTokenModel } from \"../services/one-time-tokens\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\nimport { safeEqual } from \"../utils/safe-equal\";\n\n/** The slice of `@warlock.js/notifications` OTP delivery uses (an optional peer). */\ntype NotifyModule = {\n  notify: {\n    channel: (name: string) => { send: (to: string, payload: unknown) => Promise<unknown> };\n  };\n};\n\nconst CODE_PATTERN = /^\\d{6}$/;\n\n/** One error for every rejection: unknown phone, no code, wrong, expired, used, over the cap. */\nfunction invalidCode(): InvalidOneTimeTokenError {\n  return new InvalidOneTimeTokenError(\"Invalid or expired code.\");\n}\n\n/**\n * Keyed hash of a code. A plain SHA-256 of a 6-digit code is reversed by\n * trying all million values, so the MAC key (derived from the access-token\n * secret) is what keeps a leaked table useless. `salt` makes each stored\n * value unique.\n */\nfunction macCode(user: Auth, salt: string, code: string): string {\n  const key = createHmac(\"sha256\", authConfig.accessToken.secret())\n    .update(\"@warlock.js/auth:otp\")\n    .digest();\n\n  return createHmac(\"sha256\", key)\n    .update(`${salt}:${user.userType}:${user.id}:${code}`)\n    .digest(\"base64url\");\n}\n\n/** Stored form: `<salt>.<mac>` — 16 + 1 + 43 chars, inside the 64-char `token_hash` column. */\nfunction storedCodeHash(user: Auth, code: string): string {\n  const salt = randomBytes(12).toString(\"base64url\");\n\n  return `${salt}.${macCode(user, salt, code)}`;\n}\n\nfunction codeMatches(user: Auth, stored: string, code: string): boolean {\n  const [salt, mac] = stored.split(\".\");\n\n  return !!salt && !!mac && safeEqual(mac, macCode(user, salt, code));\n}\n\n/**\n * Resolve how a code is sent: `auth.otp.send`, else the app's notifications\n * channel. Resolved BEFORE the user lookup, so a missing notifications package\n * fails identically for known and unknown phones.\n */\nasync function resolveDelivery(channel: string): Promise<OtpSender> {\n  const custom = authConfig.otp.send();\n\n  if (custom) return custom;\n\n  const { notify } = await loadOptionalPeer<NotifyModule>(\n    \"@warlock.js/notifications\",\n    \"notifications\",\n  );\n\n  return (phone, message, channelName) => notify.channel(channelName).send(phone, message);\n}\n\n/**\n * Send a 6-digit login code to the account whose `auth.otp.phoneField`\n * (default `phone`) equals `phone`, through the notifications channel named by\n * `options.channel` / `auth.otp.channel` (default `\"sms\"`). Auth ships no\n * SMS/WhatsApp driver — the app registers that channel.\n *\n * The code is stored only as a keyed hash in `one_time_tokens` (purpose\n * `otp`), expires after `auth.otp.expiresIn` (default 5m), and replaces any\n * earlier unused code. **Anti-enumeration:** an unknown phone resolves the same\n * way and sends nothing. Throttle the route with `otpRequestThrottleMiddleware()`.\n *\n * @throws AuthProviderSdkMissingError when `@warlock.js/notifications` is not\n *   installed and no `auth.otp.send` is configured.\n */\nexport async function requestOtp<T extends Auth>(\n  Model: ChildModel<T>,\n  phone: string,\n  options: { channel?: string } = {},\n): Promise<void> {\n  const channel = options.channel ?? authConfig.otp.channel();\n  const deliver = await resolveDelivery(channel);\n\n  if (typeof phone !== \"string\" || phone.length === 0) return;\n\n  const user = (await Model.first({ [authConfig.otp.phoneField()]: phone })) as T | null;\n\n  if (!user) return;\n\n  const code = String(randomInt(0, 1_000_000)).padStart(6, \"0\");\n  const expiresAt = new Date(Date.now() + authConfig.otp.expiresInMs());\n  const TokenModel = oneTimeTokenModel();\n\n  await TokenModel.invalidateActiveFor(user, \"otp\");\n  await TokenModel.issue(user, \"otp\", storedCodeHash(user, code), expiresAt);\n\n  const message: OtpMessage = { body: authConfig.otp.message(code), code, expiresAt };\n\n  await deliver(phone, message, channel);\n}\n\n/**\n * Verify a phone login code and log the user in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * Each check first counts an attempt atomically; once `auth.otp.maxAttempts`\n * (default 5) have been counted the code is invalidated, so it is compared at\n * most that many times even under concurrent guesses. A correct code is\n * consumed single-use. Throttle the route with `otpVerifyThrottleMiddleware()`.\n *\n * @throws InvalidOneTimeTokenError (400, EC008) — the same for an unknown\n *   phone, a wrong, expired, used or exhausted code.\n */\nexport async function verifyOtp<T extends Auth>(\n  Model: ChildModel<T>,\n  phone: string,\n  code: string,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<T>> {\n  if (typeof phone !== \"string\" || phone.length === 0) throw invalidCode();\n  if (typeof code !== \"string\" || !CODE_PATTERN.test(code)) throw invalidCode();\n\n  const user = (await Model.first({ [authConfig.otp.phoneField()]: phone })) as T | null;\n\n  if (!user) throw invalidCode();\n\n  const row = await oneTimeTokenModel().findActiveFor(user, \"otp\");\n\n  if (!row || row.isConsumed || row.isExpired) throw invalidCode();\n\n  if (!(await row.recordAttempt(authConfig.otp.maxAttempts()))) {\n    await row.consumeIfActive();\n\n    throw invalidCode();\n  }\n\n  if (!codeMatches(user, String(row.get(\"token_hash\") ?? \"\"), code)) throw invalidCode();\n\n  if (!(await row.consumeIfActive())) throw invalidCode();\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;AAmBA,MAAM,eAAe;;AAGrB,SAAS,cAAwC;CAC/C,OAAO,IAAI,yBAAyB,0BAA0B;AAChE;;;;;;;AAQA,SAAS,QAAQ,MAAY,MAAc,MAAsB;CAK/D,OAAO,WAAW,UAJN,WAAW,UAAU,WAAW,YAAY,OAAO,CAAC,CAAC,CAC9D,OAAO,sBAAsB,CAAC,CAC9B,OAE2B,CAAC,CAAC,CAC7B,OAAO,GAAG,KAAK,GAAG,KAAK,SAAS,GAAG,KAAK,GAAG,GAAG,MAAM,CAAC,CACrD,OAAO,WAAW;AACvB;;AAGA,SAAS,eAAe,MAAY,MAAsB;CACxD,MAAM,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CAEjD,OAAO,GAAG,KAAK,GAAG,QAAQ,MAAM,MAAM,IAAI;AAC5C;AAEA,SAAS,YAAY,MAAY,QAAgB,MAAuB;CACtE,MAAM,CAAC,MAAM,OAAO,OAAO,MAAM,GAAG;CAEpC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ,MAAM,MAAM,IAAI,CAAC;AACpE;;;;;;AAOA,eAAe,gBAAgB,SAAqC;CAClE,MAAM,SAAS,WAAW,IAAI,KAAK;CAEnC,IAAI,QAAQ,OAAO;CAEnB,MAAM,EAAE,WAAW,MAAM,iBACvB,6BACA,eACF;CAEA,QAAQ,OAAO,SAAS,gBAAgB,OAAO,QAAQ,WAAW,CAAC,CAAC,KAAK,OAAO,OAAO;AACzF;;;;;;;;;;;;;;;AAgBA,eAAsB,WACpB,OACA,OACA,UAAgC,CAAC,GAClB;CACf,MAAM,UAAU,QAAQ,WAAW,WAAW,IAAI,QAAQ;CAC1D,MAAM,UAAU,MAAM,gBAAgB,OAAO;CAE7C,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;CAErD,MAAM,OAAQ,MAAM,MAAM,MAAM,GAAG,WAAW,IAAI,WAAW,IAAI,MAAM,CAAC;CAExE,IAAI,CAAC,MAAM;CAEX,MAAM,OAAO,OAAO,UAAU,GAAG,GAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG;CAC5D,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,IAAI,YAAY,CAAC;CACpE,MAAM,aAAa,kBAAkB;CAErC,MAAM,WAAW,oBAAoB,MAAM,KAAK;CAChD,MAAM,WAAW,MAAM,MAAM,OAAO,eAAe,MAAM,IAAI,GAAG,SAAS;CAIzE,MAAM,QAAQ,OAAO;EAFS,MAAM,WAAW,IAAI,QAAQ,IAAI;EAAG;EAAM;CAE7C,GAAG,OAAO;AACvC;;;;;;;;;;;;;AAcA,eAAsB,UACpB,OACA,OACA,MACA,YACyB;CACzB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,YAAY;CACvE,IAAI,OAAO,SAAS,YAAY,CAAC,aAAa,KAAK,IAAI,GAAG,MAAM,YAAY;CAE5E,MAAM,OAAQ,MAAM,MAAM,MAAM,GAAG,WAAW,IAAI,WAAW,IAAI,MAAM,CAAC;CAExE,IAAI,CAAC,MAAM,MAAM,YAAY;CAE7B,MAAM,MAAM,MAAM,kBAAkB,CAAC,CAAC,cAAc,MAAM,KAAK;CAE/D,IAAI,CAAC,OAAO,IAAI,cAAc,IAAI,WAAW,MAAM,YAAY;CAE/D,IAAI,CAAE,MAAM,IAAI,cAAc,WAAW,IAAI,YAAY,CAAC,GAAI;EAC5D,MAAM,IAAI,gBAAgB;EAE1B,MAAM,YAAY;CACpB;CAEA,IAAI,CAAC,YAAY,MAAM,OAAO,IAAI,IAAI,YAAY,KAAK,EAAE,GAAG,IAAI,GAAG,MAAM,YAAY;CAErF,IAAI,CAAE,MAAM,IAAI,gBAAgB,GAAI,MAAM,YAAY;CAEtD,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}

package/esm/passkeys/index.d.mts

@@ -0,0 +1,3 @@
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./simplewebauthn.mjs";
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkey-registration.mjs";

package/esm/passkeys/index.mjs

@@ -0,0 +1,4 @@
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkey-registration.mjs";
+
+export {  };

package/esm/passkeys/passkey-authentication.d.mts

@@ -0,0 +1,33 @@
+import { Auth } from "../models/auth.model.mjs";
+import { DeviceInfo, LoginResult } from "../contracts/types.mjs";
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./simplewebauthn.mjs";
+import { Request } from "@warlock.js/core";
+
+//#region ../auth/src/passkeys/passkey-authentication.d.ts
+/**
+ * Authentication options for a passkey login. No user is identified yet
+ * (discoverable credentials), so the stored single-use challenge has no owner;
+ * the credential the browser returns decides the user.
+ *
+ * @example
+ * // POST /auth/passkeys/login/options
+ * response.success(await generatePasskeyAuthenticationOptions());
+ */
+declare function generatePasskeyAuthenticationOptions(): Promise<PasskeyOptionsJSON>;
+/**
+ * Verify a passkey assertion and log its owner in through
+ * `authService.completeLogin` — the same outcome as password login.
+ *
+ * Checks, in order: the request `Origin` (CSRF), the single-use challenge
+ * (consumed even if what follows fails), the credential is registered, the
+ * assertion via `@simplewebauthn/server`, then that the signature counter
+ * ADVANCED — a counter that did not move past the stored one (when either is
+ * non-zero) means a cloned authenticator and is rejected. The new counter is
+ * written with a compare-and-set.
+ *
+ * @throws InvalidPasskeyError (400, EC011) on any rejection.
+ */
+declare function verifyPasskeyAuthentication(request: Request, credential: PasskeyResponseJSON, deviceInfo?: DeviceInfo): Promise<LoginResult<Auth>>;
+//#endregion
+export { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication };
+//# sourceMappingURL=passkey-authentication.d.mts.map

package/esm/passkeys/passkey-authentication.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-authentication.d.mts","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-authentication.ts"],"mappings":";;;;;;;;AAiDA;;;;AAAwF;AA0BxF;;iBA1BsB,oCAAA,IAAwC,OAAO,CAAC,kBAAA;;;;;;;;;;;;;;iBA0BhD,2BAAA,CACpB,OAAA,EAAS,OAAA,EACT,UAAA,EAAY,mBAAA,EACZ,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,IAAA"}

package/esm/passkeys/passkey-authentication.mjs

@@ -0,0 +1,93 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { authService } from "../services/auth.service.mjs";
+import { InvalidPasskeyError } from "../errors/invalid-passkey.error.mjs";
+import { PasskeyCredential } from "../models/passkey-credential/passkey-credential.model.mjs";
+import "../models/passkey-credential/index.mjs";
+import { assertPasskeyOrigin, storePasskeyChallenge, takePasskeyChallenge } from "./passkey-challenges.mjs";
+import { loadSimpleWebAuthn } from "./simplewebauthn.mjs";
+import { config } from "@warlock.js/core";
+
+//#region ../auth/src/passkeys/passkey-authentication.ts
+/** A counter that did not advance past the stored one (when either is non-zero): a cloned authenticator. */
+function counterRegressed(stored, presented) {
+	if (presented === void 0) return false;
+	return (stored > 0 || presented > 0) && !(presented > stored);
+}
+/**
+* The signature counter an assertion CLAIMS (bytes 33–36 of authenticatorData).
+* Unverified — only used to label a rejection the SDK already made.
+*/
+function presentedCounter(credential) {
+	const encoded = credential.response.authenticatorData;
+	if (typeof encoded !== "string") return void 0;
+	const authData = Buffer.from(encoded, "base64url");
+	return authData.length >= 37 ? authData.readUInt32BE(33) : void 0;
+}
+/**
+* Authentication options for a passkey login. No user is identified yet
+* (discoverable credentials), so the stored single-use challenge has no owner;
+* the credential the browser returns decides the user.
+*
+* @example
+* // POST /auth/passkeys/login/options
+* response.success(await generatePasskeyAuthenticationOptions());
+*/
+async function generatePasskeyAuthenticationOptions() {
+	const options = await (await loadSimpleWebAuthn()).generateAuthenticationOptions({
+		rpID: authConfig.passkeys.settings().rpID,
+		userVerification: "preferred"
+	});
+	await storePasskeyChallenge("passkey-authentication", options.challenge);
+	return options;
+}
+/**
+* Verify a passkey assertion and log its owner in through
+* `authService.completeLogin` — the same outcome as password login.
+*
+* Checks, in order: the request `Origin` (CSRF), the single-use challenge
+* (consumed even if what follows fails), the credential is registered, the
+* assertion via `@simplewebauthn/server`, then that the signature counter
+* ADVANCED — a counter that did not move past the stored one (when either is
+* non-zero) means a cloned authenticator and is rejected. The new counter is
+* written with a compare-and-set.
+*
+* @throws InvalidPasskeyError (400, EC011) on any rejection.
+*/
+async function verifyPasskeyAuthentication(request, credential, deviceInfo) {
+	const webauthn = await loadSimpleWebAuthn();
+	const origins = assertPasskeyOrigin(request);
+	const { challenge } = await takePasskeyChallenge("passkey-authentication", credential);
+	const stored = typeof credential.id === "string" ? await PasskeyCredential.findByCredentialId(credential.id) : null;
+	if (!stored) throw new InvalidPasskeyError("unknown-credential");
+	let verification;
+	try {
+		verification = await webauthn.verifyAuthenticationResponse({
+			response: credential,
+			expectedChallenge: challenge,
+			expectedOrigin: origins,
+			expectedRPID: authConfig.passkeys.settings().rpID,
+			credential: {
+				id: stored.credentialId,
+				publicKey: new Uint8Array(Buffer.from(String(stored.get("public_key")), "base64url")),
+				counter: stored.counter,
+				transports: stored.get("transports") ?? void 0
+			},
+			requireUserVerification: false
+		});
+	} catch (error) {
+		throw new InvalidPasskeyError(counterRegressed(stored.counter, presentedCounter(credential)) ? "counter-regression" : "authentication-verification-failed", error);
+	}
+	if (!verification.verified) throw new InvalidPasskeyError("authentication-not-verified");
+	const previous = stored.counter;
+	const next = Number(verification.authenticationInfo.newCounter);
+	if (counterRegressed(previous, next)) throw new InvalidPasskeyError("counter-regression");
+	if (!await stored.advanceCounter(previous, next)) throw new InvalidPasskeyError("counter-changed-concurrently");
+	const UserModel = config.key(`auth.userType.${stored.userType}`);
+	const user = UserModel ? await UserModel.find(stored.userId) : null;
+	if (!user) throw new InvalidPasskeyError("credential-owner-missing");
+	return authService.completeLogin(user, deviceInfo);
+}
+
+//#endregion
+export { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication };
+//# sourceMappingURL=passkey-authentication.mjs.map

package/esm/passkeys/passkey-authentication.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-authentication.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-authentication.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport { config, type Request } from \"@warlock.js/core\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidPasskeyError } from \"../errors/invalid-passkey.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { PasskeyCredential } from \"../models/passkey-credential\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport {\n  assertPasskeyOrigin,\n  storePasskeyChallenge,\n  takePasskeyChallenge,\n} from \"./passkey-challenges\";\nimport {\n  loadSimpleWebAuthn,\n  type PasskeyOptionsJSON,\n  type PasskeyResponseJSON,\n} from \"./simplewebauthn\";\n\n/** A counter that did not advance past the stored one (when either is non-zero): a cloned authenticator. */\nfunction counterRegressed(stored: number, presented: number | undefined): boolean {\n  if (presented === undefined) return false;\n\n  return (stored > 0 || presented > 0) && !(presented > stored);\n}\n\n/**\n * The signature counter an assertion CLAIMS (bytes 33–36 of authenticatorData).\n * Unverified — only used to label a rejection the SDK already made.\n */\nfunction presentedCounter(credential: PasskeyResponseJSON): number | undefined {\n  const encoded = credential.response.authenticatorData;\n\n  if (typeof encoded !== \"string\") return undefined;\n\n  const authData = Buffer.from(encoded, \"base64url\");\n\n  return authData.length >= 37 ? authData.readUInt32BE(33) : undefined;\n}\n\n/**\n * Authentication options for a passkey login. No user is identified yet\n * (discoverable credentials), so the stored single-use challenge has no owner;\n * the credential the browser returns decides the user.\n *\n * @example\n * // POST /auth/passkeys/login/options\n * response.success(await generatePasskeyAuthenticationOptions());\n */\nexport async function generatePasskeyAuthenticationOptions(): Promise<PasskeyOptionsJSON> {\n  const webauthn = await loadSimpleWebAuthn();\n\n  const options = await webauthn.generateAuthenticationOptions({\n    rpID: authConfig.passkeys.settings().rpID,\n    userVerification: \"preferred\",\n  });\n\n  await storePasskeyChallenge(\"passkey-authentication\", options.challenge);\n\n  return options;\n}\n\n/**\n * Verify a passkey assertion and log its owner in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * Checks, in order: the request `Origin` (CSRF), the single-use challenge\n * (consumed even if what follows fails), the credential is registered, the\n * assertion via `@simplewebauthn/server`, then that the signature counter\n * ADVANCED — a counter that did not move past the stored one (when either is\n * non-zero) means a cloned authenticator and is rejected. The new counter is\n * written with a compare-and-set.\n *\n * @throws InvalidPasskeyError (400, EC011) on any rejection.\n */\nexport async function verifyPasskeyAuthentication(\n  request: Request,\n  credential: PasskeyResponseJSON,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<Auth>> {\n  const webauthn = await loadSimpleWebAuthn();\n  const origins = assertPasskeyOrigin(request);\n  const { challenge } = await takePasskeyChallenge(\"passkey-authentication\", credential);\n\n  const stored =\n    typeof credential.id === \"string\"\n      ? await PasskeyCredential.findByCredentialId(credential.id)\n      : null;\n\n  if (!stored) {\n    throw new InvalidPasskeyError(\"unknown-credential\");\n  }\n\n  let verification: Awaited<ReturnType<typeof webauthn.verifyAuthenticationResponse>>;\n\n  try {\n    verification = await webauthn.verifyAuthenticationResponse({\n      response: credential,\n      expectedChallenge: challenge,\n      expectedOrigin: origins,\n      expectedRPID: authConfig.passkeys.settings().rpID,\n      credential: {\n        id: stored.credentialId,\n        publicKey: new Uint8Array(Buffer.from(String(stored.get(\"public_key\")), \"base64url\")),\n        counter: stored.counter,\n        transports: stored.get(\"transports\") ?? undefined,\n      },\n      requireUserVerification: false,\n    });\n  } catch (error) {\n    // The SDK enforces the counter rule itself and throws a generic Error for\n    // it; keep clone detection visible as its own reason in the logs.\n    const reason = counterRegressed(stored.counter, presentedCounter(credential))\n      ? \"counter-regression\"\n      : \"authentication-verification-failed\";\n\n    throw new InvalidPasskeyError(reason, error);\n  }\n\n  if (!verification.verified) {\n    throw new InvalidPasskeyError(\"authentication-not-verified\");\n  }\n\n  const previous = stored.counter;\n  const next = Number(verification.authenticationInfo.newCounter);\n\n  if (counterRegressed(previous, next)) {\n    throw new InvalidPasskeyError(\"counter-regression\");\n  }\n\n  if (!(await stored.advanceCounter(previous, next))) {\n    throw new InvalidPasskeyError(\"counter-changed-concurrently\");\n  }\n\n  const UserModel = config.key<ChildModel<Auth> | undefined>(`auth.userType.${stored.userType}`);\n  const user = UserModel ? ((await UserModel.find(stored.userId)) as Auth | null) : null;\n\n  if (!user) {\n    throw new InvalidPasskeyError(\"credential-owner-missing\");\n  }\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAS,iBAAiB,QAAgB,WAAwC;CAChF,IAAI,cAAc,QAAW,OAAO;CAEpC,QAAQ,SAAS,KAAK,YAAY,MAAM,EAAE,YAAY;AACxD;;;;;AAMA,SAAS,iBAAiB,YAAqD;CAC7E,MAAM,UAAU,WAAW,SAAS;CAEpC,IAAI,OAAO,YAAY,UAAU,OAAO;CAExC,MAAM,WAAW,OAAO,KAAK,SAAS,WAAW;CAEjD,OAAO,SAAS,UAAU,KAAK,SAAS,aAAa,EAAE,IAAI;AAC7D;;;;;;;;;;AAWA,eAAsB,uCAAoE;CAGxF,MAAM,UAAU,OAAM,MAFC,mBAAmB,EAEZ,CAAC,8BAA8B;EAC3D,MAAM,WAAW,SAAS,SAAS,CAAC,CAAC;EACrC,kBAAkB;CACpB,CAAC;CAED,MAAM,sBAAsB,0BAA0B,QAAQ,SAAS;CAEvE,OAAO;AACT;;;;;;;;;;;;;;AAeA,eAAsB,4BACpB,SACA,YACA,YAC4B;CAC5B,MAAM,WAAW,MAAM,mBAAmB;CAC1C,MAAM,UAAU,oBAAoB,OAAO;CAC3C,MAAM,EAAE,cAAc,MAAM,qBAAqB,0BAA0B,UAAU;CAErF,MAAM,SACJ,OAAO,WAAW,OAAO,WACrB,MAAM,kBAAkB,mBAAmB,WAAW,EAAE,IACxD;CAEN,IAAI,CAAC,QACH,MAAM,IAAI,oBAAoB,oBAAoB;CAGpD,IAAI;CAEJ,IAAI;EACF,eAAe,MAAM,SAAS,6BAA6B;GACzD,UAAU;GACV,mBAAmB;GACnB,gBAAgB;GAChB,cAAc,WAAW,SAAS,SAAS,CAAC,CAAC;GAC7C,YAAY;IACV,IAAI,OAAO;IACX,WAAW,IAAI,WAAW,OAAO,KAAK,OAAO,OAAO,IAAI,YAAY,CAAC,GAAG,WAAW,CAAC;IACpF,SAAS,OAAO;IAChB,YAAY,OAAO,IAAI,YAAY,KAAK;GAC1C;GACA,yBAAyB;EAC3B,CAAC;CACH,SAAS,OAAO;EAOd,MAAM,IAAI,oBAJK,iBAAiB,OAAO,SAAS,iBAAiB,UAAU,CAAC,IACxE,uBACA,sCAEkC,KAAK;CAC7C;CAEA,IAAI,CAAC,aAAa,UAChB,MAAM,IAAI,oBAAoB,6BAA6B;CAG7D,MAAM,WAAW,OAAO;CACxB,MAAM,OAAO,OAAO,aAAa,mBAAmB,UAAU;CAE9D,IAAI,iBAAiB,UAAU,IAAI,GACjC,MAAM,IAAI,oBAAoB,oBAAoB;CAGpD,IAAI,CAAE,MAAM,OAAO,eAAe,UAAU,IAAI,GAC9C,MAAM,IAAI,oBAAoB,8BAA8B;CAG9D,MAAM,YAAY,OAAO,IAAkC,iBAAiB,OAAO,UAAU;CAC7F,MAAM,OAAO,YAAc,MAAM,UAAU,KAAK,OAAO,MAAM,IAAqB;CAElF,IAAI,CAAC,MACH,MAAM,IAAI,oBAAoB,0BAA0B;CAG1D,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}

package/esm/passkeys/passkey-challenges.mjs

@@ -0,0 +1,53 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { InvalidPasskeyError } from "../errors/invalid-passkey.error.mjs";
+import { hashOneTimeToken, oneTimeTokenModel } from "../services/one-time-tokens.mjs";
+
+//#region ../auth/src/passkeys/passkey-challenges.ts
+/**
+* Store a ceremony challenge server-side: SHA-256 hashed, purpose-bound,
+* expiring (`auth.passkeys.challengeExpiresIn`, default 5m). A registration
+* challenge is bound to its user; an authentication challenge has none.
+*/
+async function storePasskeyChallenge(ceremony, challenge, user) {
+	const expiresAt = new Date(Date.now() + authConfig.passkeys.challengeExpiresInMs());
+	await oneTimeTokenModel().issueChallenge(ceremony, hashOneTimeToken(challenge), expiresAt, user);
+}
+/** The challenge the browser signed, read from `clientDataJSON`. */
+function signedChallenge(credential) {
+	try {
+		const clientData = JSON.parse(Buffer.from(credential.response.clientDataJSON, "base64url").toString("utf8"));
+		if (typeof clientData.challenge === "string" && clientData.challenge.length > 0) return clientData.challenge;
+	} catch {}
+	throw new InvalidPasskeyError("malformed-client-data");
+}
+/**
+* Consume the challenge a credential response signed. It is consumed BEFORE
+* the signature is verified, so a challenge is single-use even when that
+* verification fails. Unknown, other-ceremony, expired and already-used
+* challenges all throw {@link InvalidPasskeyError}.
+*/
+async function takePasskeyChallenge(ceremony, credential) {
+	const challenge = signedChallenge(credential);
+	const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(challenge), ceremony);
+	if (!row || row.isConsumed || row.isExpired) throw new InvalidPasskeyError("unknown-or-expired-challenge");
+	if (!await row.consumeIfActive()) throw new InvalidPasskeyError("challenge-already-used");
+	return {
+		challenge,
+		row
+	};
+}
+/**
+* CSRF rule for a passkey verify: the request's `Origin` header must be one
+* of `auth.passkeys.origin`. The same list is what the signed
+* `clientDataJSON.origin` is checked against.
+*/
+function assertPasskeyOrigin(request) {
+	const origins = authConfig.passkeys.origins();
+	const origin = request.origin;
+	if (typeof origin !== "string" || !origins.includes(origin)) throw new InvalidPasskeyError("origin-mismatch");
+	return origins;
+}
+
+//#endregion
+export { assertPasskeyOrigin, storePasskeyChallenge, takePasskeyChallenge };
+//# sourceMappingURL=passkey-challenges.mjs.map

package/esm/passkeys/passkey-challenges.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-challenges.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-challenges.ts"],"sourcesContent":["import type { Request } from \"@warlock.js/core\";\nimport { InvalidPasskeyError } from \"../errors/invalid-passkey.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken, OneTimeTokenPurpose } from \"../models/one-time-token\";\nimport { authConfig } from \"../services/auth-config\";\nimport { hashOneTimeToken, oneTimeTokenModel } from \"../services/one-time-tokens\";\nimport type { PasskeyResponseJSON } from \"./simplewebauthn\";\n\n/** Which ceremony a challenge belongs to. */\nexport type PasskeyCeremony = Extract<\n  OneTimeTokenPurpose,\n  \"passkey-registration\" | \"passkey-authentication\"\n>;\n\n/**\n * Store a ceremony challenge server-side: SHA-256 hashed, purpose-bound,\n * expiring (`auth.passkeys.challengeExpiresIn`, default 5m). A registration\n * challenge is bound to its user; an authentication challenge has none.\n */\nexport async function storePasskeyChallenge(\n  ceremony: PasskeyCeremony,\n  challenge: string,\n  user?: Auth,\n): Promise<void> {\n  const expiresAt = new Date(Date.now() + authConfig.passkeys.challengeExpiresInMs());\n\n  await oneTimeTokenModel().issueChallenge(ceremony, hashOneTimeToken(challenge), expiresAt, user);\n}\n\n/** The challenge the browser signed, read from `clientDataJSON`. */\nfunction signedChallenge(credential: PasskeyResponseJSON): string {\n  try {\n    const clientData = JSON.parse(\n      Buffer.from(credential.response.clientDataJSON, \"base64url\").toString(\"utf8\"),\n    ) as { challenge?: unknown };\n\n    if (typeof clientData.challenge === \"string\" && clientData.challenge.length > 0) {\n      return clientData.challenge;\n    }\n  } catch {\n    // fall through to the rejection\n  }\n\n  throw new InvalidPasskeyError(\"malformed-client-data\");\n}\n\n/**\n * Consume the challenge a credential response signed. It is consumed BEFORE\n * the signature is verified, so a challenge is single-use even when that\n * verification fails. Unknown, other-ceremony, expired and already-used\n * challenges all throw {@link InvalidPasskeyError}.\n */\nexport async function takePasskeyChallenge(\n  ceremony: PasskeyCeremony,\n  credential: PasskeyResponseJSON,\n): Promise<{ challenge: string; row: OneTimeToken }> {\n  const challenge = signedChallenge(credential);\n  const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(challenge), ceremony);\n\n  if (!row || row.isConsumed || row.isExpired) {\n    throw new InvalidPasskeyError(\"unknown-or-expired-challenge\");\n  }\n\n  if (!(await row.consumeIfActive())) {\n    throw new InvalidPasskeyError(\"challenge-already-used\");\n  }\n\n  return { challenge, row };\n}\n\n/**\n * CSRF rule for a passkey verify: the request's `Origin` header must be one\n * of `auth.passkeys.origin`. The same list is what the signed\n * `clientDataJSON.origin` is checked against.\n */\nexport function assertPasskeyOrigin(request: Request): string[] {\n  const origins = authConfig.passkeys.origins();\n  const origin = request.origin;\n\n  if (typeof origin !== \"string\" || !origins.includes(origin)) {\n    throw new InvalidPasskeyError(\"origin-mismatch\");\n  }\n\n  return origins;\n}\n"],"mappings":";;;;;;;;;;AAmBA,eAAsB,sBACpB,UACA,WACA,MACe;CACf,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,SAAS,qBAAqB,CAAC;CAElF,MAAM,kBAAkB,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,GAAG,WAAW,IAAI;AACjG;;AAGA,SAAS,gBAAgB,YAAyC;CAChE,IAAI;EACF,MAAM,aAAa,KAAK,MACtB,OAAO,KAAK,WAAW,SAAS,gBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAC9E;EAEA,IAAI,OAAO,WAAW,cAAc,YAAY,WAAW,UAAU,SAAS,GAC5E,OAAO,WAAW;CAEtB,QAAQ,CAER;CAEA,MAAM,IAAI,oBAAoB,uBAAuB;AACvD;;;;;;;AAQA,eAAsB,qBACpB,UACA,YACmD;CACnD,MAAM,YAAY,gBAAgB,UAAU;CAC5C,MAAM,MAAM,MAAM,kBAAkB,CAAC,CAAC,WAAW,iBAAiB,SAAS,GAAG,QAAQ;CAEtF,IAAI,CAAC,OAAO,IAAI,cAAc,IAAI,WAChC,MAAM,IAAI,oBAAoB,8BAA8B;CAG9D,IAAI,CAAE,MAAM,IAAI,gBAAgB,GAC9B,MAAM,IAAI,oBAAoB,wBAAwB;CAGxD,OAAO;EAAE;EAAW;CAAI;AAC1B;;;;;;AAOA,SAAgB,oBAAoB,SAA4B;CAC9D,MAAM,UAAU,WAAW,SAAS,QAAQ;CAC5C,MAAM,SAAS,QAAQ;CAEvB,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,SAAS,MAAM,GACxD,MAAM,IAAI,oBAAoB,iBAAiB;CAGjD,OAAO;AACT"}

package/esm/passkeys/passkey-registration.d.mts

@@ -0,0 +1,29 @@
+import { Auth } from "../models/auth.model.mjs";
+import { PasskeyCredential } from "../models/passkey-credential/passkey-credential.model.mjs";
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./simplewebauthn.mjs";
+import { Request } from "@warlock.js/core";
+
+//#region ../auth/src/passkeys/passkey-registration.d.ts
+/**
+ * Registration options for a LOGGED-IN user adding a passkey. The challenge is
+ * stored single-use and bound to this user; the user's existing credentials
+ * are excluded so the same authenticator is not registered twice.
+ *
+ * @example
+ * // POST /auth/passkeys/register/options  (authMiddleware)
+ * response.success(await generatePasskeyRegistrationOptions(request.locals.user));
+ */
+declare function generatePasskeyRegistrationOptions(user: Auth): Promise<PasskeyOptionsJSON>;
+/**
+ * Verify the browser's registration response and store the credential.
+ * Checks, in order: the request `Origin` (CSRF), the single-use challenge
+ * (consumed even if what follows fails) belongs to THIS user, then the
+ * attestation via `@simplewebauthn/server` against the configured origins and
+ * rpID.
+ *
+ * @throws InvalidPasskeyError (400, EC011) on any rejection.
+ */
+declare function verifyPasskeyRegistration(request: Request, user: Auth, credential: PasskeyResponseJSON): Promise<PasskeyCredential>;
+//#endregion
+export { generatePasskeyRegistrationOptions, verifyPasskeyRegistration };
+//# sourceMappingURL=passkey-registration.d.mts.map

package/esm/passkeys/passkey-registration.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration.d.mts","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-registration.ts"],"mappings":";;;;;;;;;AAoCA;;;;;;iBAAsB,kCAAA,CAAmC,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,kBAAA;;;;;;;AAAkB;AAgChG;;iBAAsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,IAAA,EAAM,IAAA,EACN,UAAA,EAAY,mBAAA,GACX,OAAA,CAAQ,iBAAA"}

package/esm/passkeys/passkey-registration.mjs

@@ -0,0 +1,88 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { InvalidPasskeyError } from "../errors/invalid-passkey.error.mjs";
+import { PasskeyCredential } from "../models/passkey-credential/passkey-credential.model.mjs";
+import "../models/passkey-credential/index.mjs";
+import { assertPasskeyOrigin, storePasskeyChallenge, takePasskeyChallenge } from "./passkey-challenges.mjs";
+import { loadSimpleWebAuthn } from "./simplewebauthn.mjs";
+
+//#region ../auth/src/passkeys/passkey-registration.ts
+/** Account name the authenticator shows: `auth.passkeys.userName`, else email, else id. */
+function passkeyUserName(user) {
+	const configured = authConfig.passkeys.settings().userName;
+	if (configured) return configured(user);
+	const email = user.get("email");
+	return typeof email === "string" && email ? email : String(user.id);
+}
+/**
+* Registration options for a LOGGED-IN user adding a passkey. The challenge is
+* stored single-use and bound to this user; the user's existing credentials
+* are excluded so the same authenticator is not registered twice.
+*
+* @example
+* // POST /auth/passkeys/register/options  (authMiddleware)
+* response.success(await generatePasskeyRegistrationOptions(request.locals.user));
+*/
+async function generatePasskeyRegistrationOptions(user) {
+	const webauthn = await loadSimpleWebAuthn();
+	const settings = authConfig.passkeys.settings();
+	const existing = await PasskeyCredential.listFor(user);
+	const options = await webauthn.generateRegistrationOptions({
+		rpName: settings.rpName,
+		rpID: settings.rpID,
+		userName: passkeyUserName(user),
+		userID: new TextEncoder().encode(`${user.userType}:${user.id}`),
+		attestationType: "none",
+		excludeCredentials: existing.map((credential) => ({
+			id: credential.credentialId,
+			transports: credential.get("transports") ?? void 0
+		})),
+		authenticatorSelection: {
+			residentKey: "preferred",
+			userVerification: "preferred"
+		}
+	});
+	await storePasskeyChallenge("passkey-registration", options.challenge, user);
+	return options;
+}
+/**
+* Verify the browser's registration response and store the credential.
+* Checks, in order: the request `Origin` (CSRF), the single-use challenge
+* (consumed even if what follows fails) belongs to THIS user, then the
+* attestation via `@simplewebauthn/server` against the configured origins and
+* rpID.
+*
+* @throws InvalidPasskeyError (400, EC011) on any rejection.
+*/
+async function verifyPasskeyRegistration(request, user, credential) {
+	const webauthn = await loadSimpleWebAuthn();
+	const origins = assertPasskeyOrigin(request);
+	const { challenge, row } = await takePasskeyChallenge("passkey-registration", credential);
+	if (String(row.userId) !== String(user.id) || row.userType !== user.userType) throw new InvalidPasskeyError("challenge-issued-to-another-user");
+	let verification;
+	try {
+		verification = await webauthn.verifyRegistrationResponse({
+			response: credential,
+			expectedChallenge: challenge,
+			expectedOrigin: origins,
+			expectedRPID: authConfig.passkeys.settings().rpID,
+			requireUserVerification: false
+		});
+	} catch (error) {
+		throw new InvalidPasskeyError("registration-verification-failed", error);
+	}
+	if (!verification.verified || !verification.registrationInfo) throw new InvalidPasskeyError("registration-not-verified");
+	const { id, publicKey, counter, transports } = verification.registrationInfo.credential;
+	if (await PasskeyCredential.findByCredentialId(id)) throw new InvalidPasskeyError("credential-already-registered");
+	return PasskeyCredential.create({
+		credential_id: id,
+		public_key: Buffer.from(publicKey).toString("base64url"),
+		counter,
+		transports: transports ?? credential.response.transports ?? [],
+		user_id: user.id,
+		user_type: user.userType
+	});
+}
+
+//#endregion
+export { generatePasskeyRegistrationOptions, verifyPasskeyRegistration };
+//# sourceMappingURL=passkey-registration.mjs.map

package/esm/passkeys/passkey-registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/passkey-registration.ts"],"sourcesContent":["import type { Request } from \"@warlock.js/core\";\nimport { InvalidPasskeyError } from \"../errors/invalid-passkey.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { PasskeyCredential } from \"../models/passkey-credential\";\nimport { authConfig } from \"../services/auth-config\";\nimport {\n  assertPasskeyOrigin,\n  storePasskeyChallenge,\n  takePasskeyChallenge,\n} from \"./passkey-challenges\";\nimport {\n  loadSimpleWebAuthn,\n  type PasskeyOptionsJSON,\n  type PasskeyResponseJSON,\n} from \"./simplewebauthn\";\n\n/** Account name the authenticator shows: `auth.passkeys.userName`, else email, else id. */\nfunction passkeyUserName(user: Auth): string {\n  const configured = authConfig.passkeys.settings().userName;\n\n  if (configured) return configured(user);\n\n  const email = user.get(\"email\");\n\n  return typeof email === \"string\" && email ? email : String(user.id);\n}\n\n/**\n * Registration options for a LOGGED-IN user adding a passkey. The challenge is\n * stored single-use and bound to this user; the user's existing credentials\n * are excluded so the same authenticator is not registered twice.\n *\n * @example\n * // POST /auth/passkeys/register/options  (authMiddleware)\n * response.success(await generatePasskeyRegistrationOptions(request.locals.user));\n */\nexport async function generatePasskeyRegistrationOptions(user: Auth): Promise<PasskeyOptionsJSON> {\n  const webauthn = await loadSimpleWebAuthn();\n  const settings = authConfig.passkeys.settings();\n  const existing = await PasskeyCredential.listFor(user);\n\n  const options = await webauthn.generateRegistrationOptions({\n    rpName: settings.rpName,\n    rpID: settings.rpID,\n    userName: passkeyUserName(user),\n    userID: new TextEncoder().encode(`${user.userType}:${user.id}`),\n    attestationType: \"none\",\n    excludeCredentials: existing.map((credential) => ({\n      id: credential.credentialId,\n      transports: credential.get(\"transports\") ?? undefined,\n    })),\n    authenticatorSelection: { residentKey: \"preferred\", userVerification: \"preferred\" },\n  });\n\n  await storePasskeyChallenge(\"passkey-registration\", options.challenge, user);\n\n  return options;\n}\n\n/**\n * Verify the browser's registration response and store the credential.\n * Checks, in order: the request `Origin` (CSRF), the single-use challenge\n * (consumed even if what follows fails) belongs to THIS user, then the\n * attestation via `@simplewebauthn/server` against the configured origins and\n * rpID.\n *\n * @throws InvalidPasskeyError (400, EC011) on any rejection.\n */\nexport async function verifyPasskeyRegistration(\n  request: Request,\n  user: Auth,\n  credential: PasskeyResponseJSON,\n): Promise<PasskeyCredential> {\n  const webauthn = await loadSimpleWebAuthn();\n  const origins = assertPasskeyOrigin(request);\n  const { challenge, row } = await takePasskeyChallenge(\"passkey-registration\", credential);\n\n  if (String(row.userId) !== String(user.id) || row.userType !== user.userType) {\n    throw new InvalidPasskeyError(\"challenge-issued-to-another-user\");\n  }\n\n  let verification: Awaited<ReturnType<typeof webauthn.verifyRegistrationResponse>>;\n\n  try {\n    verification = await webauthn.verifyRegistrationResponse({\n      response: credential,\n      expectedChallenge: challenge,\n      expectedOrigin: origins,\n      expectedRPID: authConfig.passkeys.settings().rpID,\n      requireUserVerification: false,\n    });\n  } catch (error) {\n    throw new InvalidPasskeyError(\"registration-verification-failed\", error);\n  }\n\n  if (!verification.verified || !verification.registrationInfo) {\n    throw new InvalidPasskeyError(\"registration-not-verified\");\n  }\n\n  const { id, publicKey, counter, transports } = verification.registrationInfo.credential;\n\n  if (await PasskeyCredential.findByCredentialId(id)) {\n    throw new InvalidPasskeyError(\"credential-already-registered\");\n  }\n\n  return PasskeyCredential.create({\n    credential_id: id,\n    public_key: Buffer.from(publicKey).toString(\"base64url\"),\n    counter,\n    transports: transports ?? credential.response.transports ?? [],\n    user_id: user.id,\n    user_type: user.userType,\n  });\n}\n"],"mappings":";;;;;;;;;AAiBA,SAAS,gBAAgB,MAAoB;CAC3C,MAAM,aAAa,WAAW,SAAS,SAAS,CAAC,CAAC;CAElD,IAAI,YAAY,OAAO,WAAW,IAAI;CAEtC,MAAM,QAAQ,KAAK,IAAI,OAAO;CAE9B,OAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ,OAAO,KAAK,EAAE;AACpE;;;;;;;;;;AAWA,eAAsB,mCAAmC,MAAyC;CAChG,MAAM,WAAW,MAAM,mBAAmB;CAC1C,MAAM,WAAW,WAAW,SAAS,SAAS;CAC9C,MAAM,WAAW,MAAM,kBAAkB,QAAQ,IAAI;CAErD,MAAM,UAAU,MAAM,SAAS,4BAA4B;EACzD,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,UAAU,gBAAgB,IAAI;EAC9B,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,KAAK,SAAS,GAAG,KAAK,IAAI;EAC9D,iBAAiB;EACjB,oBAAoB,SAAS,KAAK,gBAAgB;GAChD,IAAI,WAAW;GACf,YAAY,WAAW,IAAI,YAAY,KAAK;EAC9C,EAAE;EACF,wBAAwB;GAAE,aAAa;GAAa,kBAAkB;EAAY;CACpF,CAAC;CAED,MAAM,sBAAsB,wBAAwB,QAAQ,WAAW,IAAI;CAE3E,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,0BACpB,SACA,MACA,YAC4B;CAC5B,MAAM,WAAW,MAAM,mBAAmB;CAC1C,MAAM,UAAU,oBAAoB,OAAO;CAC3C,MAAM,EAAE,WAAW,QAAQ,MAAM,qBAAqB,wBAAwB,UAAU;CAExF,IAAI,OAAO,IAAI,MAAM,MAAM,OAAO,KAAK,EAAE,KAAK,IAAI,aAAa,KAAK,UAClE,MAAM,IAAI,oBAAoB,kCAAkC;CAGlE,IAAI;CAEJ,IAAI;EACF,eAAe,MAAM,SAAS,2BAA2B;GACvD,UAAU;GACV,mBAAmB;GACnB,gBAAgB;GAChB,cAAc,WAAW,SAAS,SAAS,CAAC,CAAC;GAC7C,yBAAyB;EAC3B,CAAC;CACH,SAAS,OAAO;EACd,MAAM,IAAI,oBAAoB,oCAAoC,KAAK;CACzE;CAEA,IAAI,CAAC,aAAa,YAAY,CAAC,aAAa,kBAC1C,MAAM,IAAI,oBAAoB,2BAA2B;CAG3D,MAAM,EAAE,IAAI,WAAW,SAAS,eAAe,aAAa,iBAAiB;CAE7E,IAAI,MAAM,kBAAkB,mBAAmB,EAAE,GAC/C,MAAM,IAAI,oBAAoB,+BAA+B;CAG/D,OAAO,kBAAkB,OAAO;EAC9B,eAAe;EACf,YAAY,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,WAAW;EACvD;EACA,YAAY,cAAc,WAAW,SAAS,cAAc,CAAC;EAC7D,SAAS,KAAK;EACd,WAAW,KAAK;CAClB,CAAC;AACH"}

package/esm/passkeys/simplewebauthn.d.mts

@@ -0,0 +1,21 @@
+//#region ../auth/src/passkeys/simplewebauthn.d.ts
+/** The browser's JSON-serialized credential (`startRegistration` / `startAuthentication` result). */
+type PasskeyResponseJSON = {
+  id: string;
+  rawId: string;
+  type: string;
+  response: {
+    clientDataJSON: string;
+    transports?: string[];
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+};
+/** Options JSON handed to the browser; `challenge` is what auth stores. */
+type PasskeyOptionsJSON = {
+  challenge: string;
+  [key: string]: unknown;
+};
+//#endregion
+export { PasskeyOptionsJSON, PasskeyResponseJSON };
+//# sourceMappingURL=simplewebauthn.d.mts.map

package/esm/passkeys/simplewebauthn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.d.mts","names":[],"sources":["../../../../../../../auth/src/passkeys/simplewebauthn.ts"],"mappings":";;KAMY,mBAAA;EACV,EAAA;EACA,KAAA;EACA,IAAA;EACA,QAAA;IACE,cAAA;IACA,UAAA;IAAA,CACC,GAAA;EAAA;EAAA,CAEF,GAAA;AAAA;AAAW;AAAA,KAIF,kBAAA;EACV,SAAA;EAAA,CACC,GAAW;AAAA"}

package/esm/passkeys/simplewebauthn.mjs

@@ -0,0 +1,13 @@
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+
+//#region ../auth/src/passkeys/simplewebauthn.ts
+/** The `warlock add` feature that installs `@simplewebauthn/server`. */
+const PASSKEYS_FEATURE = "auth-passkeys";
+/** Load `@simplewebauthn/server`, or throw `AuthProviderSdkMissingError` naming `warlock add auth-passkeys`. */
+function loadSimpleWebAuthn() {
+	return loadOptionalPeer("@simplewebauthn/server", PASSKEYS_FEATURE);
+}
+
+//#endregion
+export { loadSimpleWebAuthn };
+//# sourceMappingURL=simplewebauthn.mjs.map

package/esm/passkeys/simplewebauthn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplewebauthn.mjs","names":[],"sources":["../../../../../../../auth/src/passkeys/simplewebauthn.ts"],"sourcesContent":["import { loadOptionalPeer } from \"../services/optional-peer\";\n\n/** The `warlock add` feature that installs `@simplewebauthn/server`. */\nexport const PASSKEYS_FEATURE = \"auth-passkeys\";\n\n/** The browser's JSON-serialized credential (`startRegistration` / `startAuthentication` result). */\nexport type PasskeyResponseJSON = {\n  id: string;\n  rawId: string;\n  type: string;\n  response: {\n    clientDataJSON: string;\n    transports?: string[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n};\n\n/** Options JSON handed to the browser; `challenge` is what auth stores. */\nexport type PasskeyOptionsJSON = {\n  challenge: string;\n  [key: string]: unknown;\n};\n\n/** A stored credential in the shape `@simplewebauthn/server` verifies against. */\nexport type WebAuthnCredential = {\n  id: string;\n  publicKey: Uint8Array;\n  counter: number;\n  transports?: string[];\n};\n\n/**\n * The slice of `@simplewebauthn/server` (v13) auth uses — declared locally\n * because the package is an optional peer.\n */\nexport type SimpleWebAuthnServer = {\n  generateRegistrationOptions: (options: Record<string, unknown>) => Promise<PasskeyOptionsJSON>;\n  verifyRegistrationResponse: (options: Record<string, unknown>) => Promise<{\n    verified: boolean;\n    registrationInfo?: { credential: WebAuthnCredential };\n  }>;\n  generateAuthenticationOptions: (options: Record<string, unknown>) => Promise<PasskeyOptionsJSON>;\n  verifyAuthenticationResponse: (options: Record<string, unknown>) => Promise<{\n    verified: boolean;\n    authenticationInfo: { newCounter: number };\n  }>;\n};\n\n/** Load `@simplewebauthn/server`, or throw `AuthProviderSdkMissingError` naming `warlock add auth-passkeys`. */\nexport function loadSimpleWebAuthn(): Promise<SimpleWebAuthnServer> {\n  return loadOptionalPeer<SimpleWebAuthnServer>(\"@simplewebauthn/server\", PASSKEYS_FEATURE);\n}\n"],"mappings":";;;;AAGA,MAAa,mBAAmB;;AA+ChC,SAAgB,qBAAoD;CAClE,OAAO,iBAAuC,0BAA0B,gBAAgB;AAC1F"}

package/esm/providers/google-provider.d.mts

@@ -0,0 +1,40 @@
+import { AuthProvider, GoogleProviderConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile } from "../contracts/providers.mjs";
+
+//#region ../auth/src/providers/google-provider.d.ts
+/** The `warlock add` feature that installs `jose`. */
+declare const GOOGLE_AUTH_FEATURE = "auth-google";
+/** The slice of `jose` the Google provider uses — declared locally because `jose` is an optional peer. */
+type JoseModule = {
+  createRemoteJWKSet: (url: URL) => unknown;
+  jwtVerify: (token: string, key: unknown, options: {
+    issuer: string[];
+    audience: string;
+  }) => Promise<{
+    payload: Record<string, unknown>;
+  }>;
+};
+/** PKCE S256 code challenge for a verifier. */
+declare function pkceChallenge(codeVerifier: string): string;
+/**
+ * Google sign-in: OpenID Connect authorization code flow with PKCE (S256),
+ * `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token
+ * is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the
+ * client id, `exp`), then its `nonce` is compared. No Google SDK.
+ */
+declare class GoogleProvider implements AuthProvider {
+  private readonly settings;
+  readonly name = "google";
+  constructor(settings: GoogleProviderConfig);
+  authorizationUrl(state: ProviderAuthorizationState): string;
+  handleCallback({
+    query,
+    expected
+  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+  private exchangeCode;
+  /** Verify signature, issuer, audience and expiry; resolve the claims. */
+  private verifyIdToken;
+}
+//#endregion
+export { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge };
+//# sourceMappingURL=google-provider.d.mts.map

package/esm/providers/google-provider.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-provider.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/google-provider.ts"],"mappings":";;;;cAkBa,mBAAA;AAAb;AAAA,KAGY,UAAA;EACV,kBAAA,GAAqB,GAAA,EAAK,GAAA;EAC1B,SAAA,GACE,KAAA,UACA,GAAA,WACA,OAAA;IAAW,MAAA;IAAkB,QAAA;EAAA,MAC1B,OAAA;IAAU,OAAA,EAAS,MAAA;EAAA;AAAA;;iBAOV,aAAA,CAAc,YAAoB;;;;;;;cAUrC,cAAA,YAA0B,YAAA;EAAA,iBAGD,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,oBAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAelB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAxCZ;EAAA,QA0EV,YAAA;EA1EgB;EAAA,QA4GhB,aAAA;AAAA"}