@yielded/auth-simplewebauthn 0.1.0-beta.0

package/src/internal/server/configuration.ts

@@ -0,0 +1,101 @@
+import {
+  PasskeyConfigurationError,
+  PasskeyProtocolRejected,
+  PasskeyProfile,
+  samePasskey,
+  snapshotPasskey,
+} from "@yielded/auth/Passkey";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+import { Cause, Effect } from "effect";
+import { parse } from "tldts";
+
+import { SimpleWebAuthnPasskeyProtocolOptions } from "./models";
+
+export const captureSimpleWebAuthnProfiles = Effect.fn("captureSimpleWebAuthnProfiles")(
+  function* (options: SimpleWebAuthnPasskeyProtocolOptions) {
+    const captured = yield* snapshotPasskey(SimpleWebAuthnPasskeyProtocolOptions, options).pipe(
+      Effect.mapError(() => PasskeyConfigurationError.make({})),
+    );
+
+    const keys = new Set<string>();
+
+    for (const profile of captured.profiles) {
+      const key = `${profile.rpId}/${profile.profileId}/${profile.generation}`;
+
+      if (
+        keys.has(key) ||
+        new Set(profile.origins).size !== profile.origins.length ||
+        new Set(profile.algorithms).size !== profile.algorithms.length ||
+        (profile.primarySignIn &&
+          (profile.residentKey !== "required" || profile.userVerification !== "required"))
+      ) {
+        return yield* PasskeyConfigurationError.make({});
+      }
+      keys.add(key);
+
+      const valid = yield* Effect.try({
+        try: () => {
+          const host = new URL(`https://${profile.rpId}`).hostname;
+
+          if (host !== profile.rpId) return false;
+
+          const domain = parse(host, {
+            allowIcannDomains: true,
+            allowPrivateDomains: true,
+            extractHostname: false,
+            validateHostname: true,
+            detectIp: true,
+          });
+
+          if (
+            host === "localhost"
+              ? !profile.developmentLocalhost
+              : domain.isIp || domain.domain === null || domain.publicSuffix === host
+          )
+            return false;
+
+          return profile.origins.every((origin) => {
+            const url = new URL(origin);
+
+            return (
+              url.origin === origin &&
+              url.username === "" &&
+              url.password === "" &&
+              (url.protocol === "https:" ||
+                (profile.developmentLocalhost &&
+                  profile.rpId === "localhost" &&
+                  url.hostname === "localhost" &&
+                  url.protocol === "http:")) &&
+              (url.hostname === profile.rpId ||
+                (profile.rpId !== "localhost" && url.hostname.endsWith(`.${profile.rpId}`)))
+            );
+          });
+        },
+        catch: () => PasskeyConfigurationError.make({}),
+      });
+
+      if (!valid) return yield* PasskeyConfigurationError.make({});
+    }
+
+    return Effect.fn("selectSimpleWebAuthnProfile")(function* (input: PasskeyProfile) {
+      const profile = captured.profiles.find(
+        (value) =>
+          value.rpId === input.rpId &&
+          value.profileId === input.profileId &&
+          value.generation === input.generation,
+      );
+
+      if (profile === undefined || !(yield* samePasskey(PasskeyProfile, profile, input)))
+        return yield* PasskeyProtocolRejected.make({});
+
+      return profile;
+    });
+  },
+  Effect.catchCause((cause) =>
+    Cause.hasDies(cause)
+      ? reportAuthFailure("passkey-protocol", cause).pipe(
+          Effect.andThen(Effect.fail(PasskeyConfigurationError.make({}))),
+        )
+      : Effect.failCause(cause),
+  ),
+);

package/src/internal/server/models.ts

@@ -0,0 +1,8 @@
+import { PasskeyProfile } from "@yielded/auth/Passkey";
+import { Schema } from "effect";
+
+export const SimpleWebAuthnPasskeyProtocolOptions = Schema.Struct({
+  profiles: Schema.NonEmptyArray(PasskeyProfile).check(Schema.isMaxLength(64)),
+});
+
+export type SimpleWebAuthnPasskeyProtocolOptions = typeof SimpleWebAuthnPasskeyProtocolOptions.Type;