accounts 0.16.0 → 0.16.1

package/src/core/zod/rpc.ts

@@ -710,7 +710,7 @@ export namespace wallet_connect {
         }),
         z.object({
           digest: z.optional(u.hex()),
-          credentialId: z.optional(z.string()),
+          credentialId: z.optional(z.union([z.string(), z.array(z.string())])),
           authorizeAccessKey,
           auth,
           identity,
@@ -829,7 +829,7 @@ export namespace wallet_connect_strict {
         }),
         z.object({
           digest: z.optional(u.hex()),
-          credentialId: z.optional(z.string()),
+          credentialId: z.optional(z.union([z.string(), z.array(z.string())])),
           authorizeAccessKey,
           auth,
           identity,

package/src/server/internal/handlers/utils.test.ts

@@ -0,0 +1,53 @@
+import { RpcRequest } from 'ox'
+import { describe, expect, test } from 'vp/test'
+
+import * as Utils from './utils.js'
+
+const request = RpcRequest.from({ id: 1, method: 'eth_sendRawTransaction', params: ['0x00'] })
+
+describe('rpcErrorJson', () => {
+  test('maps upstream expired transactions to a transaction-rejected error', () => {
+    const error = {
+      cause: {
+        code: -32603,
+        message: 'Revm error: transaction expired',
+      },
+    }
+
+    expect(Utils.rpcErrorJson(request, error)).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": -32003,
+          "data": {
+            "code": "transaction_expired",
+          },
+          "message": "Transaction expired.",
+        },
+        "id": 1,
+        "jsonrpc": "2.0",
+      }
+    `)
+  })
+
+  test('preserves unrelated upstream internal errors', () => {
+    const error = {
+      code: -32603,
+      data: { reason: 'database unavailable' },
+      message: 'Revm error: database unavailable',
+    }
+
+    expect(Utils.rpcErrorJson(request, error)).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": -32603,
+          "data": {
+            "reason": "database unavailable",
+          },
+          "message": "Revm error: database unavailable",
+        },
+        "id": 1,
+        "jsonrpc": "2.0",
+      }
+    `)
+  })
+})

package/src/server/internal/handlers/utils.ts

@@ -97,6 +97,22 @@ export function rpcErrorJson(request: RpcRequest.RpcRequest, error: unknown) {
     )
 
   const inner = resolveError(error)
+  if (
+    inner.code === RpcResponse.InternalError.code &&
+    inner.message !== undefined &&
+    /^Revm error: transaction expired\.?$/.test(inner.message)
+  )
+    return RpcResponse.from(
+      {
+        error: {
+          code: -32003,
+          data: { code: 'transaction_expired' },
+          message: 'Transaction expired.',
+        },
+      },
+      { request },
+    )
+
   const message = inner.message ?? (error as Error).message
   const code = inner.code ?? -32603
   const data = inner.data

package/src/server/internal/handlers/webAuthn.test.ts

@@ -1,10 +1,14 @@
+import { vi } from 'vitest'
 import { afterAll, afterEach, beforeAll, describe, expect, test } from 'vp/test'
+import { Registration } from 'webauthx/server'
 
 import { createServer, type Server } from '../../../../test/utils.js'
 import * as WebAuthnCeremony from '../../../core/WebAuthnCeremony.js'
 import * as Kv from '../../Kv.js'
 import { type SessionPayload, webAuthn } from './webAuthn.js'
 
+vi.mock('webauthx/server', { spy: true })
+
 let server: Server
 let ceremony: WebAuthnCeremony.WebAuthnCeremony
 
@@ -52,6 +56,25 @@ describe('POST /login/options', () => {
     const { options: b } = await ceremony.getAuthenticationOptions()
     expect(a.publicKey!.challenge).not.toBe(b.publicKey!.challenge)
   })
+
+  test('behavior: restricts authentication to multiple credentials', async () => {
+    const { options } = await ceremony.getAuthenticationOptions({
+      credentialId: ['Y3JlZC0x', 'Y3JlZC0y'],
+    })
+
+    expect(options.publicKey?.allowCredentials).toMatchInlineSnapshot(`
+      [
+        {
+          "id": "Y3JlZC0x",
+          "type": "public-key",
+        },
+        {
+          "id": "Y3JlZC0y",
+          "type": "public-key",
+        },
+      ]
+    `)
+  })
 })
 
 describe('POST /register', () => {
@@ -152,6 +175,59 @@ describe('hooks', () => {
     await hookServer.closeAsync()
   })
 
+  test('behavior: onRegister rejection removes the credential', async () => {
+    const kv = Kv.memory()
+    await kv.set('challenge:0x01', { created: Date.now(), name: 'Test' })
+    const publicKey =
+      '0x04ab891400140fc4f8e941ce0ff90e419de9470acaca613bbd717a4775435031a7d884318e919fd3b3e5a631d866d8a380b44063e70f0c381ee16e0652f7f97554'
+    vi.mocked(Registration.verify).mockReturnValueOnce({
+      aaguid: 'fbfc3007-154e-4ecc-8c0b-6e020557d7bd',
+      credential: { publicKey },
+    } as never)
+    const hookServer = await createServer(
+      webAuthn({
+        kv,
+        origin: 'http://localhost',
+        rpId: 'localhost',
+        onRegister() {
+          throw new Error('Authenticator not allowed')
+        },
+      }).listener,
+    )
+
+    try {
+      const clientDataJSON = 'eyJjaGFsbGVuZ2UiOiJBUSJ9'
+      const response = await fetch(`${hookServer.url}/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          attestationObject: 'AA',
+          clientDataJSON,
+          id: 'credential',
+          publicKey,
+          raw: {
+            authenticatorAttachment: null,
+            id: 'credential',
+            rawId: 'Y3JlZGVudGlhbA',
+            response: { clientDataJSON },
+            type: 'public-key',
+          },
+        }),
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`400`)
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": "Authenticator not allowed",
+        }
+      `)
+      expect(await kv.get('credential:credential')).toBeUndefined()
+      expect(await kv.get('challenge:0x01')).toBeUndefined()
+    } finally {
+      await hookServer.closeAsync()
+    }
+  })
+
   test('behavior: onAuthenticate error does not call hook', async () => {
     let called = false
     const hookServer = await createServer(

package/src/server/internal/handlers/webAuthn.ts

@@ -152,6 +152,7 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
         rpId,
       })
 
+      const { aaguid } = result
       const { publicKey } = result.credential
       const credentialId = credential.id
       // Base64url-encode the userId we registered with so it matches
@@ -160,22 +161,29 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
       const userId = stored.userId
         ? Base64.fromBytes(Bytes.fromString(stored.userId), { pad: false, url: true })
         : undefined
-      const created = await createCredential(kv, `credential:${credentialId}`, {
+      const key = `credential:${credentialId}`
+      const created = await createCredential(kv, key, {
         publicKey,
         ...(userId ? { userId } : {}),
       })
       if (!created) throw new Error('Credential already exists')
 
-      const [hook] = await Promise.all([
-        onRegister?.({
-          credentialId,
-          name: stored.name,
-          publicKey,
-          request: c.req.raw,
-          ...(userId ? { userId } : {}),
-        }),
-        kv.delete(`challenge:${challenge}`),
-      ])
+      const hook = await (async () => {
+        try {
+          return await onRegister?.({
+            ...(aaguid ? { aaguid } : {}),
+            credentialId,
+            name: stored.name,
+            publicKey,
+            request: c.req.raw,
+            ...(userId ? { userId } : {}),
+          })
+        } catch (error) {
+          await Promise.all([kv.delete(key), kv.delete(`challenge:${challenge}`)])
+          throw error
+        }
+      })()
+      await kv.delete(`challenge:${challenge}`)
 
       // Successful registration is also a successful authentication for
       // the freshly-minted credential. Issue a session here so the
@@ -231,13 +239,13 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
       } = body as {
         allowCredentialIds?: string[]
         challenge?: Hex.Hex
-        credentialId?: string
+        credentialId?: string | string[]
         mediation?: string
       }
 
       const { challenge, options: authOptions } = Authentication.getOptions({
         challenge: requestChallenge,
-        credentialId: allowCredentialIds ?? credentialId,
+        credentialId: credentialId ?? allowCredentialIds,
         rpId,
       })
       const options = mediation ? { ...authOptions, mediation } : authOptions
@@ -414,8 +422,14 @@ export declare namespace webAuthn {
      * best-effort `get` then `set` storage.
      */
     kv: Kv.Kv
-    /** Called after a successful registration. The returned response is merged onto the default JSON response. */
+    /**
+     * Called after a successful registration. The returned response is merged
+     * onto the default JSON response. Throwing rejects the request and removes
+     * the newly stored credential.
+     */
     onRegister?: (parameters: {
+      /** Authenticator model identifier, when the authenticator reports one. */
+      aaguid?: string | undefined
       credentialId: string
       /** The name provided during `/register/options` (e.g. user email). */
       name: string