accounts 0.3.0 → 0.4.1

package/src/core/Account.ts

@@ -0,0 +1,152 @@
+import { Provider, type WebCryptoP256 } from 'ox'
+import { type KeyAuthorization } from 'ox/tempo'
+import type { Hex } from 'viem'
+import type { Address, JsonRpcAccount } from 'viem/accounts'
+import { Account as TempoAccount } from 'viem/tempo'
+
+import type { OneOf } from '../internal/types.js'
+import type * as core_Store from './Store.js'
+
+/** Account stored in the provider state. */
+export type Store = {
+  /** Account address. */
+  address: Address
+} & OneOf<
+  | {}
+  | Pick<TempoAccount.Account, 'keyType' | 'sign'>
+  | { keyType: 'secp256k1'; privateKey: Hex }
+  | { keyType: 'p256'; privateKey: Hex }
+  | { keyType: 'webAuthn'; credential: { id: string; publicKey: Hex; rpId: string } }
+  | {
+      keyType: 'webCrypto'
+      keyPair: Awaited<ReturnType<typeof WebCryptoP256.createKeyPair>>
+    }
+  | {
+      keyType: 'webAuthn_headless'
+      privateKey: Hex
+      rpId: string
+      origin: string
+    }
+>
+
+/** Access key entry stored alongside accounts. */
+export type AccessKey = {
+  /** Access key address. */
+  address: Address
+  /** Owner of the access key. */
+  access: Address
+  /** Unix timestamp when the access key expires. */
+  expiry?: number | undefined
+  /** Signed key authorization to attach to the first transaction. Consumed on use. */
+  keyAuthorization?: KeyAuthorization.Signed | undefined
+  /** The WebCrypto key pair backing the access key. Only present for locally-generated keys. */
+  keyPair?: Awaited<ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined
+  /** Key type. */
+  keyType: 'secp256k1' | 'p256' | 'webAuthn' | 'webCrypto'
+  /** TIP-20 spending limits for the access key. */
+  limits?: { token: Address; limit: bigint }[] | undefined
+}
+
+/** Resolves a viem Account from the store by address (or active account). */
+export function find(options: find.Options & { signable: true }): TempoAccount.Account
+export function find(options: find.Options): TempoAccount.Account | JsonRpcAccount
+export function find(options: find.Options): TempoAccount.Account | JsonRpcAccount {
+  const { accessKey = true, address, signable = false, store } = options
+  const { accessKeys, accounts, activeAccount } = store.getState()
+
+  const activeAddr = accounts[activeAccount]?.address
+  const root = address
+    ? accounts.find((a) => a.address === address)
+    : accounts.find((a) => a.address === activeAddr)
+  if (!root)
+    throw address
+      ? new Provider.UnauthorizedError({ message: `Account "${address}" not found.` })
+      : new Provider.DisconnectedError({ message: 'No active account.' })
+
+  // When accessKey is requested, prefer a locally-signable access key for this address.
+  if (accessKey) {
+    const key = accessKeys.find(
+      (a) => a.access.toLowerCase() === root.address.toLowerCase() && a.keyPair,
+    )
+    if (key) {
+      // Remove expired access keys.
+      if (key.expiry && key.expiry < Date.now() / 1000)
+        store.setState({ accessKeys: accessKeys.filter((a) => a !== key) })
+      else return hydrateAccessKey(key) as never
+    }
+  }
+
+  return hydrate(root, { signable }) as never
+}
+
+export declare namespace find {
+  type Options = {
+    /** Whether to resolve an access key for this account. @default true */
+    accessKey?: boolean | undefined
+    /** Address to resolve. Defaults to the active account. */
+    address?: Address | undefined
+    /** Whether to hydrate signing capability. @default false */
+    signable?: boolean | undefined
+    /** Reactive state store. */
+    store: core_Store.Store
+  }
+}
+
+/** Overloaded signature for `find` without `store` (pre-bound by the provider). */
+export type Find = {
+  (options: Omit<find.Options, 'store'> & { signable: true }): TempoAccount.Account
+  (options?: Omit<find.Options, 'store'>): TempoAccount.Account | JsonRpcAccount
+}
+
+/** Hydrates an access key entry to a viem Account. Only works for locally-generated keys with a `keyPair`. */
+export function hydrateAccessKey(accessKey: AccessKey): TempoAccount.Account {
+  if (!accessKey.keyPair)
+    throw new Provider.UnauthorizedError({
+      message: 'External access key cannot be hydrated for signing.',
+    })
+  return TempoAccount.fromWebCryptoP256(accessKey.keyPair, { access: accessKey.access })
+}
+
+/** Hydrates a store account to a viem Account. */
+export function hydrate(account: Store, options: { signable: true }): TempoAccount.Account
+export function hydrate(
+  account: Store,
+  options?: hydrate.Options,
+): TempoAccount.Account | JsonRpcAccount
+export function hydrate(
+  account: Store,
+  options: hydrate.Options = {},
+): TempoAccount.Account | JsonRpcAccount {
+  const { signable = false } = options
+  if (!signable) return { address: account.address, type: 'json-rpc' }
+  if ('sign' in account && typeof account.sign === 'function')
+    return account as TempoAccount.Account
+  if (!account.keyType)
+    throw new Provider.UnauthorizedError({ message: `Account "${account.address}" cannot sign.` })
+  switch (account.keyType) {
+    case 'secp256k1':
+      return TempoAccount.fromSecp256k1(account.privateKey)
+    case 'p256':
+      return TempoAccount.fromP256(account.privateKey)
+    case 'webCrypto':
+      return TempoAccount.fromWebCryptoP256(account.keyPair)
+    case 'webAuthn':
+      return TempoAccount.fromWebAuthnP256(account.credential, {
+        rpId: account.credential.rpId,
+      })
+    case 'webAuthn_headless':
+      return TempoAccount.fromHeadlessWebAuthn(account.privateKey, {
+        rpId: account.rpId,
+        origin: account.origin,
+      })
+    default:
+      throw new Provider.UnauthorizedError({ message: 'Unknown key type.' })
+  }
+}
+
+export declare namespace hydrate {
+  type Options = {
+    /** Whether to hydrate signing capability. @default false */
+    signable?: boolean | undefined
+  }
+}

package/src/core/Adapter.ts

@@ -0,0 +1,238 @@
+import type { KeyAuthorization } from 'ox/tempo'
+import type { Client, Hex, Transport } from 'viem'
+import type { Address } from 'viem/accounts'
+import type { tempo } from 'viem/chains'
+
+import type * as Account from './Account.js'
+import type * as Schema from './Schema.js'
+import type * as Storage from './Storage.js'
+import type * as Store from './Store.js'
+import type * as Rpc from './zod/rpc.js'
+
+/** Wire-format request (method + params) for a given RPC schema item. */
+type EncodedRequest<encoded extends { method: unknown; params: unknown }> = Pick<
+  encoded,
+  'method' | 'params'
+>
+
+/** Adapter interface for the provider. */
+export type Adapter = SetupFn & Meta
+
+/** The setup function an adapter must implement. */
+export type SetupFn = (params: SetupFn.Parameters) => Instance
+
+/** Static metadata attached to an adapter function. */
+export type Meta = {
+  /** Data URI of the provider icon. @default Black 1×1 SVG. */
+  icon?: `data:image/${string}` | undefined
+  /** Display name of the provider (e.g. `"My Wallet"`). @default "Injected Wallet" */
+  name?: string | undefined
+  /** Reverse DNS identifier (e.g. `"com.example.mywallet"`). @default `com.{lowercase name}` */
+  rdns?: string | undefined
+}
+
+export type Instance = {
+  /** Adapter actions dispatched by the provider's `request()` method. */
+  actions: {
+    /** Grant an access key for the active account. */
+    authorizeAccessKey?:
+      | ((
+          params: authorizeAccessKey.Parameters,
+          request: EncodedRequest<Rpc.wallet_authorizeAccessKey.Encoded>,
+        ) => Promise<authorizeAccessKey.ReturnType>)
+      | undefined
+    /** Create a new account (e.g. WebAuthn registration). */
+    createAccount: (
+      params: createAccount.Parameters,
+      request: EncodedRequest<Rpc.wallet_connect.Encoded>,
+    ) => Promise<createAccount.ReturnType>
+    /** Disconnect hook for adapter-specific cleanup. */
+    disconnect?: (() => Promise<void>) | undefined
+    /** Discover existing accounts (e.g. WebAuthn assertion). */
+    loadAccounts: (
+      params: loadAccounts.Parameters | undefined,
+      request: EncodedRequest<Rpc.wallet_connect.Encoded>,
+    ) => Promise<loadAccounts.ReturnType>
+    /** Revoke an access key. */
+    revokeAccessKey?:
+      | ((
+          params: revokeAccessKey.Parameters,
+          request: EncodedRequest<Rpc.wallet_revokeAccessKey.Encoded>,
+        ) => Promise<void>)
+      | undefined
+    /** Send a transaction. */
+    sendTransaction: (
+      params: sendTransaction.Parameters,
+      request: EncodedRequest<Rpc.eth_sendTransaction.Encoded>,
+    ) => Promise<sendTransaction.ReturnType>
+    /** Send a transaction and wait for the receipt. */
+    sendTransactionSync: (
+      params: sendTransactionSync.Parameters,
+      request: EncodedRequest<Rpc.eth_sendTransactionSync.Encoded>,
+    ) => Promise<sendTransactionSync.ReturnType>
+    /** Sign a personal message (EIP-191). */
+    signPersonalMessage: (
+      params: signPersonalMessage.Parameters,
+      request: EncodedRequest<Rpc.personal_sign.Encoded>,
+    ) => Promise<Hex>
+    /** Sign a transaction without broadcasting it. */
+    signTransaction: (
+      params: signTransaction.Parameters,
+      request: EncodedRequest<Rpc.eth_signTransaction.Encoded>,
+    ) => Promise<signTransaction.ReturnType>
+    /** Sign EIP-712 typed data. */
+    signTypedData: (
+      params: signTypedData.Parameters,
+      request: EncodedRequest<Rpc.eth_signTypedData_v4.Encoded>,
+    ) => Promise<Hex>
+    /** Switch chain hook for adapter-specific handling. */
+    switchChain?: ((params: switchChain.Parameters) => Promise<void>) | undefined
+  }
+  /** Cleanup function called when the provider is destroyed. */
+  cleanup?: (() => void) | undefined
+  /** When `true`, the provider merges new accounts onto existing ones instead of replacing. */
+  persistAccounts?: boolean | undefined
+}
+
+export declare namespace SetupFn {
+  /** Parameters passed to an adapter's setup function. */
+  export type Parameters = {
+    /** Returns the rehydrated local account for the given address, or the active account if omitted. */
+    getAccount: Account.Find
+    /** Get the viem client for a given chain ID. Defaults to the active chain. */
+    getClient: (options?: getClient.Options | undefined) => Client<Transport, typeof tempo>
+    /** Storage adapter used by the provider. */
+    storage: Storage.Storage
+    /** Reactive state store. */
+    store: Store.Store
+  }
+
+  /** Value returned from an adapter's setup function. */
+  export type ReturnType = Instance
+}
+
+/** Creates an adapter from metadata and a setup function. */
+export function define(meta: Meta, fn: SetupFn): Adapter {
+  const { name, ...rest } = meta
+  Object.defineProperty(fn, 'name', { value: name, configurable: true })
+  return Object.assign(fn, rest) as Adapter
+}
+
+/** Spreads decoded params. */
+export type ActionRequest<item extends Schema.Item> =
+  Schema.Decoded<item>['params'] extends readonly [infer first] ? first : never
+
+export declare namespace getClient {
+  type Options = {
+    /** Chain ID. Defaults to the active chain. */
+    chainId?: number | undefined
+    /** Fee payer service URL. */
+    feePayer?: string | undefined
+  }
+}
+
+export declare namespace createAccount {
+  type Parameters = {
+    /** Grant an access key during the ceremony. */
+    authorizeAccessKey?: authorizeAccessKey.Parameters | undefined
+    /** Digest to sign. */
+    digest?: Hex | undefined
+    /** Display name for the new account (e.g. credential name for WebAuthn). */
+    name: string
+    /** Opaque user identifier (e.g. for WebAuthn `user.id`). */
+    userId?: string | undefined
+  }
+  type ReturnType = {
+    accounts: readonly Store.Account[]
+    /** Signed key authorization, if an access key was granted. */
+    keyAuthorization?: authorizeAccessKey.ReturnType | undefined
+    /** Signature over the digest, if one was provided. */
+    signature?: Hex | undefined
+  }
+}
+
+export declare namespace loadAccounts {
+  type Parameters = {
+    /** Grant an access key during the ceremony. */
+    authorizeAccessKey?: authorizeAccessKey.Parameters | undefined
+    /** Credential ID to restrict authentication to a specific credential. */
+    credentialId?: string | undefined
+    /** Digest to sign. */
+    digest?: Hex | undefined
+    /** When `true`, prompts the user to pick from all available credentials instead of using the last-used one. */
+    selectAccount?: boolean | undefined
+  }
+  type ReturnType = {
+    /** Loaded accounts. */
+    accounts: readonly Store.Account[]
+    /** Signed key authorization, if an access key was granted. */
+    keyAuthorization?: authorizeAccessKey.ReturnType | undefined
+    /** Signature over the digest, if one was provided. */
+    signature?: Hex | undefined
+  }
+}
+
+export declare namespace signPersonalMessage {
+  type Parameters = {
+    /** Address of the account to sign with. */
+    address: Address
+    /** Hex-encoded message data. */
+    data: Hex
+  }
+}
+
+export declare namespace signTypedData {
+  type Parameters = {
+    /** Address of the account to sign with. */
+    address: Address
+    /** JSON-encoded EIP-712 typed data. */
+    data: string
+  }
+}
+
+export declare namespace authorizeAccessKey {
+  type Parameters = {
+    /** Access key address. Alternative to `publicKey` when the caller already knows the derived address. */
+    address?: Address | undefined
+    /** Unix timestamp (seconds) when the key expires. */
+    expiry: number
+    /** Key type of the external public key. Required when `publicKey` or `address` is provided. */
+    keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined
+    /** TIP-20 spending limits for this key. */
+    limits?: readonly { token: Address; limit: bigint }[] | undefined
+    /** External public key to authorize. When provided, no key pair is generated — the caller holds the signing material. */
+    publicKey?: Hex | undefined
+    /** Pre-computed signature over the key authorization digest (skips a second signing ceremony). */
+    signature?: Hex | undefined
+  }
+
+  type ReturnType = KeyAuthorization.Rpc
+}
+
+export declare namespace revokeAccessKey {
+  type Parameters = {
+    /** Root account address. */
+    address: Address
+    /** Address of the access key to revoke. */
+    accessKeyAddress: Address
+  }
+}
+
+export declare namespace sendTransaction {
+  type Parameters = ActionRequest<typeof Rpc.eth_sendTransaction.schema>
+  type ReturnType = Rpc.eth_sendTransaction.Encoded['returns']
+}
+
+export declare namespace sendTransactionSync {
+  type Parameters = ActionRequest<typeof Rpc.eth_sendTransactionSync.schema>
+  type ReturnType = Rpc.eth_sendTransactionSync.Encoded['returns']
+}
+
+export declare namespace signTransaction {
+  type Parameters = ActionRequest<typeof Rpc.eth_signTransaction.schema>
+  type ReturnType = Hex
+}
+
+export declare namespace switchChain {
+  type Parameters = { chainId: number }
+}

package/src/core/Ceremony.browser.test.ts

@@ -0,0 +1,239 @@
+import { describe, expect, test } from 'vp/test'
+import { Registration, Authentication } from 'webauthx/client'
+
+import { hooksUrl, url as webauthnUrl } from '../../test/webauthn.constants.js'
+import { webAuthn } from './adapters/webAuthn.js'
+import * as Ceremony from './Ceremony.js'
+import * as Provider from './Provider.js'
+import * as Storage from './Storage.js'
+
+describe('local', () => {
+  test('default: creates a passkey and verifies registration', async () => {
+    const ceremony = Ceremony.local()
+    const { options } = await ceremony.getRegistrationOptions({ name: 'Test' })
+    const credential = await Registration.create({ options })
+    const result = await ceremony.verifyRegistration(credential)
+
+    expect(result.publicKey).toMatch(/^0x[0-9a-f]+$/)
+    expect(result.credentialId).toBeTypeOf('string')
+  })
+
+  test('behavior: authenticates with an existing passkey', async () => {
+    const ceremony = Ceremony.local()
+    const { options: regOptions } = await ceremony.getRegistrationOptions({ name: 'Test' })
+    const credential = await Registration.create({ options: regOptions })
+    const { publicKey } = await ceremony.verifyRegistration(credential)
+
+    const { options: authOptions } = await ceremony.getAuthenticationOptions({
+      credentialId: credential.id,
+    })
+    const response = await Authentication.sign({ options: authOptions })
+    const result = await ceremony.verifyAuthentication(response)
+
+    expect(result.publicKey).toMatchInlineSnapshot(`"${publicKey}"`)
+    expect(result.credentialId).toBeTypeOf('string')
+  })
+
+  test('behavior: register → authenticate → publicKeys match', async () => {
+    const ceremony = Ceremony.local()
+    const { options: regOptions } = await ceremony.getRegistrationOptions({ name: 'Round-trip' })
+    const credential = await Registration.create({ options: regOptions })
+    const reg = await ceremony.verifyRegistration(credential)
+
+    const { options: authOptions } = await ceremony.getAuthenticationOptions({
+      credentialId: reg.credentialId,
+    })
+    const response = await Authentication.sign({ options: authOptions })
+    const auth = await ceremony.verifyAuthentication(response)
+
+    expect(auth.publicKey).toBe(reg.publicKey)
+    expect(auth.credentialId).toBe(reg.credentialId)
+  })
+})
+
+describe('server', () => {
+  const ceremony = Ceremony.server({ url: webauthnUrl })
+
+  test('default: register → verify returns valid publicKey hex', async () => {
+    const { options } = await ceremony.getRegistrationOptions({ name: 'Server Test' })
+    const credential = await Registration.create({ options })
+    const result = await ceremony.verifyRegistration(credential)
+
+    expect(result.credentialId).toBeTypeOf('string')
+    expect(result.publicKey).toMatch(/^0x[0-9a-f]+$/)
+  })
+
+  test('behavior: authentication publicKeys match registration', async () => {
+    const { options: regOptions } = await ceremony.getRegistrationOptions({ name: 'Server Auth' })
+    const credential = await Registration.create({ options: regOptions })
+    const reg = await ceremony.verifyRegistration(credential)
+
+    const { options: authOptions } = await ceremony.getAuthenticationOptions({
+      credentialId: reg.credentialId,
+    })
+    const response = await Authentication.sign({ options: authOptions })
+    const auth = await ceremony.verifyAuthentication(response)
+
+    expect(auth.publicKey).toBe(reg.publicKey)
+    expect(auth.credentialId).toBe(reg.credentialId)
+  })
+
+  test('behavior: challenge consumed after use (replay → 400)', async () => {
+    const { options } = await ceremony.getRegistrationOptions({ name: 'Replay Test' })
+    const credential = await Registration.create({ options })
+
+    // First verify succeeds
+    const result = await ceremony.verifyRegistration(credential)
+    expect(result.credentialId).toBeTypeOf('string')
+
+    // Replay same credential → 400 (challenge consumed)
+    const response = await fetch(`${webauthnUrl}/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    })
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.error).toMatchInlineSnapshot(`"Missing or expired challenge"`)
+  })
+
+  test('behavior: multiple credentials return correct publicKeys', async () => {
+    const { options: regA } = await ceremony.getRegistrationOptions({ name: 'User A' })
+    const credA = await Registration.create({ options: regA })
+    const a = await ceremony.verifyRegistration(credA)
+
+    const { options: regB } = await ceremony.getRegistrationOptions({ name: 'User B' })
+    const credB = await Registration.create({ options: regB })
+    const b = await ceremony.verifyRegistration(credB)
+
+    expect(a.publicKey).not.toBe(b.publicKey)
+
+    // Login with credential A
+    const { options: authA } = await ceremony.getAuthenticationOptions({
+      credentialId: a.credentialId,
+    })
+    const resA = await Authentication.sign({ options: authA })
+    const authResultA = await ceremony.verifyAuthentication(resA)
+    expect(authResultA.publicKey).toBe(a.publicKey)
+
+    // Login with credential B
+    const { options: authB } = await ceremony.getAuthenticationOptions({
+      credentialId: b.credentialId,
+    })
+    const resB = await Authentication.sign({ options: authB })
+    const authResultB = await ceremony.verifyAuthentication(resB)
+    expect(authResultB.publicKey).toBe(b.publicKey)
+  })
+})
+
+describe('server (provider round-trip)', () => {
+  const ceremony = Ceremony.server({ url: webauthnUrl })
+
+  function createProvider() {
+    return Provider.create({
+      storage: Storage.idb({ key: crypto.randomUUID() }),
+      adapter: webAuthn({ ceremony }),
+    })
+  }
+
+  test('behavior: wallet_connect register → eth_accounts returns address', async () => {
+    const provider = createProvider()
+
+    const result = await provider.request({
+      method: 'wallet_connect',
+      params: [{ capabilities: { method: 'register' } }],
+    })
+
+    expect(result.accounts).toHaveLength(1)
+    expect(result.accounts[0]!.address).toMatch(/^0x[0-9a-fA-F]{40}$/)
+
+    const accounts = await provider.request({ method: 'eth_accounts' })
+    expect(accounts).toHaveLength(1)
+    expect(accounts[0]).toBe(result.accounts[0]!.address)
+  })
+
+  test('behavior: register two accounts → eth_accounts returns both', async () => {
+    const provider = createProvider()
+
+    // Register first
+    const first = await provider.request({
+      method: 'wallet_connect',
+      params: [{ capabilities: { method: 'register' } }],
+    })
+
+    // Register second
+    const second = await provider.request({
+      method: 'wallet_connect',
+      params: [{ capabilities: { method: 'register' } }],
+    })
+
+    expect(second.accounts).toHaveLength(2)
+    expect(second.accounts[0]!.address).not.toBe(first.accounts[0]!.address)
+
+    const accounts = await provider.request({ method: 'eth_accounts' })
+    expect(accounts).toHaveLength(2)
+  })
+})
+
+describe('server (hooks)', () => {
+  test('behavior: onRegister merges extra JSON and headers', async () => {
+    const regOptionsRes = await fetch(`${hooksUrl}/register/options`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: 'Hook Test' }),
+    })
+    const { options } = await regOptionsRes.json()
+    const credential = await Registration.create({ options })
+
+    const res = await fetch(`${hooksUrl}/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    })
+
+    const body = await res.json()
+    expect(body.credentialId).toBeTypeOf('string')
+    expect(body.publicKey).toMatch(/^0x[0-9a-f]+$/)
+    expect(body.sessionToken).toBe(`reg_${body.credentialId}`)
+    expect(res.headers.get('x-custom')).toBe('register-hook')
+  })
+
+  test('behavior: onAuthenticate merges extra JSON and headers', async () => {
+    // Register first
+    const regOptionsRes = await fetch(`${hooksUrl}/register/options`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: 'Hook Auth Test' }),
+    })
+    const { options: regOptions } = await regOptionsRes.json()
+    const credential = await Registration.create({ options: regOptions })
+
+    const regRes = await fetch(`${hooksUrl}/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(credential),
+    })
+    const { credentialId } = await regRes.json()
+
+    // Authenticate
+    const authOptionsRes = await fetch(`${hooksUrl}/login/options`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credentialId }),
+    })
+    const { options: authOptions } = await authOptionsRes.json()
+    const response = await Authentication.sign({ options: authOptions })
+
+    const res = await fetch(`${hooksUrl}/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(response),
+    })
+
+    const body = await res.json()
+    expect(body.credentialId).toBe(credentialId)
+    expect(body.publicKey).toMatch(/^0x[0-9a-f]+$/)
+    expect(body.sessionToken).toBe(`auth_${credentialId}`)
+    expect(res.headers.get('x-custom')).toBe('authenticate-hook')
+  })
+})