agentplugged 0.0.0-stage → 1.0.0

package/dist/rolldown-runtime.js

@@ -0,0 +1,38 @@
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+export { __toCommonJS as a, __require as i, __esmMin as n, __exportAll as r, __commonJSMin as t };

package/dist/webauthn-verify.js

@@ -0,0 +1 @@
+export { n as verifyWebAuthn } from "./webauthn-verify2.js";

package/dist/webauthn-verify2.js

@@ -0,0 +1,107 @@
+import { Po as SIGNATURE_REASON, a as sha256, d as utf8, l as toBase64url, n as WEBAUTHN_RP_ID, s as fromBase64url, t as WEBAUTHN_ORIGIN } from "./webauthn.js";
+//#region ../../packages/crypto/dist/webauthn-verify.js
+/** COSE algorithm of each WebAuthn `alg`. */
+const COSE_ALG = {
+	"webauthn-es256": -7,
+	"webauthn-rs256": -257
+};
+/** Authenticator data flags (WebAuthn §6.1). */
+const FLAG_UV = 4;
+/** rpIdHash (32) + flags (1) + signCount (4). */
+const AUTHENTICATOR_DATA_MIN = 37;
+function equal(a, b) {
+	return a.length === b.length && a.every((byte, index) => byte === b[index]);
+}
+const fail = (reason) => ({
+	ok: false,
+	reason
+});
+/**
+* Checks a WebAuthn assertion over `challenge`: credential algorithm, client data (type,
+* origin, challenge), relying party, UV flag, signature counter, then the signature with
+* `@simplewebauthn/server`. Returns the new counter, to store with the credential.
+*/
+async function verifyWebAuthn(alg, sig, challenge, credential) {
+	const { decodeCredentialPublicKey, cose } = await import("./helpers2.js");
+	try {
+		if (decodeCredentialPublicKey(new Uint8Array(credential.publicKey)).get(cose.COSEKEYS.alg) !== COSE_ALG[alg]) return fail(SIGNATURE_REASON.algMismatch);
+	} catch {
+		return fail(SIGNATURE_REASON.algMismatch);
+	}
+	const clientDataBytes = fromBase64url(sig.clientDataJSON);
+	const authenticatorData = fromBase64url(sig.authenticatorData);
+	if (clientDataBytes === void 0 || authenticatorData === void 0) return fail(SIGNATURE_REASON.clientDataMismatch);
+	let clientData;
+	try {
+		clientData = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(clientDataBytes));
+	} catch {
+		return fail(SIGNATURE_REASON.clientDataMismatch);
+	}
+	if (typeof clientData !== "object" || clientData === null || clientData.type !== "webauthn.get" || clientData.origin !== WEBAUTHN_ORIGIN) return fail(SIGNATURE_REASON.clientDataMismatch);
+	const expectedChallenge = toBase64url(challenge);
+	if (clientData.challenge !== expectedChallenge) return fail(SIGNATURE_REASON.challengeMismatch);
+	if (authenticatorData.length < AUTHENTICATOR_DATA_MIN || !equal(authenticatorData.subarray(0, 32), sha256(utf8("agentplugged.local")))) return fail(SIGNATURE_REASON.clientDataMismatch);
+	if (((authenticatorData[32] ?? 0) & FLAG_UV) === 0) return fail(SIGNATURE_REASON.uvMissing);
+	const counter = new DataView(authenticatorData.buffer, authenticatorData.byteOffset, authenticatorData.byteLength).getUint32(33);
+	const stored = credential.counter ?? 0;
+	if ((stored > 0 || counter > 0) && counter <= stored) return fail(SIGNATURE_REASON.counterRegression);
+	const { verifyAuthenticationResponse } = await import("./esm.js");
+	try {
+		const result = await verifyAuthenticationResponse({
+			response: {
+				id: credential.id,
+				rawId: credential.id,
+				type: "public-key",
+				response: {
+					authenticatorData: sig.authenticatorData,
+					clientDataJSON: sig.clientDataJSON,
+					signature: sig.signature
+				},
+				clientExtensionResults: {}
+			},
+			expectedChallenge,
+			expectedOrigin: WEBAUTHN_ORIGIN,
+			expectedRPID: WEBAUTHN_RP_ID,
+			credential: {
+				id: credential.id,
+				publicKey: new Uint8Array(credential.publicKey),
+				counter: stored
+			},
+			requireUserVerification: true
+		});
+		return result.verified && result.authenticationInfo.userVerified ? {
+			ok: true,
+			newCounter: result.authenticationInfo.newCounter
+		} : fail(SIGNATURE_REASON.signatureMismatch);
+	} catch {
+		return fail(SIGNATURE_REASON.signatureMismatch);
+	}
+}
+/**
+* The credential a platform authenticator created, read from its attestation object (CBOR): the
+* attested credential data of its authenticator data. The attestation statement is not checked
+* (attestation `none`): the credential proves itself when it signs `human.presence_linked`.
+* Undefined when the object is unreadable, made for another relying party, without user
+* verification, or of an algorithm other than ES256 and RS256.
+*/
+async function parsePresenceAttestation(attestationObject) {
+	const { decodeAttestationObject, parseAuthenticatorData, decodeCredentialPublicKey, cose } = await import("./helpers2.js");
+	try {
+		const parsed = parseAuthenticatorData(decodeAttestationObject(new Uint8Array(attestationObject)).get("authData"));
+		if (!equal(parsed.rpIdHash, sha256(utf8("agentplugged.local"))) || !parsed.flags.uv) return void 0;
+		const { credentialID, credentialPublicKey } = parsed;
+		if (credentialID === void 0 || credentialPublicKey === void 0) return void 0;
+		const algId = decodeCredentialPublicKey(credentialPublicKey).get(cose.COSEKEYS.alg);
+		const alg = Object.keys(COSE_ALG).find((name) => COSE_ALG[name] === algId);
+		if (alg === void 0) return void 0;
+		return {
+			credential_id: toBase64url(credentialID),
+			cose_public_key: toBase64url(credentialPublicKey),
+			alg
+		};
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { verifyWebAuthn as n, parsePresenceAttestation as t };