decane-connect-kit 2.12.1 → 2.13.0

package/dist/index.cjs

@@ -2968,9 +2968,6 @@ async function deriveKeyFromPin(pin, salt) {
     ["encrypt", "decrypt"]
   );
 }
-function validatePin(pin) {
-  if (!/^\d{4,8}$/.test(pin)) throw new Error("PIN must be 4\u20138 digits");
-}
 
 // src/social/crypto/passkey.ts
 var import_browser2 = require("@simplewebauthn/browser");
@@ -3784,21 +3781,38 @@ async function createDecaneConnect(config) {
     }
   }
   events.on("session-expired", () => dropLiveSession());
-  async function pinSetup() {
-    if (!config.promptPin) throw new PromptPinNotConfiguredError();
-    const pin = await config.promptPin();
-    validatePin(pin);
-    const pinSalt = generateRandomBytes(32);
-    const wrappingKey = await deriveKeyFromPin(pin, pinSalt);
+  async function passwordSetup() {
+    if (!config.promptUnlockPassword) throw new PromptPasswordNotConfiguredError();
+    const password = await config.promptUnlockPassword({ kind: "set" });
+    validateUnlockPassword(password);
+    const passwordSalt = generateRandomBytes(32);
+    const { shareKey, tokenKey } = await derivePasswordKeys(password, passwordSalt);
     return {
-      wrappingKey,
+      wrappingKey: shareKey,
+      tokenKey,
       meta: {
-        unlockMethod: "pin",
-        pinSalt: bufferToB64u(pinSalt),
-        pinIterations: 6e5
+        unlockMethod: "password",
+        passwordSalt: bufferToB64u(passwordSalt),
+        passwordIterations: PBKDF2_ITERATIONS
       }
     };
   }
+  async function attachUnlockToken(userId, jwt, tokenKey) {
+    try {
+      const stored = await storage.getShare(userId);
+      if (!stored) return;
+      const { token } = await api.issueUnlockToken(jwt);
+      const unlockTokenIv = generateRandomBytes(12);
+      const wrappedUnlockToken = await aesGcmEncrypt(
+        tokenKey,
+        new TextEncoder().encode(token),
+        unlockTokenIv
+      );
+      await storage.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+    } catch (e) {
+      console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
+    }
+  }
   async function persistRotatedDeviceShare(userId, deviceShare) {
     const stored = await storage.getShare(userId);
     if (!stored) {
@@ -3892,6 +3906,7 @@ async function createDecaneConnect(config) {
     let unlockMethod;
     let wrappingKey;
     let meta = {};
+    let unlockTokenKey = null;
     if (isPasskeySupported()) {
       const prfSalt = generateRandomBytes(32);
       try {
@@ -3905,18 +3920,18 @@ async function createDecaneConnect(config) {
             prfSalt: bufferToB64u(prfSalt)
           };
         } else {
-          ({ wrappingKey, meta } = await pinSetup());
-          unlockMethod = "pin";
+          ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+          unlockMethod = "password";
         }
       } catch (e) {
         if (e.name === "UserCancelledError")
           throw new UserCancelledError();
-        ({ wrappingKey, meta } = await pinSetup());
-        unlockMethod = "pin";
+        ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+        unlockMethod = "password";
       }
     } else {
-      ({ wrappingKey, meta } = await pinSetup());
-      unlockMethod = "pin";
+      ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+      unlockMethod = "password";
     }
     const provisioningStartedAt = Date.now();
     const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
@@ -3948,8 +3963,11 @@ async function createDecaneConnect(config) {
       prfSalt: meta.prfSalt ? b64uToBuffer(meta.prfSalt) : void 0,
       pinSalt: meta.pinSalt ? b64uToBuffer(meta.pinSalt) : void 0,
       pinIterations: meta.pinIterations,
+      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+      passwordIterations: meta.passwordIterations,
       version: 1
     });
+    if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
     const serverIv = generateRandomBytes(12);
     await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,