decane-connect-kit 2.12.1 → 2.14.0

package/dist/index.d.cts

@@ -506,11 +506,13 @@ interface DecaneConnect {
     off(event: SdkEvent, handler: (...args: unknown[]) => void): void;
 }
 interface WrappedShareMeta {
-    unlockMethod: 'passkey' | 'pin';
+    unlockMethod: 'passkey' | 'pin' | 'password';
     credentialId?: string;
     prfSalt?: string;
     pinSalt?: string;
     pinIterations?: number;
+    passwordSalt?: string;
+    passwordIterations?: number;
 }
 /**
  * Who the user is, as the identity provider just described them.

package/dist/index.d.ts

@@ -506,11 +506,13 @@ interface DecaneConnect {
     off(event: SdkEvent, handler: (...args: unknown[]) => void): void;
 }
 interface WrappedShareMeta {
-    unlockMethod: 'passkey' | 'pin';
+    unlockMethod: 'passkey' | 'pin' | 'password';
     credentialId?: string;
     prfSalt?: string;
     pinSalt?: string;
     pinIterations?: number;
+    passwordSalt?: string;
+    passwordIterations?: number;
 }
 /**
  * Who the user is, as the identity provider just described them.

package/dist/index.js

@@ -2886,9 +2886,6 @@ async function deriveKeyFromPin(pin, salt) {
     ["encrypt", "decrypt"]
   );
 }
-function validatePin(pin) {
-  if (!/^\d{4,8}$/.test(pin)) throw new Error("PIN must be 4\u20138 digits");
-}
 
 // src/social/crypto/passkey.ts
 init_errors();
@@ -3702,21 +3699,38 @@ async function createDecaneConnect(config) {
     }
   }
   events.on("session-expired", () => dropLiveSession());
-  async function pinSetup() {
-    if (!config.promptPin) throw new PromptPinNotConfiguredError();
-    const pin = await config.promptPin();
-    validatePin(pin);
-    const pinSalt = generateRandomBytes(32);
-    const wrappingKey = await deriveKeyFromPin(pin, pinSalt);
+  async function passwordSetup() {
+    if (!config.promptUnlockPassword) throw new PromptPasswordNotConfiguredError();
+    const password = await config.promptUnlockPassword({ kind: "set" });
+    validateUnlockPassword(password);
+    const passwordSalt = generateRandomBytes(32);
+    const { shareKey, tokenKey } = await derivePasswordKeys(password, passwordSalt);
     return {
-      wrappingKey,
+      wrappingKey: shareKey,
+      tokenKey,
       meta: {
-        unlockMethod: "pin",
-        pinSalt: bufferToB64u(pinSalt),
-        pinIterations: 6e5
+        unlockMethod: "password",
+        passwordSalt: bufferToB64u(passwordSalt),
+        passwordIterations: PBKDF2_ITERATIONS
       }
     };
   }
+  async function attachUnlockToken(userId, jwt, tokenKey) {
+    try {
+      const stored = await storage.getShare(userId);
+      if (!stored) return;
+      const { token } = await api.issueUnlockToken(jwt);
+      const unlockTokenIv = generateRandomBytes(12);
+      const wrappedUnlockToken = await aesGcmEncrypt(
+        tokenKey,
+        new TextEncoder().encode(token),
+        unlockTokenIv
+      );
+      await storage.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+    } catch (e) {
+      console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
+    }
+  }
   async function persistRotatedDeviceShare(userId, deviceShare) {
     const stored = await storage.getShare(userId);
     if (!stored) {
@@ -3773,13 +3787,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+    const existing = await storage.getShare(userId);
     await storage.putShare({
+      ...existing,
       userId,
       wrappedDeviceShare,
       iv,
       unlockMethod: "passkey",
       credentialId,
       prfSalt,
+      pinSalt: void 0,
+      pinIterations: void 0,
+      passwordSalt: void 0,
+      passwordIterations: void 0,
+      wrappedUnlockToken: void 0,
+      unlockTokenIv: void 0,
       version: 1
     });
     try {
@@ -3805,11 +3827,44 @@ async function createDecaneConnect(config) {
       );
     }
   }
+  async function persistProvisionedShare(userId, jwt, deviceShare) {
+    if (isPasskeySupported()) {
+      try {
+        await registerPasskeyForDevice(userId, jwt, deviceShare);
+        return;
+      } catch (e) {
+        console.warn(
+          "decane-connect-kit: passkey provisioning failed; falling back to an unlock password so the share is still stored.",
+          e
+        );
+      }
+    }
+    if (!config.promptUnlockPassword) {
+      console.error(
+        "decane-connect-kit: this device could not store its share \u2014 no passkey and no promptUnlockPassword. The session works, but every visit will re-provision and no unlock will be offered. Configure promptUnlockPassword."
+      );
+      return;
+    }
+    const { wrappingKey, tokenKey, meta } = await passwordSetup();
+    const iv = generateRandomBytes(12);
+    const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+    await storage.putShare({
+      userId,
+      wrappedDeviceShare,
+      iv,
+      unlockMethod: "password",
+      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+      passwordIterations: meta.passwordIterations,
+      version: 1
+    });
+    await attachUnlockToken(userId, jwt, tokenKey);
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
     let wrappingKey;
     let meta = {};
+    let unlockTokenKey = null;
     if (isPasskeySupported()) {
       const prfSalt = generateRandomBytes(32);
       try {
@@ -3823,18 +3878,18 @@ async function createDecaneConnect(config) {
             prfSalt: bufferToB64u(prfSalt)
           };
         } else {
-          ({ wrappingKey, meta } = await pinSetup());
-          unlockMethod = "pin";
+          ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+          unlockMethod = "password";
         }
       } catch (e) {
         if (e.name === "UserCancelledError")
           throw new UserCancelledError();
-        ({ wrappingKey, meta } = await pinSetup());
-        unlockMethod = "pin";
+        ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+        unlockMethod = "password";
       }
     } else {
-      ({ wrappingKey, meta } = await pinSetup());
-      unlockMethod = "pin";
+      ({ wrappingKey, meta, tokenKey: unlockTokenKey } = await passwordSetup());
+      unlockMethod = "password";
     }
     const provisioningStartedAt = Date.now();
     const remainingBudget = () => PROVISIONING_BUDGET_MS - (Date.now() - provisioningStartedAt);
@@ -3866,8 +3921,11 @@ async function createDecaneConnect(config) {
       prfSalt: meta.prfSalt ? b64uToBuffer(meta.prfSalt) : void 0,
       pinSalt: meta.pinSalt ? b64uToBuffer(meta.pinSalt) : void 0,
       pinIterations: meta.pinIterations,
+      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+      passwordIterations: meta.passwordIterations,
       version: 1
     });
+    if (unlockTokenKey) await attachUnlockToken(userId, jwt, unlockTokenKey);
     const serverIv = generateRandomBytes(12);
     await withDeadline(api.putShare(jwt, {
       ciphertext: shareSet.server,
@@ -3965,8 +4023,7 @@ async function createDecaneConnect(config) {
           const tee = new TeeClient(teeUrl);
           const provisioned = await tee.provisionDeviceShare(jwt);
           if (provisioned) {
-            await registerPasskeyAndBackup(userId, jwt, provisioned).catch(() => {
-            });
+            await persistProvisionedShare(userId, jwt, provisioned);
             let addrs;
             try {
               addrs = await session.start(provisioned, jwt, recordedAddresses);
@@ -4096,6 +4153,12 @@ async function createDecaneConnect(config) {
     const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
+  async function canOfferPasskey() {
+    if (!isPasskeySupported()) return false;
+    if (await passkeyDeviceCandidate()) return true;
+    if (!persisted?.userId) return false;
+    return await storage.getShare(persisted.userId) == null;
+  }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
@@ -4111,6 +4174,28 @@ async function createDecaneConnect(config) {
     if (!stored.credentialId || !stored.prfSalt) return null;
     return stored;
   }
+  async function passkeyLoginWithoutShare(userId) {
+    events.emit("wallet-unlocking");
+    const options = await api.getWebAuthnLoginOptions(userId, rpId);
+    if (!options) throw new NewDeviceError();
+    const { response } = await authenticateWithPasskey({
+      optionsJSON: options,
+      prfSalt: generateRandomBytes(32)
+    });
+    const result = await api.postWebAuthnLogin(userId, response, window.location.origin);
+    const addresses = await returningUserUnlock(userId, result.jwt);
+    auth = { jwt: result.jwt, userId, addresses };
+    persisted = { userId, addresses };
+    savePersisted(PERSIST_KEY, persisted);
+    events.emit("connected");
+    persistLiveSession();
+    const stored = await storage.getShare(userId);
+    return {
+      addresses,
+      isNewUser: false,
+      ...stored?.profile ? { profile: stored.profile } : {}
+    };
+  }
   async function passkeyLogin(stored) {
     const userId = stored.userId;
     events.emit("wallet-unlocking");
@@ -4270,12 +4355,15 @@ async function createDecaneConnect(config) {
       return handleAuthResult(result);
     },
     async canSignInWithPasskey() {
-      return await passkeyDeviceCandidate() !== null;
+      return canOfferPasskey();
     },
     async signInWithPasskey() {
       const candidate = await passkeyDeviceCandidate();
-      if (!candidate) throw new NewDeviceError();
-      return passkeyLogin(candidate);
+      if (candidate) return passkeyLogin(candidate);
+      if (isPasskeySupported() && persisted?.userId && await storage.getShare(persisted.userId) == null) {
+        return passkeyLoginWithoutShare(persisted.userId);
+      }
+      throw new NewDeviceError();
     },
     /**
      * Turn on "unlock with your password" for this device.