decane-connect-kit 2.13.0 → 2.15.0

package/dist/index.cjs

@@ -2887,7 +2887,7 @@ var PBKDF2_ITERATIONS = 6e5;
 function buf2(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
-var MIN_PASSWORD_LENGTH = 12;
+var MIN_PASSWORD_LENGTH = 8;
 var TOO_PREDICTABLE = [
   /^(.)\1+$/,
   // one repeated character
@@ -3869,13 +3869,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+    const existing = await storage.getShare(userId);
     await storage.putShare({
+      ...existing,
       userId,
       wrappedDeviceShare,
       iv,
       unlockMethod: "passkey",
       credentialId,
       prfSalt,
+      pinSalt: void 0,
+      pinIterations: void 0,
+      passwordSalt: void 0,
+      passwordIterations: void 0,
+      wrappedUnlockToken: void 0,
+      unlockTokenIv: void 0,
       version: 1
     });
     try {
@@ -3901,6 +3909,38 @@ async function createDecaneConnect(config) {
       );
     }
   }
+  async function persistProvisionedShare(userId, jwt, deviceShare) {
+    if (isPasskeySupported()) {
+      try {
+        await registerPasskeyForDevice(userId, jwt, deviceShare);
+        return;
+      } catch (e) {
+        console.warn(
+          "decane-connect-kit: passkey provisioning failed; falling back to an unlock password so the share is still stored.",
+          e
+        );
+      }
+    }
+    if (!config.promptUnlockPassword) {
+      console.error(
+        "decane-connect-kit: this device could not store its share \u2014 no passkey and no promptUnlockPassword. The session works, but every visit will re-provision and no unlock will be offered. Configure promptUnlockPassword."
+      );
+      return;
+    }
+    const { wrappingKey, tokenKey, meta } = await passwordSetup();
+    const iv = generateRandomBytes(12);
+    const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+    await storage.putShare({
+      userId,
+      wrappedDeviceShare,
+      iv,
+      unlockMethod: "password",
+      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+      passwordIterations: meta.passwordIterations,
+      version: 1
+    });
+    await attachUnlockToken(userId, jwt, tokenKey);
+  }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);
     let unlockMethod;
@@ -4065,8 +4105,7 @@ async function createDecaneConnect(config) {
           const tee = new TeeClient(teeUrl);
           const provisioned = await tee.provisionDeviceShare(jwt);
           if (provisioned) {
-            await registerPasskeyAndBackup(userId, jwt, provisioned).catch(() => {
-            });
+            await persistProvisionedShare(userId, jwt, provisioned);
             let addrs;
             try {
               addrs = await session.start(provisioned, jwt, recordedAddresses);
@@ -4196,6 +4235,12 @@ async function createDecaneConnect(config) {
     const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
+  async function canOfferPasskey() {
+    if (!isPasskeySupported()) return false;
+    if (await passkeyDeviceCandidate()) return true;
+    if (!persisted?.userId) return false;
+    return await storage.getShare(persisted.userId) == null;
+  }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
@@ -4211,6 +4256,28 @@ async function createDecaneConnect(config) {
     if (!stored.credentialId || !stored.prfSalt) return null;
     return stored;
   }
+  async function passkeyLoginWithoutShare(userId) {
+    events.emit("wallet-unlocking");
+    const options = await api.getWebAuthnLoginOptions(userId, rpId);
+    if (!options) throw new NewDeviceError();
+    const { response } = await authenticateWithPasskey({
+      optionsJSON: options,
+      prfSalt: generateRandomBytes(32)
+    });
+    const result = await api.postWebAuthnLogin(userId, response, window.location.origin);
+    const addresses = await returningUserUnlock(userId, result.jwt);
+    auth = { jwt: result.jwt, userId, addresses };
+    persisted = { userId, addresses };
+    savePersisted(PERSIST_KEY, persisted);
+    events.emit("connected");
+    persistLiveSession();
+    const stored = await storage.getShare(userId);
+    return {
+      addresses,
+      isNewUser: false,
+      ...stored?.profile ? { profile: stored.profile } : {}
+    };
+  }
   async function passkeyLogin(stored) {
     const userId = stored.userId;
     events.emit("wallet-unlocking");
@@ -4370,12 +4437,15 @@ async function createDecaneConnect(config) {
       return handleAuthResult(result);
     },
     async canSignInWithPasskey() {
-      return await passkeyDeviceCandidate() !== null;
+      return canOfferPasskey();
     },
     async signInWithPasskey() {
       const candidate = await passkeyDeviceCandidate();
-      if (!candidate) throw new NewDeviceError();
-      return passkeyLogin(candidate);
+      if (candidate) return passkeyLogin(candidate);
+      if (isPasskeySupported() && persisted?.userId && await storage.getShare(persisted.userId) == null) {
+        return passkeyLoginWithoutShare(persisted.userId);
+      }
+      throw new NewDeviceError();
     },
     /**
      * Turn on "unlock with your password" for this device.