decane-connect-kit 2.15.0 → 2.17.0

package/dist/index.cjs

@@ -3858,14 +3858,35 @@ async function createDecaneConnect(config) {
   async function registerPasskeyForDevice(userId, jwt, deviceShare) {
     if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    const { credentialId, prfOutput } = await registerWebAuthnCredential({
-      api,
-      jwt,
-      rpId,
-      rpName,
-      prfSalt
-    });
-    if (!prfOutput) throw new WebAuthnNotSupportedError();
+    let credentialId;
+    let prfOutput;
+    try {
+      ({ credentialId, prfOutput } = await registerWebAuthnCredential({
+        api,
+        jwt,
+        rpId,
+        rpName,
+        prfSalt
+      }));
+    } catch (e) {
+      if (e?.name !== "InvalidStateError") throw e;
+      return adoptExistingPasskey(userId, jwt, deviceShare);
+    }
+    let key = prfOutput;
+    if (!key) {
+      try {
+        key = await getPrfOutput({ rpId, credentialId, prfSalt });
+      } catch (e) {
+        console.warn(
+          "decane-connect-kit: the new credential did not return a PRF output; it cannot wrap the share.",
+          e
+        );
+      }
+    }
+    if (!key) throw new WebAuthnNotSupportedError();
+    await storeShareUnderPasskey(userId, jwt, deviceShare, credentialId, key, prfSalt);
+  }
+  async function storeShareUnderPasskey(userId, jwt, deviceShare, credentialId, prfOutput, prfSalt) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
@@ -3898,6 +3919,24 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function adoptExistingPasskey(userId, jwt, deviceShare) {
+    const options = await api.getWebAuthnLoginOptions(userId, rpId);
+    if (!options) throw new WebAuthnNotSupportedError();
+    const prfSalt = generateRandomBytes(32);
+    const { response, prfOutput } = await authenticateWithPasskey({
+      optionsJSON: options,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
+    await storeShareUnderPasskey(
+      userId,
+      jwt,
+      deviceShare,
+      b64uToBuffer(response.id),
+      prfOutput,
+      prfSalt
+    );
+  }
   async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
     if (!isPasskeySupported()) return;
     try {
@@ -4577,8 +4616,19 @@ async function createDecaneConnect(config) {
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
       const stored = await storage.getShare(auth.userId);
-      if (!stored) throw new NewDeviceError();
-      if (stored.unlockMethod === "passkey") return;
+      if (stored?.unlockMethod === "passkey") return;
+      if (!stored) {
+        if (!serverAssistedRecovery) throw new NewDeviceError();
+        const tee = new TeeClient(teeUrl);
+        const provisioned = await tee.provisionDeviceShare(auth.jwt);
+        if (!provisioned) throw new NewDeviceError();
+        try {
+          await registerPasskeyForDevice(auth.userId, auth.jwt, provisioned);
+        } finally {
+          zeroize(provisioned);
+        }
+        return;
+      }
       let deviceShare;
       try {
         deviceShare = await aesGcmDecrypt(