decane-connect-kit 2.16.0 → 2.18.0

package/dist/index.js

@@ -2971,6 +2971,7 @@ function bufFromBytes(u) {
 }
 async function registerWebAuthnCredential(opts) {
   const baseOptions = await opts.api.getWebAuthnRegisterOptions(opts.jwt, opts.rpId, opts.rpName);
+  if (opts.allowDuplicate) delete baseOptions.excludeCredentials;
   const optionsJSON = {
     ...baseOptions,
     extensions: {
@@ -2979,11 +2980,7 @@ async function registerWebAuthnCredential(opts) {
     }
   };
   const { credentialId, prfOutput, response } = await registerPasskey({ optionsJSON });
-  try {
-    await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
-  } catch (e) {
-    console.warn("decane-connect-kit: WebAuthn server-side registration failed; PRF-based unlock still works, but rotateShares()/exportPortableBackup() will not until this is retried.", e);
-  }
+  await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
   return { credentialId, prfOutput };
 }
 
@@ -3773,16 +3770,24 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+  async function registerPasskeyForDevice(userId, jwt, deviceShare, opts = {}) {
     if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
-    const { credentialId, prfOutput } = await registerWebAuthnCredential({
-      api,
-      jwt,
-      rpId,
-      rpName,
-      prfSalt
-    });
+    let credentialId;
+    let prfOutput;
+    try {
+      ({ credentialId, prfOutput } = await registerWebAuthnCredential({
+        api,
+        jwt,
+        rpId,
+        rpName,
+        prfSalt,
+        ...opts.allowDuplicate ? { allowDuplicate: true } : {}
+      }));
+    } catch (e) {
+      if (e?.name !== "InvalidStateError" || opts.allowDuplicate) throw e;
+      return adoptExistingPasskey(userId, jwt, deviceShare);
+    }
     let key = prfOutput;
     if (!key) {
       try {
@@ -3795,7 +3800,10 @@ async function createDecaneConnect(config) {
       }
     }
     if (!key) throw new WebAuthnNotSupportedError();
-    const wrappingKey = await importAesKey(key);
+    await storeShareUnderPasskey(userId, jwt, deviceShare, credentialId, key, prfSalt);
+  }
+  async function storeShareUnderPasskey(userId, jwt, deviceShare, credentialId, prfOutput, prfSalt) {
+    const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
     const existing = await storage.getShare(userId);
@@ -3827,6 +3835,29 @@ async function createDecaneConnect(config) {
       console.warn("decane-connect-kit: wrapped share backup upload failed; user can retry from settings.", e);
     }
   }
+  async function adoptExistingPasskey(userId, jwt, deviceShare) {
+    const options = await api.getWebAuthnLoginOptions(userId, rpId);
+    if (!options) {
+      console.warn(
+        "decane-connect-kit: this authenticator holds a credential the server does not know; registering a fresh one."
+      );
+      return registerPasskeyForDevice(userId, jwt, deviceShare, { allowDuplicate: true });
+    }
+    const prfSalt = generateRandomBytes(32);
+    const { response, prfOutput } = await authenticateWithPasskey({
+      optionsJSON: options,
+      prfSalt
+    });
+    if (!prfOutput) throw new WebAuthnNotSupportedError();
+    await storeShareUnderPasskey(
+      userId,
+      jwt,
+      deviceShare,
+      b64uToBuffer(response.id),
+      prfOutput,
+      prfSalt
+    );
+  }
   async function registerPasskeyAndBackup(userId, jwt, deviceShare) {
     if (!isPasskeySupported()) return;
     try {
@@ -3856,19 +3887,26 @@ async function createDecaneConnect(config) {
       );
       return;
     }
-    const { wrappingKey, tokenKey, meta } = await passwordSetup();
-    const iv = generateRandomBytes(12);
-    const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage.putShare({
-      userId,
-      wrappedDeviceShare,
-      iv,
-      unlockMethod: "password",
-      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
-      passwordIterations: meta.passwordIterations,
-      version: 1
-    });
-    await attachUnlockToken(userId, jwt, tokenKey);
+    try {
+      const { wrappingKey, tokenKey, meta } = await passwordSetup();
+      const iv = generateRandomBytes(12);
+      const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+      await storage.putShare({
+        userId,
+        wrappedDeviceShare,
+        iv,
+        unlockMethod: "password",
+        passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+        passwordIterations: meta.passwordIterations,
+        version: 1
+      });
+      await attachUnlockToken(userId, jwt, tokenKey);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: no unlock password was set, so this device stored no share. The session works; the next visit will provision again.",
+        e
+      );
+    }
   }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);