decane-connect-kit 2.17.0 → 2.18.0

package/dist/index.cjs

@@ -3053,6 +3053,7 @@ function bufFromBytes(u) {
 }
 async function registerWebAuthnCredential(opts) {
   const baseOptions = await opts.api.getWebAuthnRegisterOptions(opts.jwt, opts.rpId, opts.rpName);
+  if (opts.allowDuplicate) delete baseOptions.excludeCredentials;
   const optionsJSON = {
     ...baseOptions,
     extensions: {
@@ -3061,11 +3062,7 @@ async function registerWebAuthnCredential(opts) {
     }
   };
   const { credentialId, prfOutput, response } = await registerPasskey({ optionsJSON });
-  try {
-    await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
-  } catch (e) {
-    console.warn("decane-connect-kit: WebAuthn server-side registration failed; PRF-based unlock still works, but rotateShares()/exportPortableBackup() will not until this is retried.", e);
-  }
+  await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
   return { credentialId, prfOutput };
 }
 
@@ -3855,7 +3852,7 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+  async function registerPasskeyForDevice(userId, jwt, deviceShare, opts = {}) {
     if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
     let credentialId;
@@ -3866,10 +3863,11 @@ async function createDecaneConnect(config) {
         jwt,
         rpId,
         rpName,
-        prfSalt
+        prfSalt,
+        ...opts.allowDuplicate ? { allowDuplicate: true } : {}
       }));
     } catch (e) {
-      if (e?.name !== "InvalidStateError") throw e;
+      if (e?.name !== "InvalidStateError" || opts.allowDuplicate) throw e;
       return adoptExistingPasskey(userId, jwt, deviceShare);
     }
     let key = prfOutput;
@@ -3921,7 +3919,12 @@ async function createDecaneConnect(config) {
   }
   async function adoptExistingPasskey(userId, jwt, deviceShare) {
     const options = await api.getWebAuthnLoginOptions(userId, rpId);
-    if (!options) throw new WebAuthnNotSupportedError();
+    if (!options) {
+      console.warn(
+        "decane-connect-kit: this authenticator holds a credential the server does not know; registering a fresh one."
+      );
+      return registerPasskeyForDevice(userId, jwt, deviceShare, { allowDuplicate: true });
+    }
     const prfSalt = generateRandomBytes(32);
     const { response, prfOutput } = await authenticateWithPasskey({
       optionsJSON: options,
@@ -3966,19 +3969,26 @@ async function createDecaneConnect(config) {
       );
       return;
     }
-    const { wrappingKey, tokenKey, meta } = await passwordSetup();
-    const iv = generateRandomBytes(12);
-    const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage.putShare({
-      userId,
-      wrappedDeviceShare,
-      iv,
-      unlockMethod: "password",
-      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
-      passwordIterations: meta.passwordIterations,
-      version: 1
-    });
-    await attachUnlockToken(userId, jwt, tokenKey);
+    try {
+      const { wrappingKey, tokenKey, meta } = await passwordSetup();
+      const iv = generateRandomBytes(12);
+      const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+      await storage.putShare({
+        userId,
+        wrappedDeviceShare,
+        iv,
+        unlockMethod: "password",
+        passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+        passwordIterations: meta.passwordIterations,
+        version: 1
+      });
+      await attachUnlockToken(userId, jwt, tokenKey);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: no unlock password was set, so this device stored no share. The session works; the next visit will provision again.",
+        e
+      );
+    }
   }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);