decane-connect-kit 2.17.0 → 2.19.0

package/dist/index.d.cts

@@ -592,7 +592,12 @@ declare class ApiClient {
         metadata?: Record<string, unknown>;
     }): Promise<TransactionRecord>;
     getTransactions(jwt: string, limit?: number): Promise<TransactionRecord[]>;
-    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * `label` is what the user's password manager will show for this passkey.
+     * Without one they see the account's opaque id. Sent, used, and forgotten —
+     * the backend echoes it into the options and stores nothing.
+     */
+    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string, label?: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
     /**
      * Exchange a token from the developer's own auth system for a Decane

package/dist/index.d.ts

@@ -592,7 +592,12 @@ declare class ApiClient {
         metadata?: Record<string, unknown>;
     }): Promise<TransactionRecord>;
     getTransactions(jwt: string, limit?: number): Promise<TransactionRecord[]>;
-    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * `label` is what the user's password manager will show for this passkey.
+     * Without one they see the account's opaque id. Sent, used, and forgotten —
+     * the backend echoes it into the options and stores nothing.
+     */
+    getWebAuthnRegisterOptions(jwt: string, rpId: string, rpName: string, label?: string): Promise<_simplewebauthn_browser.PublicKeyCredentialCreationOptionsJSON>;
     postWebAuthnRegister(jwt: string, response: _simplewebauthn_browser.RegistrationResponseJSON, origin: string): Promise<void>;
     /**
      * Exchange a token from the developer's own auth system for a Decane

package/dist/index.js

@@ -2085,8 +2085,14 @@ var ApiClient = class {
     return body.transactions;
   }
   // ── WebAuthn registration (additive to the PRF-only passkey flow) ─────────
-  async getWebAuthnRegisterOptions(jwt, rpId, rpName) {
-    return this._request(`/webauthn/register-options?rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}`, {
+  /**
+   * `label` is what the user's password manager will show for this passkey.
+   * Without one they see the account's opaque id. Sent, used, and forgotten —
+   * the backend echoes it into the options and stores nothing.
+   */
+  async getWebAuthnRegisterOptions(jwt, rpId, rpName, label) {
+    const query = `rpId=${encodeURIComponent(rpId)}&rpName=${encodeURIComponent(rpName)}` + (label ? `&label=${encodeURIComponent(label)}` : "");
+    return this._request(`/webauthn/register-options?${query}`, {
       headers: { Authorization: `Bearer ${jwt}` }
     });
   }
@@ -2970,7 +2976,13 @@ function bufFromBytes(u) {
   return u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
 }
 async function registerWebAuthnCredential(opts) {
-  const baseOptions = await opts.api.getWebAuthnRegisterOptions(opts.jwt, opts.rpId, opts.rpName);
+  const baseOptions = await opts.api.getWebAuthnRegisterOptions(
+    opts.jwt,
+    opts.rpId,
+    opts.rpName,
+    opts.label
+  );
+  if (opts.allowDuplicate) delete baseOptions.excludeCredentials;
   const optionsJSON = {
     ...baseOptions,
     extensions: {
@@ -2979,11 +2991,7 @@ async function registerWebAuthnCredential(opts) {
     }
   };
   const { credentialId, prfOutput, response } = await registerPasskey({ optionsJSON });
-  try {
-    await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
-  } catch (e) {
-    console.warn("decane-connect-kit: WebAuthn server-side registration failed; PRF-based unlock still works, but rotateShares()/exportPortableBackup() will not until this is retried.", e);
-  }
+  await opts.api.postWebAuthnRegister(opts.jwt, response, window.location.origin);
   return { credentialId, prfOutput };
 }
 
@@ -3773,21 +3781,24 @@ async function createDecaneConnect(config) {
     const pin = await config.promptPin();
     return deriveKeyFromPin(pin, stored.pinSalt);
   }
-  async function registerPasskeyForDevice(userId, jwt, deviceShare) {
+  async function registerPasskeyForDevice(userId, jwt, deviceShare, opts = {}) {
     if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
     const prfSalt = generateRandomBytes(32);
     let credentialId;
     let prfOutput;
     try {
+      const label = (await storage.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
         rpId,
         rpName,
-        prfSalt
+        prfSalt,
+        ...label ? { label } : {},
+        ...opts.allowDuplicate ? { allowDuplicate: true } : {}
       }));
     } catch (e) {
-      if (e?.name !== "InvalidStateError") throw e;
+      if (e?.name !== "InvalidStateError" || opts.allowDuplicate) throw e;
       return adoptExistingPasskey(userId, jwt, deviceShare);
     }
     let key = prfOutput;
@@ -3839,7 +3850,12 @@ async function createDecaneConnect(config) {
   }
   async function adoptExistingPasskey(userId, jwt, deviceShare) {
     const options = await api.getWebAuthnLoginOptions(userId, rpId);
-    if (!options) throw new WebAuthnNotSupportedError();
+    if (!options) {
+      console.warn(
+        "decane-connect-kit: this authenticator holds a credential the server does not know; registering a fresh one."
+      );
+      return registerPasskeyForDevice(userId, jwt, deviceShare, { allowDuplicate: true });
+    }
     const prfSalt = generateRandomBytes(32);
     const { response, prfOutput } = await authenticateWithPasskey({
       optionsJSON: options,
@@ -3884,19 +3900,26 @@ async function createDecaneConnect(config) {
       );
       return;
     }
-    const { wrappingKey, tokenKey, meta } = await passwordSetup();
-    const iv = generateRandomBytes(12);
-    const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage.putShare({
-      userId,
-      wrappedDeviceShare,
-      iv,
-      unlockMethod: "password",
-      passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
-      passwordIterations: meta.passwordIterations,
-      version: 1
-    });
-    await attachUnlockToken(userId, jwt, tokenKey);
+    try {
+      const { wrappingKey, tokenKey, meta } = await passwordSetup();
+      const iv = generateRandomBytes(12);
+      const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
+      await storage.putShare({
+        userId,
+        wrappedDeviceShare,
+        iv,
+        unlockMethod: "password",
+        passwordSalt: meta.passwordSalt ? b64uToBuffer(meta.passwordSalt) : void 0,
+        passwordIterations: meta.passwordIterations,
+        version: 1
+      });
+      await attachUnlockToken(userId, jwt, tokenKey);
+    } catch (e) {
+      console.warn(
+        "decane-connect-kit: no unlock password was set, so this device stored no share. The session works; the next visit will provision again.",
+        e
+      );
+    }
   }
   async function firstTimeSetup(userId, jwt) {
     prewarmAttestation(teeUrl);