faire-auth 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +661 -0
- package/README.md +34 -0
- package/dist/access-B5bBI4uT.mjs +39 -0
- package/dist/access-Crt-IJ2P.cjs +51 -0
- package/dist/adapter-factory-BXei1QRX.mjs +881 -0
- package/dist/adapter-factory-DT-_2aHJ.cjs +893 -0
- package/dist/adapters/drizzle-adapter/index.cjs +208 -0
- package/dist/adapters/drizzle-adapter/index.d.cts +48 -0
- package/dist/adapters/drizzle-adapter/index.d.mts +48 -0
- package/dist/adapters/drizzle-adapter/index.mjs +207 -0
- package/dist/adapters/index.cjs +23 -0
- package/dist/adapters/index.d.cts +157 -0
- package/dist/adapters/index.d.mts +157 -0
- package/dist/adapters/index.mjs +17 -0
- package/dist/adapters/kysely-adapter/index.cjs +11 -0
- package/dist/adapters/kysely-adapter/index.d.cts +52 -0
- package/dist/adapters/kysely-adapter/index.d.mts +52 -0
- package/dist/adapters/kysely-adapter/index.mjs +9 -0
- package/dist/adapters/memory-adapter/index.cjs +9 -0
- package/dist/adapters/memory-adapter/index.d.cts +15 -0
- package/dist/adapters/memory-adapter/index.d.mts +15 -0
- package/dist/adapters/memory-adapter/index.mjs +9 -0
- package/dist/adapters/mongodb-adapter/index.cjs +9 -0
- package/dist/adapters/mongodb-adapter/index.d.cts +4 -0
- package/dist/adapters/mongodb-adapter/index.d.mts +4 -0
- package/dist/adapters/mongodb-adapter/index.mjs +9 -0
- package/dist/adapters/prisma-adapter/index.cjs +156 -0
- package/dist/adapters/prisma-adapter/index.d.cts +35 -0
- package/dist/adapters/prisma-adapter/index.d.mts +35 -0
- package/dist/adapters/prisma-adapter/index.mjs +155 -0
- package/dist/adapters/test.cjs +797 -0
- package/dist/adapters/test.d.cts +82 -0
- package/dist/adapters/test.d.mts +82 -0
- package/dist/adapters/test.mjs +793 -0
- package/dist/api/index.cjs +20 -0
- package/dist/api/index.d.cts +3 -0
- package/dist/api/index.d.mts +3 -0
- package/dist/api/index.mjs +20 -0
- package/dist/api/middleware/index.cjs +16 -0
- package/dist/api/middleware/index.d.cts +16 -0
- package/dist/api/middleware/index.d.mts +16 -0
- package/dist/api/middleware/index.mjs +11 -0
- package/dist/api-Bm89BLgN.cjs +1899 -0
- package/dist/api-_B7qO28y.mjs +1892 -0
- package/dist/auth-Bo9PDt5j.cjs +739 -0
- package/dist/auth-Ds4AG4h4.mjs +709 -0
- package/dist/bearer-0SeEmaS4.mjs +54 -0
- package/dist/bearer-CHeREcGT.cjs +60 -0
- package/dist/bun-sqlite-dialect-CfkBo2v5.mjs +155 -0
- package/dist/bun-sqlite-dialect-wuaC2-gh.cjs +156 -0
- package/dist/chunk-Ceigfy4P.mjs +39 -0
- package/dist/chunk-oakRccI5.cjs +60 -0
- package/dist/client/index.cjs +22 -0
- package/dist/client/index.d.cts +8 -0
- package/dist/client/index.d.mts +8 -0
- package/dist/client/index.mjs +19 -0
- package/dist/client/lynx/index.cjs +79 -0
- package/dist/client/lynx/index.d.cts +156 -0
- package/dist/client/lynx/index.d.mts +156 -0
- package/dist/client/lynx/index.mjs +76 -0
- package/dist/client/plugins/index.cjs +11 -0
- package/dist/client/plugins/index.d.cts +17 -0
- package/dist/client/plugins/index.d.mts +17 -0
- package/dist/client/plugins/index.mjs +10 -0
- package/dist/client/react/index.cjs +79 -0
- package/dist/client/react/index.d.cts +156 -0
- package/dist/client/react/index.d.mts +156 -0
- package/dist/client/react/index.mjs +76 -0
- package/dist/client/solid/index.cjs +51 -0
- package/dist/client/solid/index.d.cts +90 -0
- package/dist/client/solid/index.d.mts +90 -0
- package/dist/client/solid/index.mjs +50 -0
- package/dist/client/svelte/index.cjs +28 -0
- package/dist/client/svelte/index.d.cts +110 -0
- package/dist/client/svelte/index.d.mts +110 -0
- package/dist/client/svelte/index.mjs +28 -0
- package/dist/client/vue/index.cjs +68 -0
- package/dist/client/vue/index.d.cts +123 -0
- package/dist/client/vue/index.d.mts +123 -0
- package/dist/client/vue/index.mjs +67 -0
- package/dist/cookies-B5xeA6i8.cjs +456 -0
- package/dist/cookies-Ch1JfQIz.mjs +367 -0
- package/dist/crypto/index.cjs +11 -0
- package/dist/crypto/index.d.cts +22 -0
- package/dist/crypto/index.d.mts +22 -0
- package/dist/crypto/index.mjs +5 -0
- package/dist/crypto-CcTxYH82.cjs +57 -0
- package/dist/crypto-CyQRFtkq.mjs +41 -0
- package/dist/db/index.cjs +40 -0
- package/dist/db/index.d.cts +4 -0
- package/dist/db/index.d.mts +4 -0
- package/dist/db/index.mjs +16 -0
- package/dist/db-BTKyYu-_.cjs +1180 -0
- package/dist/db-xiJtoDgz.mjs +1119 -0
- package/dist/defu-B0Svx_x4.cjs +34 -0
- package/dist/defu-SZkpHhbR.mjs +28 -0
- package/dist/email-verification-C-AsfJsb.cjs +247 -0
- package/dist/email-verification-CWhj2qfb.mjs +228 -0
- package/dist/hono-BEq1NYVX.cjs +526 -0
- package/dist/hono-Cdukwu5K.cjs +13 -0
- package/dist/hono-CoKYWnXA.mjs +7 -0
- package/dist/hono-Covz10jU.mjs +508 -0
- package/dist/hono-DOM31WQz.d.cts +18 -0
- package/dist/hono-DuE14mmj.d.mts +18 -0
- package/dist/index-B-WeOMzg.d.cts +13350 -0
- package/dist/index-B09P9p5_.d.cts +33 -0
- package/dist/index-B5_0QTLg.d.mts +3 -0
- package/dist/index-B7SKyR_a.d.cts +3 -0
- package/dist/index-BVHscLQl.d.cts +992 -0
- package/dist/index-C2-2QDyS.d.cts +35 -0
- package/dist/index-CTwrVluH.d.mts +41 -0
- package/dist/index-CWAqWfoZ.d.cts +27 -0
- package/dist/index-CYSShrFx.d.mts +27 -0
- package/dist/index-Qu-iJGNr.d.mts +992 -0
- package/dist/index-cs4Sh0En.d.cts +41 -0
- package/dist/index-jlessPI0.d.mts +13350 -0
- package/dist/index-ppgcFe12.d.mts +33 -0
- package/dist/index-to0RO38U.d.mts +35 -0
- package/dist/index.cjs +85 -0
- package/dist/index.d.cts +5 -0
- package/dist/index.d.mts +5 -0
- package/dist/index.mjs +27 -0
- package/dist/integrations/next-js.cjs +50 -0
- package/dist/integrations/next-js.d.cts +23 -0
- package/dist/integrations/next-js.d.mts +23 -0
- package/dist/integrations/next-js.mjs +49 -0
- package/dist/integrations/node.cjs +139 -0
- package/dist/integrations/node.d.cts +22 -0
- package/dist/integrations/node.d.mts +22 -0
- package/dist/integrations/node.mjs +134 -0
- package/dist/integrations/react-start.cjs +37 -0
- package/dist/integrations/react-start.d.cts +17 -0
- package/dist/integrations/react-start.d.mts +17 -0
- package/dist/integrations/react-start.mjs +37 -0
- package/dist/integrations/solid-start.cjs +14 -0
- package/dist/integrations/solid-start.d.cts +13 -0
- package/dist/integrations/solid-start.d.mts +13 -0
- package/dist/integrations/solid-start.mjs +13 -0
- package/dist/integrations/svelte-kit.cjs +52 -0
- package/dist/integrations/svelte-kit.d.cts +42 -0
- package/dist/integrations/svelte-kit.d.mts +42 -0
- package/dist/integrations/svelte-kit.mjs +49 -0
- package/dist/ip-B5SwXaMB.cjs +54 -0
- package/dist/ip-BjNYspCH.mjs +36 -0
- package/dist/json-B1v2qRTQ.mjs +24 -0
- package/dist/json-CcJ2HjGo.cjs +30 -0
- package/dist/kysely-adapter-Bxi7sPdG.cjs +288 -0
- package/dist/kysely-adapter-DRuoT_X8.mjs +270 -0
- package/dist/logged-CyGfp8_H.mjs +187 -0
- package/dist/logged-DQK3C64b.cjs +193 -0
- package/dist/memory-adapter-BlnDIAAX.cjs +154 -0
- package/dist/memory-adapter-Db3tsJTn.mjs +148 -0
- package/dist/middleware-CE6OhDkq.mjs +29 -0
- package/dist/middleware-CWvRH4EW.cjs +47 -0
- package/dist/mongodb-adapter-C_qGQED5.mjs +291 -0
- package/dist/mongodb-adapter-C_qfK87x.cjs +297 -0
- package/dist/node-sqlite-dialect-BfBzyOAg.mjs +155 -0
- package/dist/node-sqlite-dialect-mJWC8LWQ.cjs +156 -0
- package/dist/oauth2/index.cjs +25 -0
- package/dist/oauth2/index.d.cts +42 -0
- package/dist/oauth2/index.d.mts +42 -0
- package/dist/oauth2/index.mjs +16 -0
- package/dist/oauth2-B8M0lW9l.mjs +159 -0
- package/dist/oauth2-BLeOEi7Y.cjs +177 -0
- package/dist/origin-check-8Gajklvh.mjs +228 -0
- package/dist/origin-check-id9lTnqZ.cjs +246 -0
- package/dist/parser-CdncAl9i.cjs +83 -0
- package/dist/parser-CeAer-RM.mjs +71 -0
- package/dist/passkey-B6N20LSS.cjs +512 -0
- package/dist/passkey-DJsR_GX3.mjs +505 -0
- package/dist/plugins/access/index.cjs +4 -0
- package/dist/plugins/access/index.d.cts +2 -0
- package/dist/plugins/access/index.d.mts +2 -0
- package/dist/plugins/access/index.mjs +3 -0
- package/dist/plugins/bearer/index.cjs +7 -0
- package/dist/plugins/bearer/index.d.cts +4 -0
- package/dist/plugins/bearer/index.d.mts +4 -0
- package/dist/plugins/bearer/index.mjs +7 -0
- package/dist/plugins/index.cjs +49 -0
- package/dist/plugins/index.d.cts +9326 -0
- package/dist/plugins/index.d.mts +9326 -0
- package/dist/plugins/index.mjs +26 -0
- package/dist/plugins/passkey/index.cjs +15 -0
- package/dist/plugins/passkey/index.d.cts +4 -0
- package/dist/plugins/passkey/index.d.mts +4 -0
- package/dist/plugins/passkey/index.mjs +15 -0
- package/dist/plugins-C1lm2Wj3.cjs +5254 -0
- package/dist/plugins-Dai1QkRU.mjs +5199 -0
- package/dist/request-1NL_1lyJ.mjs +58 -0
- package/dist/request-CPNlp-DK.cjs +100 -0
- package/dist/schema-D-qjygfE.cjs +179 -0
- package/dist/schema-DTIwLLmf.mjs +125 -0
- package/dist/session-De9POJTW.cjs +641 -0
- package/dist/session-rH8ougDl.mjs +538 -0
- package/dist/social-providers/index.cjs +10 -0
- package/dist/social-providers/index.d.cts +2 -0
- package/dist/social-providers/index.d.mts +2 -0
- package/dist/social-providers/index.mjs +5 -0
- package/dist/social-providers-DcFNUT0S.cjs +13 -0
- package/dist/social-providers-DoYJhBe3.mjs +9 -0
- package/dist/state--f7fwIGh.cjs +99 -0
- package/dist/state-CqJfCIl9.mjs +86 -0
- package/dist/test-utils/index.cjs +27492 -0
- package/dist/test-utils/index.d.cts +4584 -0
- package/dist/test-utils/index.d.mts +4584 -0
- package/dist/test-utils/index.mjs +27490 -0
- package/dist/types/index.cjs +0 -0
- package/dist/types/index.d.cts +3 -0
- package/dist/types/index.d.mts +3 -0
- package/dist/types/index.mjs +1 -0
- package/dist/url-BoUuoIwZ.mjs +88 -0
- package/dist/url-D2yvKaM7.cjs +118 -0
- package/dist/utils/cookies.cjs +51 -0
- package/dist/utils/cookies.d.cts +179 -0
- package/dist/utils/cookies.d.mts +179 -0
- package/dist/utils/cookies.mjs +7 -0
- package/dist/utils-44aDDP8f.cjs +2 -0
- package/dist/utils-D4vZd1-9.mjs +4 -0
- package/dist/vanilla-Bu2PmFzE.cjs +30 -0
- package/dist/vanilla-TfHqeiC7.mjs +25 -0
- package/package.json +470 -0
|
@@ -0,0 +1,505 @@
|
|
|
1
|
+
import { n as cookies_exports, y as setSessionCookie } from "./cookies-Ch1JfQIz.mjs";
|
|
2
|
+
import { f as createEndpoint, r as getSessionFromCtx, t as freshSessionMiddleware, u as sessionMiddleware } from "./session-rH8ougDl.mjs";
|
|
3
|
+
import { i as generateRandomString, r as generateId } from "./utils-D4vZd1-9.mjs";
|
|
4
|
+
import { t as mergeSchema } from "./schema-DTIwLLmf.mjs";
|
|
5
|
+
import { logger } from "@faire-auth/core/env";
|
|
6
|
+
import { createRoute, emailSchema, req, res } from "@faire-auth/core/factory";
|
|
7
|
+
import { Definitions, False, SCHEMAS, True } from "@faire-auth/core/static";
|
|
8
|
+
import { toSuccess } from "@faire-auth/core/utils";
|
|
9
|
+
import { base64 } from "@faire-auth/core/datatypes";
|
|
10
|
+
import * as z$1 from "zod";
|
|
11
|
+
import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
|
|
12
|
+
|
|
13
|
+
//#region src/plugins/passkey/index.ts
|
|
14
|
+
const getRpID = (options, baseURL) => options.rpID || (baseURL ? new URL(baseURL).hostname : "localhost");
|
|
15
|
+
const passkeySchema = z$1.object({
|
|
16
|
+
id: z$1.string(),
|
|
17
|
+
name: z$1.string().optional(),
|
|
18
|
+
publicKey: z$1.string(),
|
|
19
|
+
userId: z$1.string(),
|
|
20
|
+
credentialID: z$1.string(),
|
|
21
|
+
counter: z$1.number().int().nonnegative(),
|
|
22
|
+
deviceType: z$1.enum(["singleDevice", "multiDevice"]),
|
|
23
|
+
backedUp: z$1.boolean(),
|
|
24
|
+
transports: z$1.string().optional(),
|
|
25
|
+
createdAt: z$1.date().or(z$1.iso.datetime()),
|
|
26
|
+
aaguid: z$1.string().optional()
|
|
27
|
+
});
|
|
28
|
+
const passkey = (options) => {
|
|
29
|
+
const opts = {
|
|
30
|
+
origin: null,
|
|
31
|
+
...options,
|
|
32
|
+
advanced: {
|
|
33
|
+
webAuthnChallengeCookie: "better-auth-passkey",
|
|
34
|
+
...options?.advanced
|
|
35
|
+
}
|
|
36
|
+
};
|
|
37
|
+
const expirationTime = new Date(Date.now() + 1e3 * 60 * 5);
|
|
38
|
+
const currentTime = /* @__PURE__ */ new Date();
|
|
39
|
+
const maxAgeInSeconds = Math.floor((expirationTime.getTime() - currentTime.getTime()) / 1e3);
|
|
40
|
+
const ERROR_CODES = {
|
|
41
|
+
CHALLENGE_NOT_FOUND: "Challenge not found",
|
|
42
|
+
YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
|
|
43
|
+
FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
|
|
44
|
+
PASSKEY_NOT_FOUND: "Passkey not found",
|
|
45
|
+
AUTHENTICATION_FAILED: "Authentication failed",
|
|
46
|
+
UNABLE_TO_CREATE_SESSION: "Unable to create session",
|
|
47
|
+
FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey"
|
|
48
|
+
};
|
|
49
|
+
return {
|
|
50
|
+
id: "passkey",
|
|
51
|
+
routes: {
|
|
52
|
+
generatePasskeyRegistrationOptions: createEndpoint(createRoute({
|
|
53
|
+
operationId: "generatePasskeyRegistrationOptions",
|
|
54
|
+
method: "get",
|
|
55
|
+
path: "/passkey/generate-register-options",
|
|
56
|
+
client: false,
|
|
57
|
+
description: "Generate registration options for a new passkey",
|
|
58
|
+
middleware: [freshSessionMiddleware],
|
|
59
|
+
request: req().qry(z$1.object({
|
|
60
|
+
authenticatorAttachment: z$1.enum(["platform", "cross-platform"]).optional().openapi({ description: `Type of authenticator to use for registration.
|
|
61
|
+
"platform" for device-specific authenticators,
|
|
62
|
+
"cross-platform" for authenticators that can be used across devices.` }),
|
|
63
|
+
name: z$1.string().optional().openapi({ description: `Optional custom name for the passkey.
|
|
64
|
+
This can help identify the passkey when managing multiple credentials.` })
|
|
65
|
+
})).bld(),
|
|
66
|
+
responses: res(z$1.object({
|
|
67
|
+
challenge: z$1.base64url(),
|
|
68
|
+
timeout: z$1.number().optional(),
|
|
69
|
+
rp: z$1.object({
|
|
70
|
+
name: z$1.string(),
|
|
71
|
+
id: z$1.string().optional()
|
|
72
|
+
}),
|
|
73
|
+
user: z$1.object({
|
|
74
|
+
id: z$1.string(),
|
|
75
|
+
name: z$1.string(),
|
|
76
|
+
displayName: z$1.string()
|
|
77
|
+
}),
|
|
78
|
+
pubKeyCredParams: z$1.array(z$1.object({
|
|
79
|
+
type: z$1.string(),
|
|
80
|
+
alg: z$1.number()
|
|
81
|
+
})),
|
|
82
|
+
excludeCredentials: z$1.array(z$1.object({
|
|
83
|
+
id: z$1.string(),
|
|
84
|
+
type: z$1.string(),
|
|
85
|
+
transports: z$1.array(z$1.enum([
|
|
86
|
+
"ble",
|
|
87
|
+
"cable",
|
|
88
|
+
"hybrid",
|
|
89
|
+
"internal",
|
|
90
|
+
"nfc",
|
|
91
|
+
"smart-card",
|
|
92
|
+
"usb"
|
|
93
|
+
])).optional()
|
|
94
|
+
})).optional(),
|
|
95
|
+
authenticatorSelection: z$1.object({
|
|
96
|
+
authenticatorAttachment: z$1.string(),
|
|
97
|
+
requireResidentKey: z$1.boolean(),
|
|
98
|
+
userVerification: z$1.string()
|
|
99
|
+
}).partial().optional(),
|
|
100
|
+
attestation: z$1.string(),
|
|
101
|
+
extensions: z$1.record(z$1.string(), z$1.any())
|
|
102
|
+
}).transform(toSuccess)).err(401).bld()
|
|
103
|
+
}), (authOptions) => async (ctx) => {
|
|
104
|
+
const session = ctx.get("session");
|
|
105
|
+
const { name, authenticatorAttachment } = ctx.req.valid("query");
|
|
106
|
+
const userPasskeys = await ctx.get("context").adapter.findMany({
|
|
107
|
+
model: "passkey",
|
|
108
|
+
where: [{
|
|
109
|
+
field: "userId",
|
|
110
|
+
value: session.user.id
|
|
111
|
+
}]
|
|
112
|
+
});
|
|
113
|
+
const userID = new TextEncoder().encode(generateRandomString(32, "a-z", "0-9"));
|
|
114
|
+
let options$1;
|
|
115
|
+
options$1 = await generateRegistrationOptions({
|
|
116
|
+
rpName: opts.rpName || ctx.get("context").appName,
|
|
117
|
+
rpID: getRpID(opts, authOptions.baseURL),
|
|
118
|
+
userID,
|
|
119
|
+
userName: name ?? session.user.email ?? session.user.id,
|
|
120
|
+
userDisplayName: session.user.email ?? session.user.id,
|
|
121
|
+
attestationType: "none",
|
|
122
|
+
excludeCredentials: userPasskeys.map((passkey$1) => ({
|
|
123
|
+
id: passkey$1.credentialID,
|
|
124
|
+
transports: passkey$1.transports?.split(",")
|
|
125
|
+
})),
|
|
126
|
+
authenticatorSelection: {
|
|
127
|
+
residentKey: "preferred",
|
|
128
|
+
userVerification: "preferred",
|
|
129
|
+
...opts.authenticatorSelection ?? {},
|
|
130
|
+
...authenticatorAttachment && { authenticatorAttachment }
|
|
131
|
+
}
|
|
132
|
+
});
|
|
133
|
+
const id = generateId(32);
|
|
134
|
+
const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
|
|
135
|
+
await (0, cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
|
|
136
|
+
...webAuthnCookie.attributes,
|
|
137
|
+
maxAge: maxAgeInSeconds
|
|
138
|
+
});
|
|
139
|
+
await ctx.get("context").internalAdapter.createVerificationValue({
|
|
140
|
+
identifier: id,
|
|
141
|
+
value: JSON.stringify({
|
|
142
|
+
expectedChallenge: options$1.challenge,
|
|
143
|
+
userData: { id: session.user.id }
|
|
144
|
+
}),
|
|
145
|
+
expiresAt: expirationTime
|
|
146
|
+
});
|
|
147
|
+
return ctx.render(options$1, 200);
|
|
148
|
+
}),
|
|
149
|
+
generatePasskeyAuthenticationOptions: createEndpoint(createRoute({
|
|
150
|
+
operationId: "generatePasskeyAuthenticationOptions",
|
|
151
|
+
method: "post",
|
|
152
|
+
path: "/passkey/generate-authenticate-options",
|
|
153
|
+
description: "Generate authentication options for a passkey",
|
|
154
|
+
request: req().bdy(z$1.object({ email: emailSchema.openapi({ description: "The email address of the user" }).optional() })).bld(),
|
|
155
|
+
responses: res(z$1.object({
|
|
156
|
+
challenge: z$1.base64url(),
|
|
157
|
+
timeout: z$1.number().optional(),
|
|
158
|
+
rpId: z$1.string().optional(),
|
|
159
|
+
allowCredentials: z$1.array(z$1.object({
|
|
160
|
+
id: z$1.string(),
|
|
161
|
+
type: z$1.string(),
|
|
162
|
+
transports: z$1.array(z$1.enum([
|
|
163
|
+
"ble",
|
|
164
|
+
"cable",
|
|
165
|
+
"hybrid",
|
|
166
|
+
"internal",
|
|
167
|
+
"nfc",
|
|
168
|
+
"smart-card",
|
|
169
|
+
"usb"
|
|
170
|
+
])).optional()
|
|
171
|
+
})).optional(),
|
|
172
|
+
userVerification: z$1.enum([
|
|
173
|
+
"discouraged",
|
|
174
|
+
"preferred",
|
|
175
|
+
"required"
|
|
176
|
+
]).optional(),
|
|
177
|
+
extensions: z$1.record(z$1.string(), z$1.any()).optional()
|
|
178
|
+
}).transform(toSuccess)).bld()
|
|
179
|
+
}), (authOptions) => async (ctx) => {
|
|
180
|
+
const session = await getSessionFromCtx(ctx);
|
|
181
|
+
let userPasskeys = [];
|
|
182
|
+
if (!(session instanceof Response)) userPasskeys = await ctx.get("context").adapter.findMany({
|
|
183
|
+
model: "passkey",
|
|
184
|
+
where: [{
|
|
185
|
+
field: "userId",
|
|
186
|
+
value: session.user.id
|
|
187
|
+
}]
|
|
188
|
+
});
|
|
189
|
+
const options$1 = await generateAuthenticationOptions({
|
|
190
|
+
rpID: getRpID(opts, authOptions.baseURL),
|
|
191
|
+
userVerification: "preferred",
|
|
192
|
+
...userPasskeys.length > 0 && { allowCredentials: userPasskeys.map((passkey$1) => ({
|
|
193
|
+
id: passkey$1.credentialID,
|
|
194
|
+
transports: passkey$1.transports?.split(",")
|
|
195
|
+
})) }
|
|
196
|
+
});
|
|
197
|
+
const data = {
|
|
198
|
+
expectedChallenge: options$1.challenge,
|
|
199
|
+
userData: { id: "user" in session ? session.user.id : "" }
|
|
200
|
+
};
|
|
201
|
+
const id = generateId(32);
|
|
202
|
+
const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
|
|
203
|
+
await (0, cookies_exports.setSignedCookie)(ctx, webAuthnCookie.name, id, ctx.get("context").secret, {
|
|
204
|
+
...webAuthnCookie.attributes,
|
|
205
|
+
maxAge: maxAgeInSeconds
|
|
206
|
+
});
|
|
207
|
+
await ctx.get("context").internalAdapter.createVerificationValue({
|
|
208
|
+
identifier: id,
|
|
209
|
+
value: JSON.stringify(data),
|
|
210
|
+
expiresAt: expirationTime
|
|
211
|
+
});
|
|
212
|
+
return ctx.render(options$1, 200);
|
|
213
|
+
}),
|
|
214
|
+
verifyPasskeyRegistration: createEndpoint(createRoute({
|
|
215
|
+
operationId: "verifyPasskeyRegistration",
|
|
216
|
+
method: "post",
|
|
217
|
+
path: "/passkey/verify-registration",
|
|
218
|
+
description: "Verify registration of a new passkey",
|
|
219
|
+
middleware: [freshSessionMiddleware],
|
|
220
|
+
request: req().bdy(z$1.object({
|
|
221
|
+
response: z$1.any(),
|
|
222
|
+
name: z$1.string().openapi({ description: "Name of the passkey" }).optional()
|
|
223
|
+
})).bld(),
|
|
224
|
+
responses: res(passkeySchema.transform(toSuccess)).err(400).err(401).err(500, "Failed to verify registration").bld()
|
|
225
|
+
}), (authOptions) => async (ctx) => {
|
|
226
|
+
const origin = options?.origin ?? ctx.req.header("origin") ?? "";
|
|
227
|
+
if (!origin) return ctx.render({ success: False }, 400);
|
|
228
|
+
const session = ctx.get("session");
|
|
229
|
+
const { response } = ctx.req.valid("json");
|
|
230
|
+
const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
|
|
231
|
+
const challengeId = await (0, cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
|
|
232
|
+
if (!challengeId) return ctx.render({
|
|
233
|
+
success: False,
|
|
234
|
+
message: ERROR_CODES.CHALLENGE_NOT_FOUND
|
|
235
|
+
}, 400);
|
|
236
|
+
const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
|
|
237
|
+
if (!data) return ctx.render({
|
|
238
|
+
success: False,
|
|
239
|
+
message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
|
|
240
|
+
}, 400);
|
|
241
|
+
const { expectedChallenge, userData } = JSON.parse(data.value);
|
|
242
|
+
if (userData.id !== session.user.id) return ctx.render({
|
|
243
|
+
success: False,
|
|
244
|
+
message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
|
|
245
|
+
}, 401);
|
|
246
|
+
try {
|
|
247
|
+
const { verified, registrationInfo } = await verifyRegistrationResponse({
|
|
248
|
+
response,
|
|
249
|
+
expectedChallenge,
|
|
250
|
+
expectedOrigin: origin,
|
|
251
|
+
expectedRPID: getRpID(opts, authOptions.baseURL),
|
|
252
|
+
requireUserVerification: false
|
|
253
|
+
});
|
|
254
|
+
if (!verified || !registrationInfo) return ctx.render({
|
|
255
|
+
success: False,
|
|
256
|
+
message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
|
|
257
|
+
}, 400);
|
|
258
|
+
const { aaguid, credentialDeviceType, credentialBackedUp, credential } = registrationInfo;
|
|
259
|
+
const pubKey = base64.encode(credential.publicKey);
|
|
260
|
+
const newPasskey = {
|
|
261
|
+
name: ctx.body.name,
|
|
262
|
+
userId: userData.id,
|
|
263
|
+
credentialID: credential.id,
|
|
264
|
+
publicKey: pubKey,
|
|
265
|
+
counter: credential.counter,
|
|
266
|
+
deviceType: credentialDeviceType,
|
|
267
|
+
transports: response.response.transports.join(","),
|
|
268
|
+
backedUp: credentialBackedUp,
|
|
269
|
+
createdAt: /* @__PURE__ */ new Date(),
|
|
270
|
+
aaguid
|
|
271
|
+
};
|
|
272
|
+
const newPasskeyRes = await ctx.get("context").adapter.create({
|
|
273
|
+
model: "passkey",
|
|
274
|
+
data: newPasskey
|
|
275
|
+
});
|
|
276
|
+
return ctx.render(newPasskeyRes, 200);
|
|
277
|
+
} catch (e) {
|
|
278
|
+
logger.error(String(e));
|
|
279
|
+
return ctx.render({
|
|
280
|
+
success: False,
|
|
281
|
+
message: ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION
|
|
282
|
+
}, 500);
|
|
283
|
+
}
|
|
284
|
+
}),
|
|
285
|
+
verifyPasskeyAuthentication: createEndpoint(createRoute({
|
|
286
|
+
operationId: "verifyPasskeyAuthentication",
|
|
287
|
+
method: "post",
|
|
288
|
+
path: "/passkey/verify-authentication",
|
|
289
|
+
description: "Verify authentication of a passkey",
|
|
290
|
+
$Infer: { body: {} },
|
|
291
|
+
request: req().bdy(z$1.object({ response: z$1.record(z$1.string(), z$1.any()) })).bld(),
|
|
292
|
+
responses: res(SCHEMAS[Definitions.SESSION_RESPONSE].default).err(400, "Origin missing, challenge not found, or auth failed").err(401, "Passkey not found or auth failed").err(500, "User not found or unable to create session").bld()
|
|
293
|
+
}), (authOptions) => async (ctx) => {
|
|
294
|
+
const origin = options?.origin ?? ctx.req.header("origin") ?? "";
|
|
295
|
+
if (!origin) return ctx.render({
|
|
296
|
+
success: False,
|
|
297
|
+
message: "Origin missing"
|
|
298
|
+
}, 400);
|
|
299
|
+
const { response } = ctx.req.valid("json");
|
|
300
|
+
const webAuthnCookie = ctx.get("context").createAuthCookie(opts.advanced.webAuthnChallengeCookie);
|
|
301
|
+
const challengeId = await (0, cookies_exports.getSignedCookie)(ctx, ctx.get("context").secret, webAuthnCookie.name);
|
|
302
|
+
if (!challengeId) return ctx.render({
|
|
303
|
+
success: False,
|
|
304
|
+
message: ERROR_CODES.CHALLENGE_NOT_FOUND
|
|
305
|
+
}, 400);
|
|
306
|
+
const data = await ctx.get("context").internalAdapter.findVerificationValue(challengeId);
|
|
307
|
+
if (!data) return ctx.render({
|
|
308
|
+
success: False,
|
|
309
|
+
message: ERROR_CODES.CHALLENGE_NOT_FOUND
|
|
310
|
+
}, 400);
|
|
311
|
+
const { expectedChallenge } = JSON.parse(data.value);
|
|
312
|
+
const passkey$1 = await ctx.get("context").adapter.findOne({
|
|
313
|
+
model: "passkey",
|
|
314
|
+
where: [{
|
|
315
|
+
field: "credentialID",
|
|
316
|
+
value: response["id"]
|
|
317
|
+
}]
|
|
318
|
+
});
|
|
319
|
+
if (!passkey$1) return ctx.render({
|
|
320
|
+
success: False,
|
|
321
|
+
message: ERROR_CODES.PASSKEY_NOT_FOUND
|
|
322
|
+
}, 401);
|
|
323
|
+
try {
|
|
324
|
+
const verification = await verifyAuthenticationResponse({
|
|
325
|
+
response,
|
|
326
|
+
expectedChallenge,
|
|
327
|
+
expectedOrigin: origin,
|
|
328
|
+
expectedRPID: getRpID(opts, authOptions.baseURL),
|
|
329
|
+
credential: {
|
|
330
|
+
id: passkey$1.credentialID,
|
|
331
|
+
publicKey: base64.decode(passkey$1.publicKey),
|
|
332
|
+
counter: passkey$1.counter,
|
|
333
|
+
transports: passkey$1.transports?.split(",")
|
|
334
|
+
},
|
|
335
|
+
requireUserVerification: false
|
|
336
|
+
});
|
|
337
|
+
const { verified } = verification;
|
|
338
|
+
if (!verified) return ctx.render({
|
|
339
|
+
success: False,
|
|
340
|
+
message: ERROR_CODES.AUTHENTICATION_FAILED
|
|
341
|
+
}, 401);
|
|
342
|
+
await ctx.get("context").adapter.update({
|
|
343
|
+
model: "passkey",
|
|
344
|
+
where: [{
|
|
345
|
+
field: "id",
|
|
346
|
+
value: passkey$1.id
|
|
347
|
+
}],
|
|
348
|
+
update: { counter: verification.authenticationInfo.newCounter }
|
|
349
|
+
});
|
|
350
|
+
const s = await ctx.get("context").internalAdapter.createSession(passkey$1.userId);
|
|
351
|
+
if (!s) return ctx.render({
|
|
352
|
+
success: False,
|
|
353
|
+
message: ERROR_CODES.UNABLE_TO_CREATE_SESSION
|
|
354
|
+
}, 500);
|
|
355
|
+
const user = await ctx.get("context").internalAdapter.findUserById(passkey$1.userId);
|
|
356
|
+
if (!user) return ctx.render({
|
|
357
|
+
success: False,
|
|
358
|
+
message: "User not found"
|
|
359
|
+
}, 500);
|
|
360
|
+
await setSessionCookie(ctx, authOptions, {
|
|
361
|
+
session: s,
|
|
362
|
+
user
|
|
363
|
+
});
|
|
364
|
+
return ctx.render(s, 200);
|
|
365
|
+
} catch (e) {
|
|
366
|
+
ctx.get("context").logger.error("Failed to verify authentication", e);
|
|
367
|
+
return ctx.render({
|
|
368
|
+
success: False,
|
|
369
|
+
message: ERROR_CODES.AUTHENTICATION_FAILED
|
|
370
|
+
}, 400);
|
|
371
|
+
}
|
|
372
|
+
}),
|
|
373
|
+
listPasskeys: createEndpoint(createRoute({
|
|
374
|
+
operationId: "listPasskeys",
|
|
375
|
+
method: "get",
|
|
376
|
+
path: "/passkey/list-user-passkeys",
|
|
377
|
+
description: "List all passkeys for the authenticated user",
|
|
378
|
+
middleware: [sessionMiddleware()],
|
|
379
|
+
responses: res(z$1.array(passkeySchema).openapi({ description: "Array of passkey objects associated with the user" }).transform(toSuccess)).err(401).bld()
|
|
380
|
+
}), (_authOptions) => async (ctx) => {
|
|
381
|
+
const session = ctx.get("session");
|
|
382
|
+
const passkeys = await ctx.get("context").adapter.findMany({
|
|
383
|
+
model: "passkey",
|
|
384
|
+
where: [{
|
|
385
|
+
field: "userId",
|
|
386
|
+
value: session.user.id
|
|
387
|
+
}]
|
|
388
|
+
});
|
|
389
|
+
return ctx.render(passkeys, 200);
|
|
390
|
+
}),
|
|
391
|
+
deletePasskey: createEndpoint(createRoute({
|
|
392
|
+
operationId: "deletePasskey",
|
|
393
|
+
method: "post",
|
|
394
|
+
path: "/passkey/delete-passkey",
|
|
395
|
+
description: "Delete a specific passkey",
|
|
396
|
+
middleware: [sessionMiddleware()],
|
|
397
|
+
request: req().bdy(z$1.object({ id: z$1.string().openapi({ description: "The ID of the passkey to delete. Eg: \"some-passkey-id\"" }) })).bld(),
|
|
398
|
+
responses: res(SCHEMAS[Definitions.SUCCESS].default, "Passkey deleted successfully").err(401).bld()
|
|
399
|
+
}), (_authOptions) => async (ctx) => {
|
|
400
|
+
await ctx.get("context").adapter.delete({
|
|
401
|
+
model: "passkey",
|
|
402
|
+
where: [{
|
|
403
|
+
field: "id",
|
|
404
|
+
value: ctx.req.valid("json").id
|
|
405
|
+
}]
|
|
406
|
+
});
|
|
407
|
+
return ctx.render({ success: True }, 200);
|
|
408
|
+
}),
|
|
409
|
+
updatePasskey: createEndpoint(createRoute({
|
|
410
|
+
operationId: "updatePasskey",
|
|
411
|
+
method: "post",
|
|
412
|
+
path: "/passkey/update-passkey",
|
|
413
|
+
description: "Update a specific passkey's name",
|
|
414
|
+
middleware: [sessionMiddleware()],
|
|
415
|
+
request: req().bdy(z$1.object({
|
|
416
|
+
id: z$1.string().openapi({ description: `The ID of the passkey which will be updated. Eg: \"passkey-id\"` }),
|
|
417
|
+
name: z$1.string().openapi({ description: `The new name which the passkey will be updated to. Eg: \"my-new-passkey-name\"` })
|
|
418
|
+
})).bld(),
|
|
419
|
+
responses: res(passkeySchema.transform(toSuccess)).err(401, "Invalid session or not allowed to register").err(404, "Passkey not found").err(500, "Failed to update passkey").bld()
|
|
420
|
+
}), (_authOptions) => async (ctx) => {
|
|
421
|
+
const session = ctx.get("session");
|
|
422
|
+
const { id, name } = ctx.req.valid("json");
|
|
423
|
+
const passkey$1 = await ctx.get("context").adapter.findOne({
|
|
424
|
+
model: "passkey",
|
|
425
|
+
where: [{
|
|
426
|
+
field: "id",
|
|
427
|
+
value: id
|
|
428
|
+
}]
|
|
429
|
+
});
|
|
430
|
+
if (!passkey$1) return ctx.render({
|
|
431
|
+
success: False,
|
|
432
|
+
message: ERROR_CODES.PASSKEY_NOT_FOUND
|
|
433
|
+
}, 404);
|
|
434
|
+
if (passkey$1.userId !== session.user.id) return ctx.render({
|
|
435
|
+
success: False,
|
|
436
|
+
message: ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY
|
|
437
|
+
}, 401);
|
|
438
|
+
const updatedPasskey = await ctx.get("context").adapter.update({
|
|
439
|
+
model: "passkey",
|
|
440
|
+
where: [{
|
|
441
|
+
field: "id",
|
|
442
|
+
value: id
|
|
443
|
+
}],
|
|
444
|
+
update: { name }
|
|
445
|
+
});
|
|
446
|
+
if (!updatedPasskey) return ctx.render({
|
|
447
|
+
success: False,
|
|
448
|
+
message: ERROR_CODES.FAILED_TO_UPDATE_PASSKEY
|
|
449
|
+
}, 500);
|
|
450
|
+
return ctx.render(updatedPasskey, 200);
|
|
451
|
+
})
|
|
452
|
+
},
|
|
453
|
+
schema: mergeSchema(schema, options?.schema),
|
|
454
|
+
$ERROR_CODES: ERROR_CODES
|
|
455
|
+
};
|
|
456
|
+
};
|
|
457
|
+
const schema = { passkey: { fields: {
|
|
458
|
+
name: {
|
|
459
|
+
type: "string",
|
|
460
|
+
required: false
|
|
461
|
+
},
|
|
462
|
+
publicKey: {
|
|
463
|
+
type: "string",
|
|
464
|
+
required: true
|
|
465
|
+
},
|
|
466
|
+
userId: {
|
|
467
|
+
type: "string",
|
|
468
|
+
references: {
|
|
469
|
+
model: "user",
|
|
470
|
+
field: "id"
|
|
471
|
+
},
|
|
472
|
+
required: true
|
|
473
|
+
},
|
|
474
|
+
credentialID: {
|
|
475
|
+
type: "string",
|
|
476
|
+
required: true
|
|
477
|
+
},
|
|
478
|
+
counter: {
|
|
479
|
+
type: "number",
|
|
480
|
+
required: true
|
|
481
|
+
},
|
|
482
|
+
deviceType: {
|
|
483
|
+
type: "string",
|
|
484
|
+
required: true
|
|
485
|
+
},
|
|
486
|
+
backedUp: {
|
|
487
|
+
type: "boolean",
|
|
488
|
+
required: true
|
|
489
|
+
},
|
|
490
|
+
transports: {
|
|
491
|
+
type: "string",
|
|
492
|
+
required: false
|
|
493
|
+
},
|
|
494
|
+
createdAt: {
|
|
495
|
+
type: "date",
|
|
496
|
+
required: false
|
|
497
|
+
},
|
|
498
|
+
aaguid: {
|
|
499
|
+
type: "string",
|
|
500
|
+
required: false
|
|
501
|
+
}
|
|
502
|
+
} } };
|
|
503
|
+
|
|
504
|
+
//#endregion
|
|
505
|
+
export { passkey as t };
|
|
@@ -0,0 +1,2 @@
|
|
|
1
|
+
import { a as Role, c as Subset, i as AccessControl, n as createAccessControl, o as Statements, r as role, s as SubArray, t as AuthorizeResponse } from "../../index-cs4Sh0En.cjs";
|
|
2
|
+
export { AccessControl, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };
|
|
@@ -0,0 +1,2 @@
|
|
|
1
|
+
import { a as Role, c as Subset, i as AccessControl, n as createAccessControl, o as Statements, r as role, s as SubArray, t as AuthorizeResponse } from "../../index-CTwrVluH.mjs";
|
|
2
|
+
export { AccessControl, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
const require_chunk = require('../chunk-oakRccI5.cjs');
|
|
2
|
+
require('../hono-Cdukwu5K.cjs');
|
|
3
|
+
require('../ip-B5SwXaMB.cjs');
|
|
4
|
+
require('../crypto-CcTxYH82.cjs');
|
|
5
|
+
require('../json-CcJ2HjGo.cjs');
|
|
6
|
+
require('../cookies-B5xeA6i8.cjs');
|
|
7
|
+
require('../logged-DQK3C64b.cjs');
|
|
8
|
+
require('../url-D2yvKaM7.cjs');
|
|
9
|
+
const require_middleware = require('../middleware-CWvRH4EW.cjs');
|
|
10
|
+
const require_session = require('../session-De9POJTW.cjs');
|
|
11
|
+
require('../origin-check-id9lTnqZ.cjs');
|
|
12
|
+
require('../email-verification-C-AsfJsb.cjs');
|
|
13
|
+
require('../state--f7fwIGh.cjs');
|
|
14
|
+
require('../request-CPNlp-DK.cjs');
|
|
15
|
+
require('../utils-44aDDP8f.cjs');
|
|
16
|
+
require('../schema-D-qjygfE.cjs');
|
|
17
|
+
require('../kysely-adapter-Bxi7sPdG.cjs');
|
|
18
|
+
require('../adapter-factory-DT-_2aHJ.cjs');
|
|
19
|
+
require('../db-BTKyYu-_.cjs');
|
|
20
|
+
require('../memory-adapter-BlnDIAAX.cjs');
|
|
21
|
+
require('../parser-CdncAl9i.cjs');
|
|
22
|
+
const require_access = require('../access-Crt-IJ2P.cjs');
|
|
23
|
+
const require_bearer = require('../bearer-CHeREcGT.cjs');
|
|
24
|
+
const require_plugins = require('../plugins-C1lm2Wj3.cjs');
|
|
25
|
+
const require_passkey = require('../passkey-B6N20LSS.cjs');
|
|
26
|
+
let __faire_auth_core_factory = require("@faire-auth/core/factory");
|
|
27
|
+
|
|
28
|
+
exports.TWO_FACTOR_ERROR_CODES = require_plugins.TWO_FACTOR_ERROR_CODES;
|
|
29
|
+
exports.USERNAME_ERROR_CODES = require_plugins.USERNAME_ERROR_CODES;
|
|
30
|
+
exports.bearer = require_bearer.bearer;
|
|
31
|
+
exports.createAccessControl = require_access.createAccessControl;
|
|
32
|
+
exports.createEndpoint = require_session.createEndpoint;
|
|
33
|
+
exports.createHook = require_middleware.createHook;
|
|
34
|
+
exports.createMiddleware = require_middleware.createMiddleware;
|
|
35
|
+
Object.defineProperty(exports, 'createRoute', {
|
|
36
|
+
enumerable: true,
|
|
37
|
+
get: function () {
|
|
38
|
+
return __faire_auth_core_factory.createRoute;
|
|
39
|
+
}
|
|
40
|
+
});
|
|
41
|
+
exports.magicLink = require_plugins.magicLink;
|
|
42
|
+
exports.oAuthProxy = require_plugins.oAuthProxy;
|
|
43
|
+
exports.organization = require_plugins.organization;
|
|
44
|
+
exports.parseRoles = require_plugins.parseRoles;
|
|
45
|
+
exports.passkey = require_passkey.passkey;
|
|
46
|
+
exports.role = require_access.role;
|
|
47
|
+
exports.twoFactor = require_plugins.twoFactor;
|
|
48
|
+
exports.twoFactorClient = require_plugins.twoFactorClient;
|
|
49
|
+
exports.username = require_plugins.username;
|