libre-webui 0.26.0 → 0.28.0

package/backend/dist/services/webPushService.js

@@ -0,0 +1,328 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Browser Web Push, implemented directly on node:crypto:
+ *
+ * - RFC 8291 payload encryption (ECDH P-256 + HKDF + aes128gcm, one record).
+ * - RFC 8292 VAPID authorization (ES256 JWT bound to the endpoint origin).
+ * - Per-device subscriptions encrypted at rest, bound to the auth session
+ *   that created them, and removed when that session is revoked.
+ *
+ * VAPID keys come from `VAPID_PUBLIC_KEY`/`VAPID_PRIVATE_KEY` (base64url,
+ * uncompressed point + raw scalar) or are generated once and persisted in
+ * system settings, encrypted. Deliveries go through the shared egress guard,
+ * so a subscription endpoint can never reach private address space.
+ */
+import { createCipheriv, createECDH, createPrivateKey, hkdfSync, randomBytes, randomUUID, sign as cryptoSign, } from 'node:crypto';
+import { isIP } from 'node:net';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { getSystemSetting, setSystemSetting } from './systemSettingsService.js';
+import { isAllowlistedPrivateHost, secureToolRequest, validateToolServerUrl, } from '../utils/toolEgress.js';
+import { isPublicIpAddress } from '../utils/webpageFetcher.js';
+import { registerSessionRevocationListener, } from './authSessionService.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:web-push');
+const repositories = () => getPersistence(encryptionService).repositories.resources;
+const MAX_SUBSCRIPTIONS_PER_USER = 10;
+const MAX_PAYLOAD_BYTES = 3800;
+const PUSH_TTL_SECONDS = 24 * 60 * 60;
+const VAPID_JWT_LIFETIME_SECONDS = 12 * 60 * 60;
+export class WebPushError extends Error {
+    constructor(message, statusCode = 400) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+/** The endpoint acknowledged but the subscription no longer exists. */
+export class PushSubscriptionGoneError extends Error {
+}
+let cachedKeys = null;
+const generateVapidKeys = () => {
+    const ecdh = createECDH('prime256v1');
+    ecdh.generateKeys();
+    return {
+        publicKey: ecdh.getPublicKey().toString('base64url'),
+        privateKey: ecdh.getPrivateKey().toString('base64url'),
+    };
+};
+const validKeyShape = (keys) => {
+    try {
+        const publicKey = Buffer.from(keys.publicKey, 'base64url');
+        const privateKey = Buffer.from(keys.privateKey, 'base64url');
+        return (publicKey.length === 65 &&
+            publicKey[0] === 0x04 &&
+            privateKey.length === 32);
+    }
+    catch {
+        return false;
+    }
+};
+export const getVapidKeys = async () => {
+    if (cachedKeys)
+        return cachedKeys;
+    const fromEnv = {
+        publicKey: process.env.VAPID_PUBLIC_KEY?.trim() ?? '',
+        privateKey: process.env.VAPID_PRIVATE_KEY?.trim() ?? '',
+    };
+    if (fromEnv.publicKey && fromEnv.privateKey) {
+        if (!validKeyShape(fromEnv)) {
+            throw new WebPushError('VAPID_PUBLIC_KEY/VAPID_PRIVATE_KEY are not valid base64url P-256 keys', 500);
+        }
+        cachedKeys = fromEnv;
+        return cachedKeys;
+    }
+    const stored = await getSystemSetting('web_push_vapid_keys');
+    if (stored) {
+        try {
+            const decoded = JSON.parse(encryptionService.decryptAuthenticated(stored));
+            if (validKeyShape(decoded)) {
+                cachedKeys = decoded;
+                return cachedKeys;
+            }
+        }
+        catch {
+            logger.warn('Stored VAPID keys were unreadable; regenerating');
+        }
+    }
+    const generated = generateVapidKeys();
+    await setSystemSetting('web_push_vapid_keys', encryptionService.encrypt(JSON.stringify(generated)));
+    cachedKeys = generated;
+    return cachedKeys;
+};
+export const getVapidPublicKey = async () => (await getVapidKeys()).publicKey;
+/** Raw P-256 scalar + point → a PEM/KeyObject for ES256 signing. */
+const vapidPrivateKeyObject = (keys) => {
+    const publicKey = Buffer.from(keys.publicKey, 'base64url');
+    return createPrivateKey({
+        key: {
+            kty: 'EC',
+            crv: 'P-256',
+            d: keys.privateKey,
+            x: publicKey.subarray(1, 33).toString('base64url'),
+            y: publicKey.subarray(33, 65).toString('base64url'),
+        },
+        format: 'jwk',
+    });
+};
+const base64UrlJson = (value) => Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+/** RFC 8292 VAPID JWT for one push-service origin. */
+export const buildVapidAuthorization = async (endpointOrigin) => {
+    const keys = await getVapidKeys();
+    const header = base64UrlJson({ typ: 'JWT', alg: 'ES256' });
+    const payload = base64UrlJson({
+        aud: endpointOrigin,
+        exp: Math.floor(Date.now() / 1000) + VAPID_JWT_LIFETIME_SECONDS,
+        sub: process.env.VAPID_SUBJECT?.trim() || 'mailto:admin@localhost',
+    });
+    const signature = cryptoSign('sha256', Buffer.from(`${header}.${payload}`, 'utf8'), { key: vapidPrivateKeyObject(keys), dsaEncoding: 'ieee-p1363' }).toString('base64url');
+    return `vapid t=${header}.${payload}.${signature}, k=${keys.publicKey}`;
+};
+/**
+ * Encrypt one push message with aes128gcm content encoding. Returns the
+ * complete request body (header block + single record).
+ */
+export const encryptPushPayload = (userAgentPublicKey, authSecret, plaintext, params = {}) => {
+    if (userAgentPublicKey.length !== 65 || userAgentPublicKey[0] !== 0x04) {
+        throw new WebPushError('Subscription p256dh key is not a P-256 point');
+    }
+    if (authSecret.length !== 16) {
+        throw new WebPushError('Subscription auth secret must be 16 bytes');
+    }
+    if (plaintext.length > MAX_PAYLOAD_BYTES) {
+        throw new WebPushError('Push payload is too large');
+    }
+    const ecdh = createECDH('prime256v1');
+    if (params.ephemeralPrivateKey) {
+        ecdh.setPrivateKey(params.ephemeralPrivateKey);
+    }
+    else {
+        ecdh.generateKeys();
+    }
+    const applicationServerPublicKey = ecdh.getPublicKey();
+    const sharedSecret = ecdh.computeSecret(userAgentPublicKey);
+    // RFC 8291 §3.3-3.4: combine the ECDH secret with the auth secret and both
+    // public keys, then derive the content key and nonce from a random salt.
+    const keyInfo = Buffer.concat([
+        Buffer.from('WebPush: info\0', 'utf8'),
+        userAgentPublicKey,
+        applicationServerPublicKey,
+    ]);
+    const inputKeyingMaterial = Buffer.from(hkdfSync('sha256', sharedSecret, authSecret, keyInfo, 32));
+    const salt = params.salt ?? randomBytes(16);
+    const contentEncryptionKey = Buffer.from(hkdfSync('sha256', inputKeyingMaterial, salt, Buffer.from('Content-Encoding: aes128gcm\0', 'utf8'), 16));
+    const nonce = Buffer.from(hkdfSync('sha256', inputKeyingMaterial, salt, Buffer.from('Content-Encoding: nonce\0', 'utf8'), 12));
+    const recordSize = Buffer.alloc(4);
+    recordSize.writeUInt32BE(4096);
+    const header = Buffer.concat([
+        salt,
+        recordSize,
+        Buffer.from([applicationServerPublicKey.length]),
+        applicationServerPublicKey,
+    ]);
+    const cipher = createCipheriv('aes-128-gcm', contentEncryptionKey, nonce);
+    const padded = Buffer.concat([plaintext, Buffer.from([0x02])]);
+    const ciphertext = Buffer.concat([
+        cipher.update(padded),
+        cipher.final(),
+        cipher.getAuthTag(),
+    ]);
+    return Buffer.concat([header, ciphertext]);
+};
+/* ------------------------------------------------------ subscriptions */
+const endpointLookup = (endpoint) => encryptionService.purposeLookupToken('push-endpoint', endpoint);
+const assertAcceptableEndpoint = (endpoint) => {
+    let url;
+    try {
+        url = validateToolServerUrl(endpoint);
+    }
+    catch {
+        throw new WebPushError('The push endpoint URL is not valid');
+    }
+    if (url.protocol !== 'https:') {
+        throw new WebPushError('Push endpoints must use HTTPS');
+    }
+    const literalHost = url.hostname.replace(/^\[|\]$/g, '');
+    if (isIP(literalHost) !== 0 &&
+        !isAllowlistedPrivateHost(url.hostname) &&
+        !isPublicIpAddress(literalHost)) {
+        throw new WebPushError('Push endpoints cannot target private or local addresses');
+    }
+    return url;
+};
+const decodeSubscriptionKey = (value, name, expectedLength) => {
+    if (typeof value !== 'string' || !value) {
+        throw new WebPushError(`Subscription ${name} key is required`);
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.length !== expectedLength) {
+        throw new WebPushError(`Subscription ${name} key has the wrong length`);
+    }
+    return decoded;
+};
+export const subscribe = async (userId, sessionId, input, userAgent) => {
+    const endpoint = typeof input.endpoint === 'string' ? input.endpoint : '';
+    if (!endpoint || endpoint.length > 2048) {
+        throw new WebPushError('The push endpoint URL is not valid');
+    }
+    assertAcceptableEndpoint(endpoint);
+    decodeSubscriptionKey(input.keys?.p256dh, 'p256dh', 65);
+    decodeSubscriptionKey(input.keys?.auth, 'auth', 16);
+    const existing = await repositories().pushSubscriptions.listByUser(userId);
+    const lookup = endpointLookup(endpoint);
+    const alreadyMine = existing.some(row => row.endpoint_lookup === lookup);
+    if (!alreadyMine && existing.length >= MAX_SUBSCRIPTIONS_PER_USER) {
+        throw new WebPushError(`At most ${MAX_SUBSCRIPTIONS_PER_USER} push subscriptions are supported per account`, 409);
+    }
+    const record = {
+        id: randomUUID(),
+        user_id: userId,
+        session_id: sessionId,
+        endpoint_lookup: lookup,
+        subscription: encryptionService.encrypt(JSON.stringify({
+            endpoint,
+            keys: { p256dh: input.keys?.p256dh, auth: input.keys?.auth },
+        })),
+        user_agent: userAgent?.slice(0, 512) ?? null,
+        created_at: Date.now(),
+        last_used_at: null,
+    };
+    await repositories().pushSubscriptions.upsertByEndpoint(record);
+    const stored = await repositories().pushSubscriptions.findByLookup(lookup);
+    return { id: stored?.id ?? record.id };
+};
+export const unsubscribe = async (userId, endpoint) => repositories().pushSubscriptions.deleteByLookup(userId, endpointLookup(endpoint));
+export const listSubscriptionsForUser = async (userId) => repositories().pushSubscriptions.listByUser(userId);
+/* ------------------------------------------------------------ delivery */
+const decryptSubscription = (record) => {
+    try {
+        const decoded = JSON.parse(encryptionService.decryptAuthenticated(record.subscription));
+        if (typeof decoded.endpoint === 'string' &&
+            typeof decoded.keys?.p256dh === 'string' &&
+            typeof decoded.keys?.auth === 'string') {
+            return decoded;
+        }
+    }
+    catch {
+        // Fall through: an unreadable envelope means the subscription is dead.
+    }
+    return null;
+};
+/**
+ * Deliver one message to one stored subscription. Returns false (and
+ * removes the row) when the push service reports the subscription gone.
+ */
+export const deliverToSubscription = async (subscriptionId, message, signal) => {
+    const record = await repositories().pushSubscriptions.findById(subscriptionId);
+    if (!record)
+        return { delivered: false };
+    const subscription = decryptSubscription(record);
+    if (!subscription) {
+        await repositories().pushSubscriptions.delete(record.id);
+        return { delivered: false };
+    }
+    const endpointUrl = assertAcceptableEndpoint(subscription.endpoint);
+    const body = encryptPushPayload(Buffer.from(subscription.keys.p256dh, 'base64url'), Buffer.from(subscription.keys.auth, 'base64url'), Buffer.from(JSON.stringify(message), 'utf8'));
+    const authorization = await buildVapidAuthorization(endpointUrl.origin);
+    const response = await secureToolRequest({
+        url: subscription.endpoint,
+        method: 'POST',
+        headers: {
+            Authorization: authorization,
+            TTL: String(PUSH_TTL_SECONDS),
+            'Content-Encoding': 'aes128gcm',
+            'Content-Type': 'application/octet-stream',
+            Urgency: 'normal',
+        },
+        body,
+        timeoutMs: 10000,
+        maxResponseBytes: 16 * 1024,
+        ...(signal ? { signal } : {}),
+    });
+    if (response.status === 404 || response.status === 410) {
+        await repositories().pushSubscriptions.delete(record.id);
+        throw new PushSubscriptionGoneError(`Push subscription is gone (${response.status})`);
+    }
+    if (response.status >= 200 && response.status < 300) {
+        await repositories().pushSubscriptions.touch(record.id, Date.now());
+        return { delivered: true, status: response.status };
+    }
+    return { delivered: false, status: response.status };
+};
+/* ---------------------------------------------------------- lifecycle */
+let revocationCleanupRegistered = false;
+/** Remove device subscriptions when their auth session is revoked. */
+export const registerPushSessionCleanup = () => {
+    if (revocationCleanupRegistered)
+        return;
+    revocationCleanupRegistered = true;
+    registerSessionRevocationListener((event) => {
+        void (async () => {
+            try {
+                for (const sessionId of event.sessionIds) {
+                    await repositories().pushSubscriptions.deleteForSession(sessionId);
+                }
+            }
+            catch (error) {
+                logger.warn('Push subscription cleanup after revocation failed', {
+                    error,
+                });
+            }
+        })();
+    });
+};
+//# sourceMappingURL=webPushService.js.map

package/backend/dist/services/webPushService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webPushService.js","sourceRoot":"","sources":["../../src/services/webPushService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,IAAI,IAAI,UAAU,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC;AAE3D,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YACE,OAAe,EACC,UAAU,GAAG,GAAG;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFC,UAAU;IAG5B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAgBvD,IAAI,UAAU,GAAqB,IAAI,CAAC;AAExC,MAAM,iBAAiB,GAAG,GAAc,EAAE;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,EAAE,CAAC;IACpB,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KACvD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAe,EAAW,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,EAAE;YACvB,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI;YACrB,UAAU,CAAC,MAAM,KAAK,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IACzD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,OAAO,GAAc;QACzB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE;QACrD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;KACxD,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,uEAAuE,EACvE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,OAAO,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,iBAAiB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAClC,CAAC;YACf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,UAAU,GAAG,OAAO,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,MAAM,gBAAgB,CACpB,qBAAqB,EACrB,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CACrD,CAAC;IACF,UAAU,GAAG,SAAS,CAAC;IACvB,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAqB,EAAE,CAC3D,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;AAEnC,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,CAAC,IAAe,EAAE,EAAE;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,OAAO;YACZ,CAAC,EAAE,IAAI,CAAC,UAAU;YAClB,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClD,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACpD;QACD,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE,CAC/C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEnE,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,cAAsB,EACL,EAAE;IACnB,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,0BAA0B;QAC/D,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,wBAAwB;KACnE,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,UAAU,CAC1B,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,EAC3C,EAAE,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAChE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,WAAW,MAAM,IAAI,OAAO,IAAI,SAAS,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;AAC1E,CAAC,CAAC;AAWF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,kBAA0B,EAC1B,UAAkB,EAClB,SAAiB,EACjB,MAAM,GAAkB,EAAE,EAClB,EAAE;IACV,IAAI,kBAAkB,CAAC,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC,2CAA2C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,0BAA0B,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACtC,kBAAkB;QAClB,0BAA0B;KAC3B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CACrC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,CAC1D,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,QAAQ,CACN,QAAQ,EACR,mBAAmB,EACnB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,EACpD,EAAE,CACH,CACF,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,QAAQ,CACN,QAAQ,EACR,mBAAmB,EACnB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,EAChD,EAAE,CACH,CACF,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI;QACJ,UAAU;QACV,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAChD,0BAA0B;KAC3B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,KAAK,EAAE;QACd,MAAM,CAAC,UAAU,EAAE;KACpB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0EAA0E;AAE1E,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAU,EAAE,CAClD,iBAAiB,CAAC,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AAElE,MAAM,wBAAwB,GAAG,CAAC,QAAgB,EAAO,EAAE;IACzD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IACE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QACvB,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,KAAc,EACd,IAAY,EACZ,cAAsB,EACd,EAAE;IACV,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,gBAAgB,IAAI,kBAAkB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CAAC,gBAAgB,IAAI,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,MAAc,EACd,SAAwB,EACxB,KAA0E,EAC1E,SAAwB,EACC,EAAE;IAC3B,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxD,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CACpB,WAAW,0BAA0B,+CAA+C,EACpF,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAiC;QAC3C,EAAE,EAAE,UAAU,EAAE;QAChB,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,MAAM;QACvB,YAAY,EAAE,iBAAiB,CAAC,OAAO,CACrC,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ;YACR,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;SAC7D,CAAC,CACH;QACD,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;QAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI;KACnB,CAAC;IACF,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAc,EACd,QAAgB,EACE,EAAE,CACpB,YAAY,EAAE,CAAC,iBAAiB,CAAC,cAAc,CAC7C,MAAM,EACN,cAAc,CAAC,QAAQ,CAAC,CACzB,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,MAAc,EAC2B,EAAE,CAC3C,YAAY,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAEtD,2EAA2E;AAE3E,MAAM,mBAAmB,GAAG,CAC1B,MAAoC,EACP,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,iBAAiB,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CACpC,CAAC;QAC1B,IACE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACpC,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ;YACxC,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EACtC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AASF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,cAAsB,EACtB,OAAoB,EACpB,MAAoB,EAC8B,EAAE;IACpD,MAAM,MAAM,GACV,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,kBAAkB,CAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAClD,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAC7C,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,GAAG,EAAE,YAAY,CAAC,QAAQ;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,aAAa;YAC5B,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC;YAC7B,kBAAkB,EAAE,WAAW;YAC/B,cAAc,EAAE,0BAA0B;YAC1C,OAAO,EAAE,QAAQ;SAClB;QACD,IAAI;QACJ,SAAS,EAAE,KAAM;QACjB,gBAAgB,EAAE,EAAE,GAAG,IAAI;QAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,yBAAyB,CACjC,8BAA8B,QAAQ,CAAC,MAAM,GAAG,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,0EAA0E;AAE1E,IAAI,2BAA2B,GAAG,KAAK,CAAC;AAExC,sEAAsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAS,EAAE;IACnD,IAAI,2BAA2B;QAAE,OAAO;IACxC,2BAA2B,GAAG,IAAI,CAAC;IACnC,iCAAiC,CAAC,CAAC,KAA6B,EAAE,EAAE;QAClE,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;oBACzC,MAAM,YAAY,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;oBAC/D,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/backend/dist/services/webauthnService.d.ts

@@ -0,0 +1,58 @@
+export declare class PasskeyError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode?: number);
+}
+/** The relying-party id and origin policy for a request host. */
+export declare const resolveRelyingParty: (requestHost: string) => {
+    rpId: string;
+};
+export interface PublicPasskey {
+    id: string;
+    name: string | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+export declare const listPasskeys: (userId: string) => Promise<PublicPasskey[]>;
+export declare const deletePasskey: (userId: string, passkeyId: string) => Promise<boolean>;
+export declare const deleteAllPasskeys: (userId: string) => Promise<number>;
+export declare const registrationOptions: (user: {
+    id: string;
+    username: string;
+}, requestHost: string) => Promise<{
+    challengeToken: string;
+    publicKey: Record<string, unknown>;
+}>;
+export interface RegistrationSubmission {
+    challengeToken: string;
+    name?: string;
+    credential: {
+        rawId: string;
+        response: {
+            clientDataJSON: string;
+            attestationObject: string;
+            transports?: string[];
+        };
+    };
+}
+export declare const registerPasskey: (userId: string, submission: RegistrationSubmission, requestHost: string) => Promise<PublicPasskey>;
+export declare const loginOptions: (requestHost: string) => Promise<{
+    challengeToken: string;
+    publicKey: Record<string, unknown>;
+}>;
+export interface AssertionSubmission {
+    challengeToken: string;
+    credential: {
+        rawId: string;
+        response: {
+            clientDataJSON: string;
+            authenticatorData: string;
+            signature: string;
+        };
+    };
+}
+/** Verify a passwordless sign-in assertion; returns the credential owner. */
+export declare const verifyPasskeyLogin: (submission: AssertionSubmission, requestHost: string) => Promise<{
+    userId: string;
+    passkeyId: string;
+}>;
+//# sourceMappingURL=webauthnService.d.ts.map

package/backend/dist/services/webauthnService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthnService.d.ts","sourceRoot":"","sources":["../../src/services/webauthnService.ts"],"names":[],"mappings":"AAyDA,qBAAa,YAAa,SAAQ,KAAK;aAGnB,UAAU;IAF5B,YACE,OAAO,EAAE,MAAM,EACC,UAAU,SAAM,EAGjC;CACF;AAyBD,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,gBAAiB,MAAM,KAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAQvE,CAAC;AAuEF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AASD,eAAO,MAAM,YAAY,WAAkB,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CACV,CAAC;AAElE,eAAO,MAAM,aAAa,WAChB,MAAM,aACH,MAAM,KAChB,OAAO,CAAC,OAAO,CAAqD,CAAC;AAExE,eAAO,MAAM,iBAAiB,WAAkB,MAAM,KAAG,OAAO,CAAC,MAAM,CACzB,CAAC;AAE/C,eAAO,MAAM,mBAAmB,SACxB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,eACzB,MAAM,KAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CA2CxE,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC;KACH,CAAC;CACH;AAED,eAAO,MAAM,eAAe,WAClB,MAAM,cACF,sBAAsB,eACrB,MAAM,KAClB,OAAO,CAAC,aAAa,CAgGvB,CAAC;AAEF,eAAO,MAAM,YAAY,gBACV,MAAM,KAClB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAYxE,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAC;YACvB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,eACjB,mBAAmB,eAClB,MAAM,KAClB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAqF/C,CAAC"}