libre-webui 0.26.0 → 0.28.0

package/backend/dist/utils/totp.js

@@ -0,0 +1,117 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * RFC 6238 TOTP over RFC 4226 HOTP, implemented directly on node:crypto.
+ * Authenticator apps expect HMAC-SHA1, 30-second steps, and 6 digits; those
+ * are protocol constants here, not options.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+export const TOTP_STEP_SECONDS = 30;
+export const TOTP_DIGITS = 6;
+/** Accept the previous/next step to absorb clock skew. */
+export const TOTP_SKEW_STEPS = 1;
+export const encodeBase32 = (bytes) => {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+};
+export const decodeBase32 = (encoded) => {
+    const normalized = encoded.toUpperCase().replace(/[\s=-]/g, '');
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const character of normalized) {
+        const index = BASE32_ALPHABET.indexOf(character);
+        if (index === -1) {
+            throw new Error('Invalid base32 character');
+        }
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+};
+/** Generate a new 160-bit shared secret, base32-encoded for authenticator apps. */
+export const generateTotpSecret = () => encodeBase32(randomBytes(20));
+/** The otpauth:// provisioning URI understood by authenticator apps. */
+export const buildOtpauthUrl = (secret, accountName, issuer) => {
+    const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}`;
+    const query = new URLSearchParams({
+        secret,
+        issuer,
+        algorithm: 'SHA1',
+        digits: String(TOTP_DIGITS),
+        period: String(TOTP_STEP_SECONDS),
+    });
+    return `otpauth://totp/${label}?${query.toString()}`;
+};
+export const totpCodeForStep = (secret, step) => {
+    const key = decodeBase32(secret);
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(step));
+    const digest = createHmac('sha1', key).update(counter).digest();
+    const offset = digest[digest.length - 1] & 0x0f;
+    const binary = ((digest[offset] & 0x7f) << 24) |
+        (digest[offset + 1] << 16) |
+        (digest[offset + 2] << 8) |
+        digest[offset + 3];
+    return String(binary % 10 ** TOTP_DIGITS).padStart(TOTP_DIGITS, '0');
+};
+export const currentTotpStep = (nowMs = Date.now()) => Math.floor(nowMs / 1000 / TOTP_STEP_SECONDS);
+const codesEqual = (left, right) => {
+    const leftBuffer = Buffer.from(left, 'utf8');
+    const rightBuffer = Buffer.from(right, 'utf8');
+    return (leftBuffer.length === rightBuffer.length &&
+        timingSafeEqual(leftBuffer, rightBuffer));
+};
+/**
+ * Verify a submitted code within the skew window. Returns the matched
+ * timestep so the caller can persist it and refuse replays; null when the
+ * code does not match any step in the window.
+ */
+export const verifyTotpCode = (secret, submitted, nowMs = Date.now()) => {
+    const normalized = submitted.replace(/\s/g, '');
+    if (!/^\d{6}$/.test(normalized))
+        return null;
+    const current = currentTotpStep(nowMs);
+    for (let offset = -TOTP_SKEW_STEPS; offset <= TOTP_SKEW_STEPS; offset++) {
+        const step = current + offset;
+        if (step < 0)
+            continue;
+        if (codesEqual(totpCodeForStep(secret, step), normalized)) {
+            return step;
+        }
+    }
+    return null;
+};
+//# sourceMappingURL=totp.js.map

package/backend/dist/utils/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/utils/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE;IACpD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAc,EACd,WAAmB,EACnB,MAAc,EACN,EAAE;IACV,MAAM,KAAK,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,kBAAkB,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACtE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,iBAAiB,CAAC,CAAC;AAE/C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,SAAiB,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACH,EAAE;IACjB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,IAAI,MAAM,GAAG,CAAC,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC;QAC9B,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS;QACvB,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/backend/dist/utils/webauthn.d.ts

@@ -0,0 +1,47 @@
+export declare class WebAuthnError extends Error {
+}
+type CborValue = number | string | Buffer | CborValue[] | Map<number | string, CborValue> | boolean | null;
+/** Decode one CBOR item and report how many bytes it consumed. */
+export declare const decodeCbor: (buffer: Buffer) => {
+    value: CborValue;
+    bytesRead: number;
+};
+export interface ParsedAuthenticatorData {
+    rpIdHash: Buffer;
+    userPresent: boolean;
+    userVerified: boolean;
+    signCount: number;
+    credentialId: Buffer | null;
+    /** COSE public key map, present only with attested credential data. */
+    publicKey: Map<number | string, CborValue> | null;
+}
+export declare const parseAuthenticatorData: (authData: Buffer) => ParsedAuthenticatorData;
+export interface StoredPublicKey {
+    /** COSE algorithm: -7 = ES256, -8 = EdDSA (Ed25519), -257 = RS256. */
+    alg: number;
+    /**
+     * base64url key parameters. For EC2 keys `x`/`y` are the curve
+     * coordinates; for Ed25519 `x` is the key; for RSA `x` holds the
+     * modulus n and `y` the public exponent e.
+     */
+    x: string;
+    y?: string;
+}
+/** Extract the supported key material from a COSE public-key map. */
+export declare const extractPublicKey: (cose: Map<number | string, CborValue>) => StoredPublicKey;
+/** Verify a WebAuthn assertion signature over authData || sha256(clientData). */
+export declare const verifyAssertionSignature: (stored: StoredPublicKey, authData: Buffer, clientDataJson: Buffer, signature: Buffer) => boolean;
+export interface ParsedClientData {
+    type: string;
+    challenge: string;
+    origin: string;
+}
+export declare const parseClientDataJson: (clientDataJson: Buffer) => ParsedClientData;
+/** The registrable-domain rule: the origin's hostname must equal the RP id
+ * or be a subdomain of it. */
+export declare const originMatchesRpId: (origin: string, rpId: string) => boolean;
+/** Parse an attestation object far enough to reach authData ('none' policy). */
+export declare const parseAttestationObject: (attestationObject: Buffer) => Buffer;
+export declare const sha256: (input: string | Buffer) => Buffer;
+export {};
+//# sourceMappingURL=webauthn.d.ts.map

package/backend/dist/utils/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/utils/webauthn.ts"],"names":[],"mappings":"AAmCA,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAI3C,KAAK,SAAS,GACV,MAAM,GACN,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,GAC/B,OAAO,GACP,IAAI,CAAC;AAyGT,kEAAkE;AAClE,eAAO,MAAM,UAAU,WACb,MAAM,KACb;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAA4B,CAAC;AAIrE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;CACnD;AAED,eAAO,MAAM,sBAAsB,aACvB,MAAM,KACf,uBAuCF,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AASD,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,SACrB,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,KACpC,eA+CF,CAAC;AAwBF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,WAC3B,eAAe,YACb,MAAM,kBACA,MAAM,aACX,MAAM,KAChB,OAuBF,CAAC;AAIF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,mBAAmB,mBACd,MAAM,KACrB,gBAoBF,CAAC;AAEF;8BAC8B;AAC9B,eAAO,MAAM,iBAAiB,WAAY,MAAM,QAAQ,MAAM,KAAG,OAQhE,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,sBAAuB,MAAM,KAAG,MAUlE,CAAC;AAEF,eAAO,MAAM,MAAM,UAAW,MAAM,GAAG,MAAM,KAAG,MACH,CAAC"}

package/backend/dist/utils/webauthn.js

@@ -0,0 +1,323 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Minimal WebAuthn (passkey) server-side verification on node:crypto.
+ *
+ * Scope is deliberate: attestation is accepted as `none` (the statement is
+ * not evaluated — standard for consumer passkeys), and the algorithms
+ * browsers actually negotiate are supported: ES256 (COSE -7), EdDSA
+ * (COSE -8), and RS256 (COSE -257, required for TPM-backed Windows Hello).
+ * The bounded CBOR reader below decodes only the subset WebAuthn
+ * structures use: unsigned/negative integers, byte/text strings, arrays,
+ * and maps.
+ */
+import { createHash, createPublicKey, verify as cryptoVerify, } from 'node:crypto';
+export class WebAuthnError extends Error {
+}
+const MAX_CBOR_ITEMS = 1024;
+const readCbor = (buffer, offset, depth) => {
+    if (depth > 8)
+        throw new WebAuthnError('CBOR nesting too deep');
+    if (offset >= buffer.length)
+        throw new WebAuthnError('CBOR truncated');
+    const initial = buffer[offset];
+    const majorType = initial >> 5;
+    const additional = initial & 0x1f;
+    let length = 0;
+    let headerBytes = 1;
+    if (additional < 24) {
+        length = additional;
+    }
+    else if (additional === 24) {
+        if (offset + 2 > buffer.length)
+            throw new WebAuthnError('CBOR truncated');
+        length = buffer[offset + 1];
+        headerBytes = 2;
+    }
+    else if (additional === 25) {
+        if (offset + 3 > buffer.length)
+            throw new WebAuthnError('CBOR truncated');
+        length = buffer.readUInt16BE(offset + 1);
+        headerBytes = 3;
+    }
+    else if (additional === 26) {
+        if (offset + 5 > buffer.length)
+            throw new WebAuthnError('CBOR truncated');
+        length = buffer.readUInt32BE(offset + 1);
+        headerBytes = 5;
+    }
+    else if (additional === 27) {
+        if (offset + 9 > buffer.length)
+            throw new WebAuthnError('CBOR truncated');
+        const big = buffer.readBigUInt64BE(offset + 1);
+        if (big > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new WebAuthnError('CBOR value too large');
+        }
+        length = Number(big);
+        headerBytes = 9;
+    }
+    else {
+        throw new WebAuthnError('Unsupported CBOR additional info');
+    }
+    switch (majorType) {
+        case 0:
+            return { value: length, bytesRead: headerBytes };
+        case 1:
+            return { value: -1 - length, bytesRead: headerBytes };
+        case 2: {
+            const end = offset + headerBytes + length;
+            if (end > buffer.length)
+                throw new WebAuthnError('CBOR truncated');
+            return {
+                value: buffer.subarray(offset + headerBytes, end),
+                bytesRead: headerBytes + length,
+            };
+        }
+        case 3: {
+            const end = offset + headerBytes + length;
+            if (end > buffer.length)
+                throw new WebAuthnError('CBOR truncated');
+            return {
+                value: buffer.subarray(offset + headerBytes, end).toString('utf8'),
+                bytesRead: headerBytes + length,
+            };
+        }
+        case 4: {
+            if (length > MAX_CBOR_ITEMS)
+                throw new WebAuthnError('CBOR array too large');
+            const items = [];
+            let cursor = offset + headerBytes;
+            for (let index = 0; index < length; index++) {
+                const item = readCbor(buffer, cursor, depth + 1);
+                items.push(item.value);
+                cursor += item.bytesRead;
+            }
+            return { value: items, bytesRead: cursor - offset };
+        }
+        case 5: {
+            if (length > MAX_CBOR_ITEMS)
+                throw new WebAuthnError('CBOR map too large');
+            const map = new Map();
+            let cursor = offset + headerBytes;
+            for (let index = 0; index < length; index++) {
+                const key = readCbor(buffer, cursor, depth + 1);
+                cursor += key.bytesRead;
+                const value = readCbor(buffer, cursor, depth + 1);
+                cursor += value.bytesRead;
+                if (typeof key.value !== 'number' && typeof key.value !== 'string') {
+                    throw new WebAuthnError('Unsupported CBOR map key');
+                }
+                map.set(key.value, value.value);
+            }
+            return { value: map, bytesRead: cursor - offset };
+        }
+        case 7: {
+            if (additional === 20)
+                return { value: false, bytesRead: 1 };
+            if (additional === 21)
+                return { value: true, bytesRead: 1 };
+            if (additional === 22)
+                return { value: null, bytesRead: 1 };
+            throw new WebAuthnError('Unsupported CBOR simple value');
+        }
+        default:
+            throw new WebAuthnError('Unsupported CBOR major type');
+    }
+};
+/** Decode one CBOR item and report how many bytes it consumed. */
+export const decodeCbor = (buffer) => readCbor(buffer, 0, 0);
+export const parseAuthenticatorData = (authData) => {
+    if (authData.length < 37) {
+        throw new WebAuthnError('Authenticator data too short');
+    }
+    const rpIdHash = authData.subarray(0, 32);
+    const flags = authData[32];
+    const signCount = authData.readUInt32BE(33);
+    const attestedCredentialIncluded = (flags & 0x40) !== 0;
+    let credentialId = null;
+    let publicKey = null;
+    if (attestedCredentialIncluded) {
+        if (authData.length < 55) {
+            throw new WebAuthnError('Attested credential data too short');
+        }
+        const credentialIdLength = authData.readUInt16BE(53);
+        if (credentialIdLength === 0 || credentialIdLength > 1023) {
+            throw new WebAuthnError('Invalid credential id length');
+        }
+        const credentialIdEnd = 55 + credentialIdLength;
+        if (authData.length < credentialIdEnd) {
+            throw new WebAuthnError('Attested credential data truncated');
+        }
+        credentialId = authData.subarray(55, credentialIdEnd);
+        const key = readCbor(authData, credentialIdEnd, 0);
+        if (!(key.value instanceof Map)) {
+            throw new WebAuthnError('COSE public key is not a map');
+        }
+        publicKey = key.value;
+    }
+    return {
+        rpIdHash,
+        userPresent: (flags & 0x01) !== 0,
+        userVerified: (flags & 0x04) !== 0,
+        signCount,
+        credentialId,
+        publicKey,
+    };
+};
+const asBuffer = (value, name) => {
+    if (!Buffer.isBuffer(value)) {
+        throw new WebAuthnError(`COSE key is missing ${name}`);
+    }
+    return value;
+};
+/** Extract the supported key material from a COSE public-key map. */
+export const extractPublicKey = (cose) => {
+    const kty = cose.get(1);
+    const alg = cose.get(3);
+    if (alg === -7) {
+        if (kty !== 2 || cose.get(-1) !== 1) {
+            throw new WebAuthnError('ES256 requires an EC2 P-256 key');
+        }
+        const x = asBuffer(cose.get(-2), 'x');
+        const y = asBuffer(cose.get(-3), 'y');
+        if (x.length !== 32 || y.length !== 32) {
+            throw new WebAuthnError('Invalid P-256 coordinate length');
+        }
+        return {
+            alg: -7,
+            x: x.toString('base64url'),
+            y: y.toString('base64url'),
+        };
+    }
+    if (alg === -8) {
+        if (kty !== 1 || cose.get(-1) !== 6) {
+            throw new WebAuthnError('EdDSA requires an Ed25519 key');
+        }
+        const x = asBuffer(cose.get(-2), 'x');
+        if (x.length !== 32) {
+            throw new WebAuthnError('Invalid Ed25519 key length');
+        }
+        return { alg: -8, x: x.toString('base64url') };
+    }
+    if (alg === -257) {
+        if (kty !== 3) {
+            throw new WebAuthnError('RS256 requires an RSA key');
+        }
+        const n = asBuffer(cose.get(-1), 'n');
+        const e = asBuffer(cose.get(-2), 'e');
+        if (n.length < 256 || n.length > 512) {
+            throw new WebAuthnError('RSA modulus must be 2048-4096 bits');
+        }
+        if (e.length < 1 || e.length > 8) {
+            throw new WebAuthnError('Invalid RSA exponent length');
+        }
+        return {
+            alg: -257,
+            x: n.toString('base64url'),
+            y: e.toString('base64url'),
+        };
+    }
+    throw new WebAuthnError('Unsupported credential algorithm');
+};
+const publicKeyObject = (stored) => {
+    if (stored.alg === -7) {
+        return createPublicKey({
+            key: { kty: 'EC', crv: 'P-256', x: stored.x, y: stored.y },
+            format: 'jwk',
+        });
+    }
+    if (stored.alg === -8) {
+        return createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: stored.x },
+            format: 'jwk',
+        });
+    }
+    if (stored.alg === -257) {
+        return createPublicKey({
+            key: { kty: 'RSA', n: stored.x, e: stored.y },
+            format: 'jwk',
+        });
+    }
+    throw new WebAuthnError('Unsupported credential algorithm');
+};
+/** Verify a WebAuthn assertion signature over authData || sha256(clientData). */
+export const verifyAssertionSignature = (stored, authData, clientDataJson, signature) => {
+    const signedData = Buffer.concat([
+        authData,
+        createHash('sha256').update(clientDataJson).digest(),
+    ]);
+    const key = publicKeyObject(stored);
+    try {
+        if (stored.alg === -7) {
+            return cryptoVerify('sha256', signedData, { key, dsaEncoding: 'der' }, signature);
+        }
+        if (stored.alg === -257) {
+            // RSASSA-PKCS1-v1_5 with SHA-256 (node's default RSA padding).
+            return cryptoVerify('sha256', signedData, key, signature);
+        }
+        return cryptoVerify(null, signedData, key, signature);
+    }
+    catch {
+        return false;
+    }
+};
+export const parseClientDataJson = (clientDataJson) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(clientDataJson.toString('utf8'));
+    }
+    catch {
+        throw new WebAuthnError('clientDataJSON is not valid JSON');
+    }
+    const record = parsed;
+    if (typeof record.type !== 'string' ||
+        typeof record.challenge !== 'string' ||
+        typeof record.origin !== 'string') {
+        throw new WebAuthnError('clientDataJSON is missing required fields');
+    }
+    return {
+        type: record.type,
+        challenge: record.challenge,
+        origin: record.origin,
+    };
+};
+/** The registrable-domain rule: the origin's hostname must equal the RP id
+ * or be a subdomain of it. */
+export const originMatchesRpId = (origin, rpId) => {
+    let hostname;
+    try {
+        hostname = new URL(origin).hostname;
+    }
+    catch {
+        return false;
+    }
+    return hostname === rpId || hostname.endsWith(`.${rpId}`);
+};
+/** Parse an attestation object far enough to reach authData ('none' policy). */
+export const parseAttestationObject = (attestationObject) => {
+    const decoded = decodeCbor(attestationObject);
+    if (!(decoded.value instanceof Map)) {
+        throw new WebAuthnError('Attestation object is not a CBOR map');
+    }
+    const authData = decoded.value.get('authData');
+    if (!Buffer.isBuffer(authData)) {
+        throw new WebAuthnError('Attestation object is missing authData');
+    }
+    return authData;
+};
+export const sha256 = (input) => createHash('sha256').update(input).digest();
+//# sourceMappingURL=webauthn.js.map

package/backend/dist/utils/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/utils/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EACL,UAAU,EACV,eAAe,EACf,MAAM,IAAI,YAAY,GACvB,MAAM,aAAa,CAAC;AAErB,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAkB3C,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa,EAAY,EAAE;IAC3E,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,CAAC;IAElC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,UAAU,CAAC;IACtB,CAAC;SAAM,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1E,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5B,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1E,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1E,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,aAAa,CAAC,kCAAkC,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QACnD,KAAK,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QACxD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;YAC1C,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACnE,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW,EAAE,GAAG,CAAC;gBACjD,SAAS,EAAE,WAAW,GAAG,MAAM;aAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;YAC1C,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACnE,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClE,SAAS,EAAE,WAAW,GAAG,MAAM;aAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,IAAI,MAAM,GAAG,cAAc;gBACzB,MAAM,IAAI,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;YAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;YAC3B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,IAAI,MAAM,GAAG,cAAc;gBACzB,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;YAClD,IAAI,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;YAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC;gBACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;gBAC1B,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnE,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC;gBACtD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,IAAI,UAAU,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,UAAU,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YAC5D,IAAI,UAAU,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QACD;YACE,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EAC2B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAcrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAgB,EACS,EAAE;IAC3B,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,0BAA0B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAExD,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,SAAS,GAA2C,IAAI,CAAC;IAC7D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,kBAAkB,KAAK,CAAC,IAAI,kBAAkB,GAAG,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,eAAe,GAAG,EAAE,GAAG,kBAAkB,CAAC;QAChD,IAAI,QAAQ,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC1D,CAAC;QACD,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,YAAY,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAClC,SAAS;QACT,YAAY;QACZ,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AAgBF,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,IAAY,EAAU,EAAE;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAqC,EACpB,EAAE;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO;YACL,GAAG,EAAE,CAAC,CAAC;YACP,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1B,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,GAAG,EAAE,CAAC,GAAG;YACT,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1B,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAE,EAAE;IAClD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,eAAe,CAAC;YACrB,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;YAC1D,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,eAAe,CAAC;YACrB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;YAChD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC;YACrB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;YAC7C,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAuB,EACvB,QAAgB,EAChB,cAAsB,EACtB,SAAiB,EACR,EAAE;IACX,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,QAAQ;QACR,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,YAAY,CACjB,QAAQ,EACR,UAAU,EACV,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAC3B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxB,+DAA+D;YAC/D,OAAO,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,cAAsB,EACJ,EAAE;IACpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,kCAAkC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EACjC,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF;8BAC8B;AAC9B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAW,EAAE;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,iBAAyB,EAAU,EAAE;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAU,EAAE,CACvD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/backend/dist/websocketServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocketServer.d.ts","sourceRoot":"","sources":["../src/websocketServer.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,MAAM,CAAC;AAgIpD,eAAO,MAAM,wBAAwB,WAC3B,MAAM,GAAG,SAAS,iDAEzB,OAqBF,CAAC;AAuDF,MAAM,WAAW,0BAA0B;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AASD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GACb,0BAA0B,CAkjC5B"}
+{"version":3,"file":"websocketServer.d.ts","sourceRoot":"","sources":["../src/websocketServer.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,MAAM,CAAC;AAqIpD,eAAO,MAAM,wBAAwB,WAC3B,MAAM,GAAG,SAAS,iDAEzB,OAqBF,CAAC;AAuDF,MAAM,WAAW,0BAA0B;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AASD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GACb,0BAA0B,CA0jC5B"}

package/backend/dist/websocketServer.js

@@ -14,6 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { tryHandleScreenUpgrade, WORK_AUDIO_WS_PATH, WORK_SCREEN_WS_PATH, } from './workScreenServer.js';
 import { WebSocketServer } from 'ws';
 import ollamaService from './services/ollamaService.js';
 import chatService from './services/chatService.js';
@@ -830,6 +831,14 @@ export function registerWebSocketServer(server) {
             });
             return;
         }
+        if (pathname === WORK_SCREEN_WS_PATH || pathname === WORK_AUDIO_WS_PATH) {
+            if (!isAllowedWebSocketOrigin(request.headers.origin)) {
+                rejectUpgrade(socket, 403, 'WebSocket origin is not allowed');
+                return;
+            }
+            tryHandleScreenUpgrade(request, socket, head);
+            return;
+        }
         if (pathname === '/ws') {
             if (!isAllowedWebSocketOrigin(request.headers.origin)) {
                 rejectUpgrade(socket, 403, 'WebSocket origin is not allowed');