nebula-notebook 0.2.45 → 0.2.47

package/node-server/dist/routes/auth.js

@@ -1,11 +1,43 @@
 "use strict";
 /**
- * Auth Routes - API endpoints for 2FA authentication
+ * Auth Routes - API endpoints for 2FA (TOTP) and passkey (WebAuthn) login
+ *
+ * Public (no session required): /auth/status, /auth/verify,
+ * /auth/passkeys/login-options, /auth/passkeys/login.
+ * Everything else under /auth/passkeys requires a valid session — the auth
+ * middleware enforces that (see PUBLIC_ROUTES in auth-middleware.ts).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTrusted = parseTrusted;
 exports.default = authRoutes;
 const auth_service_1 = require("../auth/auth-service");
 const auth_middleware_1 = require("../auth/auth-middleware");
+const passkeys_1 = require("../auth/passkeys");
+/**
+ * Session length flag. Absent → long (30-day) session; only an explicit
+ * `false` (or "false"/0) asks for the 24 h one. Accepts both the historical
+ * `trustBrowser` key the UI sends and the shorter `trusted`.
+ */
+function parseTrusted(body) {
+    const b = body && typeof body === 'object' ? body : {};
+    const flag = b.trusted !== undefined ? b.trusted : b.trustBrowser;
+    if (flag === undefined || flag === null)
+        return true;
+    return !(flag === false || flag === 'false' || flag === 0 || flag === '0');
+}
+/** rpID/origin for this request, or a 400 reply (IP-literal host). */
+function rpInfoOrReply(request, reply) {
+    try {
+        return (0, passkeys_1.deriveRpInfo)(request.headers);
+    }
+    catch (err) {
+        if (err instanceof passkeys_1.PasskeyRpError) {
+            reply.code(400).send({ ok: false, error: err.message, code: err.code });
+            return null;
+        }
+        throw err;
+    }
+}
 async function authRoutes(fastify) {
     /**
      * GET /auth/status
@@ -26,7 +58,7 @@ async function authRoutes(fastify) {
      * Verify a TOTP code and issue a session token
      */
     fastify.post('/auth/verify', async (request, reply) => {
-        const { code, trustBrowser } = request.body;
+        const { code } = request.body ?? {};
         if (!code || typeof code !== 'string') {
             return reply.code(400).send({
                 error: 'invalid_request',
@@ -41,7 +73,7 @@ async function authRoutes(fastify) {
                 message: 'Code must be 6 digits',
             });
         }
-        const result = auth_service_1.authService.verifyCode(cleanCode, !!trustBrowser);
+        const result = auth_service_1.authService.verifyCode(cleanCode, parseTrusted(request.body));
         if (result.success) {
             // Persist token so MCP servers and CLI tools can auto-authenticate
             if (result.token)
@@ -58,4 +90,100 @@ async function authRoutes(fastify) {
             });
         }
     });
+    // ── Passkeys (WebAuthn) ───────────────────────────────────────────────────
+    /**
+     * POST /auth/passkeys/login-options  (public)
+     * A login challenge for the passkeys enrolled at this hostname, or
+     * `{ ok:false, error }` when there are none (the UI shows a hint).
+     */
+    fastify.post('/auth/passkeys/login-options', async (request, reply) => {
+        const rp = rpInfoOrReply(request, reply);
+        if (!rp)
+            return;
+        return reply.send(await passkeys_1.passkeyService.loginOptions(rp));
+    });
+    /**
+     * POST /auth/passkeys/login  (public, rate-limited like TOTP)
+     * Verify the assertion and issue the SAME session token TOTP issues, in the
+     * same response shape, so the client's login path is shared. Passkey login
+     * always gets the long (30-day) session — the device already proved itself.
+     */
+    fastify.post('/auth/passkeys/login', async (request, reply) => {
+        if (auth_service_1.authService.isAuthDisabled()) {
+            return reply.code(400).send({ success: false, error: 'Authentication is disabled on this server' });
+        }
+        const rp = rpInfoOrReply(request, reply);
+        if (!rp)
+            return;
+        const limit = auth_service_1.authService.checkRateLimit();
+        if (!limit.allowed) {
+            return reply.code(429).send({ success: false, error: `Too many attempts. Try again in ${limit.waitSeconds}s` });
+        }
+        const result = await passkeys_1.passkeyService.login(rp, request.body);
+        // `=== false` (not `!`): the root tsconfig has no strictNullChecks, where
+        // truthiness does not narrow a boolean discriminant.
+        if (result.ok === false) {
+            auth_service_1.authService.recordFailedAttempt();
+            return reply.code(401).send({ success: false, error: result.error });
+        }
+        auth_service_1.authService.clearFailedAttempts();
+        const token = auth_service_1.authService.issueToken(true);
+        (0, auth_middleware_1.persistSessionToken)(token);
+        return reply.send({ success: true, token });
+    });
+    /**
+     * POST /auth/passkeys/register-options  (authenticated)
+     */
+    fastify.post('/auth/passkeys/register-options', async (request, reply) => {
+        const rp = rpInfoOrReply(request, reply);
+        if (!rp)
+            return;
+        return reply.send(await passkeys_1.passkeyService.registerOptions(rp));
+    });
+    /**
+     * POST /auth/passkeys/register  (authenticated)
+     * Body: { token, response, label? }
+     */
+    fastify.post('/auth/passkeys/register', async (request, reply) => {
+        const rp = rpInfoOrReply(request, reply);
+        if (!rp)
+            return;
+        const result = await passkeys_1.passkeyService.register(rp, request.body);
+        if (result.ok === false) {
+            return reply.code(400).send(result);
+        }
+        return reply.send(result);
+    });
+    /**
+     * GET /auth/passkeys  (authenticated)
+     * Every enrolled passkey (never the public keys) plus this request's rpID so
+     * the UI can tell which ones apply to the address it is open at.
+     */
+    fastify.get('/auth/passkeys', async (request, reply) => {
+        let rpID = null;
+        let rpError = null;
+        try {
+            rpID = (0, passkeys_1.deriveRpInfo)(request.headers).rpID;
+        }
+        catch (err) {
+            if (!(err instanceof passkeys_1.PasskeyRpError))
+                throw err;
+            rpError = err.message; // listing still works; enrolling here will not
+        }
+        return reply.send({ ok: true, rpID, rpError, passkeys: passkeys_1.passkeyService.list() });
+    });
+    /**
+     * DELETE /auth/passkeys/:id  (authenticated)
+     */
+    fastify.delete('/auth/passkeys/:id', async (request, reply) => {
+        const { id } = request.params;
+        if (!id) {
+            return reply.code(400).send({ ok: false, error: 'Passkey id is required' });
+        }
+        const removed = passkeys_1.passkeyService.delete(id);
+        if (!removed) {
+            return reply.code(404).send({ ok: false, error: 'Passkey not found' });
+        }
+        return reply.send({ ok: true, removed: 1 });
+    });
 }

package/node-server/package.json

@@ -17,6 +17,7 @@
     "@fastify/static": "^9.0.0",
     "@fastify/websocket": "^11.2.0",
     "@homebridge/node-pty-prebuilt-multiarch": "^0.14.0",
+    "@simplewebauthn/server": "^13.3.3",
     "better-sqlite3": "^11.0.0",
     "fastify": "^5.8.2",
     "jsonwebtoken": "^9.0.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nebula-notebook",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "description": "AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP",
   "type": "module",
   "license": "MIT",
@@ -61,6 +61,7 @@
     "@fastify/static": "^9.0.0",
     "@fastify/websocket": "^11.2.0",
     "@homebridge/node-pty-prebuilt-multiarch": "^0.14.0",
+    "@simplewebauthn/server": "^13.3.3",
     "@xterm/addon-clipboard": "^0.2.0",
     "@xterm/addon-webgl": "^0.19.0",
     "better-sqlite3": "^11.0.0",
@@ -79,6 +80,7 @@
     "@codemirror/lang-python": "^6.2.1",
     "@jupyter-widgets/html-manager": "^1.0.14",
     "@playwright/test": "^1.57.0",
+    "@simplewebauthn/browser": "^13.3.0",
     "@tailwindcss/vite": "^4.2.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",