nid-webauthn-emulator 0.2.13 → 0.2.15

package/README.ja.md

@@ -62,11 +62,14 @@ const authenticator = new AuthenticatorEmulator({
     userPresent: false,
   },
   signCounterIncrement: 0,
+  hmacSecret: "hmac-secret-mc",
 });
 
 const webAuthnEmulator = new WebAuthnEmulator(authenticator);
 ```
 
+`hmacSecret` オプションは、WebAuthn の [PRF 拡張](https://www.w3.org/TR/webauthn-3/#prf-extension) の実装のバックエンドとなりうる CTAP2 拡張の有無を制御します。認証時にのみ評価するなら `"hmac-secret"`、登録時にも評価するなら（CTAP 2.2）`"hmac-secret-mc"`、拡張を使わないなら `"none"`（デフォルト）を指定します。
+
 `AuthenticatorEmulator` は FIDO2/CTAP の仕様のうち下記のコマンドを実装しています。
 
 - `authenticatorMakeCredential` (CTAP2) : 認証情報の作成
@@ -94,6 +97,12 @@ const authenticatorResponse = unpackMakeCredentialResponse(this.authenticator.co
 
 WebAuthn の著名なデモサイトである [webauthn.io](https://webauthn.io/) での使用例を示します。[統合テスト](spec/integration/integration.spec.ts) に実際にうごくテストコード例があります。
 
+webauthn.io の統合テストは外部サイトに依存するため、通常の `pnpm test` ではスキップされます。このテストだけを実行する場合は、下記のコマンドを利用してください。
+
+```sh
+pnpm test:webauthn-io
+```
+
 ```TypeScript
 // Origin および WebAuthn API エミュレータを初期化します
 // ここでは、https://webauthn.io を Origin として利用します
@@ -203,7 +212,7 @@ await page.evaluate(BrowserInjection.HookWebAuthnApis);
 
 ## ユニットテストでの WebAuthn API フック
 
-Vitest/Jest などで WebAuthn API を差し替えたい場合は、`src/test-utils/unit-test.ts` の `createPasskeysEmulator` を使うと `PublicKeyCredential` / `navigator.credentials` を簡単にモックできます。
+ユニットテストで WebAuthn API を差し替えたい場合は、`src/test-utils/unit-test.ts` の `createPasskeysEmulator` を使うと `PublicKeyCredential` / `navigator.credentials` を簡単にモックできます。
 
 ```TypeScript
 import { createPasskeysEmulator } from "nid-webauthn-emulator";

package/README.md

@@ -63,11 +63,14 @@ const authenticator = new AuthenticatorEmulator({
     userPresent: false,
   },
   signCounterIncrement: 0,
+  hmacSecret: "hmac-secret-mc",
 });
 
 const webAuthnEmulator = new WebAuthnEmulator(authenticator);
 ```
 
+The `hmacSecret` option controls the CTAP2 extension that backs the WebAuthn [PRF extension](https://www.w3.org/TR/webauthn-3/#prf-extension). Use `"hmac-secret"` to evaluate at authentication, `"hmac-secret-mc"` (CTAP 2.2) to also evaluate at registration, or `"none"` to disable (default).
+
 `AuthenticatorEmulator` implements the following commands from the FIDO2/CTAP specification:
 
 - `authenticatorMakeCredential` (CTAP2): Creating credentials
@@ -95,6 +98,12 @@ const authenticatorResponse = unpackMakeCredentialResponse(this.authenticator.co
 
 Here's an example of usage with [webauthn.io](https://webauthn.io/), a well-known WebAuthn demo site. You can find working test code examples in the [integration tests](spec/integration/integration.spec.ts).
 
+The webauthn.io integration test is skipped by the default `pnpm test` command because it depends on an external site. To run only that test, use:
+
+```sh
+pnpm test:webauthn-io
+```
+
 ```TypeScript
 // Initialize the Origin and WebAuthn API emulator
 // Here we use https://webauthn.io as the Origin
@@ -212,7 +221,7 @@ This ensures that the `WebAuthnEmulator` methods defined earlier with `exposeFun
 
 ## Hooking WebAuthn APIs in Unit Tests
 
-If you want to swap out WebAuthn APIs in Vitest/Jest, you can mock `PublicKeyCredential` / `navigator.credentials` using `createPasskeysEmulator` from `src/test-utils/unit-test.ts`.
+If you want to swap out WebAuthn APIs in unit tests, you can mock `PublicKeyCredential` / `navigator.credentials` using `createPasskeysEmulator` from `src/test-utils/unit-test.ts`.
 
 ```TypeScript
 import { createPasskeysEmulator } from "nid-webauthn-emulator";

package/dist/spec/authenticator/authenticator-emulator.spec.js

@@ -3,24 +3,26 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const globals_1 = require("@jest/globals");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
 const src_1 = require("../../src");
 const ctap_model_1 = require("../../src/authenticator/ctap-model");
 const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
 const credentials_memory_repository_1 = require("../../src/repository/credentials-memory-repository");
-(0, globals_1.describe)("Authenticator Emulator Exceptional Test", () => {
+const webauthn_model_1 = require("../../src/webauthn/webauthn-model");
+(0, node_test_1.describe)("Authenticator Emulator Exceptional Test", () => {
     // Success case has been tested in the webauthn-emulator.spec.ts
-    (0, globals_1.test)("Unknown command _ CTAP Error", async () => {
+    (0, node_test_1.test)("Unknown command _ CTAP Error", async () => {
         const testRequest = {
             command: ctap_model_1.CTAP_COMMAND.authenticatorReset,
         };
         const authenticator = new src_1.AuthenticatorEmulator();
-        (0, globals_1.expect)(() => {
+        strict_1.default.throws(() => {
             authenticator.command(testRequest);
-        }).toThrow("CTAP error: CTAP1_ERR_INVALID_COMMAND (1)");
+        }, { message: "CTAP error: CTAP1_ERR_INVALID_COMMAND (1)" });
     });
 });
-(0, globals_1.describe)("Authenticator Credential Management Tests", () => {
+(0, node_test_1.describe)("Authenticator Credential Management Tests", () => {
     let authenticator;
     let repository;
     // Test data
@@ -41,7 +43,7 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
         name: "user3",
         displayName: "User Three",
     };
-    (0, globals_1.beforeEach)(() => {
+    (0, node_test_1.beforeEach)(() => {
         // Create a new repository for each test
         repository = new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository();
         // Create authenticator with the repository
@@ -64,8 +66,8 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
         };
         authenticator.authenticatorMakeCredential(makeCredentialRequest);
     }
-    (0, globals_1.describe)("enumerateCredentialsBegin", () => {
-        (0, globals_1.test)("should return the total number of credentials for a specific RP", () => {
+    (0, node_test_1.describe)("enumerateCredentialsBegin", () => {
+        (0, node_test_1.test)("should return the total number of credentials for a specific RP", () => {
             // Create request for enumerateCredentialsBegin
             const request = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
@@ -76,19 +78,19 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
             // Execute the command
             const response = authenticator.authenticatorCredentialManagement(request);
             // Verify the response
-            (0, globals_1.expect)(response.totalCredentials).toBe(2); // We created 2 credentials for rpId1
+            strict_1.default.equal(response.totalCredentials, 2); // We created 2 credentials for rpId1
         });
-        (0, globals_1.test)("should throw an error if rpId is not provided", () => {
+        (0, node_test_1.test)("should throw an error if rpId is not provided", () => {
             // Create request without rpId
             const request = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
             };
             // Execute the command and expect an error
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(request);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
         });
-        (0, globals_1.test)("should return 0 credentials for an RP with no credentials", () => {
+        (0, node_test_1.test)("should return 0 credentials for an RP with no credentials", () => {
             // Create request for a non-existent RP
             const request = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
@@ -99,11 +101,11 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
             // Execute the command
             const response = authenticator.authenticatorCredentialManagement(request);
             // Verify the response
-            (0, globals_1.expect)(response.totalCredentials).toBe(0);
+            strict_1.default.equal(response.totalCredentials, 0);
         });
     });
-    (0, globals_1.describe)("enumerateCredentialsGetNextCredential", () => {
-        (0, globals_1.test)("should return credentials one by one", () => {
+    (0, node_test_1.describe)("enumerateCredentialsGetNextCredential", () => {
+        (0, node_test_1.test)("should return credentials one by one", () => {
             // First, call enumerateCredentialsBegin
             const beginRequest = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
@@ -118,34 +120,34 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
             };
             // Get first credential
             const response1 = authenticator.authenticatorCredentialManagement(getNextRequest);
-            (0, globals_1.expect)(response1.user).toBeDefined();
-            (0, globals_1.expect)(response1.credentialID).toBeDefined();
-            (0, globals_1.expect)(response1.publicKey).toBeDefined();
+            strict_1.default.notEqual(response1.user, undefined);
+            strict_1.default.notEqual(response1.credentialID, undefined);
+            strict_1.default.notEqual(response1.publicKey, undefined);
             // Get second credential
             const response2 = authenticator.authenticatorCredentialManagement(getNextRequest);
-            (0, globals_1.expect)(response2.user).toBeDefined();
-            (0, globals_1.expect)(response2.credentialID).toBeDefined();
-            (0, globals_1.expect)(response2.publicKey).toBeDefined();
+            strict_1.default.notEqual(response2.user, undefined);
+            strict_1.default.notEqual(response2.credentialID, undefined);
+            strict_1.default.notEqual(response2.publicKey, undefined);
             // Verify we got different credentials
             if (response1.credentialID && response2.credentialID) {
-                (0, globals_1.expect)(encode_utils_1.default.encodeBase64Url(response1.credentialID)).not.toBe(encode_utils_1.default.encodeBase64Url(response2.credentialID));
+                strict_1.default.notEqual(encode_utils_1.default.encodeBase64Url(response1.credentialID), encode_utils_1.default.encodeBase64Url(response2.credentialID));
             }
             // Verify we can't get more credentials
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(getNextRequest);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
         });
-        (0, globals_1.test)("should throw an error if called without calling enumerateCredentialsBegin first", () => {
+        (0, node_test_1.test)("should throw an error if called without calling enumerateCredentialsBegin first", () => {
             const getNextRequest = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsGetNextCredential,
             };
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(getNextRequest);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
         });
     });
-    (0, globals_1.describe)("updateUserInformation", () => {
-        (0, globals_1.test)("should update user information for all credentials of a user", () => {
+    (0, node_test_1.describe)("updateUserInformation", () => {
+        (0, node_test_1.test)("should update user information for all credentials of a user", () => {
             // Create updated user information
             const updatedUser = {
                 id: user1.id, // Same ID
@@ -178,33 +180,33 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
             // Find the credential for user1
             if (nextResponse.user &&
                 encode_utils_1.default.encodeBase64Url(nextResponse.user.id) === encode_utils_1.default.encodeBase64Url(user1.id)) {
-                (0, globals_1.expect)(nextResponse.user.name).toBe(updatedUser.name);
-                (0, globals_1.expect)(nextResponse.user.displayName).toBe(updatedUser.displayName);
+                strict_1.default.equal(nextResponse.user.name, updatedUser.name);
+                strict_1.default.equal(nextResponse.user.displayName, updatedUser.displayName);
             }
         });
-        (0, globals_1.test)("should throw an error if rpId is not provided", () => {
+        (0, node_test_1.test)("should throw an error if rpId is not provided", () => {
             const request = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
                 subCommandParams: {
                     user: user1,
                 },
             };
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(request);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
         });
-        (0, globals_1.test)("should throw an error if user is not provided", () => {
+        (0, node_test_1.test)("should throw an error if user is not provided", () => {
             const request = {
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
                 subCommandParams: {
                     rpId: rpId1,
                 },
             };
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(request);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
         });
-        (0, globals_1.test)("should throw an error if no credentials exist for the user", () => {
+        (0, node_test_1.test)("should throw an error if no credentials exist for the user", () => {
             const nonExistentUser = {
                 id: encode_utils_1.default.strToUint8Array("nonexistent-id"),
                 name: "nonexistent",
@@ -217,13 +219,13 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
                     user: nonExistentUser,
                 },
             };
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 authenticator.authenticatorCredentialManagement(request);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
         });
     });
-    (0, globals_1.describe)("authenticatorCredentialManagement with stateless authenticator", () => {
-        (0, globals_1.test)("should throw an error if authenticator is stateless", () => {
+    (0, node_test_1.describe)("authenticatorCredentialManagement with stateless authenticator", () => {
+        (0, node_test_1.test)("should throw an error if authenticator is stateless", () => {
             // Create a stateless authenticator
             const statelessAuthenticator = new src_1.AuthenticatorEmulator({
                 stateless: true,
@@ -236,76 +238,222 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
                 },
             };
             // Execute the command and expect an error
-            (0, globals_1.expect)(() => {
+            strict_1.default.throws(() => {
                 statelessAuthenticator.authenticatorCredentialManagement(request);
-            }).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            }, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
     });
-    (0, globals_1.describe)("Authenticator Credential Management additional error coverage", () => {
-        (0, globals_1.test)("dispatch default branch throws invalid command", () => {
+    (0, node_test_1.describe)("Authenticator Credential Management additional error coverage", () => {
+        (0, node_test_1.test)("dispatch default branch throws invalid command", () => {
             const authenticator = new src_1.AuthenticatorEmulator();
             // Build a CTAP request with an unknown subCommand to hit default branch
             const data = encode_utils_1.default.encodeCbor({ "1": -1 });
-            (0, globals_1.expect)(() => authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorCredentialManagement, data })).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_COMMAND));
+            strict_1.default.throws(() => authenticator.command({ command: ctap_model_1.CTAP_COMMAND.authenticatorCredentialManagement, data }), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_COMMAND));
         });
-        (0, globals_1.test)("enumerateCredentialsBegin without repository throws not allowed", () => {
+        (0, node_test_1.test)("enumerateCredentialsBegin without repository throws not allowed", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const req = (0, ctap_model_1.packCredentialManagementRequest)({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
                 subCommandParams: { rpId: "example.com" },
             });
-            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(() => authenticator.command(req), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
-        (0, globals_1.test)("updateUserInformation without repository throws not allowed", () => {
+        (0, node_test_1.test)("updateUserInformation without repository throws not allowed", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const req = (0, ctap_model_1.packCredentialManagementRequest)({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
                 subCommandParams: { rpId: "example.com", user: { id: new Uint8Array([1]), name: "n", displayName: "d" } },
             });
-            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(() => authenticator.command(req), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
-        (0, globals_1.test)("deleteCredential without repository throws not allowed", () => {
+        (0, node_test_1.test)("deleteCredential without repository throws not allowed", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const req = (0, ctap_model_1.packCredentialManagementRequest)({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
-            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(() => authenticator.command(req), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
-        (0, globals_1.test)("deleteCredential without credentialId throws invalid parameter", () => {
+        (0, node_test_1.test)("deleteCredential without credentialId throws invalid parameter", () => {
             const authenticator = new src_1.AuthenticatorEmulator();
             const req = (0, ctap_model_1.packCredentialManagementRequest)({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
-            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+            strict_1.default.throws(() => authenticator.command(req), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
         });
-        (0, globals_1.test)("deleteCredential for non-existent id throws no credentials", () => {
+        (0, node_test_1.test)("deleteCredential for non-existent id throws no credentials", () => {
             const authenticator = new src_1.AuthenticatorEmulator();
             const credentialId = encode_utils_1.default.strToUint8Array("non-existent-id");
             const req = (0, ctap_model_1.packCredentialManagementRequest)({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential,
                 subCommandParams: { credentialId },
             });
-            (0, globals_1.expect)(() => authenticator.command(req)).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
+            strict_1.default.throws(() => authenticator.command(req), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NO_CREDENTIALS));
         });
-        (0, globals_1.test)("private enumerateCredentialsBegin guard throws not allowed when repository missing", () => {
+        (0, node_test_1.test)("private enumerateCredentialsBegin guard throws not allowed when repository missing", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const target = authenticator.authenticatorEnumerateCredentialsBegin.bind(authenticator);
             const call = () => target({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.enumerateCredentialsBegin,
                 subCommandParams: { rpId: "x" },
             });
-            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(call, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
-        (0, globals_1.test)("private updateUserInformation guard throws not allowed when repository missing", () => {
+        (0, node_test_1.test)("private updateUserInformation guard throws not allowed when repository missing", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const target = authenticator.authenticatorUpdateUserInformation.bind(authenticator);
             const call = () => target({
                 subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.updateUserInformation,
                 subCommandParams: { rpId: "x", user: { id: new Uint8Array([1]), name: "n", displayName: "d" } },
             });
-            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(call, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
-        (0, globals_1.test)("private deleteCredential guard throws not allowed when repository missing", () => {
+        (0, node_test_1.test)("private deleteCredential guard throws not allowed when repository missing", () => {
             const authenticator = new src_1.AuthenticatorEmulator({ stateless: true });
             const target = authenticator.authenticatorDeleteCredential.bind(authenticator);
             const call = () => target({ subCommand: ctap_model_1.CREDENTIAL_MANAGEMENT_SUBCOMMAND.deleteCredential });
-            (0, globals_1.expect)(call).toThrow(new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
+            strict_1.default.throws(call, new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP2_ERR_NOT_ALLOWED));
         });
     });
 });
+(0, node_test_1.describe)("hmac-secret extension", () => {
+    const rpId = "example.com";
+    const user = { id: encode_utils_1.default.strToUint8Array("hmac-user"), name: "user", displayName: "User" };
+    const clientDataHash = new Uint8Array(32).fill(1);
+    const pubKeyCredParams = [{ type: "public-key", alg: -7 }];
+    const salt1 = new Uint8Array(32).fill(2);
+    const salt2 = new Uint8Array(32).fill(3);
+    function extensionOutput(authData) {
+        const extensions = (0, webauthn_model_1.unpackAuthenticatorData)(authData).extensions;
+        return extensions?.["hmac-secret"];
+    }
+    function assertUint8Array(value) {
+        if (!(value instanceof Uint8Array)) {
+            strict_1.default.fail("expected Uint8Array");
+        }
+    }
+    function credentialIdOf(authData) {
+        const attested = (0, webauthn_model_1.unpackAuthenticatorData)(authData).attestedCredentialData;
+        if (!attested)
+            throw new Error("expected attested credential data");
+        return attested.credentialId;
+    }
+    function makeCredential(authenticator, credUser, extensions) {
+        return authenticator.authenticatorMakeCredential({
+            clientDataHash,
+            rp: { id: rpId, name: rpId },
+            user: credUser,
+            pubKeyCredParams,
+            extensions,
+        });
+    }
+    function getAssertion(authenticator, credentialId, extensions) {
+        return authenticator.authenticatorGetAssertion({
+            rpId,
+            clientDataHash,
+            allowList: [{ type: "public-key", id: credentialId }],
+            extensions,
+        });
+    }
+    (0, node_test_1.test)("authenticator info returns enabled extensions", () => {
+        strict_1.default.equal(new src_1.AuthenticatorEmulator({ hmacSecret: "none" }).authenticatorGetInfo().extensions, undefined);
+        strict_1.default.deepEqual(new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret" }).authenticatorGetInfo().extensions, [
+            "hmac-secret",
+        ]);
+        strict_1.default.deepEqual(new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret-mc" }).authenticatorGetInfo().extensions, [
+            "hmac-secret",
+            "hmac-secret-mc",
+        ]);
+    });
+    (0, node_test_1.test)("hmac-secret makeCredential produces matching getAssertion output", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true });
+        strict_1.default.equal(extensionOutput(credential.authData), true);
+        const credentialId = credentialIdOf(credential.authData);
+        const output1 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        assertUint8Array(output1);
+        strict_1.default.equal(output1.length, 32);
+        const output2 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output2, output1);
+    });
+    (0, node_test_1.test)("hmac-secret-mc makeCredential produces matching getAssertion output", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret-mc",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        const output1 = extensionOutput(credential.authData);
+        assertUint8Array(output1);
+        const credentialId = credentialIdOf(credential.authData);
+        const output2 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output1, output2);
+        const output3 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output2, output3);
+    });
+    (0, node_test_1.test)("credRandom survives the stateless credentialId blob", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret-mc", stateless: true });
+        const make = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        const createOutput = extensionOutput(make.authData);
+        assertUint8Array(createOutput);
+        const credentialId = credentialIdOf(make.authData);
+        const assertOutput = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(assertOutput, createOutput);
+    });
+    (0, node_test_1.test)("output differs per salt and per credential", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const user2 = { id: encode_utils_1.default.strToUint8Array("hmac-user-2"), name: "user2", displayName: "User Two" };
+        const id1 = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        const id2 = credentialIdOf(makeCredential(authenticator, user2, { "hmac-secret": true }).authData);
+        const out1Salt1 = extensionOutput(getAssertion(authenticator, id1, { "hmac-secret": salt1 }).authData);
+        const out1Salt2 = extensionOutput(getAssertion(authenticator, id1, { "hmac-secret": salt2 }).authData);
+        const out2Salt1 = extensionOutput(getAssertion(authenticator, id2, { "hmac-secret": salt1 }).authData);
+        strict_1.default.notDeepEqual(out1Salt1, out1Salt2);
+        strict_1.default.notDeepEqual(out1Salt1, out2Salt1);
+    });
+    (0, node_test_1.test)("two salts produce the two concatenated outputs", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        const both = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": new Uint8Array([...salt1, ...salt2]) }).authData);
+        assertUint8Array(both);
+        strict_1.default.equal(both.length, 64);
+        const first = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        const second = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt2 }).authData);
+        strict_1.default.deepEqual(both.slice(0, 32), first);
+        strict_1.default.deepEqual(both.slice(32), second);
+    });
+    (0, node_test_1.test)("rejects a salt that is not 32 or 64 bytes", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        strict_1.default.throws(() => getAssertion(authenticator, credentialId, { "hmac-secret": new Uint8Array(33) }), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+    });
+    (0, node_test_1.test)("no output for a credential created without hmac-secret", () => {
+        let authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        let credentialId = credentialIdOf(makeCredential(authenticator, user).authData);
+        let output = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.equal(output, undefined);
+        authenticator = new src_1.AuthenticatorEmulator({
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        output = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.equal(output, undefined);
+    });
+    (0, node_test_1.test)("hmac-secret makeCredential ignores makeCredential salt", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        strict_1.default.equal(extensionOutput(credential.authData), true);
+    });
+});