nid-webauthn-emulator 0.2.14 → 0.2.16

package/README.ja.md

@@ -62,11 +62,14 @@ const authenticator = new AuthenticatorEmulator({
     userPresent: false,
   },
   signCounterIncrement: 0,
+  hmacSecret: "hmac-secret-mc",
 });
 
 const webAuthnEmulator = new WebAuthnEmulator(authenticator);
 ```
 
+`hmacSecret` オプションは、WebAuthn の [PRF 拡張](https://www.w3.org/TR/webauthn-3/#prf-extension) の実装のバックエンドとなりうる CTAP2 拡張の有無を制御します。認証時にのみ評価するなら `"hmac-secret"`、登録時にも評価するなら（CTAP 2.2）`"hmac-secret-mc"`、拡張を使わないなら `"none"`（デフォルト）を指定します。
+
 `AuthenticatorEmulator` は FIDO2/CTAP の仕様のうち下記のコマンドを実装しています。
 
 - `authenticatorMakeCredential` (CTAP2) : 認証情報の作成

package/README.md

@@ -63,11 +63,14 @@ const authenticator = new AuthenticatorEmulator({
     userPresent: false,
   },
   signCounterIncrement: 0,
+  hmacSecret: "hmac-secret-mc",
 });
 
 const webAuthnEmulator = new WebAuthnEmulator(authenticator);
 ```
 
+The `hmacSecret` option controls the CTAP2 extension that backs the WebAuthn [PRF extension](https://www.w3.org/TR/webauthn-3/#prf-extension). Use `"hmac-secret"` to evaluate at authentication, `"hmac-secret-mc"` (CTAP 2.2) to also evaluate at registration, or `"none"` to disable (default).
+
 `AuthenticatorEmulator` implements the following commands from the FIDO2/CTAP specification:
 
 - `authenticatorMakeCredential` (CTAP2): Creating credentials

package/dist/spec/authenticator/authenticator-emulator.spec.js

@@ -9,6 +9,7 @@ const src_1 = require("../../src");
 const ctap_model_1 = require("../../src/authenticator/ctap-model");
 const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
 const credentials_memory_repository_1 = require("../../src/repository/credentials-memory-repository");
+const webauthn_model_1 = require("../../src/webauthn/webauthn-model");
 (0, node_test_1.describe)("Authenticator Emulator Exceptional Test", () => {
     // Success case has been tested in the webauthn-emulator.spec.ts
     (0, node_test_1.test)("Unknown command _ CTAP Error", async () => {
@@ -310,3 +311,149 @@ const credentials_memory_repository_1 = require("../../src/repository/credential
         });
     });
 });
+(0, node_test_1.describe)("hmac-secret extension", () => {
+    const rpId = "example.com";
+    const user = { id: encode_utils_1.default.strToUint8Array("hmac-user"), name: "user", displayName: "User" };
+    const clientDataHash = new Uint8Array(32).fill(1);
+    const pubKeyCredParams = [{ type: "public-key", alg: -7 }];
+    const salt1 = new Uint8Array(32).fill(2);
+    const salt2 = new Uint8Array(32).fill(3);
+    function extensionOutput(authData) {
+        const extensions = (0, webauthn_model_1.unpackAuthenticatorData)(authData).extensions;
+        return extensions?.["hmac-secret"];
+    }
+    function assertUint8Array(value) {
+        if (!(value instanceof Uint8Array)) {
+            strict_1.default.fail("expected Uint8Array");
+        }
+    }
+    function credentialIdOf(authData) {
+        const attested = (0, webauthn_model_1.unpackAuthenticatorData)(authData).attestedCredentialData;
+        if (!attested)
+            throw new Error("expected attested credential data");
+        return attested.credentialId;
+    }
+    function makeCredential(authenticator, credUser, extensions) {
+        return authenticator.authenticatorMakeCredential({
+            clientDataHash,
+            rp: { id: rpId, name: rpId },
+            user: credUser,
+            pubKeyCredParams,
+            extensions,
+        });
+    }
+    function getAssertion(authenticator, credentialId, extensions) {
+        return authenticator.authenticatorGetAssertion({
+            rpId,
+            clientDataHash,
+            allowList: [{ type: "public-key", id: credentialId }],
+            extensions,
+        });
+    }
+    (0, node_test_1.test)("authenticator info returns enabled extensions", () => {
+        strict_1.default.equal(new src_1.AuthenticatorEmulator({ hmacSecret: "none" }).authenticatorGetInfo().extensions, undefined);
+        strict_1.default.deepEqual(new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret" }).authenticatorGetInfo().extensions, [
+            "hmac-secret",
+        ]);
+        strict_1.default.deepEqual(new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret-mc" }).authenticatorGetInfo().extensions, [
+            "hmac-secret",
+            "hmac-secret-mc",
+        ]);
+    });
+    (0, node_test_1.test)("hmac-secret makeCredential produces matching getAssertion output", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true });
+        strict_1.default.equal(extensionOutput(credential.authData), true);
+        const credentialId = credentialIdOf(credential.authData);
+        const output1 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        assertUint8Array(output1);
+        strict_1.default.equal(output1.length, 32);
+        const output2 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output2, output1);
+    });
+    (0, node_test_1.test)("hmac-secret-mc makeCredential produces matching getAssertion output", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret-mc",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        const output1 = extensionOutput(credential.authData);
+        assertUint8Array(output1);
+        const credentialId = credentialIdOf(credential.authData);
+        const output2 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output1, output2);
+        const output3 = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(output2, output3);
+    });
+    (0, node_test_1.test)("credRandom survives the stateless credentialId blob", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret-mc", stateless: true });
+        const make = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        const createOutput = extensionOutput(make.authData);
+        assertUint8Array(createOutput);
+        const credentialId = credentialIdOf(make.authData);
+        const assertOutput = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.deepEqual(assertOutput, createOutput);
+    });
+    (0, node_test_1.test)("output differs per salt and per credential", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const user2 = { id: encode_utils_1.default.strToUint8Array("hmac-user-2"), name: "user2", displayName: "User Two" };
+        const id1 = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        const id2 = credentialIdOf(makeCredential(authenticator, user2, { "hmac-secret": true }).authData);
+        const out1Salt1 = extensionOutput(getAssertion(authenticator, id1, { "hmac-secret": salt1 }).authData);
+        const out1Salt2 = extensionOutput(getAssertion(authenticator, id1, { "hmac-secret": salt2 }).authData);
+        const out2Salt1 = extensionOutput(getAssertion(authenticator, id2, { "hmac-secret": salt1 }).authData);
+        strict_1.default.notDeepEqual(out1Salt1, out1Salt2);
+        strict_1.default.notDeepEqual(out1Salt1, out2Salt1);
+    });
+    (0, node_test_1.test)("two salts produce the two concatenated outputs", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        const both = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": new Uint8Array([...salt1, ...salt2]) }).authData);
+        assertUint8Array(both);
+        strict_1.default.equal(both.length, 64);
+        const first = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        const second = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt2 }).authData);
+        strict_1.default.deepEqual(both.slice(0, 32), first);
+        strict_1.default.deepEqual(both.slice(32), second);
+    });
+    (0, node_test_1.test)("rejects a salt that is not 32 or 64 bytes", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        strict_1.default.throws(() => getAssertion(authenticator, credentialId, { "hmac-secret": new Uint8Array(33) }), new ctap_model_1.AuthenticationEmulatorError(ctap_model_1.CTAP_STATUS_CODE.CTAP1_ERR_INVALID_PARAMETER));
+    });
+    (0, node_test_1.test)("no output for a credential created without hmac-secret", () => {
+        let authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        let credentialId = credentialIdOf(makeCredential(authenticator, user).authData);
+        let output = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.equal(output, undefined);
+        authenticator = new src_1.AuthenticatorEmulator({
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        credentialId = credentialIdOf(makeCredential(authenticator, user, { "hmac-secret": true }).authData);
+        output = extensionOutput(getAssertion(authenticator, credentialId, { "hmac-secret": salt1 }).authData);
+        strict_1.default.equal(output, undefined);
+    });
+    (0, node_test_1.test)("hmac-secret makeCredential ignores makeCredential salt", () => {
+        const authenticator = new src_1.AuthenticatorEmulator({
+            hmacSecret: "hmac-secret",
+            credentialsRepository: new credentials_memory_repository_1.PasskeysCredentialsMemoryRepository(),
+        });
+        const credential = makeCredential(authenticator, user, { "hmac-secret": true, "hmac-secret-mc": salt1 });
+        strict_1.default.equal(extensionOutput(credential.authData), true);
+    });
+});

package/dist/spec/libs/browser-injection.spec.js

@@ -5,7 +5,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const strict_1 = __importDefault(require("node:assert/strict"));
 const node_test_1 = require("node:test");
+const authenticator_emulator_1 = require("../../src/authenticator/authenticator-emulator");
+const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
 const browser_injection_1 = require("../../src/test-utils/browser-injection");
+const webauthn_emulator_1 = require("../../src/webauthn/webauthn-emulator");
 (0, node_test_1.describe)("Browser Injection Test", () => {
     (0, node_test_1.test)("Browser Injection Test", async () => {
         const window = { navigator: { credentials: { create: undefined, get: undefined } } };
@@ -20,4 +23,45 @@ const browser_injection_1 = require("../../src/test-utils/browser-injection");
         strict_1.default.notEqual(window.navigator.credentials.get, undefined);
         strict_1.default.notEqual(PublicKeyCredential.signalUnknownCredential, undefined);
     });
+    // The hooked create/get run in-page, so every helper they reach must be exported.
+    (0, node_test_1.test)("hooked create and get round-trip prf through the emulator", async () => {
+        const origin = "https://test-rp.org";
+        const emulator = new webauthn_emulator_1.WebAuthnEmulator(new authenticator_emulator_1.AuthenticatorEmulator({ hmacSecret: "hmac-secret-mc" }));
+        const window = {
+            navigator: { credentials: { create: undefined, get: undefined } },
+            webAuthnEmulatorCreate: async (optionsJSON) => emulator.createJSON(origin, optionsJSON),
+            webAuthnEmulatorGet: async (optionsJSON) => emulator.getJSON(origin, optionsJSON),
+        };
+        const PublicKeyCredential = { isConditionalMediationAvailable: async () => false };
+        // biome-ignore lint/security/noGlobalEval: This is a test code.
+        eval(browser_injection_1.HookWebAuthnApis);
+        strict_1.default.ok(await PublicKeyCredential.isConditionalMediationAvailable());
+        const first = encode_utils_1.default.strToUint8Array("prf-input-first");
+        const create = window.navigator.credentials.create;
+        strict_1.default.ok(create);
+        const created = await create({
+            publicKey: {
+                rp: { id: "test-rp.org", name: "rp" },
+                user: { id: encode_utils_1.default.strToUint8Array("user"), name: "user", displayName: "user" },
+                challenge: encode_utils_1.default.strToUint8Array("challenge"),
+                pubKeyCredParams: [{ alg: -7, type: "public-key" }],
+                extensions: { prf: { eval: { first } } },
+            },
+        });
+        const createdPrf = created.getClientExtensionResults().prf?.results?.first;
+        strict_1.default.ok(createdPrf instanceof ArrayBuffer);
+        strict_1.default.equal(createdPrf.byteLength, 32);
+        const get = window.navigator.credentials.get;
+        strict_1.default.ok(get);
+        const asserted = await get({
+            publicKey: {
+                rpId: "test-rp.org",
+                challenge: encode_utils_1.default.strToUint8Array("challenge-2"),
+                extensions: { prf: { eval: { first } } },
+            },
+        });
+        const assertedPrf = asserted.getClientExtensionResults().prf?.results?.first;
+        strict_1.default.ok(assertedPrf instanceof ArrayBuffer);
+        strict_1.default.deepEqual(new Uint8Array(assertedPrf), new Uint8Array(createdPrf));
+    });
 });

package/dist/spec/libs/cbor.spec.js

@@ -62,6 +62,15 @@ const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
         strict_1.default.equal(encode_utils_1.default.decodeCbor(new Uint8Array([0x1b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00])), 0x1_0000_0000);
         strict_1.default.equal(encode_utils_1.default.decodeCbor(new Uint8Array([0xf6])), null);
     });
+    (0, node_test_1.test)("decodeCborWithRemainder returns the first value and trailing bytes", () => {
+        const first = encode_utils_1.default.encodeCbor({ 1: "a", [-2]: new Uint8Array([9, 9]) });
+        const second = encode_utils_1.default.encodeCbor({ 2: "b" });
+        const combined = new Uint8Array([...first, ...second]);
+        const { value, remainder } = encode_utils_1.default.decodeCborWithRemainder(combined);
+        strict_1.default.equal(value[1], "a");
+        strict_1.default.deepEqual(value[-2], new Uint8Array([9, 9]));
+        strict_1.default.deepEqual(remainder, second);
+    });
     (0, node_test_1.test)("rejects unsupported values and malformed input", () => {
         strict_1.default.throws(() => encode_utils_1.default.encodeCbor(Symbol("unsupported")), {
             message: "Unsupported CBOR value type: symbol",