nid-webauthn-emulator 0.2.2 → 0.2.4

package/README.md

@@ -125,13 +125,13 @@ import WebAuthnEmulator, {
   type PublicKeyCredentialRequestOptionsJSON,
 } from "nid-webauthn-emulator";
 
-async function startWebAuthnEmulator(page: Page, origin: string, debug = false) {
+async function startWebAuthnEmulator(page: Page, origin: string, debug = false, relatedOrigins: string[] = []) {
   const emulator = new WebAuthnEmulator();
 
   await page.exposeFunction(
     BrowserInjection.WebAuthnEmulatorCreate,
     async (optionsJSON: PublicKeyCredentialCreationOptionsJSON) => {
-      const response = emulator.createJSON(origin, optionsJSON);
+      const response = emulator.createJSON(origin, optionsJSON, relatedOrigins);
       return response;
     },
   );
@@ -139,7 +139,7 @@ async function startWebAuthnEmulator(page: Page, origin: string, debug = false)
   await page.exposeFunction(
     BrowserInjection.WebAuthnEmulatorGet,
     async (optionsJSON: PublicKeyCredentialRequestOptionsJSON) => {
-      const response = emulator.getJSON(origin, optionsJSON);
+      const response = emulator.getJSON(origin, optionsJSON, relatedOrigins);
       return response;
     },
   );
@@ -155,21 +155,23 @@ async function startWebAuthnEmulator(page: Page, origin: string, debug = false)
     BrowserInjection.WebAuthnEmulatorSignalAllAcceptedCredentials,
     async (options: AllAcceptedCredentialsOptionsJSON) => {
       emulator.signalAllAcceptedCredentials(options);
-    };
+    },
   );
 
   await page.exposeFunction(
     BrowserInjection.WebAuthnEmulatorSignalCurrentUserDetails,
     async (options: CurrentUserDetailsOptionsJSON) => {
       emulator.signalCurrentUserDetails(options);
-    };
+    },
   );
 }
 
 test.describe("Passkeys Tests", { tag: ["@daily"] }, () => {
   test("Passkeys login test", async ({ page }) => {
     // Page内で最初に1回だけ定義する exposed functions
-    await startWebAuthnEmulator(page, env, true);
+    // 必要に応じて関連オリジンを指定できます
+    const relatedOrigins = ["https://sub.example.com", "https://alt.example.com"];
+    await startWebAuthnEmulator(page, env, true, relatedOrigins);
     await page.goto("https://example.com/passkeys/login");
 
     // Passkeys の WebAuthn API をフック開始
@@ -184,6 +186,10 @@ test.describe("Passkeys Tests", { tag: ["@daily"] }, () => {
 - `window.webAuthnEmulatorGet`: `WebAuthnEmulator.getJSON` の Exposed Function
 - `window.webAuthnEmulatorCreate`: `WebAuthnEmulator.createJSON` の Exposed Function
 - `window.webAuthnEmulatorSignalUnknownCredential`: `WebAuthnEmulator.signalUnknownCredential` の Exposed Function
+- `window.webAuthnEmulatorSignalAllAcceptedCredentials`: `WebAuthnEmulator.signalAllAcceptedCredentials` の Exposed Function
+- `window.webAuthnEmulatorSignalCurrentUserDetails`: `WebAuthnEmulator.signalCurrentUserDetails` の Exposed Function
+
+さらに`startWebAuthnEmulator`関数は`relatedOrigins`パラメータをサポートしています。これにより、異なるオリジンからのリクエストでも同じRP IDを使用できるようになります。例えば、マルチドメイン環境（`example.com`と`sub.example.com`など）でPasskeysを使用する場合に便利です。`relatedOrigins` の値はRP IDで指定されたドメインでホストされた `/.well-known/webauthn` の内容と同じです。
 
 これらは Page グローバルに定義されるため、Page インスタンスにつき 1 回だけ定義する必要があります。
 

package/dist/spec/webauthn/webauthn-emulator.spec.js

@@ -337,6 +337,29 @@ const webauthn_test_server_1 = require("./webauthn-test-server");
         (0, globals_1.expect)(userCredentialsAfter.length).toBe(0);
     });
 });
+(0, globals_1.describe)("WebAuthnEmulator relatedOrigins Test", () => {
+    (0, globals_1.test)("Get with relatedOrigins _ OK with origin not matching rpId", async () => {
+        const user = { username: "test-related", id: "test-related" };
+        const emulator = new src_1.default();
+        // Origin is different from the RP ID
+        const testServer = new webauthn_test_server_1.WebAuthnTestServer("https://test-rp.com", "test-rp2.com");
+        const relatedOrigins = ["https://test-rp-a.com", "https://test-rp-b.com", "https://test-rp.com"];
+        // Register a credential
+        const regOptions = await testServer.getRegistrationOptions(user);
+        const credential = emulator.createJSON(testServer.origin, regOptions, relatedOrigins);
+        await testServer.getRegistrationVerification(user, credential);
+        // Create authentication options
+        const authOptions = await testServer.getAuthenticationOptions();
+        // Standard RP ID validation only
+        await (0, globals_1.expect)(async () => {
+            emulator.getJSON(testServer.origin, authOptions);
+        }).rejects.toThrow(src_1.InvalidRpIdError);
+        // Related origins validation
+        const authResponse = emulator.getJSON(testServer.origin, authOptions, relatedOrigins);
+        (0, globals_1.expect)(authResponse).toBeDefined();
+        (0, globals_1.expect)(authResponse.id).toBe(credential.id);
+    });
+});
 (0, globals_1.describe)("WebAuthnEmulator signalCurrentUserDetails Test", () => {
     (0, globals_1.test)("Signal Current User Details _ OK", async () => {
         // Create user

package/dist/src/webauthn/webauthn-emulator.d.ts

@@ -20,8 +20,8 @@ export declare class InvalidRpIdError extends WebAuthnEmulatorError {
 export declare class WebAuthnEmulator {
     authenticator: AuthenticatorEmulator;
     constructor(authenticator?: AuthenticatorEmulator);
-    getJSON(origin: string, optionsJSON: PublicKeyCredentialRequestOptionsJSON): AuthenticationResponseJSON;
-    createJSON(origin: string, optionsJSON: PublicKeyCredentialCreationOptionsJSON): RegistrationResponseJSON;
+    getJSON(origin: string, optionsJSON: PublicKeyCredentialRequestOptionsJSON, relatedOrigins?: string[]): AuthenticationResponseJSON;
+    createJSON(origin: string, optionsJSON: PublicKeyCredentialCreationOptionsJSON, relatedOrigins?: string[]): RegistrationResponseJSON;
     getAuthenticatorInfo(): AuthenticatorInfo;
     signalUnknownCredential(options: UnknownCredentialOptionsJSON): void;
     /**
@@ -39,7 +39,7 @@ export declare class WebAuthnEmulator {
      */
     signalCurrentUserDetails(options: CurrentUserDetailsOptionsJSON): void;
     /** @see https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get */
-    get(origin: string, options: CredentialRequestOptions): RequestPublicKeyCredential;
+    get(origin: string, options: CredentialRequestOptions, relatedOrigins?: string[]): RequestPublicKeyCredential;
     /** @see https://developer.mozilla.org/ja/docs/Web/API/CredentialsContainer/create */
-    create(origin: string, options: CredentialCreationOptions): CreatePublicKeyCredential;
+    create(origin: string, options: CredentialCreationOptions, relatedOrigins?: string[]): CreatePublicKeyCredential;
 }

package/dist/src/webauthn/webauthn-emulator.js

@@ -27,14 +27,14 @@ class WebAuthnEmulator {
     constructor(authenticator = new authenticator_emulator_1.AuthenticatorEmulator()) {
         this.authenticator = authenticator;
     }
-    getJSON(origin, optionsJSON) {
+    getJSON(origin, optionsJSON, relatedOrigins = []) {
         const options = (0, webauthn_model_json_1.parseRequestOptionsFromJSON)(optionsJSON);
-        const response = this.get(origin, { publicKey: options });
+        const response = this.get(origin, { publicKey: options }, relatedOrigins);
         return response.toJSON();
     }
-    createJSON(origin, optionsJSON) {
+    createJSON(origin, optionsJSON, relatedOrigins = []) {
         const options = (0, webauthn_model_json_1.parseCreationOptionsFromJSON)(optionsJSON);
-        const response = this.create(origin, { publicKey: options });
+        const response = this.create(origin, { publicKey: options }, relatedOrigins);
         return response.toJSON();
     }
     getAuthenticatorInfo() {
@@ -129,11 +129,11 @@ class WebAuthnEmulator {
         }));
     }
     /** @see https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get */
-    get(origin, options) {
+    get(origin, options, relatedOrigins = []) {
         if (!options.publicKey)
             throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
         const rpId = new webauthn_model_1.RpId(options.publicKey.rpId ?? new URL(origin).hostname);
-        if (!rpId.validate(origin))
+        if (!rpId.validate(origin, relatedOrigins))
             throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
         const clientData = {
             type: "webauthn.get",
@@ -170,11 +170,11 @@ class WebAuthnEmulator {
         return publicKeyCredential;
     }
     /** @see https://developer.mozilla.org/ja/docs/Web/API/CredentialsContainer/create */
-    create(origin, options) {
+    create(origin, options, relatedOrigins = []) {
         if (!options.publicKey)
             throw new NoPublicKeyError("PublicKeyCredentialCreationOptions are required");
         const rpId = new webauthn_model_1.RpId(options.publicKey.rp.id ?? new URL(origin).hostname);
-        if (!rpId.validate(origin))
+        if (!rpId.validate(origin, relatedOrigins))
             throw new InvalidRpIdError(`Invalid rpId: RP_ID=${rpId.value}, ORIGIN=${origin}`);
         const clientData = {
             challenge: encode_utils_1.default.encodeBase64Url(options.publicKey.challenge),

package/dist/src/webauthn/webauthn-model.d.ts

@@ -5,7 +5,7 @@ export declare class RpId {
     constructor(value: string);
     get hash(): Uint8Array;
     /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
-    validate(origin: string): boolean;
+    validate(origin: string, relatedOrigins?: string[]): boolean;
 }
 /** @see https://www.w3.org/TR/webauthn-3/#public-key-credential-source */
 export type PublicKeyCredentialSource = {

package/dist/src/webauthn/webauthn-model.js

@@ -25,14 +25,22 @@ class RpId {
         return new Uint8Array((0, node_crypto_1.createHash)("sha256").update(this.value).digest());
     }
     /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
-    validate(origin) {
+    validate(origin, relatedOrigins = []) {
         const parsedOrigin = (0, tldts_1.parse)(origin, { validHosts: ["localhost"] });
-        const parsedRpId = (0, tldts_1.parse)(this.value, { validHosts: ["localhost"] });
-        return Boolean(parsedOrigin.domain &&
-            parsedOrigin.subdomain !== null &&
-            parsedRpId.subdomain !== null &&
-            parsedOrigin.domain === parsedRpId.domain &&
-            parsedOrigin.subdomain.endsWith(parsedRpId.subdomain));
+        const expectedOrigins = [this.value, ...relatedOrigins];
+        // Check each origin using standard validation
+        for (const expectedOrigin of expectedOrigins) {
+            const parsedExpectedOrigin = (0, tldts_1.parse)(expectedOrigin, { validHosts: ["localhost"] });
+            const isValid = Boolean(parsedOrigin.domain &&
+                parsedOrigin.subdomain !== null &&
+                parsedExpectedOrigin.subdomain !== null &&
+                parsedOrigin.domain === parsedExpectedOrigin.domain &&
+                parsedOrigin.subdomain.endsWith(parsedExpectedOrigin.subdomain));
+            if (isValid) {
+                return true;
+            }
+        }
+        return false;
     }
 }
 exports.RpId = RpId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nid-webauthn-emulator",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "keywords": [
     "test",
     "e2e",
@@ -19,7 +19,7 @@
     "@jest/globals": "^29.7.0",
     "@simplewebauthn/server": "^13.1.1",
     "@tsconfig/recommended": "^1.0.8",
-    "@types/node": "^22.14.1",
+    "@types/node": "^22.15.17",
     "jest": "^29.7.0",
     "ts-jest": "^29.3.2",
     "ts-node": "^10.9.2",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "cbor": "^10.0.3",
-    "tldts": "^7.0.0"
+    "tldts": "^7.0.7"
   },
   "scripts": {
     "check": "biome check .",