ox 1.2.0 → 1.3.0

package/src/core/_test/WebAuthn.test.ts

@@ -0,0 +1,766 @@
+import { runInNewContext } from 'node:vm'
+import { Bytes, Hex, WebAuthn } from 'ox'
+import { afterAll, beforeAll, describe, expect, test, vi } from 'vp/test'
+import type * as Types from '../../webauthn/Types.js'
+
+const challenge =
+  '0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f'
+const credentialId = 'AQID'
+const input = Bytes.fromHex(
+  '0x202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f',
+)
+const publicKey = Uint8Array.from([
+  48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61,
+  3, 1, 7, 3, 66, 0, 4, 171, 137, 20, 0, 20, 15, 196, 248, 233, 65, 206, 15,
+  249, 14, 65, 157, 233, 71, 10, 202, 202, 97, 59, 189, 113, 122, 71, 117, 67,
+  80, 49, 167, 216, 132, 49, 142, 145, 159, 211, 179, 229, 166, 49, 216, 102,
+  216, 163, 128, 180, 64, 99, 231, 15, 12, 56, 30, 225, 110, 6, 82, 247, 249,
+  117, 84,
+])
+
+beforeAll(() => {
+  vi.stubGlobal('window', {
+    document: {
+      title: 'Example',
+    },
+    location: {
+      hostname: 'example.com',
+    },
+  })
+})
+
+afterAll(() => {
+  vi.restoreAllMocks()
+})
+
+describe('createCredential', () => {
+  test('default', async () => {
+    let options: Types.CredentialCreationOptions | undefined
+    const output = Uint8Array.from({ length: 32 }, (_, index) => index + 64)
+
+    const result = await WebAuthn.createCredential({
+      authenticatorSelection: {
+        authenticatorAttachment: 'platform',
+        residentKey: 'required',
+      },
+      challenge,
+      createFn(options_) {
+        options = options_
+        return Promise.resolve(registrationCredential({ output }))
+      },
+      extensions: {
+        credProps: true,
+      },
+      name: 'Example',
+      prf: true,
+      rp: {
+        id: 'example.com',
+        name: 'Example',
+      },
+    })
+
+    expect({
+      credentialId: result.id,
+      prf: Hex.fromBytes(result.prf),
+    }).toMatchInlineSnapshot(`
+      {
+        "credentialId": "AQID",
+        "prf": "0x404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f",
+      }
+    `)
+    expect(options?.publicKey?.authenticatorSelection).toMatchInlineSnapshot(`
+      {
+        "authenticatorAttachment": "platform",
+        "residentKey": "required",
+        "userVerification": "required",
+      }
+    `)
+    expect(options?.publicKey?.extensions).toMatchInlineSnapshot(`
+      {
+        "credProps": true,
+        "prf": {
+          "eval": {
+            "first": Uint8Array [
+              111,
+              120,
+              46,
+              119,
+              101,
+              98,
+              97,
+              117,
+              116,
+              104,
+              110,
+              46,
+              112,
+              114,
+              102,
+              46,
+              118,
+              49,
+            ],
+          },
+        },
+      }
+    `)
+    expect(options?.publicKey?.challenge).toMatchInlineSnapshot(`
+      Uint8Array [
+        0,
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        11,
+        12,
+        13,
+        14,
+        15,
+        16,
+        17,
+        18,
+        19,
+        20,
+        21,
+        22,
+        23,
+        24,
+        25,
+        26,
+        27,
+        28,
+        29,
+        30,
+        31,
+      ]
+    `)
+    expect(result.prf).not.toBe(output)
+  })
+
+  test('behavior: custom input', async () => {
+    let options: Types.CredentialCreationOptions | undefined
+    const customInput = input.slice()
+
+    await WebAuthn.createCredential({
+      createFn(options_) {
+        options = options_
+        return Promise.resolve(
+          registrationCredential({
+            output: new Uint8Array(32),
+          }),
+        )
+      },
+      name: 'Example',
+      prf: {
+        input: customInput,
+      },
+    })
+
+    const first = options?.publicKey?.extensions?.prf?.eval?.first
+    expect(first).toEqual(input)
+    expect(first).not.toBe(customInput)
+    expect(options?.publicKey?.authenticatorSelection).toMatchObject({
+      requireResidentKey: true,
+      residentKey: 'required',
+      userVerification: 'required',
+    })
+  })
+
+  test('behavior: without PRF', async () => {
+    let options: Types.CredentialCreationOptions | undefined
+    const credential = await WebAuthn.createCredential({
+      createFn(options_) {
+        options = options_
+        return Promise.resolve(registrationCredential({}))
+      },
+      name: 'Example',
+    })
+
+    expect(credential.id).toMatchInlineSnapshot(`"AQID"`)
+    expect(options?.publicKey?.extensions).toBeUndefined()
+  })
+
+  test('behavior: follow-up assertion', async () => {
+    let creationOptions: Types.CredentialCreationOptions | undefined
+    let options: Types.CredentialRequestOptions | undefined
+    const output = Uint8Array.from({ length: 32 }, (_, index) => index + 96)
+
+    const result = await WebAuthn.createCredential({
+      challenge,
+      createFn(options_) {
+        creationOptions = options_
+        return Promise.resolve(
+          registrationCredential({
+            enabled: true,
+          }),
+        )
+      },
+      getFn(options_) {
+        options = options_
+        return Promise.resolve(authenticationCredential({ output }))
+      },
+      name: 'Example',
+      prf: {
+        input,
+      },
+      rp: {
+        id: 'wallet.example.com',
+        name: 'Example',
+      },
+      timeout: 30_000,
+    })
+
+    expect(Hex.fromBytes(result.prf)).toMatchInlineSnapshot(
+      `"0x606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f"`,
+    )
+    expect(options?.publicKey).toMatchObject({
+      allowCredentials: [
+        {
+          id: Uint8Array.from([1, 2, 3]),
+          type: 'public-key',
+        },
+      ],
+      extensions: {
+        prf: {
+          eval: {
+            first: input,
+          },
+        },
+      },
+      rpId: 'wallet.example.com',
+      timeout: 30_000,
+      userVerification: 'required',
+    })
+    expect(creationOptions?.publicKey?.timeout).toBe(30_000)
+    expect(options?.publicKey?.challenge).toHaveLength(32)
+  })
+
+  test('behavior: plain array output', async () => {
+    const output = Array.from({ length: 32 }, (_, index) => index)
+    const result = await WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(registrationCredential({ output }))
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    expect(Hex.fromBytes(result.prf)).toMatchInlineSnapshot(
+      `"0x000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"`,
+    )
+  })
+
+  test('behavior: cross-realm ArrayBuffer output', async () => {
+    const output = runInNewContext('new ArrayBuffer(32)') as ArrayBuffer
+    const result = await WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(registrationCredential({ output }))
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    expect(output).not.toBeInstanceOf(ArrayBuffer)
+    expect(result.prf).toEqual(new Uint8Array(32))
+  })
+
+  test('error: unsupported credential is retained', async () => {
+    const promise = WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(
+          registrationCredential({
+            enabled: false,
+          }),
+        )
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.PrfNotSupportedError: The created credential does not support PRF evaluation.]`,
+    )
+    await expect(promise).rejects.toMatchObject({
+      credential: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: failed follow-up retains credential', async () => {
+    const promise = WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(
+          registrationCredential({
+            enabled: true,
+          }),
+        )
+      },
+      getFn() {
+        return Promise.resolve(null)
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(`
+      [WebAuthn.PrfEvaluationFailedError: Created a credential, but failed to evaluate its PRF.
+
+      Details: Failed to request credential.]
+    `)
+    await expect(promise).rejects.toMatchObject({
+      credential: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: follow-up credential mismatch', async () => {
+    const promise = WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(
+          registrationCredential({
+            enabled: true,
+          }),
+        )
+      },
+      getFn() {
+        return Promise.resolve(
+          authenticationCredential({
+            id: 'different',
+            output: new Uint8Array(32),
+          }),
+        )
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(`
+      [WebAuthn.PrfEvaluationFailedError: Created a credential, but failed to evaluate its PRF.
+
+      Details: Expected credential "AQID", but received "different".]
+    `)
+    await expect(promise).rejects.toMatchObject({
+      credential: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: invalid output size', async () => {
+    const promise = WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(
+          registrationCredential({
+            output: new Uint8Array(31),
+          }),
+        )
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidPrfOutputError: Expected a 32-byte PRF output, but received 31 bytes.]`,
+    )
+    await expect(promise).rejects.toMatchObject({
+      credential: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: extension result failure retains credential', async () => {
+    const promise = WebAuthn.createCredential({
+      createFn() {
+        return Promise.resolve(
+          registrationCredential({
+            error: new Error('extension result unavailable'),
+          }),
+        )
+      },
+      name: 'Example',
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(`
+      [WebAuthn.PrfEvaluationFailedError: Created a credential, but failed to evaluate its PRF.
+
+      Details: extension result unavailable]
+    `)
+    await expect(promise).rejects.toMatchObject({
+      credential: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: invalid plain array output', async () => {
+    const output = Array.from({ length: 32 }, () => 0)
+    output[31] = 256
+
+    await expect(() =>
+      WebAuthn.createCredential({
+        createFn() {
+          return Promise.resolve(registrationCredential({ output }))
+        },
+        name: 'Example',
+        prf: true,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidPrfOutputError: Expected a 32-byte PRF output.]`,
+    )
+  })
+
+  test('error: managed extension', async () => {
+    await expect(() =>
+      WebAuthn.createCredential({
+        extensions: {
+          prf: {
+            eval: {
+              first: input,
+            },
+          },
+        } as never,
+        name: 'Example',
+        prf: true,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidExtensionError: The \`prf\` extension is managed by this function.]`,
+    )
+  })
+
+  test('error: raw credential options', async () => {
+    await expect(() =>
+      WebAuthn.createCredential({
+        name: 'Example',
+        prf: true,
+        publicKey: {},
+      } as never),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidOptionsError: The \`publicKey\` option cannot be combined with managed PRF evaluation.]`,
+    )
+  })
+})
+
+describe('getCredential', () => {
+  test('default', async () => {
+    let options: Types.CredentialRequestOptions | undefined
+    const output = Uint8Array.from({ length: 32 }, (_, index) => index + 128)
+
+    const result = await WebAuthn.getCredential({
+      challenge,
+      credentialId,
+      extensions: {
+        appid: 'https://example.com',
+      },
+      getFn(options_) {
+        options = options_
+        return Promise.resolve(authenticationCredential({ output }))
+      },
+      prf: true,
+      rpId: 'example.com',
+    })
+
+    expect({
+      id: result.id,
+      prf: Hex.fromBytes(result.prf),
+    }).toMatchInlineSnapshot(`
+      {
+        "id": "AQID",
+        "prf": "0x808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f",
+      }
+    `)
+    expect(options?.publicKey?.extensions).toMatchInlineSnapshot(`
+      {
+        "appid": "https://example.com",
+        "prf": {
+          "eval": {
+            "first": Uint8Array [
+              111,
+              120,
+              46,
+              119,
+              101,
+              98,
+              97,
+              117,
+              116,
+              104,
+              110,
+              46,
+              112,
+              114,
+              102,
+              46,
+              118,
+              49,
+            ],
+          },
+        },
+      }
+    `)
+    expect(options?.publicKey?.userVerification).toMatchInlineSnapshot(
+      `"required"`,
+    )
+    expect(result.prf).not.toBe(output)
+  })
+
+  test('behavior: custom input', async () => {
+    let options: Types.CredentialRequestOptions | undefined
+    const customInput = input.slice()
+
+    await WebAuthn.getCredential({
+      getFn(options_) {
+        options = options_
+        return Promise.resolve(
+          authenticationCredential({
+            output: new Uint8Array(32),
+          }),
+        )
+      },
+      prf: {
+        input: customInput,
+      },
+    })
+
+    const first = options?.publicKey?.extensions?.prf?.eval?.first
+    expect(first).toEqual(input)
+    expect(first).not.toBe(customInput)
+  })
+
+  test('behavior: does not parse the assertion signature', async () => {
+    const result = await WebAuthn.getCredential({
+      getFn() {
+        return Promise.resolve({
+          ...authenticationCredential({
+            output: new Uint8Array(32),
+          }),
+          response: {},
+        } as Types.PublicKeyCredential)
+      },
+      prf: true,
+    })
+
+    expect(result.id).toMatchInlineSnapshot(`"AQID"`)
+  })
+
+  test('error: failed credential request', async () => {
+    await expect(() =>
+      WebAuthn.getCredential({
+        getFn() {
+          return Promise.resolve(null)
+        },
+        prf: true,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.GetCredentialFailedError: Failed to request credential.]`,
+    )
+  })
+
+  test('error: unavailable output retains response', async () => {
+    const promise = WebAuthn.getCredential({
+      getFn() {
+        return Promise.resolve(
+          authenticationCredential({
+            enabled: true,
+          }),
+        )
+      },
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.PrfUnavailableError: The credential did not return a PRF output.]`,
+    )
+    await expect(promise).rejects.toMatchObject({
+      response: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: invalid output size', async () => {
+    const promise = WebAuthn.getCredential({
+      getFn() {
+        return Promise.resolve(
+          authenticationCredential({
+            output: new Uint8Array(33),
+          }),
+        )
+      },
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidPrfOutputError: Expected a 32-byte PRF output, but received 33 bytes.]`,
+    )
+    await expect(promise).rejects.toMatchObject({
+      response: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: extension result failure retains response', async () => {
+    const promise = WebAuthn.getCredential({
+      getFn() {
+        return Promise.resolve(
+          authenticationCredential({
+            error: new Error('extension result unavailable'),
+          }),
+        )
+      },
+      prf: true,
+    })
+
+    await expect(promise).rejects.toThrowErrorMatchingInlineSnapshot(`
+      [WebAuthn.PrfEvaluationFailedError: Failed to evaluate the credential PRF.
+
+      Details: extension result unavailable]
+    `)
+    await expect(promise).rejects.toMatchObject({
+      response: {
+        id: credentialId,
+      },
+    })
+  })
+
+  test('error: managed extension', async () => {
+    await expect(() =>
+      WebAuthn.getCredential({
+        extensions: {
+          prf: {
+            eval: {
+              first: input,
+            },
+          },
+        } as never,
+        prf: true,
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidExtensionError: The \`prf\` extension is managed by this function.]`,
+    )
+  })
+
+  test('error: raw credential options', async () => {
+    await expect(() =>
+      WebAuthn.getCredential({
+        prf: true,
+        publicKey: {},
+      } as never),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[WebAuthn.InvalidOptionsError: The \`publicKey\` option cannot be combined with managed PRF evaluation.]`,
+    )
+  })
+})
+
+function authenticationCredential({
+  enabled,
+  error,
+  id = credentialId,
+  output,
+}: {
+  enabled?: boolean | undefined
+  error?: Error | undefined
+  id?: string | undefined
+  output?: ArrayLike<number> | Types.BufferSource | undefined
+}) {
+  const authenticatorData = new Uint8Array(37)
+  const clientDataJSON = Bytes.fromString(
+    '{"type":"webauthn.get","challenge":"AA","origin":"https://example.com"}',
+  )
+  const signature = Uint8Array.from([48, 6, 2, 1, 1, 2, 1, 1])
+  return {
+    authenticatorAttachment: null,
+    getClientExtensionResults() {
+      if (error) throw error
+      if (output)
+        return {
+          prf: {
+            enabled,
+            results: {
+              first: output,
+            },
+          },
+        }
+      return {
+        prf: {
+          enabled,
+        },
+      }
+    },
+    id,
+    rawId: new ArrayBuffer(0),
+    response: {
+      authenticatorData: toArrayBuffer(authenticatorData),
+      clientDataJSON: toArrayBuffer(clientDataJSON),
+      signature: toArrayBuffer(signature),
+    },
+    type: 'public-key',
+  } as Types.PublicKeyCredential
+}
+
+function registrationCredential({
+  enabled,
+  error,
+  output,
+}: {
+  enabled?: boolean | undefined
+  error?: Error | undefined
+  output?: ArrayLike<number> | Types.BufferSource | undefined
+}) {
+  return {
+    authenticatorAttachment: null,
+    getClientExtensionResults() {
+      if (error) throw error
+      if (output)
+        return {
+          prf: {
+            enabled,
+            results: {
+              first: output,
+            },
+          },
+        }
+      return {
+        prf: {
+          enabled,
+        },
+      }
+    },
+    id: credentialId,
+    rawId: new ArrayBuffer(0),
+    response: {
+      attestationObject: new ArrayBuffer(0),
+      clientDataJSON: new ArrayBuffer(0),
+      getAuthenticatorData() {
+        return new ArrayBuffer(0)
+      },
+      getPublicKey() {
+        return toArrayBuffer(publicKey)
+      },
+      getPublicKeyAlgorithm() {
+        return -7
+      },
+      getTransports() {
+        return []
+      },
+    },
+    type: 'public-key',
+  } as Types.PublicKeyCredential
+}
+
+function toArrayBuffer(bytes: Uint8Array) {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer
+}