passkey-kit 0.4.3 → 0.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "A helper library for creating and using passkey accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven",
   "license": "MIT",
@@ -12,7 +12,6 @@
     "@stellar/stellar-sdk": "12.1.0",
     "base64url": "^3.0.1",
     "buffer": "^6.0.3",
-    "cbor-x": "^1.5.9",
     "passkey-factory-sdk": "0.2.1",
     "passkey-kit-sdk": "0.2.1"
   },

package/src/base.ts

@@ -2,8 +2,8 @@ import { SorobanRpc, xdr } from "@stellar/stellar-sdk"
 import base64url from "base64url"
 
 export class PasskeyBase {
-    public rpc: SorobanRpc.Server
-    public rpcUrl: string
+    public rpc: SorobanRpc.Server | undefined
+    public rpcUrl: string | undefined
     public launchtubeUrl: string | undefined
     public launchtubeJwt: string | undefined
     public mercuryUrl: string | undefined
@@ -12,9 +12,7 @@ export class PasskeyBase {
     public mercuryPassword: string | undefined
 
     constructor(options: {
-        rpcUrl: string,
-        networkPassphrase: string,
-        factoryContractId: string,
+        rpcUrl?: string,
         launchtubeUrl?: string,
         launchtubeJwt?: string,
         mercuryUrl?: string,
@@ -53,8 +51,10 @@ export class PasskeyBase {
         if (!mercuryJwt && mercuryUrl && mercuryEmail && mercuryPassword)
             this.setMercuryJwt()
 
-        this.rpcUrl = rpcUrl
-        this.rpc = new SorobanRpc.Server(rpcUrl)
+        if (rpcUrl) {
+            this.rpcUrl = rpcUrl
+            this.rpc = new SorobanRpc.Server(rpcUrl)
+        }
     }
 
     public async setMercuryJwt() {
@@ -89,7 +89,7 @@ export class PasskeyBase {
     }
 
     public async getSigners(contractId: string) {
-        if (!this.mercuryUrl || !this.mercuryJwt)
+        if (!this.rpc || !this.mercuryUrl || !this.mercuryJwt)
             throw new Error('Mercury service not configured')
 
         const signers = await fetch(`${this.mercuryUrl}/zephyr/execute`, {

package/src/kit.ts

@@ -4,7 +4,6 @@ import { Address, StrKey, hash, xdr, Transaction, SorobanRpc, Operation, Transac
 import base64url from 'base64url'
 import { startRegistration, startAuthentication } from "@simplewebauthn/browser"
 import type { AuthenticatorAttestationResponseJSON } from "@simplewebauthn/types"
-import { decode } from 'cbor-x/decode'
 import { Buffer } from 'buffer'
 import { PasskeyBase } from './base'
 
@@ -29,6 +28,12 @@ export class PasskeyKit extends PasskeyBase {
 
         super(options)
 
+        if (!this.rpcUrl)
+            this.rpcUrl = rpcUrl
+
+        if (!this.rpc)
+            this.rpc = new SorobanRpc.Server(rpcUrl)
+
         this.networkPassphrase = networkPassphrase
         this.factory = new FactoryClient({
             contractId: factoryContractId,
@@ -82,7 +87,7 @@ export class PasskeyKit extends PasskeyBase {
             },
             pubKeyCredParams: [{ alg: -7, type: "public-key" }],
             attestation: "none",
-            timeout: 120_000
+            timeout: 120_000,
         });
 
         if (!this.keyId)
@@ -90,7 +95,7 @@ export class PasskeyKit extends PasskeyBase {
 
         return {
             keyId: base64url.toBuffer(id),
-            publicKey: this.getPublicKey(response)
+            publicKey: await this.getPublicKey(response)
         }
     }
 
@@ -109,7 +114,7 @@ export class PasskeyKit extends PasskeyBase {
                 timeout: 120_000
             });
 
-            console.log(response);
+            // console.log(response);
 
             keyId = response.id
         }
@@ -140,7 +145,7 @@ export class PasskeyKit extends PasskeyBase {
         // attempt passkey id derivation
         try {
             // TODO what is the error if the entry exists but is archived?
-            await this.rpc.getContractData(contractId, xdr.ScVal.scvLedgerKeyContractInstance())
+            await this.rpc!.getContractData(contractId, xdr.ScVal.scvLedgerKeyContractInstance())
         }
         // if that fails look up from the `getContractId` function
         catch {
@@ -172,7 +177,7 @@ export class PasskeyKit extends PasskeyBase {
         // Default mirrors DEFAULT_TIMEOUT (currently 5 minutes) https://github.com/stellar/js-stellar-sdk/blob/master/src/contract/utils.ts#L7
         let { keyId, ledgersToLive = 60 } = options || {}
 
-        const lastLedger = await this.rpc.getLatestLedger().then(({ sequence }) => sequence)
+        const lastLedger = await this.rpc!.getLatestLedger().then(({ sequence }) => sequence)
         const credentials = entry.credentials().address();
         const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
             new xdr.HashIdPreimageSorobanAuthorization({
@@ -295,7 +300,7 @@ export class PasskeyKit extends PasskeyBase {
                 await this.signAuthEntries(entries, options)
         }
 
-        const sim = await this.rpc.simulateTransaction(txn)
+        const sim = await this.rpc!.simulateTransaction(txn)
 
         if (
             SorobanRpc.Api.isSimulationError(sim)
@@ -311,30 +316,51 @@ export class PasskeyKit extends PasskeyBase {
             @Later
     */
 
-    private getPublicKey(response: AuthenticatorAttestationResponseJSON) {
+    private async getPublicKey(response: AuthenticatorAttestationResponseJSON) {
         let publicKey: Buffer | undefined
 
-        if (response.publicKey)
-            publicKey = base64url.toBuffer(response.publicKey).slice(response.publicKey.length - 65)
+        if (response.publicKey) {
+            publicKey = base64url.toBuffer(response.publicKey)
+            publicKey = publicKey!.slice(publicKey!.length - 65)
+        }
 
         if (
             !publicKey
             || publicKey[0] !== 0x04
             || publicKey.length !== 65
         ) {
-            // Extract and decode attestation object (CBOR), slice authenticator data to get COSE-encoded public key, and decode COSE to obtain key components
-            const { authData } = response.authenticatorData ? { authData: base64url.toBuffer(response.authenticatorData) } : decode(base64url.toBuffer(response.attestationObject));
-            const credentialIdLength = (authData[53] << 8) + authData[54];
-            const publicKeyBytes = authData.slice(55 + credentialIdLength);
-            const publicKeyCose = decode(publicKeyBytes);
+            let x: Buffer
+            let y: Buffer
+
+            if (response.authenticatorData) {
+                const authenticatorData = base64url.toBuffer(response.authenticatorData)
+                const credentialIdLength = (authenticatorData[53] << 8) | authenticatorData[54]
+
+                x = authenticatorData.slice(65 + credentialIdLength, 97 + credentialIdLength)
+                y = authenticatorData.slice(100 + credentialIdLength, 132 + credentialIdLength)
+            } else {
+                const attestationData = base64url.toBuffer(response.attestationObject)
+                
+                let startIndex = attestationData.indexOf(0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20)
+                    startIndex = startIndex + startIndex.length
+
+                x = attestationData.slice(startIndex, 32 + startIndex)
+                y = attestationData.slice(35 + startIndex, 67 + startIndex)
+            }
 
             publicKey = Buffer.from([
                 0x04, // (0x04 prefix) https://en.bitcoin.it/wiki/Elliptic_Curve_Digital_Signature_Algorithm
-                ...publicKeyCose['-2'],
-                ...publicKeyCose['-3']
+                ...x,
+                ...y
             ])
         }
 
+        /* TODO 
+            - We're doing some pretty "smart" public key decoding stuff so we should verify the signature against this final public key before assuming it's safe to use and save on-chain
+                Given that `startRegistration` doesn't produce a signature, verifying we've got the correct public key isn't really possible
+                @Later
+        */
+
         return publicKey
     }
 

package/types/base.d.ts

@@ -1,7 +1,7 @@
 import { SorobanRpc } from "@stellar/stellar-sdk";
 export declare class PasskeyBase {
-    rpc: SorobanRpc.Server;
-    rpcUrl: string;
+    rpc: SorobanRpc.Server | undefined;
+    rpcUrl: string | undefined;
     launchtubeUrl: string | undefined;
     launchtubeJwt: string | undefined;
     mercuryUrl: string | undefined;
@@ -9,9 +9,7 @@ export declare class PasskeyBase {
     mercuryEmail: string | undefined;
     mercuryPassword: string | undefined;
     constructor(options: {
-        rpcUrl: string;
-        networkPassphrase: string;
-        factoryContractId: string;
+        rpcUrl?: string;
         launchtubeUrl?: string;
         launchtubeJwt?: string;
         mercuryUrl?: string;