pgkiln 0.63.0 → 0.65.0

package/src/sharedlogin.ts

@@ -73,7 +73,7 @@ export async function useShared(req: FastifyRequest, reply: FastifyReply, a: Sha
     await owner.query('delete from meta.shared_login where token_hash = $1', [hash]);
     return clear(), null;
   }
-  if (row.method === 'password' && (await passwordDaysLeft(row.username)) === 0) return null;
+  if (row.method.split('+')[0] === 'password' && (await passwordDaysLeft(row.username)) === 0) return null;
   const access = await ssoAccess(a.id, row.username, row.groups);
   if (!access.allowed) return null; // no access to this app: its own sign-in page (the shared sign-in stays for the others)
   return { username: row.username, roles: access.roles, groups: row.groups, method: row.method, hash };

package/src/webauthn.ts

@@ -16,6 +16,26 @@ export const b64url = (b: Buffer | Uint8Array) => Buffer.from(b).toString('base6
 export const unb64url = (s: string) => Buffer.from(String(s ?? ''), 'base64url');
 export const newChallenge = () => b64url(randomBytes(32));
 
+const CHALLENGE_SECONDS = 300;
+type WithState = { state: Record<string, unknown> };
+
+/** A one-time challenge kept in the session (for this purpose only), or null when there is none or it expired. */
+export function takeChallenge(s: WithState, purpose: 'create' | 'get'): string | null {
+  try {
+    const p = JSON.parse(String(s.state.__PK ?? ''));
+    delete s.state.__PK;
+    return p && p.purpose === purpose && Date.now() - Number(p.at) < CHALLENGE_SECONDS * 1000 && typeof p.c === 'string' ? p.c : null;
+  } catch {
+    delete s.state.__PK;
+    return null;
+  }
+}
+export function giveChallenge(s: WithState, purpose: 'create' | 'get'): string {
+  const c = newChallenge();
+  s.state.__PK = JSON.stringify({ c, purpose, at: Date.now() });
+  return c;
+}
+
 // ------------------------------------------------------------------ CBOR (RFC 8949), only what WebAuthn uses
 
 type Cbor = number | bigint | string | Buffer | boolean | null | undefined | Cbor[] | Map<Cbor, Cbor>;