thirdweb 5.45.2-nightly-b15aa4cdff3f3b233025da285780668a18fe29ab-20240813000336 → 5.46.0-nightly-d6e4898458ae0b7db99acb8a44f0730c18d6bdd9-20240815000344

package/src/wallets/in-app/core/authentication/passkeys.ts

@@ -0,0 +1,209 @@
+import type { ThirdwebClient } from "../../../../client/client.js";
+import { getThirdwebBaseUrl } from "../../../../utils/domains.js";
+import { getClientFetch } from "../../../../utils/fetch.js";
+import type { AsyncStorage } from "../../../../utils/storage/AsyncStorage.js";
+import type { Ecosystem } from "../../web/types.js";
+import { ClientScopedStorage } from "./client-scoped-storage.js";
+import type { AuthStoredTokenWithCookieReturnType } from "./types.js";
+
+function getVerificationPath() {
+  return `${getThirdwebBaseUrl(
+    "inAppWallet",
+  )}/api/2024-05-05/login/passkey/callback`;
+}
+function getChallengePath(type: "sign-in" | "sign-up", username?: string) {
+  return `${getThirdwebBaseUrl(
+    "inAppWallet",
+  )}/api/2024-05-05/login/passkey?type=${type}${
+    username ? `&username=${username}` : ""
+  }`;
+}
+
+export type RegisterResult = {
+  authenticatorData: string;
+  credentialId: string;
+  clientData: string;
+  credential: {
+    publicKey: string;
+    algorithm: string;
+  };
+  origin: string;
+};
+
+export type AuthenticateResult = {
+  credentialId: string;
+  authenticatorData: string;
+  clientData: string;
+  signature: string;
+  origin: string;
+};
+
+export type RpInfo = { name: string; id: string };
+
+export interface PasskeyClient {
+  register: (args: {
+    name: string;
+    challenge: string;
+    rp: RpInfo;
+  }) => Promise<RegisterResult>;
+  authenticate: (args: {
+    credentialId: string | undefined;
+    challenge: string;
+    rp: RpInfo;
+  }) => Promise<AuthenticateResult>;
+  isAvailable: () => boolean;
+}
+
+export async function registerPasskey(options: {
+  client: ThirdwebClient;
+  storage: AsyncStorage;
+  passkeyClient: PasskeyClient;
+  ecosystem?: Ecosystem;
+  username?: string;
+  rp: RpInfo;
+}): Promise<AuthStoredTokenWithCookieReturnType> {
+  if (!options.passkeyClient.isAvailable()) {
+    throw new Error("Passkeys are not available on this device");
+  }
+  const storage = new ClientScopedStorage({
+    storage: options.storage,
+    clientId: options.client.clientId,
+    ecosystemId: options.ecosystem?.id,
+  });
+  const fetchWithId = getClientFetch(options.client, options.ecosystem);
+  const generatedName = options.username ?? generateUsername(options.ecosystem);
+  // 1. request challenge from  server
+  const res = await fetchWithId(getChallengePath("sign-up", generatedName));
+  const challengeData = await res.json();
+  if (!challengeData.challenge) {
+    throw new Error("No challenge received");
+  }
+  const challenge = challengeData.challenge;
+
+  // 2. initiate registration
+  const registration = await options.passkeyClient.register({
+    name: generatedName,
+    challenge,
+    rp: options.rp,
+  });
+
+  const customHeaders: Record<string, string> = {};
+  if (options.ecosystem?.partnerId) {
+    customHeaders["x-ecosystem-partner-id"] = options.ecosystem.partnerId;
+  }
+  if (options.ecosystem?.id) {
+    customHeaders["x-ecosystem-id"] = options.ecosystem.id;
+  }
+
+  // 3. send the registration object to the server
+  const verifRes = await fetchWithId(getVerificationPath(), {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...customHeaders,
+    },
+    body: JSON.stringify({
+      type: "sign-up",
+      authenticatorData: registration.authenticatorData,
+      credentialId: registration.credentialId,
+      serverVerificationId: challengeData.serverVerificationId,
+      clientData: registration.clientData,
+      username: generatedName,
+      credential: {
+        publicKey: registration.credential.publicKey,
+        algorithm: registration.credential.algorithm,
+      },
+      origin: registration.origin,
+      rpId: options.rp.id,
+    }),
+  });
+  const verifData = await verifRes.json();
+
+  if (!verifData || !verifData.storedToken) {
+    throw new Error(
+      `Error verifying passkey: ${verifData.message ?? "unknown error"}`,
+    );
+  }
+  // 4. store the credentialId in local storage
+  await storage.savePasskeyCredentialId(registration.credentialId);
+
+  // 5. returns back the IAW authentication token
+  return verifData;
+}
+
+export async function loginWithPasskey(options: {
+  client: ThirdwebClient;
+  storage: AsyncStorage;
+  passkeyClient: PasskeyClient;
+  rp: RpInfo;
+  ecosystem?: Ecosystem;
+}): Promise<AuthStoredTokenWithCookieReturnType> {
+  if (!options.passkeyClient.isAvailable()) {
+    throw new Error("Passkeys are not available on this device");
+  }
+  const storage = new ClientScopedStorage({
+    storage: options.storage,
+    clientId: options.client.clientId,
+    ecosystemId: options.ecosystem?.id,
+  });
+  const fetchWithId = getClientFetch(options.client, options.ecosystem);
+  // 1. request challenge from  server/iframe
+  const res = await fetchWithId(getChallengePath("sign-in"));
+  const challengeData = await res.json();
+  if (!challengeData.challenge) {
+    throw new Error("No challenge received");
+  }
+  const challenge = challengeData.challenge;
+  // 1.2. find the user's credentialId in local storage
+  const credentialId = (await storage.getPasskeyCredentialId()) ?? undefined;
+  // 2. initiate login
+  const authentication = await options.passkeyClient.authenticate({
+    credentialId,
+    challenge,
+    rp: options.rp,
+  });
+
+  const customHeaders: Record<string, string> = {};
+  if (options.ecosystem?.partnerId) {
+    customHeaders["x-ecosystem-partner-id"] = options.ecosystem.partnerId;
+  }
+  if (options.ecosystem?.id) {
+    customHeaders["x-ecosystem-id"] = options.ecosystem.id;
+  }
+
+  const verifRes = await fetchWithId(getVerificationPath(), {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...customHeaders,
+    },
+    body: JSON.stringify({
+      type: "sign-in",
+      authenticatorData: authentication.authenticatorData,
+      credentialId: authentication.credentialId,
+      serverVerificationId: challengeData.serverVerificationId,
+      clientData: authentication.clientData,
+      signature: authentication.signature,
+      origin: authentication.origin,
+      rpId: options.rp.id,
+    }),
+  });
+
+  const verifData = await verifRes.json();
+
+  if (!verifData || !verifData.storedToken) {
+    throw new Error(
+      `Error verifying passkey: ${verifData.message ?? "unknown error"}`,
+    );
+  }
+
+  // 5. store the credentialId in local storage
+  await storage.savePasskeyCredentialId(authentication.credentialId);
+
+  // 6. return the auth'd user type
+  return verifData;
+}
+
+function generateUsername(ecosystem?: Ecosystem) {
+  return `${ecosystem?.id ?? "wallet"}-${new Date().toISOString()}`;
+}

package/src/wallets/in-app/core/authentication/siwe.ts

@@ -1,9 +1,9 @@
 import { signLoginPayload } from "../../../../auth/core/sign-login-payload.js";
 import type { LoginPayload } from "../../../../auth/core/types.js";
+import type { Chain } from "../../../../chains/types.js";
 import type { ThirdwebClient } from "../../../../client/client.js";
 import { getClientFetch } from "../../../../utils/fetch.js";
-import type { InjectedSupportedWalletIds } from "../../../../wallets/__generated__/wallet-ids.js";
-import { createWallet } from "../../../../wallets/create-wallet.js";
+import type { Wallet } from "../../../interfaces/wallet.js";
 import type { Ecosystem } from "../../web/types.js";
 import { getLoginCallbackUrl, getLoginUrl } from "./getLoginPath.js";
 import type { AuthStoredTokenWithCookieReturnType } from "./types.js";
@@ -12,23 +12,23 @@ import type { AuthStoredTokenWithCookieReturnType } from "./types.js";
  * @internal
  */
 export async function siweAuthenticate(args: {
-  walletId: InjectedSupportedWalletIds;
-  chainId: number;
+  wallet: Wallet;
+  chain: Chain;
   client: ThirdwebClient;
   ecosystem?: Ecosystem;
 }): Promise<AuthStoredTokenWithCookieReturnType> {
-  const wallet = createWallet(args.walletId);
+  const { wallet, chain } = args;
   const account = await wallet.connect({ client: args.client });
   const clientFetch = getClientFetch(args.client, args.ecosystem);
 
   const payload = await (async () => {
     const path = getLoginUrl({
-      authOption: "siwe",
+      authOption: "wallet",
       client: args.client,
       ecosystem: args.ecosystem,
     });
     const res = await clientFetch(
-      `${path}&address=${account.address}&chainId=${args.chainId}`,
+      `${path}&address=${account.address}&chainId=${chain.id}`,
     );
 
     if (!res.ok) throw new Error("Failed to generate SIWE login payload");
@@ -39,7 +39,7 @@ export async function siweAuthenticate(args: {
 
   const authResult = await (async () => {
     const path = getLoginCallbackUrl({
-      authOption: "siwe",
+      authOption: "wallet",
       client: args.client,
       ecosystem: args.ecosystem,
     });

package/src/wallets/in-app/core/authentication/types.ts

@@ -1,8 +1,8 @@
-import type { AuthType } from "@passwordless-id/webauthn/dist/esm/types.js";
+import type { Chain } from "../../../../chains/types.js";
 import type { ThirdwebClient } from "../../../../client/client.js";
 import type { Address } from "../../../../utils/address.js";
-import type { InjectedSupportedWalletIds } from "../../../../wallets/__generated__/wallet-ids.js";
 import type { Account } from "../../../interfaces/wallet.js";
+import type { Wallet } from "../../../interfaces/wallet.js";
 import type { AuthOption, SocialAuthOption } from "../../../types.js";
 import type { Ecosystem } from "../../web/types.js";
 
@@ -37,14 +37,28 @@ export type SingleStepAuthArgsType =
   | { strategy: "iframe" }
   | {
       strategy: "passkey";
+      /**
+       * Whether to create a new passkey (sign up) or login to an existing one (sign in).
+       * You can use `hasStoredPasskey()` to check if a user has previously logged in with a passkey on this device.
+       */
       type: "sign-up" | "sign-in";
+      /**
+       * Optional name of the passkey to create, defaults to a generated name
+       */
       passkeyName?: string;
-      authenticatorType?: AuthType;
+      /**
+       * Optional domain, defaults to current window location.
+       * NOTE: this is required on native platforms.
+       */
+      domain?: {
+        displayName: string;
+        hostname: string;
+      };
     }
   | {
-      strategy: "siwe";
-      walletId: InjectedSupportedWalletIds;
-      chainId: number;
+      strategy: "wallet";
+      wallet: Wallet;
+      chain: Chain;
     };
 
 export type AuthArgsType = (MultiStepAuthArgsType | SingleStepAuthArgsType) & {

package/src/wallets/in-app/core/wallet/types.ts

@@ -29,9 +29,22 @@ export type InAppWalletAuth = AuthOption;
 export type InAppWalletCreationOptions =
   | {
       auth?: {
+        /**
+         * List of authentication options to display in the Connect Modal
+         */
         options: InAppWalletAuth[];
+        /**
+         * Whether to display the social auth prompt in a popup or redirect
+         */
         mode?: "popup" | "redirect";
+        /**
+         * The domain of the passkey to use for authentication
+         */
+        passkeyDomain?: string;
       };
+      /**
+       * Metadata to display in the Connect Modal
+       */
       metadata?: {
         image?: {
           src: string;
@@ -40,8 +53,17 @@ export type InAppWalletCreationOptions =
           alt?: string;
         };
       };
+      /**
+       * The partnerId of the ecosystem wallet to connect to
+       */
       partnerId?: string;
+      /**
+       * The smart account options to convert the wallet to a smart account
+       **/
       smartAccount?: SmartWalletOptions;
+      /**
+       * Whether to hide the private key export button in the Connect Modal
+       */
       hidePrivateKeyExport?: boolean;
     }
   | undefined;

package/src/wallets/in-app/native/auth/native-auth.ts

@@ -1,6 +1,7 @@
 import * as WebBrowser from "expo-web-browser";
+import type { Chain } from "../../../../chains/types.js";
 import type { ThirdwebClient } from "../../../../client/client.js";
-import type { InjectedSupportedWalletIds } from "../../../../wallets/__generated__/wallet-ids.js";
+import type { Wallet } from "../../../interfaces/wallet.js";
 import { getLoginUrl } from "../../core/authentication/getLoginPath.js";
 import { siweAuthenticate } from "../../core/authentication/siwe.js";
 import type {
@@ -125,15 +126,15 @@ export async function socialLogin(
 
 export async function siweLogin(
   client: ThirdwebClient,
-  walletId: InjectedSupportedWalletIds,
-  chainId: number,
+  wallet: Wallet,
+  chain: Chain,
   ecosystem?: Ecosystem,
 ): Promise<AuthStoredTokenWithCookieReturnType> {
   const { storedToken } = await siweAuthenticate({
     client,
     ecosystem,
-    walletId,
-    chainId,
+    wallet,
+    chain,
   });
   try {
     const toStoreToken: AuthStoredTokenWithCookieReturnType["storedToken"] = {

package/src/wallets/in-app/native/auth/passkeys.ts

@@ -0,0 +1,269 @@
+import { Passkey } from "react-native-passkey";
+import { concat } from "viem";
+import type { ThirdwebClient } from "../../../../client/client.js";
+import { toBytes } from "../../../../utils/encoding/to-bytes.js";
+import { keccak256 } from "../../../../utils/hashing/keccak256.js";
+import { nativeLocalStorage } from "../../../../utils/storage/nativeStorage.js";
+import {
+  base64ToString,
+  base64ToUint8Array,
+  base64UrlToBase64,
+  uint8ArrayToBase64,
+} from "../../../../utils/uint8-array.js";
+import type { EcosystemWalletId } from "../../../wallet-types.js";
+import { ClientScopedStorage } from "../../core/authentication/client-scoped-storage.js";
+import type {
+  AuthenticateResult,
+  PasskeyClient,
+  RegisterResult,
+  RpInfo,
+} from "../../core/authentication/passkeys.js";
+
+export class PasskeyNativeClient implements PasskeyClient {
+  isAvailable(): boolean {
+    return Passkey.isSupported();
+  }
+
+  async register(args: {
+    name: string;
+    challenge: string;
+    rp: RpInfo;
+  }): Promise<RegisterResult> {
+    const { name, challenge, rp } = args;
+    const result = await Passkey.create({
+      challenge,
+      user: {
+        displayName: name,
+        name: name,
+        id: keccak256(toBytes(name)),
+      },
+      authenticatorSelection: {
+        authenticatorAttachment: "platform",
+        residentKey: "required",
+        userVerification: "required",
+        requireResidentKey: true,
+      },
+      rp,
+      pubKeyCredParams: [
+        {
+          alg: -7,
+          type: "public-key",
+        },
+      ],
+    });
+
+    const parsedResult =
+      typeof result === "string" ? JSON.parse(result) : result;
+    const { publicKey, authData } = await extractPublicKeyAndAuthData(
+      parsedResult.response,
+    );
+    const clientDataB64 = base64UrlToBase64(
+      parsedResult.response.clientDataJSON,
+    );
+    const clientDataParsed = JSON.parse(base64ToString(clientDataB64));
+
+    return {
+      authenticatorData: authData,
+      credentialId: parsedResult.id,
+      clientData: clientDataB64,
+      credential: {
+        publicKey,
+        algorithm: "ES256",
+      },
+      origin: clientDataParsed.origin,
+    };
+  }
+
+  async authenticate(args: {
+    credentialId: string | undefined;
+    challenge: string;
+    rp: RpInfo;
+  }): Promise<AuthenticateResult> {
+    const { credentialId, challenge, rp } = args;
+    const result = await Passkey.get({
+      challenge,
+      rpId: rp.id,
+      allowCredentials: credentialId
+        ? [
+            {
+              id: credentialId,
+              type: "public-key",
+              // biome-ignore lint/suspicious/noExplicitAny: enum not exported
+              transports: ["hybrid" as any],
+            },
+          ]
+        : [],
+    });
+
+    const parsedResult =
+      typeof result === "string" ? JSON.parse(result) : result;
+    const clientDataB64 = base64UrlToBase64(
+      parsedResult.response.clientDataJSON,
+    );
+    const clientDataParsed = JSON.parse(base64ToString(clientDataB64));
+
+    return {
+      authenticatorData: parsedResult.response.authenticatorData,
+      credentialId: parsedResult.id,
+      clientData: clientDataB64,
+      signature: parsedResult.response.signature,
+      origin: clientDataParsed.origin,
+    };
+  }
+}
+
+/**
+ * Returns whether this device has a stored passkey ready to be used for sign-in
+ * @param client - the thirdweb client
+ * @returns whether the device has a stored passkey
+ * @walletUtils
+ */
+export async function hasStoredPasskey(
+  client: ThirdwebClient,
+  ecosystemId?: EcosystemWalletId,
+) {
+  const storage = new ClientScopedStorage({
+    storage: nativeLocalStorage,
+    clientId: client.clientId,
+    ecosystemId: ecosystemId,
+  });
+  const credId = await storage.getPasskeyCredentialId();
+  return !!credId;
+}
+
+type ExtractedData = {
+  publicKey: string;
+  authData: string;
+};
+
+async function extractPublicKeyAndAuthData(response: {
+  attestationObject: string;
+}): Promise<ExtractedData> {
+  const { decode } = await import("../../../../utils/bytecode/cbor-decode.js");
+  const { attestationObject } = response;
+  const attestationBase64 = base64UrlToBase64(attestationObject);
+
+  // Decode the attestationObject from base64url
+  const attestationBytes = base64ToUint8Array(attestationBase64);
+  const decodedAttestationObject = decode(attestationBytes);
+
+  // Extract the authenticator data (authData) from the attestation object
+  const authData = Uint8Array.from(decodedAttestationObject.authData);
+  const decoded = decodeAuthData(authData);
+
+  if (!decoded.publicKey) {
+    throw new Error("No public key found");
+  }
+  const coseKey = decode(decoded.publicKey);
+  // convert to PEM format
+  const x = Uint8Array.from(coseKey[-2]); // x coordinate
+  const y = Uint8Array.from(coseKey[-3]); // y coordinate
+  // Concatenate x and y coordinates with the uncompressed point indicator (0x04)
+  const pubKey = concat([
+    Uint8Array.from([
+      // ASN.1 DER encoding, aka X.690 ... https://en.wikipedia.org/wiki/X.690
+
+      0x30, // DER Sequence
+      0x59, // Length (2+19 + 2+66) = 89
+
+      0x30, // DER Sequence
+      0x13, // Length (2+7 + 2+8) = 19
+
+      0x06, // DER OBJECT IDENTIFIER
+      0x07, // Length
+      0x2a,
+      0x86,
+      0x48,
+      0xce,
+      0x3d,
+      0x02,
+      0x01, // OID 1.2.840.10045.2.1 ecPublicKey
+
+      0x06, // DER OBJECT IDENTIFIER
+      0x08, // Length
+      0x2a,
+      0x86,
+      0x48,
+      0xce,
+      0x3d,
+      0x03,
+      0x01,
+      0x07, // OID 1.2.840.10045.3.1.7 prime256v1
+
+      0x03, // DER BIT STRING
+      0x42, // Length (32 + 32 + 1(null) + 1) = 66
+      0x00,
+
+      0x04, // ECC uncompressed... beginning of X9.62 Key
+    ]), // Uncompressed point indicator
+    x,
+    y,
+  ]);
+
+  return {
+    publicKey: uint8ArrayToBase64(pubKey),
+    authData: uint8ArrayToBase64(authData),
+  };
+}
+
+function decodeAuthData(authData: Uint8Array) {
+  let offset = 0;
+
+  // Step 1: Read the RP ID hash (32 bytes)
+  const rpIdHash = authData.slice(offset, offset + 32);
+  offset += 32;
+
+  // Step 2: Read the flags (1 byte)
+  const flags = authData[offset];
+  offset += 1;
+
+  if (!flags) {
+    throw new Error("No flags found");
+  }
+
+  // Step 3: Read the sign count (4 bytes)
+  const signCount = authData.slice(offset, offset + 4);
+  offset += 4;
+
+  // Step 4: Check if attested credential data is present
+  const attestedCredentialDataPresent = (flags & 0x40) !== 0;
+  let aaguid: Uint8Array | undefined;
+  let credentialIdLength: number | undefined;
+  let credentialId: Uint8Array | undefined;
+  let publicKey: Uint8Array | undefined;
+
+  if (attestedCredentialDataPresent) {
+    // Step 5: Read AAGUID (16 bytes)
+    aaguid = authData.slice(offset, offset + 16);
+    offset += 16;
+
+    const start = authData[offset];
+    const end = authData[offset + 1];
+
+    if (start === undefined || end === undefined) {
+      throw new Error("No credential ID found");
+    }
+
+    // Step 6: Read Credential ID Length (2 bytes)
+    credentialIdLength = (start << 8) + end;
+    offset += 2;
+
+    // Step 7: Read Credential ID (variable length)
+    credentialId = authData.slice(offset, offset + credentialIdLength);
+    offset += credentialIdLength;
+
+    // Step 8: Read Public Key (variable length, COSE-encoded)
+    publicKey = authData.slice(offset); // The rest is the public key
+    offset += publicKey.length;
+  }
+
+  return {
+    rpIdHash,
+    flags,
+    signCount,
+    aaguid,
+    credentialIdLength,
+    credentialId,
+    publicKey,
+  };
+}

package/src/wallets/in-app/native/helpers/api/fetchers.ts

@@ -87,9 +87,8 @@ export async function fetchUserDetails(args: {
 }): Promise<UserDetailsApiType> {
   const url = new URL(ROUTE_EMBEDDED_WALLET_DETAILS);
   if (args) {
-    if (args.email) {
-      url.searchParams.append("email", args.email);
-    }
+    // TODO (inapp) remove this, unused in the backend but still required
+    url.searchParams.append("email", args.email ?? "none");
     url.searchParams.append("clientId", args.client.clientId);
   }
   const resp = await authFetchEmbeddedWalletUser(args.client, url.href, {

package/src/wallets/in-app/native/helpers/auth/middleware.ts

@@ -152,14 +152,13 @@ async function getRecoveryCode(
         );
       }
       return recoveryCode;
-    } else {
-      try {
-        return await getCognitoRecoveryPasswordV2(client);
-      } catch (e) {
-        return await getCognitoRecoveryPasswordV1(client).catch(() => {
-          throw new Error("Something went wrong getting cognito recovery code");
-        });
-      }
+    }
+    try {
+      return await getCognitoRecoveryPasswordV2(client);
+    } catch (e) {
+      return await getCognitoRecoveryPasswordV1(client).catch(() => {
+        throw new Error("Something went wrong getting cognito recovery code");
+      });
     }
   } else if (
     storedToken.authDetails.recoveryShareManagement ===

package/src/wallets/in-app/native/in-app.ts

@@ -64,6 +64,7 @@ export function inAppWallet(
       const { InAppNativeConnector } = await import("./native-connector.js");
       return new InAppNativeConnector({
         client,
+        passkeyDomain: createOptions?.auth?.passkeyDomain,
       });
     },
   });