thirdweb 5.46.0-nightly-814024ae249141ad1446ce7f21793b1d37b95d13-20240814000405 → 5.46.0

package/src/wallets/in-app/native/auth/passkeys.ts

@@ -0,0 +1,269 @@
+import { Passkey } from "react-native-passkey";
+import { concat } from "viem";
+import type { ThirdwebClient } from "../../../../client/client.js";
+import { toBytes } from "../../../../utils/encoding/to-bytes.js";
+import { keccak256 } from "../../../../utils/hashing/keccak256.js";
+import { nativeLocalStorage } from "../../../../utils/storage/nativeStorage.js";
+import {
+  base64ToString,
+  base64ToUint8Array,
+  base64UrlToBase64,
+  uint8ArrayToBase64,
+} from "../../../../utils/uint8-array.js";
+import type { EcosystemWalletId } from "../../../wallet-types.js";
+import { ClientScopedStorage } from "../../core/authentication/client-scoped-storage.js";
+import type {
+  AuthenticateResult,
+  PasskeyClient,
+  RegisterResult,
+  RpInfo,
+} from "../../core/authentication/passkeys.js";
+
+export class PasskeyNativeClient implements PasskeyClient {
+  isAvailable(): boolean {
+    return Passkey.isSupported();
+  }
+
+  async register(args: {
+    name: string;
+    challenge: string;
+    rp: RpInfo;
+  }): Promise<RegisterResult> {
+    const { name, challenge, rp } = args;
+    const result = await Passkey.create({
+      challenge,
+      user: {
+        displayName: name,
+        name: name,
+        id: keccak256(toBytes(name)),
+      },
+      authenticatorSelection: {
+        authenticatorAttachment: "platform",
+        residentKey: "required",
+        userVerification: "required",
+        requireResidentKey: true,
+      },
+      rp,
+      pubKeyCredParams: [
+        {
+          alg: -7,
+          type: "public-key",
+        },
+      ],
+    });
+
+    const parsedResult =
+      typeof result === "string" ? JSON.parse(result) : result;
+    const { publicKey, authData } = await extractPublicKeyAndAuthData(
+      parsedResult.response,
+    );
+    const clientDataB64 = base64UrlToBase64(
+      parsedResult.response.clientDataJSON,
+    );
+    const clientDataParsed = JSON.parse(base64ToString(clientDataB64));
+
+    return {
+      authenticatorData: authData,
+      credentialId: parsedResult.id,
+      clientData: clientDataB64,
+      credential: {
+        publicKey,
+        algorithm: "ES256",
+      },
+      origin: clientDataParsed.origin,
+    };
+  }
+
+  async authenticate(args: {
+    credentialId: string | undefined;
+    challenge: string;
+    rp: RpInfo;
+  }): Promise<AuthenticateResult> {
+    const { credentialId, challenge, rp } = args;
+    const result = await Passkey.get({
+      challenge,
+      rpId: rp.id,
+      allowCredentials: credentialId
+        ? [
+            {
+              id: credentialId,
+              type: "public-key",
+              // biome-ignore lint/suspicious/noExplicitAny: enum not exported
+              transports: ["hybrid" as any],
+            },
+          ]
+        : [],
+    });
+
+    const parsedResult =
+      typeof result === "string" ? JSON.parse(result) : result;
+    const clientDataB64 = base64UrlToBase64(
+      parsedResult.response.clientDataJSON,
+    );
+    const clientDataParsed = JSON.parse(base64ToString(clientDataB64));
+
+    return {
+      authenticatorData: parsedResult.response.authenticatorData,
+      credentialId: parsedResult.id,
+      clientData: clientDataB64,
+      signature: parsedResult.response.signature,
+      origin: clientDataParsed.origin,
+    };
+  }
+}
+
+/**
+ * Returns whether this device has a stored passkey ready to be used for sign-in
+ * @param client - the thirdweb client
+ * @returns whether the device has a stored passkey
+ * @walletUtils
+ */
+export async function hasStoredPasskey(
+  client: ThirdwebClient,
+  ecosystemId?: EcosystemWalletId,
+) {
+  const storage = new ClientScopedStorage({
+    storage: nativeLocalStorage,
+    clientId: client.clientId,
+    ecosystemId: ecosystemId,
+  });
+  const credId = await storage.getPasskeyCredentialId();
+  return !!credId;
+}
+
+type ExtractedData = {
+  publicKey: string;
+  authData: string;
+};
+
+async function extractPublicKeyAndAuthData(response: {
+  attestationObject: string;
+}): Promise<ExtractedData> {
+  const { decode } = await import("../../../../utils/bytecode/cbor-decode.js");
+  const { attestationObject } = response;
+  const attestationBase64 = base64UrlToBase64(attestationObject);
+
+  // Decode the attestationObject from base64url
+  const attestationBytes = base64ToUint8Array(attestationBase64);
+  const decodedAttestationObject = decode(attestationBytes);
+
+  // Extract the authenticator data (authData) from the attestation object
+  const authData = Uint8Array.from(decodedAttestationObject.authData);
+  const decoded = decodeAuthData(authData);
+
+  if (!decoded.publicKey) {
+    throw new Error("No public key found");
+  }
+  const coseKey = decode(decoded.publicKey);
+  // convert to PEM format
+  const x = Uint8Array.from(coseKey[-2]); // x coordinate
+  const y = Uint8Array.from(coseKey[-3]); // y coordinate
+  // Concatenate x and y coordinates with the uncompressed point indicator (0x04)
+  const pubKey = concat([
+    Uint8Array.from([
+      // ASN.1 DER encoding, aka X.690 ... https://en.wikipedia.org/wiki/X.690
+
+      0x30, // DER Sequence
+      0x59, // Length (2+19 + 2+66) = 89
+
+      0x30, // DER Sequence
+      0x13, // Length (2+7 + 2+8) = 19
+
+      0x06, // DER OBJECT IDENTIFIER
+      0x07, // Length
+      0x2a,
+      0x86,
+      0x48,
+      0xce,
+      0x3d,
+      0x02,
+      0x01, // OID 1.2.840.10045.2.1 ecPublicKey
+
+      0x06, // DER OBJECT IDENTIFIER
+      0x08, // Length
+      0x2a,
+      0x86,
+      0x48,
+      0xce,
+      0x3d,
+      0x03,
+      0x01,
+      0x07, // OID 1.2.840.10045.3.1.7 prime256v1
+
+      0x03, // DER BIT STRING
+      0x42, // Length (32 + 32 + 1(null) + 1) = 66
+      0x00,
+
+      0x04, // ECC uncompressed... beginning of X9.62 Key
+    ]), // Uncompressed point indicator
+    x,
+    y,
+  ]);
+
+  return {
+    publicKey: uint8ArrayToBase64(pubKey),
+    authData: uint8ArrayToBase64(authData),
+  };
+}
+
+function decodeAuthData(authData: Uint8Array) {
+  let offset = 0;
+
+  // Step 1: Read the RP ID hash (32 bytes)
+  const rpIdHash = authData.slice(offset, offset + 32);
+  offset += 32;
+
+  // Step 2: Read the flags (1 byte)
+  const flags = authData[offset];
+  offset += 1;
+
+  if (!flags) {
+    throw new Error("No flags found");
+  }
+
+  // Step 3: Read the sign count (4 bytes)
+  const signCount = authData.slice(offset, offset + 4);
+  offset += 4;
+
+  // Step 4: Check if attested credential data is present
+  const attestedCredentialDataPresent = (flags & 0x40) !== 0;
+  let aaguid: Uint8Array | undefined;
+  let credentialIdLength: number | undefined;
+  let credentialId: Uint8Array | undefined;
+  let publicKey: Uint8Array | undefined;
+
+  if (attestedCredentialDataPresent) {
+    // Step 5: Read AAGUID (16 bytes)
+    aaguid = authData.slice(offset, offset + 16);
+    offset += 16;
+
+    const start = authData[offset];
+    const end = authData[offset + 1];
+
+    if (start === undefined || end === undefined) {
+      throw new Error("No credential ID found");
+    }
+
+    // Step 6: Read Credential ID Length (2 bytes)
+    credentialIdLength = (start << 8) + end;
+    offset += 2;
+
+    // Step 7: Read Credential ID (variable length)
+    credentialId = authData.slice(offset, offset + credentialIdLength);
+    offset += credentialIdLength;
+
+    // Step 8: Read Public Key (variable length, COSE-encoded)
+    publicKey = authData.slice(offset); // The rest is the public key
+    offset += publicKey.length;
+  }
+
+  return {
+    rpIdHash,
+    flags,
+    signCount,
+    aaguid,
+    credentialIdLength,
+    credentialId,
+    publicKey,
+  };
+}

package/src/wallets/in-app/native/helpers/api/fetchers.ts

@@ -87,9 +87,8 @@ export async function fetchUserDetails(args: {
 }): Promise<UserDetailsApiType> {
   const url = new URL(ROUTE_EMBEDDED_WALLET_DETAILS);
   if (args) {
-    if (args.email) {
-      url.searchParams.append("email", args.email);
-    }
+    // TODO (inapp) remove this, unused in the backend but still required
+    url.searchParams.append("email", args.email ?? "none");
     url.searchParams.append("clientId", args.client.clientId);
   }
   const resp = await authFetchEmbeddedWalletUser(args.client, url.href, {

package/src/wallets/in-app/native/helpers/auth/middleware.ts

@@ -152,14 +152,13 @@ async function getRecoveryCode(
         );
       }
       return recoveryCode;
-    } else {
-      try {
-        return await getCognitoRecoveryPasswordV2(client);
-      } catch (e) {
-        return await getCognitoRecoveryPasswordV1(client).catch(() => {
-          throw new Error("Something went wrong getting cognito recovery code");
-        });
-      }
+    }
+    try {
+      return await getCognitoRecoveryPasswordV2(client);
+    } catch (e) {
+      return await getCognitoRecoveryPasswordV1(client).catch(() => {
+        throw new Error("Something went wrong getting cognito recovery code");
+      });
     }
   } else if (
     storedToken.authDetails.recoveryShareManagement ===

package/src/wallets/in-app/native/in-app.ts

@@ -64,6 +64,7 @@ export function inAppWallet(
       const { InAppNativeConnector } = await import("./native-connector.js");
       return new InAppNativeConnector({
         client,
+        passkeyDomain: createOptions?.auth?.passkeyDomain,
       });
     },
   });

package/src/wallets/in-app/native/native-connector.ts

@@ -1,6 +1,12 @@
 import type { Chain } from "../../../chains/types.js";
 import type { ThirdwebClient } from "../../../client/client.js";
+import { stringify } from "../../../utils/json.js";
+import { nativeLocalStorage } from "../../../utils/storage/nativeStorage.js";
 import type { Account, Wallet } from "../../interfaces/wallet.js";
+import {
+  loginWithPasskey,
+  registerPasskey,
+} from "../core/authentication/passkeys.js";
 import { siweAuthenticate } from "../core/authentication/siwe.js";
 import {
   type AuthArgsType,
@@ -27,12 +33,14 @@ import {
 } from "./auth/native-auth.js";
 import { fetchUserDetails } from "./helpers/api/fetchers.js";
 import { logoutUser } from "./helpers/auth/logout.js";
+import { postAuth } from "./helpers/auth/middleware.js";
 import { getWalletUserDetails } from "./helpers/storage/local.js";
 import { getExistingUserAccount } from "./helpers/wallet/retrieval.js";
 
 export type NativeConnectorOptions = {
   client: ThirdwebClient;
   partnerId?: string | undefined;
+  passkeyDomain?: string;
 };
 
 export class InAppNativeConnector implements InAppConnector {
@@ -107,6 +115,8 @@ export class InAppNativeConnector implements InAppConnector {
           params.redirectUrl || (ExpoLinking.createURL("") as string);
         return authenticate({ strategy, redirectUrl }, this.options.client);
       }
+      case "passkey":
+        return this.passkeyAuth(params);
       default:
         throw new Error(`Unsupported authentication type: ${strategy}`);
     }
@@ -164,7 +174,16 @@ export class InAppNativeConnector implements InAppConnector {
         });
       }
       case "passkey": {
-        throw new Error("Passkey authentication is not implemented yet");
+        const authToken = await this.passkeyAuth(params);
+        const account = await this.getAccount();
+        return {
+          user: {
+            status: UserWalletStatus.LOGGED_IN_WALLET_INITIALIZED,
+            account,
+            authDetails: authToken.storedToken.authDetails,
+            walletAddress: account.address,
+          },
+        };
       }
       case "iframe": {
         throw new Error("iframe_email_verification is not supported in native");
@@ -177,6 +196,75 @@ export class InAppNativeConnector implements InAppConnector {
     }
   }
 
+  private async passkeyAuth(args: {
+    type: "sign-up" | "sign-in";
+    passkeyName?: string;
+    client: ThirdwebClient;
+    ecosystem?: Ecosystem;
+  }): Promise<AuthStoredTokenWithCookieReturnType> {
+    const { type, passkeyName, client, ecosystem } = args;
+    const domain = this.options.passkeyDomain;
+    if (!domain) {
+      throw new Error(
+        "Passkey domain is required for native platforms. Please pass it in the 'auth' options when creating the inAppWallet().",
+      );
+    }
+    try {
+      const { PasskeyNativeClient } = await import("./auth/passkeys.js");
+      const passkeyClient = new PasskeyNativeClient();
+      const storage = nativeLocalStorage;
+      let authToken: AuthStoredTokenWithCookieReturnType;
+
+      if (type === "sign-up") {
+        authToken = await registerPasskey({
+          client,
+          ecosystem,
+          username: passkeyName,
+          passkeyClient,
+          storage,
+          rp: {
+            id: domain,
+            name: domain,
+          },
+        });
+      } else {
+        authToken = await loginWithPasskey({
+          client,
+          ecosystem,
+          passkeyClient,
+          storage,
+          rp: {
+            id: domain,
+            name: domain,
+          },
+        });
+      }
+
+      const toStoreToken: AuthStoredTokenWithCookieReturnType["storedToken"] = {
+        jwtToken: authToken.storedToken.jwtToken,
+        authDetails: authToken.storedToken.authDetails,
+        authProvider: authToken.storedToken.authProvider,
+        developerClientId: authToken.storedToken.developerClientId,
+        cookieString: authToken.storedToken.cookieString,
+        // we should always store the jwt cookie since there's no concept of cookie in react native
+        shouldStoreCookieString: true,
+        isNewUser: authToken.storedToken.isNewUser,
+      };
+
+      await postAuth({ storedToken: toStoreToken, client });
+
+      return authToken;
+    } catch (error) {
+      console.error(
+        `Error while signing in with passkey. ${(error as Error)?.message || typeof error === "object" ? stringify(error) : error}`,
+      );
+      if (error instanceof Error) {
+        throw new Error(`Error signing in with passkey: ${error.message}`);
+      }
+      throw new Error("An unknown error occurred signing in with passkey");
+    }
+  }
+
   private async validateOtp(
     options: MultiStepAuthArgsType & {
       client: ThirdwebClient;

package/src/wallets/in-app/web/in-app.ts

@@ -187,6 +187,7 @@ export function inAppWallet(
       const { InAppWebConnector } = await import("./lib/web-connector.js");
       return new InAppWebConnector({
         client,
+        passkeyDomain: createOptions?.auth?.passkeyDomain,
       });
     },
   });

package/src/wallets/in-app/web/lib/auth/iframe-auth.ts

@@ -1,4 +1,6 @@
 import type { ThirdwebClient } from "../../../../../client/client.js";
+import { webLocalStorage } from "../../../../../utils/storage/webStorage.js";
+import { ClientScopedStorage } from "../../../core/authentication/client-scoped-storage.js";
 import type {
   AuthAndWalletRpcReturnType,
   AuthLoginReturnType,
@@ -7,7 +9,6 @@ import type {
   SendEmailOtpReturnType,
 } from "../../../core/authentication/types.js";
 import type { ClientIdWithQuerierType, Ecosystem } from "../../types.js";
-import { LocalStorage } from "../../utils/Storage/LocalStorage.js";
 import type { InAppWalletIframeCommunicator } from "../../utils/iFrameCommunication/InAppWalletIframeCommunicator.js";
 import { BaseLogin } from "./base-login.js";
 
@@ -33,7 +34,7 @@ export type AuthQuerierTypes = {
 export class Auth {
   protected client: ThirdwebClient;
   protected AuthQuerier: InAppWalletIframeCommunicator<AuthQuerierTypes>;
-  protected localStorage: LocalStorage;
+  protected localStorage: ClientScopedStorage;
   protected onAuthSuccess: (
     authResults: AuthAndWalletRpcReturnType,
   ) => Promise<AuthLoginReturnType>;
@@ -59,7 +60,8 @@ export class Auth {
     this.client = client;
 
     this.AuthQuerier = querier;
-    this.localStorage = new LocalStorage({
+    this.localStorage = new ClientScopedStorage({
+      storage: webLocalStorage,
       clientId: client.clientId,
       ecosystemId: ecosystem?.id,
     });