|
@ -4,10 +4,18 @@ import { decode as cborDecode } from "cbor-x"; |
|
|
import { createJWS, JWTPayload, verifyJWT } from "did-jwt"; |
|
|
import { createJWS, JWTPayload, verifyJWT } from "did-jwt"; |
|
|
import { DIDResolutionResult, Resolver } from "did-resolver"; |
|
|
import { DIDResolutionResult, Resolver } from "did-resolver"; |
|
|
import { bytesToMultibase } from "@veramo/utils"; |
|
|
import { bytesToMultibase } from "@veramo/utils"; |
|
|
|
|
|
import { startAuthentication } from "@simplewebauthn/browser"; |
|
|
import { |
|
|
import { |
|
|
|
|
|
generateAuthenticationOptions, |
|
|
|
|
|
verifyAuthenticationResponse, |
|
|
verifyRegistrationResponse, |
|
|
verifyRegistrationResponse, |
|
|
VerifyRegistrationResponseOpts, |
|
|
VerifyRegistrationResponseOpts, |
|
|
} from "@simplewebauthn/server"; |
|
|
} from "@simplewebauthn/server"; |
|
|
|
|
|
import { VerifyAuthenticationResponseOpts } from "@simplewebauthn/server/esm/authentication/verifyAuthenticationResponse"; |
|
|
|
|
|
import { |
|
|
|
|
|
Base64URLString, |
|
|
|
|
|
PublicKeyCredentialRequestOptionsJSON, |
|
|
|
|
|
} from "@simplewebauthn/types"; |
|
|
|
|
|
|
|
|
export interface JWK { |
|
|
export interface JWK { |
|
|
kty: string; |
|
|
kty: string; |
|
@ -61,11 +69,8 @@ export async function registerCredential( |
|
|
publicKey: publicKeyOptions, |
|
|
publicKey: publicKeyOptions, |
|
|
}); |
|
|
}); |
|
|
console.log("credential", credential); |
|
|
console.log("credential", credential); |
|
|
console.log(credential?.id, " is the new Id"); |
|
|
console.log(credential?.id, " is the new ID base64-url-encoded"); |
|
|
console.log( |
|
|
console.log(toBase64Url(credential?.rawId), " is the base64 rawId"); |
|
|
Buffer.from(credential?.rawId).toString("base64"), |
|
|
|
|
|
" is the base64 rawId", |
|
|
|
|
|
); |
|
|
|
|
|
const attestationResponse = credential?.response; |
|
|
const attestationResponse = credential?.response; |
|
|
const verfInput: VerifyRegistrationResponseOpts = { |
|
|
const verfInput: VerifyRegistrationResponseOpts = { |
|
|
response: { |
|
|
response: { |
|
@ -78,7 +83,6 @@ export async function registerCredential( |
|
|
clientExtensionResults: {}, |
|
|
clientExtensionResults: {}, |
|
|
type: "public-key", |
|
|
type: "public-key", |
|
|
}, |
|
|
}, |
|
|
//expectedChallenge: Buffer.from(challenge).toString("base64"),
|
|
|
|
|
|
expectedChallenge: toBase64Url(challenge), |
|
|
expectedChallenge: toBase64Url(challenge), |
|
|
expectedOrigin: window.location.origin, |
|
|
expectedOrigin: window.location.origin, |
|
|
}; |
|
|
}; |
|
@ -98,9 +102,6 @@ export async function registerCredential( |
|
|
); |
|
|
); |
|
|
console.log("attestationObject", attestationObject); |
|
|
console.log("attestationObject", attestationObject); |
|
|
|
|
|
|
|
|
const credData = parseAuthData(attestationObject.authData); |
|
|
|
|
|
console.log("new attempt at publicKey", credData); |
|
|
|
|
|
|
|
|
|
|
|
const jwkObj = cborDecode( |
|
|
const jwkObj = cborDecode( |
|
|
verification.registrationInfo?.credentialPublicKey as Uint8Array, |
|
|
verification.registrationInfo?.credentialPublicKey as Uint8Array, |
|
|
); |
|
|
); |
|
@ -129,7 +130,13 @@ export async function registerCredential( |
|
|
//const publicKeyBytes = extractPublicKeyCose(attestationObject.authData);
|
|
|
//const publicKeyBytes = extractPublicKeyCose(attestationObject.authData);
|
|
|
//const publicKeyJwk = extractPublicKeyJwk(attestationObject.authData);
|
|
|
//const publicKeyJwk = extractPublicKeyJwk(attestationObject.authData);
|
|
|
|
|
|
|
|
|
return { rawId: credential?.rawId, publicKeyJwk, publicKeyBytes }; |
|
|
return { |
|
|
|
|
|
authData: attestationObject.authData, |
|
|
|
|
|
credId: credential?.id, |
|
|
|
|
|
rawId: credential?.rawId, |
|
|
|
|
|
publicKeyJwk, |
|
|
|
|
|
publicKeyBytes, |
|
|
|
|
|
}; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
// parse authData
|
|
|
// parse authData
|
|
@ -148,12 +155,16 @@ export function createPeerDid(publicKeyBytes: Uint8Array) { |
|
|
return "did:peer:0" + methodSpecificId; |
|
|
return "did:peer:0" + methodSpecificId; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
export async function createJwt( |
|
|
export class PeerSetup { |
|
|
|
|
|
public authenticatorData?: ArrayBuffer; |
|
|
|
|
|
public clientDataJsonDecoded?: object; |
|
|
|
|
|
|
|
|
|
|
|
public async createJwt( |
|
|
payload: object, |
|
|
payload: object, |
|
|
issuerDid: string, |
|
|
issuerDid: string, |
|
|
credentialId: ArrayBuffer, |
|
|
credentialId: string, |
|
|
) { |
|
|
) { |
|
|
const signer = await webAuthnES256KSigner(credentialId); |
|
|
const signer = await this.webAuthnES256KSigner(credentialId); |
|
|
|
|
|
|
|
|
// from createJWT in did-jwt/src/JWT.ts
|
|
|
// from createJWT in did-jwt/src/JWT.ts
|
|
|
const header: JWTPayload = { typ: "JWT", alg: "ES256K" }; |
|
|
const header: JWTPayload = { typ: "JWT", alg: "ES256K" }; |
|
@ -163,13 +174,16 @@ export async function createJwt( |
|
|
}; |
|
|
}; |
|
|
const fullPayload = { ...timestamps, ...payload, iss: issuerDid }; |
|
|
const fullPayload = { ...timestamps, ...payload, iss: issuerDid }; |
|
|
|
|
|
|
|
|
return createJWS(fullPayload, signer, header); |
|
|
const jwt = createJWS(fullPayload, signer, header); |
|
|
|
|
|
return jwt; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
async function webAuthnES256KSigner(credentialID: ArrayBuffer) { |
|
|
async webAuthnES256KSigner(credentialID: string) { |
|
|
return async (data: string | Uint8Array) => { |
|
|
return async (data: string | Uint8Array) => { |
|
|
// also has clientDataJSON
|
|
|
const signature = await this.generateWebAuthnSignature( |
|
|
const { signature } = await generateWebAuthnSignature(data, credentialID); |
|
|
data, |
|
|
|
|
|
credentialID, |
|
|
|
|
|
); |
|
|
|
|
|
|
|
|
// This converts from the browser ArrayBuffer to a Node.js Buffer, which is a requirement for the asn1 library.
|
|
|
// This converts from the browser ArrayBuffer to a Node.js Buffer, which is a requirement for the asn1 library.
|
|
|
const signatureBuffer = Buffer.from(signature); |
|
|
const signatureBuffer = Buffer.from(signature); |
|
@ -219,17 +233,18 @@ async function webAuthnES256KSigner(credentialID: ArrayBuffer) { |
|
|
}; |
|
|
}; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
async function generateWebAuthnSignature( |
|
|
async generateWebAuthnSignature( |
|
|
dataToSign: string | Uint8Array, |
|
|
dataToSign: string | Uint8Array, // from Signer interface
|
|
|
credentialId: ArrayBuffer, |
|
|
credentialId: string, |
|
|
) { |
|
|
) { |
|
|
if (!(dataToSign instanceof Uint8Array)) { |
|
|
if (dataToSign instanceof Uint8Array) { |
|
|
dataToSign = new TextEncoder().encode(dataToSign as string); |
|
|
dataToSign = new TextDecoder("utf-8").decode(dataToSign as Uint8Array); |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
console.log("credentialId", credentialId); |
|
|
const options = { |
|
|
const options = { |
|
|
challenge: dataToSign, |
|
|
challenge: new TextEncoder().encode(dataToSign).buffer, |
|
|
allowCredentials: [{ id: credentialId, type: "public-key" }], |
|
|
//allowCredentials: [{ id: credentialId, type: "public-key" }],
|
|
|
userVerification: "preferred", |
|
|
userVerification: "preferred", |
|
|
}; |
|
|
}; |
|
|
|
|
|
|
|
@ -237,26 +252,84 @@ async function generateWebAuthnSignature( |
|
|
console.log("assertion", assertion); |
|
|
console.log("assertion", assertion); |
|
|
|
|
|
|
|
|
const authenticatorAssertionResponse = assertion?.response; |
|
|
const authenticatorAssertionResponse = assertion?.response; |
|
|
console.log( |
|
|
this.clientDataJsonDecoded = JSON.parse( |
|
|
"clientDataJSON decoded", |
|
|
|
|
|
JSON.parse( |
|
|
|
|
|
new TextDecoder("utf-8").decode( |
|
|
new TextDecoder("utf-8").decode( |
|
|
authenticatorAssertionResponse.clientDataJSON, |
|
|
authenticatorAssertionResponse.clientDataJSON, |
|
|
), |
|
|
), |
|
|
), |
|
|
|
|
|
); |
|
|
); |
|
|
return { |
|
|
console.log("clientDataJSON decoded", this.clientDataJsonDecoded); |
|
|
signature: authenticatorAssertionResponse.signature, |
|
|
this.authenticatorData = authenticatorAssertionResponse.authenticatorData; |
|
|
clientDataJSON: authenticatorAssertionResponse.clientDataJSON, |
|
|
console.log("authenticator data", this.authenticatorData); |
|
|
authenticatorData: authenticatorAssertionResponse.authenticatorData, |
|
|
return authenticatorAssertionResponse.signature; |
|
|
}; |
|
|
} |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
export async function verifyJwt( |
|
|
export async function verifyJwt( |
|
|
jwt: string, |
|
|
jwt: string, |
|
|
issuerDid: string, // eslint-disable-line @typescript-eslint/no-unused-vars
|
|
|
credId: Base64URLString, |
|
|
publicKey: JWK, // eslint-disable-line @typescript-eslint/no-unused-vars
|
|
|
rawId: Uint8Array, |
|
|
|
|
|
authenticatorData: ArrayBuffer, |
|
|
|
|
|
clientDataJSON: object, |
|
|
|
|
|
publicKey: Uint8Array, |
|
|
|
|
|
signature: Base64URLString, |
|
|
) { |
|
|
) { |
|
|
|
|
|
const options: PublicKeyCredentialRequestOptionsJSON = |
|
|
|
|
|
await generateAuthenticationOptions({ |
|
|
|
|
|
rpID: window.location.hostname, |
|
|
|
|
|
// Require users to use a previously-registered authenticator
|
|
|
|
|
|
// allowCredentials: userPasskeys.map(passkey => ({
|
|
|
|
|
|
// id: passkey.id,
|
|
|
|
|
|
// transports: passkey.transports,
|
|
|
|
|
|
// })),
|
|
|
|
|
|
}); |
|
|
|
|
|
console.log("authentication options", options); |
|
|
|
|
|
|
|
|
|
|
|
const clientAuth = await startAuthentication(options); |
|
|
|
|
|
console.log("clientAuth", clientAuth); |
|
|
|
|
|
|
|
|
|
|
|
const verfOpts: VerifyAuthenticationResponseOpts = { |
|
|
|
|
|
response: clientAuth, |
|
|
|
|
|
authenticator: { |
|
|
|
|
|
credentialID: credId, |
|
|
|
|
|
credentialPublicKey: publicKey, |
|
|
|
|
|
counter: 0, |
|
|
|
|
|
}, |
|
|
|
|
|
expectedChallenge: () => true, // options.challenge doesn't work
|
|
|
|
|
|
expectedOrigin: window.location.origin, |
|
|
|
|
|
expectedRPID: window.location.hostname, |
|
|
|
|
|
}; |
|
|
|
|
|
console.log("verfOpts", verfOpts); |
|
|
|
|
|
const verificationFromClient = await verifyAuthenticationResponse(verfOpts); |
|
|
|
|
|
console.log("client auth verification", verificationFromClient); |
|
|
|
|
|
|
|
|
|
|
|
const authData = toBase64Url(Buffer.from(authenticatorData)); |
|
|
|
|
|
const bufferizedJson = toBase64Url( |
|
|
|
|
|
new TextEncoder().encode(JSON.stringify(clientDataJSON)), |
|
|
|
|
|
); |
|
|
|
|
|
const authOpts: VerifyAuthenticationResponseOpts = { |
|
|
|
|
|
response: { |
|
|
|
|
|
id: credId, |
|
|
|
|
|
rawId: toBase64Url(rawId), |
|
|
|
|
|
response: { |
|
|
|
|
|
authenticatorData: authData, |
|
|
|
|
|
clientDataJSON: bufferizedJson, |
|
|
|
|
|
signature: signature, |
|
|
|
|
|
}, |
|
|
|
|
|
clientExtensionResults: {}, |
|
|
|
|
|
type: "public-key", |
|
|
|
|
|
}, |
|
|
|
|
|
expectedChallenge: () => true, // options.challenge doesn't work
|
|
|
|
|
|
expectedOrigin: window.location.origin, |
|
|
|
|
|
expectedRPID: window.location.hostname, |
|
|
|
|
|
authenticator: { |
|
|
|
|
|
credentialID: credId, |
|
|
|
|
|
credentialPublicKey: publicKey, |
|
|
|
|
|
counter: 0, |
|
|
|
|
|
}, |
|
|
|
|
|
}; |
|
|
|
|
|
const verification = await verifyAuthenticationResponse(authOpts); |
|
|
|
|
|
console.log("auth verification", verification); |
|
|
|
|
|
|
|
|
const decoded = verifyJWT(jwt, { |
|
|
const decoded = verifyJWT(jwt, { |
|
|
resolver: new Resolver({ peer: peerDidToDidDocument }), |
|
|
resolver: new Resolver({ peer: peerDidToDidDocument }), |
|
|
}); |
|
|
}); |
|
@ -266,7 +339,7 @@ export async function verifyJwt( |
|
|
async function peerDidToDidDocument(did: string): Promise<DIDResolutionResult> { |
|
|
async function peerDidToDidDocument(did: string): Promise<DIDResolutionResult> { |
|
|
if (!did.startsWith("did:peer:0z")) { |
|
|
if (!did.startsWith("did:peer:0z")) { |
|
|
throw new Error( |
|
|
throw new Error( |
|
|
"This only verifies a peer DID method 0 encoded base58btc.", |
|
|
"This only verifies a peer DID, method 0, encoded base58btc.", |
|
|
); |
|
|
); |
|
|
} |
|
|
} |
|
|
// this is basically hard-coded based on the results from the @aviarytech/did-peer resolver
|
|
|
// this is basically hard-coded based on the results from the @aviarytech/did-peer resolver
|
|
|