fix: add MFA for WebAuthn bindings #960

J0 · 2024-09-19T07:07:34Z

What kind of change does this PR introduce?

We introduce bindings for MFA (WebAuthn) which consists of the following:

enroll()
a. Single Step - enroll({factorType: 'webauthn'})
b. Multi-Step - enroll(factorType: 'webauthn, webAuthn{...})
challenge() -
verify()
a. Single Step - verify({factorType: 'webauthn'})
b. Multi-Step - verify({factorType: 'webauthn', webAuthn{..}})

We also expose a few helper methods:

identifyAuthenticationError
browserSupportsWebAuthn

src/lib/types.ts

src/GoTrueClient.ts

J0 · 2024-10-02T08:06:24Z

src/lib/types.ts

+ credential_request_options: { publicKey: PublicKeyCredentialRequestOptionsJSON }
+ }
+ error: null
+ }
 | { data: null; error: AuthError }

 export type AuthMFAListFactorsResponse =


Decide whether to include aaguid to image / authenticator type mapping for user: https:/passkeydeveloper/passkey-authenticator-aaguids

or to include it in documentation

Docs is better, we can add that in a follow up based on feedback.

src/lib/types.ts

src/lib/helpers.ts

src/lib/types.ts

src/GoTrueClient.ts

src/lib/helpers.ts

src/lib/types.ts

hf · 2024-10-10T14:01:49Z

src/lib/types.ts

+export interface AuthenticatorAttestationResponseJSON {
+ clientDataJSON: Base64URLString
+ attestationObject: Base64URLString
+ // Optional in L2, but becomes required in L3. Play it safe until L3 becomes Recommendation
+ authenticatorData?: Base64URLString
+ // Optional in L2, but becomes required in L3. Play it safe until L3 becomes Recommendation
+ transports?: AuthenticatorTransportFuture[]
+ // Optional in L2, but becomes required in L3. Play it safe until L3 becomes Recommendation
+ publicKeyAlgorithm?: COSEAlgorithmIdentifier
+ publicKey?: Base64URLString
+}
+
+/**
+ * A slightly-modified AuthenticatorAssertionResponse to simplify working with ArrayBuffers that
+ * are Base64URL-encoded in the browser so that they can be sent as JSON to the server.
+ *
+ * https://w3c.github.io/webauthn/#dictdef-authenticatorassertionresponsejson
+ */
+export interface AuthenticatorAssertionResponseJSON {
+ clientDataJSON: Base64URLString
+ authenticatorData: Base64URLString
+ signature: Base64URLString
+ userHandle?: Base64URLString
+}
+
+/**
+ * A WebAuthn-compatible device and the information needed to verify assertions by it
+ */
+export type AuthenticatorDevice = {
+ credentialID: Base64URLString
+ credentialPublicKey: Uint8Array
+ // Number of times this authenticator is expected to have been used
+ counter: number
+ // From browser's `startRegistration()` -> RegistrationCredentialJSON.transports (API L2 and up)
+ transports?: AuthenticatorTransportFuture[]
+}
+
+/**
+ * An attempt to communicate that this isn't just any string, but a Base64URL-encoded string
+ */
+export type Base64URLString = string
+
+/**
+ * AuthenticatorAttestationResponse in TypeScript's DOM lib is outdated (up through v3.9.7).
+ * Maintain an augmented version here so we can implement additional properties as the WebAuthn
+ * spec evolves.
+ *
+ * See https://www.w3.org/TR/webauthn-2/#iface-authenticatorattestationresponse
+ *
+ * Properties marked optional are not supported in all browsers.
+ */
+export interface AuthenticatorAttestationResponseFuture extends AuthenticatorAttestationResponse {
+ getTransports(): AuthenticatorTransportFuture[]
+}
+
+/**
+ * A super class of TypeScript's `AuthenticatorTransport` that includes support for the latest
+ * transports. Should eventually be replaced by TypeScript's when TypeScript gets updated to
+ * know about it (sometime after 4.6.3)
+ */
+export type AuthenticatorTransportFuture =
+ | 'ble'
+ | 'cable'
+ | 'hybrid'
+ | 'internal'
+ | 'nfc'
+ | 'smart-card'
+ | 'usb'
+
+/**
+ * A super class of TypeScript's `PublicKeyCredentialDescriptor` that knows about the latest
+ * transports. Should eventually be replaced by TypeScript's when TypeScript gets updated to
+ * know about it (sometime after 4.6.3)
+ */
+export interface PublicKeyCredentialDescriptorFuture
+ extends Omit<PublicKeyCredentialDescriptor, 'transports'> {
+ transports?: AuthenticatorTransportFuture[]
+}
+
+/** */
+export type PublicKeyCredentialJSON = RegistrationResponseJSON | AuthenticationResponseJSON
+
+/**
+ * A super class of TypeScript's `PublicKeyCredential` that knows about upcoming WebAuthn features
+ */
+export interface PublicKeyCredentialFuture extends PublicKeyCredential {
+ type: PublicKeyCredentialType
+ // See https:/w3c/webauthn/issues/1745
+ isConditionalMediationAvailable?(): Promise<boolean>
+ // See https://w3c.github.io/webauthn/#sctn-parseCreationOptionsFromJSON
+ parseCreationOptionsFromJSON?(
+ options: PublicKeyCredentialCreationOptionsJSON
+ ): PublicKeyCredentialCreationOptions
+ // See https://w3c.github.io/webauthn/#sctn-parseRequestOptionsFromJSON
+ parseRequestOptionsFromJSON?(
+ options: PublicKeyCredentialRequestOptionsJSON
+ ): PublicKeyCredentialRequestOptions
+ // See https://w3c.github.io/webauthn/#dom-publickeycredential-tojson
+ toJSON?(): PublicKeyCredentialJSON
+}


There's just so much going on here, and doesn't feel very used.

Can we just simplify this... the TypeScript compiler already includes all of the types necessary. We don't need to redefine anything.

The entire section is done as sugar around the TypeScript compiler fields. In the TypeScript version, certain fields are BufferSource while in the sugar version suffixed with -JSON these fields are cast to base64URL / string which is slightly easier to work with.

I would also like to remove this if possible, will see if there's a clean workaround. In the meantime open to suggestions as well

… general

J0 commented Sep 19, 2024

View reviewed changes

src/lib/types.ts Outdated Show resolved Hide resolved

J0 force-pushed the j0/add_webauthn branch from 9bb866d to 452aee4 Compare September 30, 2024 14:31

J0 commented Oct 2, 2024

View reviewed changes

src/GoTrueClient.ts Outdated Show resolved Hide resolved

J0 commented Oct 2, 2024

View reviewed changes

src/lib/types.ts Outdated Show resolved Hide resolved

J0 commented Oct 2, 2024

View reviewed changes

src/lib/helpers.ts Show resolved Hide resolved

J0 marked this pull request as ready for review October 2, 2024 14:18

J0 commented Oct 3, 2024

View reviewed changes

src/lib/types.ts Outdated Show resolved Hide resolved

J0 commented Oct 3, 2024

View reviewed changes

src/lib/types.ts Outdated Show resolved Hide resolved