2023-06-06 10:59:37 +05:30
|
|
|
import {encodeURLEncodedBase64, decodeURLEncodedBase64} from '../utils.js';
|
|
|
|
import {showElem, hideElem} from '../utils/dom.js';
|
2022-01-14 20:33:31 +05:30
|
|
|
|
|
|
|
const {appSubUrl, csrfToken} = window.config;
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
export async function initUserAuthWebAuthn() {
|
|
|
|
hideElem('#webauthn-error');
|
|
|
|
|
|
|
|
const elPrompt = document.querySelector('.user.signin.webauthn-prompt');
|
|
|
|
if (!elPrompt) {
|
2022-01-14 20:33:31 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!detectWebAuthnSupport()) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
const res = await fetch(`${appSubUrl}/user/webauthn/assertion`);
|
|
|
|
if (res.status !== 200) {
|
|
|
|
webAuthnError('unknown');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
const options = await res.json();
|
|
|
|
options.publicKey.challenge = decodeURLEncodedBase64(options.publicKey.challenge);
|
|
|
|
for (const cred of options.publicKey.allowCredentials) {
|
|
|
|
cred.id = decodeURLEncodedBase64(cred.id);
|
|
|
|
}
|
|
|
|
const credential = await navigator.credentials.get({
|
|
|
|
publicKey: options.publicKey
|
|
|
|
});
|
|
|
|
try {
|
|
|
|
await verifyAssertion(credential);
|
|
|
|
} catch (err) {
|
|
|
|
if (!options.publicKey.extensions?.appid) {
|
|
|
|
webAuthnError('general', err.message);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
delete options.publicKey.extensions.appid;
|
|
|
|
const credential = await navigator.credentials.get({
|
|
|
|
publicKey: options.publicKey
|
2022-01-14 20:33:31 +05:30
|
|
|
});
|
2023-06-06 10:59:37 +05:30
|
|
|
try {
|
|
|
|
await verifyAssertion(credential);
|
|
|
|
} catch (err) {
|
|
|
|
webAuthnError('general', err.message);
|
|
|
|
}
|
|
|
|
}
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
async function verifyAssertion(assertedCredential) {
|
2022-01-14 20:33:31 +05:30
|
|
|
// Move data into Arrays incase it is super long
|
|
|
|
const authData = new Uint8Array(assertedCredential.response.authenticatorData);
|
|
|
|
const clientDataJSON = new Uint8Array(assertedCredential.response.clientDataJSON);
|
|
|
|
const rawId = new Uint8Array(assertedCredential.rawId);
|
|
|
|
const sig = new Uint8Array(assertedCredential.response.signature);
|
|
|
|
const userHandle = new Uint8Array(assertedCredential.response.userHandle);
|
2023-06-06 10:59:37 +05:30
|
|
|
|
|
|
|
const res = await fetch(`${appSubUrl}/user/webauthn/assertion`, {
|
|
|
|
method: 'POST',
|
|
|
|
headers: {
|
|
|
|
'Content-Type': 'application/json; charset=utf-8'
|
|
|
|
},
|
|
|
|
body: JSON.stringify({
|
2022-01-14 20:33:31 +05:30
|
|
|
id: assertedCredential.id,
|
2023-02-01 12:54:10 +05:30
|
|
|
rawId: encodeURLEncodedBase64(rawId),
|
2022-01-14 20:33:31 +05:30
|
|
|
type: assertedCredential.type,
|
|
|
|
clientExtensionResults: assertedCredential.getClientExtensionResults(),
|
|
|
|
response: {
|
2023-02-01 12:54:10 +05:30
|
|
|
authenticatorData: encodeURLEncodedBase64(authData),
|
|
|
|
clientDataJSON: encodeURLEncodedBase64(clientDataJSON),
|
|
|
|
signature: encodeURLEncodedBase64(sig),
|
|
|
|
userHandle: encodeURLEncodedBase64(userHandle),
|
2022-01-14 20:33:31 +05:30
|
|
|
},
|
|
|
|
}),
|
|
|
|
});
|
2023-06-06 10:59:37 +05:30
|
|
|
if (res.status === 500) {
|
|
|
|
webAuthnError('unknown');
|
|
|
|
return;
|
|
|
|
} else if (res.status !== 200) {
|
|
|
|
webAuthnError('unable-to-process');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
const reply = await res.json();
|
2022-01-14 20:33:31 +05:30
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
window.location.href = reply?.redirect ?? `${appSubUrl}/`;
|
2023-02-01 12:54:10 +05:30
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
async function webauthnRegistered(newCredential) {
|
2022-01-14 20:33:31 +05:30
|
|
|
const attestationObject = new Uint8Array(newCredential.response.attestationObject);
|
|
|
|
const clientDataJSON = new Uint8Array(newCredential.response.clientDataJSON);
|
|
|
|
const rawId = new Uint8Array(newCredential.rawId);
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
const res = await fetch(`${appSubUrl}/user/settings/security/webauthn/register`, {
|
|
|
|
method: 'POST',
|
|
|
|
headers: {
|
|
|
|
'X-Csrf-Token': csrfToken,
|
|
|
|
'Content-Type': 'application/json; charset=utf-8',
|
|
|
|
},
|
|
|
|
body: JSON.stringify({
|
2022-01-14 20:33:31 +05:30
|
|
|
id: newCredential.id,
|
2023-02-01 12:54:10 +05:30
|
|
|
rawId: encodeURLEncodedBase64(rawId),
|
2022-01-14 20:33:31 +05:30
|
|
|
type: newCredential.type,
|
|
|
|
response: {
|
2023-02-01 12:54:10 +05:30
|
|
|
attestationObject: encodeURLEncodedBase64(attestationObject),
|
|
|
|
clientDataJSON: encodeURLEncodedBase64(clientDataJSON),
|
2022-01-14 20:33:31 +05:30
|
|
|
},
|
|
|
|
}),
|
|
|
|
});
|
2023-06-06 10:59:37 +05:30
|
|
|
|
|
|
|
if (res.status === 409) {
|
|
|
|
webAuthnError('duplicated');
|
|
|
|
return;
|
|
|
|
} else if (res.status !== 201) {
|
|
|
|
webAuthnError('unknown');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
window.location.reload();
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
function webAuthnError(errorType, message) {
|
2023-06-06 10:59:37 +05:30
|
|
|
const elErrorMsg = document.getElementById(`webauthn-error-msg`);
|
|
|
|
|
2022-01-15 22:22:56 +05:30
|
|
|
if (errorType === 'general') {
|
2023-06-06 10:59:37 +05:30
|
|
|
elErrorMsg.textContent = message || 'unknown error';
|
2022-01-14 20:33:31 +05:30
|
|
|
} else {
|
2023-06-06 10:59:37 +05:30
|
|
|
const elTypedError = document.querySelector(`#webauthn-error [data-webauthn-error-msg=${errorType}]`);
|
|
|
|
if (elTypedError) {
|
|
|
|
elErrorMsg.textContent = `${elTypedError.textContent}${message ? ` ${message}` : ''}`;
|
2022-01-15 22:22:56 +05:30
|
|
|
} else {
|
2023-06-06 10:59:37 +05:30
|
|
|
elErrorMsg.textContent = `unknown error type: ${errorType}${message ? ` ${message}` : ''}`;
|
2022-01-15 22:22:56 +05:30
|
|
|
}
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|
2023-06-06 10:59:37 +05:30
|
|
|
|
|
|
|
showElem('#webauthn-error');
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
function detectWebAuthnSupport() {
|
|
|
|
if (!window.isSecureContext) {
|
2023-06-06 10:59:37 +05:30
|
|
|
document.getElementById('register-button').disabled = true;
|
|
|
|
document.getElementById('login-button').disabled = true;
|
2022-01-14 20:33:31 +05:30
|
|
|
webAuthnError('insecure');
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (typeof window.PublicKeyCredential !== 'function') {
|
2023-06-06 10:59:37 +05:30
|
|
|
document.getElementById('register-button').disabled = true;
|
|
|
|
document.getElementById('login-button').disabled = true;
|
2022-01-14 20:33:31 +05:30
|
|
|
webAuthnError('browser');
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
export function initUserAuthWebAuthnRegister() {
|
2023-06-06 10:59:37 +05:30
|
|
|
const elRegister = document.getElementById('register-webauthn');
|
|
|
|
if (!elRegister) {
|
2022-01-14 20:33:31 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
hideElem('#webauthn-error');
|
|
|
|
|
|
|
|
elRegister.addEventListener('click', (e) => {
|
2022-01-14 20:33:31 +05:30
|
|
|
e.preventDefault();
|
2022-01-25 01:27:01 +05:30
|
|
|
if (!detectWebAuthnSupport()) {
|
|
|
|
return;
|
|
|
|
}
|
2022-01-14 20:33:31 +05:30
|
|
|
webAuthnRegisterRequest();
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
async function webAuthnRegisterRequest() {
|
|
|
|
const elNickname = document.getElementById('nickname');
|
|
|
|
|
|
|
|
const body = new FormData();
|
|
|
|
body.append('name', elNickname.value);
|
|
|
|
|
|
|
|
const res = await fetch(`${appSubUrl}/user/settings/security/webauthn/request_register`, {
|
|
|
|
method: 'POST',
|
|
|
|
headers: {
|
|
|
|
'X-Csrf-Token': csrfToken,
|
|
|
|
},
|
|
|
|
body,
|
|
|
|
});
|
|
|
|
|
|
|
|
if (res.status === 409) {
|
|
|
|
webAuthnError('duplicated');
|
|
|
|
return;
|
|
|
|
} else if (res.status !== 200) {
|
|
|
|
webAuthnError('unknown');
|
2022-01-14 20:33:31 +05:30
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2023-06-06 10:59:37 +05:30
|
|
|
const options = await res.json();
|
|
|
|
elNickname.closest('div.field').classList.remove('error');
|
|
|
|
|
|
|
|
options.publicKey.challenge = decodeURLEncodedBase64(options.publicKey.challenge);
|
|
|
|
options.publicKey.user.id = decodeURLEncodedBase64(options.publicKey.user.id);
|
|
|
|
if (options.publicKey.excludeCredentials) {
|
|
|
|
for (const cred of options.publicKey.excludeCredentials) {
|
|
|
|
cred.id = decodeURLEncodedBase64(cred.id);
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|
2023-06-06 10:59:37 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
let credential;
|
|
|
|
try {
|
|
|
|
credential = await navigator.credentials.create({
|
|
|
|
publicKey: options.publicKey
|
|
|
|
});
|
|
|
|
} catch (err) {
|
|
|
|
webAuthnError('unknown', err);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
webauthnRegistered(credential);
|
2022-01-14 20:33:31 +05:30
|
|
|
}
|