feat(web): MFA and passkey sign-in on the login page

2026-09-16 09:22:18 +00:00
parent d8597ee3ae
commit 26825841fa
6 changed files with 825 additions and 132 deletions
@@ -0,0 +1,68 @@
+// Browser-side WebAuthn helpers. The server sends and expects base64url;
+// the browser's credential APIs need ArrayBuffers.
+
+function b64urlToBuffer(value: string): ArrayBuffer {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+    const binary = atob(padded.padEnd(padded.length + ((4 - (padded.length % 4)) % 4), "="));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes.buffer;
+}
+
+function bufferToB64url(buffer: ArrayBuffer): string {
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (const b of bytes) binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function isPasskeySupported(): boolean {
+    return typeof window !== "undefined" && !!window.PublicKeyCredential;
+}
+
+export function toCreateOptions(options: any): PublicKeyCredentialCreationOptions {
+    return {
+        ...options,
+        challenge: b64urlToBuffer(options.challenge),
+        user: { ...options.user, id: b64urlToBuffer(options.user.id) },
+        excludeCredentials: (options.excludeCredentials ?? []).map((c: any) => ({
+            ...c,
+            id: b64urlToBuffer(c.id),
+        })),
+    };
+}
+
+export function toRequestOptions(options: any): PublicKeyCredentialRequestOptions {
+    return {
+        ...options,
+        challenge: b64urlToBuffer(options.challenge),
+        allowCredentials: (options.allowCredentials ?? []).map((c: any) => ({
+            ...c,
+            id: b64urlToBuffer(c.id),
+        })),
+    };
+}
+
+// credentialToJSON produces the shape go-webauthn's parsers read.
+export function credentialToJSON(cred: PublicKeyCredential): unknown {
+    const response = cred.response as AuthenticatorAttestationResponse & AuthenticatorAssertionResponse;
+    const json: any = {
+        id: cred.id,
+        rawId: bufferToB64url(cred.rawId),
+        type: cred.type,
+        clientExtensionResults: cred.getClientExtensionResults(),
+        response: { clientDataJSON: bufferToB64url(response.clientDataJSON) },
+    };
+    if (response.attestationObject) {
+        json.response.attestationObject = bufferToB64url(response.attestationObject);
+        if (typeof response.getTransports === "function") {
+            json.response.transports = response.getTransports();
+        }
+    }
+    if (response.authenticatorData) {
+        json.response.authenticatorData = bufferToB64url(response.authenticatorData);
+        json.response.signature = bufferToB64url(response.signature);
+        json.response.userHandle = response.userHandle ? bufferToB64url(response.userHandle) : null;
+    }
+    return json;
+}