bermudalamb/redefined-designs
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects 3 Releases Wiki Activity

feat(passkeys): schema, dependency and per-environment Relying Party (#37)

Browse Source 
Groundwork only. Nothing reads any of this yet, and no behaviour changes.

The Relying Party ID is derived from PUBLIC_URL rather than written down, because it is the one value in this feature that cannot be corrected afterwards: a credential is bound to it permanently, and a wrong one surfaces only as a customer unable to sign in with a passkey that no longer matches anything. PUBLIC_URL is what every customer-facing link is already built from, so the ID is correct wherever those links are, and wrong only where they were already wrong. hostname rather than host, so a port cannot reach an ID that must not contain one.

Local development is the exception the issue's table did not cover. envValidation requires PUBLIC_URL only when SMTP is configured, so a local setup that cannot send mail legitimately has none and falls back to localhost, which browsers treat as a secure context. Two origins there rather than one: the app is served by Vite on 5173 during development and by Express on 3000 once built, and those differ only by port, which is not part of the RP ID.

The challenge table is separate from customer_tokens, and the reason is structural rather than preference. customer_tokens.customer_id is NOT NULL, and an authentication challenge is issued before anyone is identified — a discoverable-credential sign-in has no customer to attach to at the moment the challenge exists. Storing it there would mean making that column nullable for every other kind of token.

Two of the issue's open decisions are deliberately not made here, because they belong to the ceremony that enforces them rather than to the schema. What to do when the signature counter fails to increase is #39's: many synced passkeys report zero forever, so treating a non-increase as cloning is wrong for them and right for a hardware key, and this only has to hold the value. Whether a disabled account can authenticate is also #39's, and the schema takes the position that it should not cost the customer their devices: credentials survive disabling and are refused at the ceremony, so re-enabling does not mean re-registering everything. Deletion is different and is settled here — credentials cascade with the customer, since one outliving its owner could authenticate as an account that no longer exists.

signature_counter is BIGINT because the spec allows a 32-bit unsigned value, which overflows a signed INTEGER at half its range. That is the first bigint column in this schema, so the generated mirror gains the Int8 alias with it.

Both tables are added to resetDb's TRUNCATE list and to REQUIRED_TABLES, and the schema mirror is updated by hand to match what kysely-codegen emits — placement and all, so a real regenerate produces no diff. Skipping either is how #56 turned a green local run into a red main; the mirror drift guard exists precisely to catch it, and schemaLoss's count moves from 18 to 20 with them.

Verified: tsc clean for src and tests, lint 0 errors with no new warnings, 494 unit tests across 34 suites including nine new ones for the RP derivation, frontend build green, and the migration parses. Not verified: the migration has not been run against a database, and the integration suite needs one this machine cannot provide.

Worth knowing before this goes further: #313 changes the domain, and every passkey registered before that cutover stops working at it. This code needs no change — it follows PUBLIC_URL — but the credentials do not survive. That is free while production is not live and nobody holds one, and it stops being free the day the shop opens.

Closes #37

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
synAdmin
2026-09-09 14:08:29 -05:00
committed by bermudalamb
co-authored by Claude Opus 5
parent 6a2143696a
commit 6d320fd867
10 changed files with 675 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/migrations/1787900000000_add-passkeys.js
+97
View File
@@ -0,0 +1,97 @@
exports.up = (pgm) => {
pgm.sql(`
-- A registered passkey (#37). Groundwork only: nothing reads these yet.
--
-- Bound to the customer and deleted with them. Account deletion already
-- removes the personal data this sits beside, and a credential that
-- outlived its owner could authenticate as a customer who no longer exists.
-- Disabling an account (#33) is a different question and is deliberately not
-- a schema concern: a disabled customer keeps their credentials and is
-- refused at the authentication ceremony instead, so re-enabling them does
-- not mean re-registering every device.
CREATE TABLE IF NOT EXISTS customer_credentials (
id SERIAL PRIMARY KEY,
customer_id INTEGER NOT NULL REFERENCES customers(id) ON DELETE CASCADE,
-- The credential ID as base64url text rather than bytea. It arrives from
-- the browser in that form, is compared as an opaque string, and is never
-- interpreted here — storing bytes would mean encoding on write and
-- decoding on every read for no gain.
--
-- Unique across the table, not merely per customer: a credential ID
-- identifies an authenticator, and the same one appearing under two
-- accounts means something has gone wrong rather than that two people
-- share a key.
credential_id TEXT NOT NULL UNIQUE,
-- The COSE public key, base64url. Verified against, never parsed here.
public_key TEXT NOT NULL,
-- BIGINT because the spec allows a 32-bit unsigned value, which overflows
-- a signed INTEGER at half its range.
--
-- What to do when this fails to increase is NOT decided here. Many synced
-- passkeys report 0 forever, so "a regression means cloning" is wrong for
-- them and right for hardware keys. That policy belongs with the
-- authentication ceremony that enforces it (#39); this column only has to
-- be able to hold the value.
signature_counter BIGINT NOT NULL DEFAULT 0,
-- How the authenticator can be reached: usb, nfc, ble, internal, hybrid.
-- A JSON array as text, because it is passed back to the browser verbatim
-- and never queried on.
transports TEXT,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-- Null until first used. Shown on the account page (#40) so a customer can
-- recognise which device a credential belongs to, which is the only way
-- they can tell two entries apart.
last_used_at TIMESTAMPTZ
);
-- Listing a customer's credentials is the common read, and revocation (#40)
-- has to scope by owner.
CREATE INDEX IF NOT EXISTS customer_credentials_customer_id_idx
ON customer_credentials (customer_id);
-- An in-flight WebAuthn challenge (#37).
--
-- A separate table rather than customer_tokens with a new kind, and the
-- reason is structural rather than tidiness: customer_tokens.customer_id is
-- NOT NULL, and an *authentication* challenge is issued before anyone is
-- identified. A discoverable-credential sign-in has no customer to attach
-- to at the moment the challenge is created, so it could not be stored
-- there without making that column nullable for every other kind of token.
CREATE TABLE IF NOT EXISTS webauthn_challenges (
-- The challenge itself, base64url, as issued. Primary key because it is
-- the thing looked up, and unique by construction.
challenge TEXT PRIMARY KEY,
-- Null for authentication, set for registration. Registration requires an
-- authenticated session — it is not a sign-up path — so that half always
-- knows whose it is.
customer_id INTEGER REFERENCES customers(id) ON DELETE CASCADE,
-- 'registration' or 'authentication'. Not a CHECK constraint: the values
-- come from this codebase rather than from a request, and the project has
-- no enum types elsewhere.
kind TEXT NOT NULL,
expires_at TIMESTAMPTZ NOT NULL
);
-- Expiry is swept by time, so the sweep reads this rather than the whole
-- table. Single use is enforced by deleting the row on consumption, which
-- needs no index beyond the primary key.
CREATE INDEX IF NOT EXISTS webauthn_challenges_expires_at_idx
ON webauthn_challenges (expires_at);
`);
};
exports.down = (pgm) => {
pgm.sql(`
DROP TABLE IF EXISTS webauthn_challenges;
DROP TABLE IF EXISTS customer_credentials;
`);
};
backend/package-lock.json
Generated
+338 -2
View File
@@ -9,6 +9,7 @@
"version": "1.0.0",
"dependencies": {
"@anthropic-ai/sdk": "^0.122.0",
"@simplewebauthn/server": "^14.0.1",
"@types/markdown-it": "^14.2.0",
"bcryptjs": "^2.4.3",
"cookie-parser": "^1.4.6",
@@ -102,6 +103,7 @@
"integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@babel/code-frame": "^7.29.7",
"@babel/generator": "^7.29.7",
@@ -1304,6 +1306,12 @@
"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
}
},
"node_modules/@hexagon/base64": {
"version": "1.1.28",
"resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
"integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==",
"license": "MIT"
},
"node_modules/@humanfs/core": {
"version": "0.19.2",
"resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
@@ -2257,6 +2265,12 @@
"@jridgewell/sourcemap-codec": "^1.4.14"
}
},
"node_modules/@levischuck/tiny-cbor": {
"version": "0.2.11",
"resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz",
"integrity": "sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==",
"license": "MIT"
},
"node_modules/@noble/hashes": {
"version": "1.8.0",
"resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
@@ -2280,6 +2294,260 @@
"@noble/hashes": "^1.1.5"
}
},
"node_modules/@peculiar/asn1-android": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-android/-/asn1-android-2.9.4.tgz",
"integrity": "sha512-SYHm4SoWSI0nRCoos6jpGusIqhPH9bbGBqv7ohlZ+H6BunrDzzQPk2ePgDuEUzV82OdvbLgtW4twUDwhU9P3YQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-asym-key": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-asym-key/-/asn1-asym-key-2.9.4.tgz",
"integrity": "sha512-s7SJfjcXlR3MYMngDTeMLCy3VjGaIxeEy905CQ0j09pDbeYhNBvBGA7r7cAvCZYkVFo9kVg9RAki0K2iUz7SGQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-pkcs8": "^2.9.4",
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-cms": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.9.4.tgz",
"integrity": "sha512-cben7oxmQsUGZqotus7yt0srYdncOT6RNWcTQ77T2RFOXejYVYkXadrfePdRcrVpO9K95IRLKKglG2k38jKXuw==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"@peculiar/asn1-x509-attr": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-csr": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.9.4.tgz",
"integrity": "sha512-xd4YN4vpRjkDAQWVfZZkeu12IEND7DOpkqaHSIHxZl1uggUNa9Ju0QxY2jHvDAS9pP0zhRBytg8ifsnGo3V0jw==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-ecc": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.9.4.tgz",
"integrity": "sha512-JJXefFshRAuVAjWQo/39bkg1ywc1VaiO44S8RRC+Ykvf/u2KDmYffoDb0ZBPCR5uJy4AGKQhl8mX+Q8ShcWaXQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-pfx": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.9.4.tgz",
"integrity": "sha512-khuGzHTzNzk4GDlIBEILyIs6Lce0yn0ZBdoI9v93kmNncfZRhD+AQ5ODFqdhvoE8cMJF/JMTQ8yA+t1D14kqCw==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-cms": "^2.9.4",
"@peculiar/asn1-pkcs8": "^2.9.4",
"@peculiar/asn1-rsa": "^2.9.4",
"@peculiar/asn1-schema": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-pkcs8": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.9.4.tgz",
"integrity": "sha512-duRdotlUx9eDZe6QrQpQKl61RbWykCHBCkKayP8V8XdEFwlKHZ8qGGDMyS6Pye7OX7nLFttTTpRkJeet78ckwQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-pkcs9": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.9.4.tgz",
"integrity": "sha512-kaL4cNxBpdQE2dKlyZBqz4ygCrwffO+8wfoxTEqM1Z8RadvCeELBRzcv0dzM8aY9azHMwODO5nxU65zXmhToOQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-cms": "^2.9.4",
"@peculiar/asn1-pfx": "^2.9.4",
"@peculiar/asn1-pkcs8": "^2.9.4",
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"@peculiar/asn1-x509-attr": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-rsa": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.9.4.tgz",
"integrity": "sha512-pZ96eD1PptovcWQ/GSmuNFXd/7EQJNlKfDaNCyE2rx3W0v6QFelkzquVqRSRyyDXXCYD69ZXJDzZ8GhIiQzKoA==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-schema": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.9.4.tgz",
"integrity": "sha512-GjzePcT9Iw8NzeOPf73iNS9xM+TBhd/FilAfP+RQGkTMQJTVWtytN3JHJACCjf/ABNau5S7mS3g+DcuxmRgYEg==",
"license": "MIT",
"dependencies": {
"@peculiar/utils": "^2.0.2",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-x509": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.9.4.tgz",
"integrity": "sha512-CxhBo/RdEbMMob7T31ZdQjGuoyRFLVwrDzTn25bihzBasRg9kRm/0IxIPvhgQtcK/9dNcO1XQL2fuPugwELL0Q==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/utils": "^2.0.2",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-x509-attr": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.9.4.tgz",
"integrity": "sha512-ehQXbpQaQYycgu8OrvigwSPTFfVRcu0ECNYCWw+yzBp02Lw5paRqzzhUpfOgO2K38+WfFZuEz/0RPtam5g0OMg==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/asn1-x509-post-quantum": {
"version": "2.9.4",
"resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-post-quantum/-/asn1-x509-post-quantum-2.9.4.tgz",
"integrity": "sha512-GD0k7BY3dsEIeai7C7bVRPddj/PzZu+sTawRPRxdHKbdy1f9b58WQyk0eFJdr28GShyLVTU8poyi4+bTAZfEtQ==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-asym-key": "^2.9.4",
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"asn1js": "^3.0.10",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=14"
}
},
"node_modules/@peculiar/utils": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
"integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
"license": "MIT",
"dependencies": {
"tslib": "^2.8.1"
}
},
"node_modules/@peculiar/x509": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-2.1.0.tgz",
"integrity": "sha512-IYbg1R03CSQGWwl24kGyqrdVtixNSbRaDvBg1r5wyYjTP+VwPQkka1BzTgU5+vxiuwqg04OxdvdJ1xYYFIdUSA==",
"license": "MIT",
"dependencies": {
"@peculiar/asn1-cms": "^2.9.4",
"@peculiar/asn1-csr": "^2.9.4",
"@peculiar/asn1-ecc": "^2.9.4",
"@peculiar/asn1-pkcs9": "^2.9.4",
"@peculiar/asn1-rsa": "^2.9.4",
"@peculiar/asn1-schema": "^2.9.4",
"@peculiar/asn1-x509": "^2.9.4",
"@peculiar/asn1-x509-post-quantum": "^2.9.4",
"pvtsutils": "^1.3.6",
"tslib": "^2.8.1",
"tsyringe": "^4.10.0"
},
"engines": {
"node": ">=20.0.0"
}
},
"node_modules/@simplewebauthn/server": {
"version": "14.0.1",
"resolved": "https://registry.npmjs.org/@simplewebauthn/server/-/server-14.0.1.tgz",
"integrity": "sha512-kjWgcm9NdSv+Tobo4Swxd1WnEawsBogpYFMjg9pKsVLPN3FdCmR6BipkL+DcPDgmQ7UKbbBZqRqn3E3YaA7NBw==",
"license": "MIT",
"dependencies": {
"@hexagon/base64": "^1.1.27",
"@levischuck/tiny-cbor": "^0.2.2",
"@peculiar/asn1-android": "^2.6.0",
"@peculiar/asn1-ecc": "^2.6.1",
"@peculiar/asn1-rsa": "^2.6.1",
"@peculiar/asn1-schema": "^2.6.0",
"@peculiar/asn1-x509": "^2.6.1",
"@peculiar/asn1-x509-post-quantum": "^2.9.4",
"@peculiar/x509": "^2.1.0",
"reflect-metadata": "^0.2.2"
},
"engines": {
"node": ">=20.0.0"
}
},
"node_modules/@sinclair/typebox": {
"version": "0.27.12",
"resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.12.tgz",
@@ -2415,6 +2683,7 @@
"integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@types/body-parser": "*",
"@types/express-serve-static-core": "^4.17.33",
@@ -2575,6 +2844,7 @@
"integrity": "sha512-AYdtudzabjLZgVgRZmAnU8bAnVUXzuJX2IYHeSIiIHm68olD+LgQYCGWdtcNYnP0uq9c4S4NibVG3Ni7VbKW7Q==",
"devOptional": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@types/node": "*",
"pg-protocol": "*",
@@ -2721,6 +2991,7 @@
"integrity": "sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@typescript-eslint/scope-manager": "8.67.0",
"@typescript-eslint/types": "8.67.0",
@@ -3090,6 +3361,7 @@
"integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
"dev": true,
"license": "MIT",
"peer": true,
"bin": {
"acorn": "bin/acorn"
},
@@ -3207,6 +3479,20 @@
"dev": true,
"license": "MIT"
},
"node_modules/asn1js": {
"version": "3.0.10",
"resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
"integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
"license": "BSD-3-Clause",
"dependencies": {
"pvtsutils": "^1.3.6",
"pvutils": "^1.1.5",
"tslib": "^2.8.1"
},
"engines": {
"node": ">=12.0.0"
}
},
"node_modules/asynckit": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
@@ -3424,6 +3710,7 @@
}
],
"license": "MIT",
"peer": true,
"dependencies": {
"baseline-browser-mapping": "^2.11.12",
"caniuse-lite": "^1.0.30001809",
@@ -4245,6 +4532,7 @@
"integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@eslint-community/eslint-utils": "^4.8.0",
"@eslint-community/regexpp": "^4.12.1",
@@ -4635,6 +4923,7 @@
"resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
"integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
"license": "MIT",
"peer": true,
"dependencies": {
"accepts": "~1.3.8",
"array-flatten": "1.1.1",
@@ -5556,6 +5845,7 @@
"integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@jest/core": "^29.7.0",
"@jest/types": "^29.6.3",
@@ -6268,6 +6558,7 @@
"resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
"integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
"license": "MIT",
"peer": true,
"engines": {
"node": ">=20.0.0"
}
@@ -7102,6 +7393,7 @@
"resolved": "https://registry.npmjs.org/pg/-/pg-8.23.0.tgz",
"integrity": "sha512-Ip2EQCngowJLGOfCwkFhPXU7/ljlhn6Rxlmy4XYfL2Y+vyRM59+8uR2xqRWKdYmbXmxCFOAmKxBuSUCdF34qLg==",
"license": "MIT",
"peer": true,
"dependencies": {
"pg-connection-string": "^2.14.0",
"pg-pool": "^3.14.0",
@@ -7385,6 +7677,24 @@
],
"license": "MIT"
},
"node_modules/pvtsutils": {
"version": "1.3.6",
"resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
"integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
"license": "MIT",
"dependencies": {
"tslib": "^2.8.1"
}
},
"node_modules/pvutils": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
"integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
"license": "MIT",
"engines": {
"node": ">=16.0.0"
}
},
"node_modules/qs": {
"version": "6.15.3",
"resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
@@ -7466,6 +7776,12 @@
"node": "^12.0.0 || ^14.0.0 || >=16.0.0"
}
},
"node_modules/reflect-metadata": {
"version": "0.2.2",
"resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
"integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
"license": "Apache-2.0"
},
"node_modules/regexp-ast-analysis": {
"version": "0.7.1",
"resolved": "https://registry.npmjs.org/regexp-ast-analysis/-/regexp-ast-analysis-0.7.1.tgz",
@@ -8154,6 +8470,7 @@
"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
"dev": true,
"license": "MIT",
"peer": true,
"engines": {
"node": ">=12"
},
@@ -8291,8 +8608,7 @@
"version": "2.8.1",
"resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
"integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
"license": "0BSD",
"optional": true
"license": "0BSD"
},
"node_modules/tsx": {
"version": "4.23.12",
@@ -8313,6 +8629,24 @@
"fsevents": "~2.3.3"
}
},
"node_modules/tsyringe": {
"version": "4.10.0",
"resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
"integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
"license": "MIT",
"dependencies": {
"tslib": "^1.9.3"
},
"engines": {
"node": ">= 6.0.0"
}
},
"node_modules/tsyringe/node_modules/tslib": {
"version": "1.14.1",
"resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
"integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
"license": "0BSD"
},
"node_modules/type-check": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -8374,6 +8708,7 @@
"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
"dev": true,
"license": "Apache-2.0",
"peer": true,
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -8696,6 +9031,7 @@
"version": "4.5.4",
"resolved": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz",
"integrity": "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==",
"peer": true,
"funding": {
"url": "https://github.com/sponsors/colinhacks"
}
backend/package.json
+1
View File
@@ -32,6 +32,7 @@
},
"dependencies": {
"@anthropic-ai/sdk": "^0.122.0",
"@simplewebauthn/server": "^14.0.1",
"@types/markdown-it": "^14.2.0",
"bcryptjs": "^2.4.3",
"cookie-parser": "^1.4.6",
backend/src/db-kysely/schema.ts
+22
View File
@@ -9,6 +9,8 @@ export type Generated<T> = T extends ColumnType<infer S, infer I, infer U>
? ColumnType<S, I | undefined, U>
: ColumnType<T, T | undefined, T>;
export type Int8 = ColumnType<string, bigint | number | string, bigint | number | string>;
export type Json = JsonValue;
export type JsonArray = JsonValue[];
@@ -71,6 +73,17 @@ export interface Checkouts {
status: Generated<string>;
}
export interface CustomerCredentials {
created_at: Generated<Timestamp>;
credential_id: string;
customer_id: number;
id: Generated<number>;
last_used_at: Timestamp | null;
public_key: string;
signature_counter: Generated<Int8>;
transports: string | null;
}
export interface Customers {
analytics_consent: Generated<boolean>;
analytics_consent_at: Timestamp | null;
@@ -212,6 +225,13 @@ export interface UploadLinks {
token_hash: string;
}
export interface WebauthnChallenges {
challenge: string;
customer_id: number | null;
expires_at: Timestamp;
kind: string;
}
export interface DB {
admin_settings: AdminSettings;
cart_items: CartItems;
@@ -219,6 +239,7 @@ export interface DB {
categories: Categories;
checkout_items: CheckoutItems;
checkouts: Checkouts;
customer_credentials: CustomerCredentials;
customer_sessions: CustomerSessions;
customer_tokens: CustomerTokens;
customers: Customers;
@@ -231,4 +252,5 @@ export interface DB {
shipping_addresses: ShippingAddresses;
tags: Tags;
upload_links: UploadLinks;
webauthn_challenges: WebauthnChallenges;
}
backend/src/passkeys/relyingParty.ts
+111
View File
@@ -0,0 +1,111 @@
/**
* Who this application is, as far as WebAuthn is concerned (#37).
*
* ## Why this is derived rather than written down
*
* The Relying Party ID is a domain, and **a credential is bound to it
* permanently**. A passkey registered against one RP ID cannot be used against
* another — there is no migration, no re-signing, and no way to carry one over.
* So the RP ID is the one piece of configuration that must never be wrong, and
* must never be a value someone remembered to change.
*
* It comes from `PUBLIC_URL`, which is the same value every customer-facing
* link is already built from. That makes the RP ID correct by construction in
* any environment where mail works, and wrong only in environments where the
* links were already wrong.
*
* ## The consequence worth stating plainly
*
* Each environment is a different Relying Party:
*
* | Environment | RP ID | Effect |
* | --- | --- | --- |
* | Local | `localhost` | A secure context by exception, so passkeys work |
* | QA | the QA hostname | Registered here, usable only here |
* | Production | the production hostname | Different credentials again |
*
* **QA can prove the flow and can never prove the credentials.** A passkey
* registered in QA will not sign in to production, and that is correct rather
* than a bug to work around.
*
* It also means **#313 destroys every passkey registered before it**. Moving to
* `redefined-designs.com` changes the RP ID, so credentials bound to
* `*.bermudalamb.synology.me` stop working at the cutover with no way back.
* This code needs no change when that happens — it follows `PUBLIC_URL` — but
* anyone who registered a passkey beforehand has to register it again. That is
* free today, because production is not live and no real customer holds one,
* and it stops being free the moment the shop opens.
*/
/** Everything the ceremonies need to identify this Relying Party. */
export interface RelyingParty {
/** The RP ID: a bare domain, no scheme and no port. */
id: string;
/** Shown by the authenticator when it asks the customer to confirm. */
name: string;
/**
* Origins a ceremony may legitimately come from.
*
* A list rather than one string because local development serves the app from
* two: Vite on 5173 during `npm run dev`, and the backend on 3000 when the
* built frontend is served by Express. Both are `localhost`, so both are the
* same Relying Party — only the port differs, and the port is not part of the
* RP ID. Deployed environments have exactly one.
*/
origins: string[];
}
export const RELYING_PARTY_NAME = 'Redefined Designs';
/**
* Local development, where `PUBLIC_URL` is legitimately unset.
*
* `envValidation` requires `PUBLIC_URL` only when SMTP is configured, so a local
* setup that cannot send mail does not have it — and refusing to start there
* would break every such setup to prevent nothing. `localhost` is a secure
* context by exception in every browser that implements WebAuthn, so this works
* without TLS.
*/
const LOCAL_ORIGINS = ['http://localhost:5173', 'http://localhost:3000'];
/**
* The Relying Party for this environment.
*
* Takes the environment as an argument so it can be tested without touching
* `process.env`, and reads it on each call rather than at import time: the
* module would otherwise capture whatever was set when it was first required,
* which in tests is whatever the previous suite happened to leave behind.
*
* Throws on a `PUBLIC_URL` that is set but unparseable. That is a deployment
* that will also produce broken links in every email, so failing here is not
* the first thing to go wrong — it is the first thing to *say so*.
*/
export function relyingParty(env: NodeJS.ProcessEnv = process.env): RelyingParty {
const publicUrl = (env.PUBLIC_URL ?? '').trim();
if (publicUrl === '') {
return { id: 'localhost', name: RELYING_PARTY_NAME, origins: LOCAL_ORIGINS };
}
let parsed: URL;
try {
parsed = new URL(publicUrl);
} catch {
throw new Error(
`PUBLIC_URL is not a URL (${publicUrl}), so the WebAuthn Relying Party ID cannot be ` +
'derived from it. Every passkey is bound permanently to that ID, so this is refused ' +
'rather than guessed at.'
);
}
return {
// `hostname` rather than `host`: the RP ID is a domain and must not carry a
// port. `host` includes one when the URL has it, and an RP ID of
// "example.com:8443" matches nothing.
id: parsed.hostname,
name: RELYING_PARTY_NAME,
// `origin` normalises away any path, trailing slash or default port, which
// is exactly the string the browser will report.
origins: [parsed.origin]
};
}
backend/tests/integration/schemaLoss.integration.test.ts
+1 -1
View File
@@ -42,7 +42,7 @@ describe('when the database loses its schema', () => {
// The count and a few names, not the whole list: the point is that a reader
// can tell at a glance this is a missing schema rather than a logic bug.
await expect(assertSchemaPresent('in a test')).rejects.toThrow(/Missing 18 of 18 tables/);
await expect(assertSchemaPresent('in a test')).rejects.toThrow(/Missing 20 of 20 tables/);
await expect(assertSchemaPresent('in a test')).rejects.toThrow(/items/);
await migrate();
backend/tests/integration/setup/testDb.ts
+4 -1
View File
@@ -37,6 +37,7 @@ const REQUIRED_TABLES = [
'categories',
'checkout_items',
'checkouts',
'customer_credentials',
'customer_sessions',
'customer_tokens',
'customers',
@@ -48,7 +49,8 @@ const REQUIRED_TABLES = [
'orders',
'shipping_addresses',
'tags',
'upload_links'
'upload_links',
'webauthn_challenges'
] as const;
/** Which of them the database does not currently have. */
@@ -151,6 +153,7 @@ export async function resetDb(): Promise<void> {
await testPool.query(`
TRUNCATE TABLE item_drafts, upload_links, orders, checkout_items, checkouts,
shipping_addresses, cart_items, carts, customer_tokens, customer_sessions, favorites,
webauthn_challenges, customer_credentials,
customers, item_tags, item_images, items, tags, categories
RESTART IDENTITY CASCADE
`);
backend/tests/unit/relyingParty.test.ts
+75
View File
@@ -0,0 +1,75 @@
import { relyingParty, RELYING_PARTY_NAME } from '../../src/passkeys/relyingParty';
/**
* The RP ID is the one value in this feature that cannot be corrected later: a
* passkey is bound to it permanently, and a wrong one is only discovered when a
* customer cannot sign in with a credential that no longer matches anything.
*
* So these assert the derivation itself rather than that the function returns
* something. Most of them are about what must *not* end up in the ID.
*/
describe('relyingParty', () => {
it('takes the RP ID from PUBLIC_URL', () => {
const rp = relyingParty({ PUBLIC_URL: 'https://redefined-designs.com' });
expect(rp.id).toBe('redefined-designs.com');
expect(rp.origins).toEqual(['https://redefined-designs.com']);
expect(rp.name).toBe(RELYING_PARTY_NAME);
});
it('keeps a subdomain, which is a different Relying Party', () => {
// QA and production are separate RPs on purpose. A credential registered
// against one does not work against the other, and collapsing them to the
// registrable domain would silently make QA able to sign into production.
const qa = relyingParty({ PUBLIC_URL: 'https://qa-redefined-designs.bermudalamb.synology.me' });
const prod = relyingParty({ PUBLIC_URL: 'https://redefined-designs.bermudalamb.synology.me' });
expect(qa.id).toBe('qa-redefined-designs.bermudalamb.synology.me');
expect(prod.id).toBe('redefined-designs.bermudalamb.synology.me');
expect(qa.id).not.toBe(prod.id);
});
it('strips the port, which is not part of an RP ID', () => {
// An RP ID of "example.com:8443" matches nothing, and the failure is a
// credential that cannot be used rather than an error at registration.
const rp = relyingParty({ PUBLIC_URL: 'https://example.com:8443' });
expect(rp.id).toBe('example.com');
expect(rp.origins).toEqual(['https://example.com:8443']);
});
it('strips a path and a trailing slash from the origin', () => {
const rp = relyingParty({ PUBLIC_URL: 'https://example.com/shop/' });
expect(rp.id).toBe('example.com');
// The browser reports an origin, never a path, so a stored path would never
// match what arrives.
expect(rp.origins).toEqual(['https://example.com']);
});
it.each(['', ' ', undefined])('falls back to localhost when PUBLIC_URL is %p', (value) => {
// envValidation requires PUBLIC_URL only when SMTP is configured, so a local
// setup that cannot send mail legitimately has none.
const rp = relyingParty(value === undefined ? {} : { PUBLIC_URL: value });
expect(rp.id).toBe('localhost');
// Both local origins, because the app is served from Vite during dev and
// from Express once built, and they differ only by port.
expect(rp.origins).toEqual(['http://localhost:5173', 'http://localhost:3000']);
});
it('refuses a PUBLIC_URL that is not a URL rather than guessing', () => {
// Guessing here would bind every passkey to something nobody chose, and the
// binding is permanent.
expect(() => relyingParty({ PUBLIC_URL: 'redefined-designs.com' })).toThrow(
/Relying Party ID cannot be derived/
);
});
it('reads the environment on each call rather than at import', () => {
// Captured at import, this would hold whatever the first suite to require
// the module happened to have set.
expect(relyingParty({ PUBLIC_URL: 'https://one.example' }).id).toBe('one.example');
expect(relyingParty({ PUBLIC_URL: 'https://two.example' }).id).toBe('two.example');
});
});