1
// Licensed to the Software Freedom Conservancy (SFC) under one
2
// or more contributor license agreements.  See the NOTICE file
3
// distributed with this work for additional information
4
// regarding copyright ownership.  The SFC licenses this file
5
// to you under the Apache License, Version 2.0 (the
6
// "License"); you may not use this file except in compliance
7
// with the License.  You may obtain a copy of the License at
8
//
9
//   http://www.apache.org/licenses/LICENSE-2.0
10
//
11
// Unless required by applicable law or agreed to in writing,
12
// software distributed under the License is distributed on an
13
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14
// KIND, either express or implied.  See the License for the
15
// specific language governing permissions and limitations
16
// under the License.
17

18
'use strict'
19

20
/**
21
 * Protocol for virtual authenticators
22
 * @enum {string}
23
 */
24
const Protocol = {
25
  CTAP2: 'ctap2',
26
  U2F: 'ctap1/u2f',
27
}
28

29
/**
30
 * AuthenticatorTransport values
31
 * @enum {string}
32
 */
33
const Transport = {
34
  BLE: 'ble',
35
  USB: 'usb',
36
  NFC: 'nfc',
37
  INTERNAL: 'internal',
38
}
39

40
/**
41
 * Options for the creation of virtual authenticators.
42
 * @see http://w3c.github.io/webauthn/#sctn-automation
43
 */
44
class VirtualAuthenticatorOptions {
45
  /**
46
   * Constructor to initialise VirtualAuthenticatorOptions object.
47
   */
48
  constructor() {
49
    this._protocol = Protocol['CTAP2']
50
    this._transport = Transport['USB']
51
    this._hasResidentKey = false
52
    this._hasUserVerification = false
53
    this._isUserConsenting = true
54
    this._isUserVerified = false
55
  }
56

57
  getProtocol() {
58
    return this._protocol
59
  }
60

61
  setProtocol(protocol) {
62
    this._protocol = protocol
63
  }
64

65
  getTransport() {
66
    return this._transport
67
  }
68

69
  setTransport(transport) {
70
    this._transport = transport
71
  }
72

73
  getHasResidentKey() {
74
    return this._hasResidentKey
75
  }
76

77
  setHasResidentKey(value) {
78
    this._hasResidentKey = value
79
  }
80

81
  getHasUserVerification() {
82
    return this._hasUserVerification
83
  }
84

85
  setHasUserVerification(value) {
86
    this._hasUserVerification = value
87
  }
88

89
  getIsUserConsenting() {
90
    return this._isUserConsenting
91
  }
92

93
  setIsUserConsenting(value) {
94
    this._isUserConsenting = value
95
  }
96

97
  getIsUserVerified() {
98
    return this._isUserVerified
99
  }
100

101
  setIsUserVerified(value) {
102
    this._isUserVerified = value
103
  }
104

105
  toDict() {
106
    return {
107
      protocol: this.getProtocol(),
108
      transport: this.getTransport(),
109
      hasResidentKey: this.getHasResidentKey(),
110
      hasUserVerification: this.getHasUserVerification(),
111
      isUserConsenting: this.getIsUserConsenting(),
112
      isUserVerified: this.getIsUserVerified(),
113
    }
114
  }
115
}
116

117
/**
118
 * A credential stored in a virtual authenticator.
119
 * @see https://w3c.github.io/webauthn/#credential-parameters
120
 */
121
class Credential {
122
  constructor(credentialId, isResidentCredential, rpId, userHandle, privateKey, signCount) {
123
    this._id = credentialId
124
    this._isResidentCredential = isResidentCredential
125
    this._rpId = rpId
126
    this._userHandle = userHandle
127
    this._privateKey = privateKey
128
    this._signCount = signCount
129
  }
130

131
  static createResidentCredential(id, rpId, userHandle, privateKey, signCount) {
132
    return new Credential(id, true, rpId, userHandle, privateKey, signCount)
133
  }
134

135
  static createNonResidentCredential(id, rpId, privateKey, signCount) {
136
    return new Credential(id, false, rpId, null, privateKey, signCount)
137
  }
138

139
  id() {
140
    return this._id
141
  }
142

143
  isResidentCredential() {
144
    return this._isResidentCredential
145
  }
146

147
  rpId() {
148
    return this._rpId
149
  }
150

151
  userHandle() {
152
    if (this._userHandle != null) {
153
      return this._userHandle
154
    }
155
    return null
156
  }
157

158
  privateKey() {
159
    return this._privateKey
160
  }
161

162
  signCount() {
163
    return this._signCount
164
  }
165

166
  /**
167
   * Creates a resident (i.e. stateless) credential.
168
   * @param id Unique base64 encoded string.
169
   * @param rpId Relying party identifier.
170
   * @param userHandle userHandle associated to the credential. Must be Base64 encoded string.
171
   * @param privateKey Base64 encoded PKCS
172
   * @param signCount initial value for a signature counter.
173
   * @deprecated This method has been made static. Call it with class name. Example, Credential.createResidentCredential()
174
   * @returns A resident credential
175
   */
176
  createResidentCredential(id, rpId, userHandle, privateKey, signCount) {
177
    return new Credential(id, true, rpId, userHandle, privateKey, signCount)
178
  }
179

180
  /**
181
   * Creates a non-resident (i.e. stateless) credential.
182
   * @param id Unique base64 encoded string.
183
   * @param rpId Relying party identifier.
184
   * @param privateKey Base64 encoded PKCS
185
   * @param signCount initial value for a signature counter.
186
   * @deprecated This method has been made static. Call it with class name. Example, Credential.createNonResidentCredential()
187
   * @returns A non-resident credential
188
   */
189
  createNonResidentCredential(id, rpId, privateKey, signCount) {
190
    return new Credential(id, false, rpId, null, privateKey, signCount)
191
  }
192

193
  toDict() {
194
    let credentialData = {
195
      credentialId: Buffer.from(this._id).toString('base64url'),
196
      isResidentCredential: this._isResidentCredential,
197
      rpId: this._rpId,
198
      privateKey: Buffer.from(this._privateKey, 'binary').toString('base64url'),
199
      signCount: this._signCount,
200
    }
201

202
    if (this.userHandle() != null) {
203
      credentialData['userHandle'] = Buffer.from(this._userHandle).toString('base64url')
204
    }
205

206
    return credentialData
207
  }
208

209
  /**
210
   * Creates a credential from a map.
211
   */
212
  fromDict(data) {
213
    let id = new Uint8Array(Buffer.from(data['credentialId'], 'base64url'))
214
    let isResidentCredential = data['isResidentCredential']
215
    let rpId = data['rpId']
216
    let privateKey = Buffer.from(data['privateKey'], 'base64url').toString('binary')
217
    let signCount = data['signCount']
218
    let userHandle
219

220
    if ('userHandle' in data) {
221
      userHandle = new Uint8Array(Buffer.from(data['userHandle'], 'base64url'))
222
    } else {
223
      userHandle = null
224
    }
225
    return new Credential(id, isResidentCredential, rpId, userHandle, privateKey, signCount)
226
  }
227
}
228

229
// PUBLIC API
230

231
module.exports = {
232
  Credential,
233
  VirtualAuthenticatorOptions,
234
  Transport,
235
  Protocol,
236
}
237

238