register.js

import express from "express";
import fido2lib from "fido2-library";
import base64url from "base64url";
import crypto from "crypto";
import bcrypt from "bcrypt";
import cfg from "config";
import User from "../models/user.js";
import { verifyPassword } from "../helpers/utils.js";
import { accountVerificationTemplate } from "../helpers/emailTemplates.js";
import mailTo from "../helpers/mailer.js";
import AccountVerificationCode from "../models/accountVerificationCode.js";

const mode = process.env.NODE_ENV || "dev";
const config = cfg.get(mode);
const router = express.Router();

const { Fido2Lib } = fido2lib;
const fido = new Fido2Lib({
  timeout: 60000,
  rpName: "WebAuthnUX",
  rpIcon: "https://whatpwacando.today/src/img/icons/icon-512x512.png",
  challengeSize: 128,
  attestation: "none",
  cryptoParams: [-7, -257],
  authenticatorAttachment: "platform",
  authenticatorRequireResidentKey: false,
  authenticatorUserVerification: "required",
});

router.post("/registration-options", async (req, res) => {
  const { email } = req.body;

  if (!email) {
    console.log("Missing email");
    return res.status(400).json({ error: "Missing email field" });
  }

  const userExists = await User.findOne({ email });
  if (userExists) {
    console.log("User already exists");
    return res.status(400).json({ error: "User already exists" });
  }

  req.session.userHandle = crypto.randomBytes(32);
  const registrationOptions = await fido.attestationOptions();
  req.session.challenge = Buffer.from(registrationOptions.challenge);

  registrationOptions.user.id = req.session.userHandle;
  registrationOptions.challenge = Buffer.from(registrationOptions.challenge);

  // iOS
  registrationOptions.authenticatorSelection = {
    authenticatorAttachment: "platform",
  };

  res.json(registrationOptions);
});

router.post("/register", async (req, res) => {
  const { credential, email, firstName, lastName, password, userAgent } = req.body;

  const challenge = new Uint8Array(req.session.challenge.data).buffer;
  const base64RawId = credential.rawId;

  credential.rawId = new Uint8Array(Buffer.from(credential.rawId, "base64")).buffer;
  credential.response.attestationObject = base64url.decode(
    credential.response.attestationObject,
    "base64"
  );
  credential.response.clientDataJSON = base64url.decode(
    credential.response.clientDataJSON,
    "base64"
  );

  const attestationExpectations = {
    challenge,
    origin: config.siteUrl,
    factor: "either",
  };

  try {
    const regResult = await fido.attestationResult(credential, attestationExpectations);
    req.session.publicKey = regResult.authnrData.get("credentialPublicKeyPem");
    req.session.prevCounter = regResult.authnrData.get("counter");
    const hash = bcrypt.hashSync(password, 10);

    const user = await User.create({
      id: req.session.userHandle,
      credentialId: base64RawId,
      firstName,
      lastName,
      email,
      password: hash,
      userAgent: userAgent,
    });
    user.save();

    const secretVerificationCode = crypto.randomBytes(32).toString("hex");
    const verificationCode = await AccountVerificationCode.create({
      email: user.email,
      code: secretVerificationCode,
    });

    verificationCode.save();
    console.log("Created new account for: ", email);
    await mailTo(
      [email],
      accountVerificationTemplate(
        `${config.siteUrl}/verification/verify-account/${user.email}/${secretVerificationCode}`
      )
    );
    res.json({ status: "ok" });
  } catch (e) {
    console.log("error", e);
    res.status(500).json({ error: e });
  }
});

router.post("/authentication-options", async (req, res) => {
  const authnOptions = await fido.assertionOptions();
  const { email } = req.body;
  const user = await User.findOne({ email });

  if (!user) {
    return res.status(401).json({ error: "User does not exist." });
  }

  if (user.status !== "active") {
    return res.status(401).json({ error: "Please activate your account first." });
  }

  req.session.challenge = Buffer.from(authnOptions.challenge);
  req.session.userHandle = user.id;
  authnOptions.challenge = Buffer.from(authnOptions.challenge);
  authnOptions.rawId = user.credentialId;
  res.json(authnOptions);
});

router.post("/authenticate", async (req, res) => {
  const { credential, authDuration, password, email, method } = req.body;

  const user = await User.findOne({ email });
  console.log("🚀 ~ file: register.js ~ line 138 ~ router.post ~ user", user);

  if (!user) {
    return res.status(401).json({ error: "Incorrect login details" });
  }

  if (user.status !== "active") {
    return res.status(401).json({ error: "Please activate your account first." });
  }

  if (method === "password") {
    try {
      if (verifyPassword(user, password)) {
        return res.status(200).json({ status: "ok" });
      } else return res.status(401).json({ error: "Incorrect login details" });
    } catch (err) {
      return res.status(500).json({ error: "Server error: " + err.message });
    }
  } else {
    credential.rawId = new Uint8Array(Buffer.from(credential.rawId, "base64")).buffer;
    const challenge = new Uint8Array(req.session.challenge.data).buffer;
    const { publicKey, prevCounter } = req.session;
    if (publicKey === "undefined" || prevCounter === undefined) {
      res.status(404).json({ error: "Credential not found" });
    } else {
      const assertionExpectations = {
        challenge,
        origin: config.siteUrl,
        factor: "either",
        publicKey,
        prevCounter,
        userHandle: new Uint8Array(Buffer.from(req.session.userHandle, "base64")).buffer,
      };
      try {
        await fido.assertionResult(credential, assertionExpectations);
        await User.findOneAndUpdate({ email: email }, { authDuration: authDuration });
        res.json({ status: "ok" });
      } catch (e) {
        res.status(500).json({ error: "Failed due internal server error" });
      }
    }
  }
});

export default router;