register.js

import express from "express";
import fido2lib from "@dannymoerkerke/fido2-lib";
import base64url from "base64url";
import crypto from "crypto";
import cfg from "config";
import User from "../models/user.js";

const mode = process.env.NODE_ENV || "dev";
const config = cfg.get(mode);
const router = express.Router();

const { Fido2Lib } = fido2lib;
const fido = new Fido2Lib({
  timeout: 60000,
  rpName: "WebAuthnUX",
  rpIcon: "https://whatpwacando.today/src/img/icons/icon-512x512.png",
  challengeSize: 128,
  attestation: "none",
  cryptoParams: [-7, -257],
  authenticatorAttachment: "platform",
  authenticatorRequireResidentKey: false,
  authenticatorUserVerification: "required",
});

router.post("/registration-options", async (req, res) => {
  const { email } = req.body;

  if (!email) {
    console.log("Missing email");
    return res.status(400).json({ error: "Missing email field" });
  }

  const userExists = await User.findOne({ email });
  if (userExists) {
    console.log("User already exists");
    return res.status(400).json({ error: "User already exists" });
  }

  req.session.userHandle = crypto.randomBytes(32);
  const registrationOptions = await fido.attestationOptions();
  req.session.challenge = Buffer.from(registrationOptions.challenge);

  registrationOptions.user.id = req.session.userHandle;
  registrationOptions.challenge = Buffer.from(registrationOptions.challenge);

  // iOS
  registrationOptions.authenticatorSelection = {
    authenticatorAttachment: "platform",
  };

  res.json(registrationOptions);
});

router.post("/register", async (req, res) => {
  const { credential, email, firstName, lastName, regDuration } = req.body;

  const challenge = new Uint8Array(req.session.challenge.data).buffer;
  const base64RawId = credential.rawId;

  credential.rawId = new Uint8Array(Buffer.from(credential.rawId, "base64")).buffer;

  credential.response.attestationObject = base64url.decode(
    credential.response.attestationObject,
    "base64"
  );
  credential.response.clientDataJSON = base64url.decode(
    credential.response.clientDataJSON,
    "base64"
  );

  const attestationExpectations = {
    challenge,
    origin: config.siteUrl,
    factor: "either",
  };

  try {
    const regResult = await fido.attestationResult(credential, attestationExpectations);
    req.session.publicKey = regResult.authnrData.get("credentialPublicKeyPem");
    req.session.prevCounter = regResult.authnrData.get("counter");

    const user = await User.create({
      id: req.session.userHandle,
      credentialId: base64RawId,
      firstName,
      lastName,
      email,
      regDuration: regDuration,
    });

    user.save();
    console.log("Created new account for: ", email);

    res.json({ status: "ok" });
  } catch (e) {
    console.log("error", e);
    res.status(500).json({ error: e });
  }
});

router.post("/authentication-options", async (req, res) => {
  const authnOptions = await fido.assertionOptions();
  const { email } = req.body;
  const user = await User.findOne({ email });
  if (user) {
    req.session.challenge = Buffer.from(authnOptions.challenge);
    req.session.userHandle = user.id;
    authnOptions.challenge = Buffer.from(authnOptions.challenge);
    authnOptions.rawId = user.credentialId;
    res.json(authnOptions);
  } else {
    res.status(404).json({ error: "User does not exist." });
  }
});

router.post("/authenticate", async (req, res) => {
  const { credential, authDuration, email } = req.body;

  credential.rawId = new Uint8Array(Buffer.from(credential.rawId, "base64")).buffer;

  const challenge = new Uint8Array(req.session.challenge.data).buffer;
  const { publicKey, prevCounter } = req.session;

  if (publicKey === "undefined" || prevCounter === undefined) {
    console.log("Not found");
    res.status(404).json({ error: "Credential not found" });
  } else {
    const assertionExpectations = {
      challenge,
      origin: config.siteUrl,
      factor: "either",
      publicKey,
      prevCounter,
      userHandle: new Uint8Array(Buffer.from(req.session.userHandle, "base64")).buffer,
    };
    try {
      await fido.assertionResult(credential, assertionExpectations);
      await User.findOneAndUpdate({ email: email }, { authDuration: authDuration });
      res.json({ status: "ok" });
    } catch (e) {
      console.log(e);
      res.status(500).json({ error: "Failed due internal server error" });
    }
  }
});

export default router;