WebAuthn and Passkeys

import {
  generateRegistrationOptions, verifyRegistrationResponse,
  generateAuthenticationOptions, verifyAuthenticationResponse,
} from '@simplewebauthn/server';

const RP_ID = 'abc.com';                 // your domain — permanent
const ORIGIN = 'https://abc.com';

// --- registration: issue a challenge ---
app.post('/webauthn/register/options', session, async (req, res) => {
  const existing = await db.credentials.findByUser(req.user.id);

  const options = await generateRegistrationOptions({
    rpName: 'SoundsCode', rpID: RP_ID,
    userName: req.user.email,
    attestationType: 'none',
    // Stops the user registering the same authenticator twice
    excludeCredentials: existing.map((c) => ({ id: c.credentialId, type: 'public-key' })),
    authenticatorSelection: { residentKey: 'preferred', userVerification: 'preferred' },
  });

  // The challenge MUST be remembered server-side and used exactly once.
  await redis.set(`webauthn:reg:${req.user.id}`, options.challenge, 'EX', 300);
  res.json(options);
});

// --- registration: verify what the device returned ---
app.post('/webauthn/register/verify', session, async (req, res) => {
  const expectedChallenge = await redis.getdel(`webauthn:reg:${req.user.id}`);
  if (!expectedChallenge) return res.status(400).json({ error: 'challenge_expired' });

  const { verified, registrationInfo } = await verifyRegistrationResponse({
    response: req.body,
    expectedChallenge,
    expectedOrigin: ORIGIN,          // ← the anti-phishing check
    expectedRPID: RP_ID,
  });
  if (!verified) return res.status(400).json({ error: 'verification_failed' });

  await db.credentials.insert({
    userId: req.user.id,
    credentialId: registrationInfo.credentialID,
    publicKey: registrationInfo.credentialPublicKey,   // public only
    counter: registrationInfo.counter,
    deviceType: registrationInfo.credentialDeviceType, // 'singleDevice' | 'multiDevice'
    label: req.body.label ?? 'Security key',
  });
  res.status(204).end();
});

// --- authentication ---
app.post('/webauthn/login/verify', async (req, res) => {
  const expectedChallenge = await redis.getdel(`webauthn:auth:${req.body.flowId}`);
  const cred = await db.credentials.findByCredentialId(req.body.id);
  if (!cred || !expectedChallenge) return res.status(400).json({ error: 'invalid_request' });

  const { verified, authenticationInfo } = await verifyAuthenticationResponse({
    response: req.body,
    expectedChallenge, expectedOrigin: ORIGIN, expectedRPID: RP_ID,
    credential: {
      id: cred.credentialId, publicKey: cred.publicKey, counter: cred.counter,
    },
  });
  if (!verified) return res.status(401).json({ error: 'verification_failed' });

  // A counter that did not advance can indicate a cloned authenticator.
  // Synced passkeys legitimately report 0 — only enforce when it was non-zero.
  if (cred.counter > 0 && authenticationInfo.newCounter <= cred.counter) {
    await alertSecurityTeam('possible_cloned_authenticator', cred.id);
    return res.status(401).json({ error: 'verification_failed' });
  }
  await db.credentials.update(cred.id, { counter: authenticationInfo.newCounter });

  res.cookie('sid', await createSession(cred.userId, req, { mfa: true }), COOKIE_OPTIONS);
  res.status(204).end();
});

// Offer passkeys where they exist, keep every other route open.
async function passkeysAvailable() {
  if (!window.PublicKeyCredential) return false;
  const [platform, autofill] = await Promise.all([
    PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable?.() ?? false,
    PublicKeyCredential.isConditionalMediationAvailable?.() ?? false,
  ]);
  return { platform, autofill };
}

// Conditional UI: the browser offers the passkey inside the username field,
// with no button for the user to find.
async function enablePasskeyAutofill() {
  const { autofill } = await passkeysAvailable();
  if (!autofill) return;

  const options = await fetch('/webauthn/login/options').then((r) => r.json());
  const assertion = await navigator.credentials.get({
    publicKey: { ...options, challenge: base64urlToBuffer(options.challenge) },
    mediation: 'conditional',        // ← shows up in the autofill dropdown
  });
  if (assertion) await completeLogin(assertion);
}

// <input name="email" autocomplete="username webauthn">

// Ladder to climb, never all at once:
//   1. passkey as an OPTIONAL second factor
//   2. passkey as an alternative to the password
//   3. passkey only, for staff / admin accounts
//   4. passkey only, everywhere — once recovery is genuinely solved