Documentation / @zerotal/auth / PasskeyService
Class: PasskeyService
Defined in: auth/src/Passkeys.ts:104
Constructors
Constructor
new PasskeyService(
opts):PasskeyService
Defined in: auth/src/Passkeys.ts:107
Parameters
opts
Returns
PasskeyService
Authentication
authenticationOptions()
authenticationOptions(
userId?):Promise<PublicKeyCredentialRequestOptionsJSON>
Defined in: auth/src/Passkeys.ts:231
Produce the WebAuthn authentication options (challenge) to send the browser's
navigator.credentials.get(). Pass a userId to restrict the assertion to
that user's registered credentials; omit it for a usernameless/discoverable
login. Persist the returned challenge for verifyAuthentication.
Parameters
userId?
number
Optional user id to scope allowCredentials.
Returns
Promise<PublicKeyCredentialRequestOptionsJSON>
The authentication options JSON, including the challenge.
verifyAuthentication()
verifyAuthentication(
assertion,challenge,ctx):Promise<"passkey.invalid"| {credential:PasskeyCredential;userId:number; }>
Defined in: auth/src/Passkeys.ts:264
Verify the browser's authentication assertion against the stashed challenge.
Looks the credential up by id, verifies the signature, advances the stored
signature counter via updateCounter (cloned-authenticator detection), then
regenerates the session and binds it to the credential's user.
Parameters
assertion
AuthenticationResponseJSON
The AuthenticationResponseJSON from the browser.
challenge
string
The challenge previously issued by authenticationOptions.
ctx
The request context (used to bind the session).
Returns
Promise<"passkey.invalid" | { credential: PasskeyCredential; userId: number; }>
{ credential, userId } of the signed-in user on success, or
"passkey.invalid" when the credential is unknown or verification fails.
Registration
registrationOptions()
registrationOptions(
user,existingCredentials?):Promise<PublicKeyCredentialCreationOptionsJSON>
Defined in: auth/src/Passkeys.ts:130
Produce the WebAuthn registration options (challenge) to send the browser's
navigator.credentials.create(). Already-registered credentials are excluded
so the same authenticator can't be enrolled twice. Persist the returned
challenge (e.g. in the session) to hand back to verifyRegistration.
Parameters
user
The user enrolling a passkey.
existingCredentials?
Optional pre-loaded credentials; otherwise fetched
via findUserCredentials.
Returns
Promise<PublicKeyCredentialCreationOptionsJSON>
The registration options JSON, including the challenge.
verifyRegistration()
verifyRegistration(
user,response,challenge,ctx,credentialName?):Promise<"passkey.registered"|"passkey.invalid">
Defined in: auth/src/Passkeys.ts:171
Verify the browser's registration response against the stashed challenge
and, on success, persist the new credential via saveCredential. If the
session is currently anonymous it is regenerated and bound to user.id.
Parameters
user
The user the credential is being registered to.
response
RegistrationResponseJSON
The RegistrationResponseJSON from the browser.
challenge
string
The challenge previously issued by registrationOptions.
ctx
The request context (used to bind the session).
credentialName?
string
Optional friendly name stored with the credential.
Returns
Promise<"passkey.registered" | "passkey.invalid">
"passkey.registered" on success, "passkey.invalid" on any failure.