webauthx AAGUID support

Verify passkey registration and inspect authenticator AAGUID metadata.

\n\n ${\n SECRET_KEY === 'replace-me-with-a-random-secret'\n ? '

Warning: SECRET_KEY is using the default placeholder. Set a Val Town environment variable named SECRET_KEY.

'\n : ''\n }\n\n

Passkey demo

\n \n

\n \n \n \n

\n\n \n\n \n\n

Session

null

\n\n \n \n`\n}\n\napp.get('/', (c) => c.html(html()))\n\napp.post(\n '/register/options',\n zValidator('json', z.object({ name: z.string().min(1).max(64) })),\n async (c) => {\n requireSecretConfigured()\n const { name } = c.req.valid('json')\n const { challenge, options } = Registration.getOptions({\n name,\n rp: { id: getRpId(c.req.url), name: 'webauthx Demo' }\n })\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/register',\n zValidator(\n 'json',\n z.object({ credential: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { credential } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const result = Registration.verify(credential, {\n challenge,\n origin: getOrigin(c.req.url),\n rpId: getRpId(c.req.url)\n })\n\n const record = {\n aaguid: result.aaguid,\n credentialId: result.credential.id,\n publicKey: result.credential.publicKey\n } satisfies CredentialRecord\n\n await putCredentialRecord(c, record)\n await setSignedCookie(\n c,\n 'session',\n result.credential.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n\n return c.json({\n authenticator: result.aaguid\n ? await Aaguid.lookup({ id: result.aaguid })\n : null,\n aaguid: result.aaguid ?? null,\n id: result.credential.id,\n publicKey: result.credential.publicKey\n })\n }\n)\n\napp.post(\n '/authenticate/options',\n zValidator(\n 'json',\n z.object({\n useAnotherProvider: z.boolean().optional()\n })\n ),\n async (c) => {\n requireSecretConfigured()\n const { useAnotherProvider } = c.req.valid('json')\n const stored = await getStoredCredentials(c)\n if (stored.credentials.length === 0) {\n return c.json({ error: 'No registered credential for this browser' }, 400)\n }\n\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n const preferredCredentialId =\n !useAnotherProvider && sessionCredentialId &&\n typeof sessionCredentialId === 'string'\n ? sessionCredentialId\n : stored.credentials[stored.credentials.length - 1]?.credentialId\n\n const { challenge, options } = Authentication.getOptions({\n ...(useAnotherProvider\n ? {}\n : preferredCredentialId\n ? { credentialId: preferredCredentialId }\n : {}),\n rpId: getRpId(c.req.url)\n })\n\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/authenticate',\n zValidator(\n 'json',\n z.object({ response: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { response } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const credential = await getCredentialRecord(c, response.id)\n if (!credential) return c.json({ error: 'Unknown credential' }, 400)\n\n if (\n !Authentication.verify(response, {\n challenge,\n origin: getOrigin(c.req.url),\n publicKey: credential.publicKey,\n rpId: getRpId(c.req.url)\n })\n ) {\n return c.json({ error: 'Verification failed' }, 401)\n }\n\n await setSignedCookie(\n c,\n 'session',\n response.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n return c.json({ credentialId: response.id })\n }\n)\n\napp.get('/me', async (c) => {\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n if (!sessionCredentialId || typeof sessionCredentialId !== 'string') {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const credential = await getCredentialRecord(c, sessionCredentialId)\n if (!credential) {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const stored = await getStoredCredentials(c)\n const providers = await Promise.all(\n stored.credentials.map(async (item) => {\n const aaguid = item.aaguid ?? null\n return {\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: item.credentialId,\n publicKey: item.publicKey\n }\n })\n )\n\n const aaguid = credential.aaguid ?? null\n return c.json({\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: credential.credentialId,\n publicKey: credential.publicKey,\n providers\n })\n})\n\napp.post('/logout', async (c) => {\n deleteCookie(c, 'session', { path: '/' })\n return c.json({ ok: true })\n})\n\nexport default app.fetch","webauthn-aaguid",[],[75],"bd523b84-3cd8-11f1-8317-42b51c65c3df","README.md","ec565a74-3cd7-11f1-860e-42b51c65c3df",16,["D",1776703701103],1,"# Val Town deployment\n\nThis folder contains a Val Town version of the demo.\n\n## Notes\n\n- It uses the `webauthx` build from `https://pkg.pr.new/webauthx@308444c`.\n- Because Val Town's runtime currently chokes on direct imports from that PR package URL, the server-side `webauthx` code used by this Val is vendored from that exact installed package into `vendor/webauthx/`.\n- It serves the UI and API from a single Val.\n- For Val Town portability, it stores the registered credential in a signed cookie instead of Cloudflare KV.\n - This means the passkey is remembered per browser profile, not in a shared server database.\n- Set a `SECRET_KEY` environment variable in Val Town before using it in production.\n\n## Create + push\n\n```sh\ncd valtown\nvt create webauth-aaguid --private --upload-if-exists\nvt push\n```\n\nThen open the Val in the browser and add an environment variable named `SECRET_KEY` in Val Town settings.\nUse a long random string.\n\nIf you rename the Val, that is fine — WebAuthn origin and RP ID are derived from the request URL at runtime.\n",[],[86],["D",1776703700417],[97],[19],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":98,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_71":99,"_18":100},["D",1776703700587],[101],[19,36],{"_34":102,"_13":103,"_37":104,"_39":38,"_41":42,"_43":105,"_45":46,"_47":106,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_71":107,"_18":108},"bd0b5fac-3cd8-11f1-8099-42b51c65c3df","server","bd0b6088-3cd8-11f1-8099-42b51c65c3df",11,["D",1776703700736],[109,110,111,112],[19,36,103],{"_34":137,"_13":138,"_37":139,"_39":104,"_41":42,"_43":140,"_45":46,"_47":141,"_17":49,"_50":117,"_52":142,"_53":54,"_55":-5,"_71":143,"_18":144},{"_34":129,"_13":130,"_37":131,"_39":104,"_41":42,"_43":132,"_45":46,"_47":133,"_17":49,"_50":117,"_52":134,"_53":54,"_55":-5,"_71":135,"_18":136},{"_34":121,"_13":122,"_37":123,"_39":104,"_41":42,"_43":124,"_45":46,"_47":125,"_17":49,"_50":117,"_52":126,"_53":54,"_55":-5,"_71":127,"_18":128},{"_34":113,"_13":75,"_37":114,"_39":104,"_41":42,"_43":115,"_45":46,"_47":116,"_17":49,"_50":117,"_52":118,"_53":54,"_55":-5,"_71":119,"_18":120},"bd38460c-3cd8-11f1-8b5f-42b51c65c3df","bd3846ca-3cd8-11f1-8b5f-42b51c65c3df",14,["D",1776703701026],"script","export * as Authentication from './Authentication.ts'\nexport * as Registration from './Registration.ts'\nexport * as Aaguid from './Aaguid.ts'\n",[],[19,36,103,75],"bd6bbf14-3cd8-11f1-a0fa-42b51c65c3df","Registration.ts","bd6bc00e-3cd8-11f1-a0fa-42b51c65c3df",17,["D",1776703701042],"import { Hex } from 'npm:ox@0.14.18'\nimport { Credential as Credential_, Registration } from 'npm:ox@0.14.18/webauthn'\nimport * as Aaguid from './Aaguid.ts'\n\nexport type Credential = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Registration.serializeOptions(Registration.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n credential: Credential,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n rpId?: string\n },\n) {\n const deserialized = Credential_.deserialize(credential)\n const result = Registration.verify({ ...options, credential: deserialized })\n return {\n ...Registration.serializeResponse(result),\n aaguid: Aaguid.extract(credential),\n }\n}\n",[],[19,36,103,122],"bd255dee-3cd8-11f1-9fbe-42b51c65c3df","Authentication.ts","bd255eca-3cd8-11f1-9fbe-42b51c65c3df",12,["D",1776703700901],"import { Hex, PublicKey } from 'npm:ox@0.14.18'\nimport { Authentication } from 'npm:ox@0.14.18/webauthn'\n\nexport type Response = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Authentication.serializeOptions(Authentication.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n response: Response,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n publicKey: `0x${string}`\n rpId?: string\n },\n) {\n const deserialized = Authentication.deserializeResponse(response)\n return Authentication.verify({\n ...options,\n metadata: deserialized.metadata,\n publicKey: PublicKey.from(options.publicKey),\n signature: deserialized.signature,\n })\n}\n",[],[19,36,103,130],"bd2b7dbe-3cd8-11f1-a19f-42b51c65c3df","Aaguid.ts","bd2b7e86-3cd8-11f1-a19f-42b51c65c3df",13,["D",1776703700906],"import { Base64, Cbor, Hex } from 'npm:ox@0.14.18'\n\nconst cache = new Map>>()\n\ntype AuthenticatorInfo = {\n iconDark?: string\n iconLight?: string\n name: string\n}\n\n/** Default remote registry. */\nexport const remoteList =\n 'https://github.com/passkeydeveloper/passkey-authenticator-aaguids/raw/refs/heads/main/combined_aaguid.json'\n\nexport function extract(credential: { attestationObject: string }) {\n try {\n const { authData } = Cbor.decode<{ authData: Uint8Array }>(\n Base64.toBytes(credential.attestationObject),\n )\n if (authData.length < 53) return undefined\n return format(authData.subarray(37, 53))\n } catch {\n return undefined\n }\n}\n\nexport async function lookup(options: {\n cache?: boolean\n fetchFn?: typeof fetch\n id: string\n remoteList?: string\n}) {\n const registry = await getRegistry(options)\n return registry[normalize(options.id)] ?? null\n}\n\nfunction format(bytes: Uint8Array) {\n const hex = Hex.fromBytes(bytes).slice(2)\n return [\n hex.slice(0, 8),\n hex.slice(8, 12),\n hex.slice(12, 16),\n hex.slice(16, 20),\n hex.slice(20, 32),\n ].join('-')\n}\n\nasync function fetchRegistry(options: { fetchFn?: typeof fetch; remoteList?: string } = {}) {\n const fetchFn = options.fetchFn ?? globalThis.fetch\n if (!fetchFn) throw new Error('`fetch` is not available in this environment.')\n\n const response = await fetchFn(options.remoteList ?? remoteList)\n if (!response.ok) {\n throw new Error(`Failed to fetch AAGUID registry: ${response.status} ${response.statusText}`)\n }\n\n const json = (await response.json()) as Record<\n string,\n { icon_dark?: string; icon_light?: string; iconDark?: string; iconLight?: string; name: string }\n >\n\n const registry: Record = {}\n for (const [id, info] of Object.entries(json)) {\n registry[normalize(id)] = {\n name: info.name,\n ...(info.iconLight || info.icon_light\n ? { iconLight: info.iconLight ?? info.icon_light }\n : {}),\n ...(info.iconDark || info.icon_dark ? { iconDark: info.iconDark ?? info.icon_dark } : {}),\n }\n }\n\n return registry\n}\n\nasync function getRegistry(options: { cache?: boolean; fetchFn?: typeof fetch; remoteList?: string }) {\n const list = options.remoteList ?? remoteList\n if (options.cache === false) return fetchRegistry({ fetchFn: options.fetchFn, remoteList: list })\n\n const cached = cache.get(list)\n if (cached) return cached\n\n const registry = fetchRegistry({\n fetchFn: options.fetchFn,\n remoteList: list,\n }).catch((error) => {\n cache.delete(list)\n throw error\n })\n\n cache.set(list, registry)\n return registry\n}\n\nfunction normalize(aaguid: string) {\n return aaguid.toLowerCase()\n}\n",[],[19,36,103,138],"ebd53da4-3cd7-11f1-a6ee-42b51c65c3df",["D",1776703349741],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","b9e6ccc7-499e-4c99-99f6-d52e7b324153","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","b2100bc6-baf7-410d-9bc0-a9181ab0c74f","tursoName","ebd53da43cd711f1a6ee42b51c65c3df","tursoHostname","ebd53da43cd711f1a6ee42b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512647429],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_201":197},"org",{"_11":12,"_195":-5,"_196":197,"_155":156,"_198":199,"_200":54},"branch",{"_17":77,"_13":16,"_34":42,"_187":145,"_188":-5,"_189":-5,"_190":-5,"_191":-5,"_192":-5,"_193":14,"_194":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/f71f69b9-f78f-40f4-11db-501b802a0900/square512?exp=1789563599&sig=5419d589166c3d99c647271d85c76124c26c5d8b53306cd74fa385fa46d18049","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":145,"_13":14,"_47":263,"_147":-5,"_148":54,"_149":150,"_151":150,"_152":153,"_154":-5,"_155":156,"_157":-5,"_158":54,"_159":-5,"_160":-5,"_161":49,"_162":163,"_164":165,"_166":167,"_168":264,"_170":-5,"_171":172,"_173":172,"_174":175,"_176":175,"_177":175,"_178":172,"_179":172,"_180":265,"_182":266,"_184":267,"_186":54},[233,240,241,242],"files",[233,234,235,236,237,238,239,240,241,242],"counts",{"_224":49,"_225":90,"_226":49,"_32":227,"_228":229},[222],{"_34":57,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":58,"_45":46,"_47":59,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_18":221},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_18":223},[19,36],"pulls","branches","forks",{"_230":90,"_232":49},"connections",{"_230":49,"_231":49},"count","unfilledCount","emptyCount",{"_34":57,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":58,"_45":46,"_47":94,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_71":261,"_18":262},{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":98,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_71":259,"_18":260},{"_34":102,"_13":103,"_37":104,"_39":38,"_41":42,"_43":105,"_45":46,"_47":106,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_71":257,"_18":258},{"_34":137,"_13":138,"_37":139,"_39":104,"_41":42,"_43":140,"_45":46,"_47":141,"_17":49,"_50":117,"_52":142,"_53":54,"_55":-5,"_71":255,"_18":256},{"_34":129,"_13":130,"_37":131,"_39":104,"_41":42,"_43":132,"_45":46,"_47":133,"_17":49,"_50":117,"_52":134,"_53":54,"_55":-5,"_71":253,"_18":254},{"_34":121,"_13":122,"_37":123,"_39":104,"_41":42,"_43":124,"_45":46,"_47":125,"_17":49,"_50":117,"_52":126,"_53":54,"_55":-5,"_71":251,"_18":252},{"_34":113,"_13":75,"_37":114,"_39":104,"_41":42,"_43":115,"_45":46,"_47":116,"_17":49,"_50":117,"_52":118,"_53":54,"_55":-5,"_71":249,"_18":250},{"_34":85,"_13":86,"_37":87,"_39":-5,"_41":42,"_43":88,"_45":46,"_47":89,"_17":90,"_50":24,"_52":91,"_53":54,"_55":-5,"_71":247,"_18":248},{"_34":74,"_13":75,"_37":76,"_39":-5,"_41":42,"_43":77,"_45":46,"_47":78,"_17":79,"_50":80,"_52":81,"_53":54,"_55":82,"_71":245,"_18":246},{"_34":65,"_13":66,"_37":67,"_39":-5,"_41":42,"_43":68,"_45":46,"_47":69,"_17":49,"_50":24,"_52":70,"_53":54,"_55":-5,"_71":243,"_18":244},[],[66],[],[75],[],[86],[],[19,36,103,75],[],[19,36,103,122],[],[19,36,103,130],[],[19,36,103,138],[236,237,238,239],[19,36,103],[235],[19,36],[234],[19],["D",1776703349741],["D",1789512647429],{"_11":12,"_201":197},{"_11":12,"_195":-5,"_196":197,"_155":156,"_198":199,"_200":54},{"_17":77,"_13":16,"_34":42,"_187":145,"_188":-5,"_189":-5,"_190":-5,"_191":-5,"_192":-5,"_193":14,"_194":12},"ctx",{"_180":-5,"_218":301,"_302":303,"_304":305,"_306":54,"_307":54,"_308":54,"_309":46,"_310":-5,"_311":-7,"_312":-7,"_313":49,"_314":54,"_315":54,"_316":-5,"_317":54,"_318":54,"_319":54,"_320":-5},"ENV",{"_272":273,"_274":275,"_276":16,"_277":278,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]