webauthx AAGUID support

Verify passkey registration and inspect authenticator AAGUID metadata.

\n\n ${\n SECRET_KEY === 'replace-me-with-a-random-secret'\n ? '

Warning: SECRET_KEY is using the default placeholder. Set a Val Town environment variable named SECRET_KEY.

'\n : ''\n }\n\n

Passkey demo

\n \n

\n \n \n \n

\n\n \n\n \n\n

Session

null

\n\n \n \n`\n}\n\napp.get('/', (c) => c.html(html()))\n\napp.post(\n '/register/options',\n zValidator('json', z.object({ name: z.string().min(1).max(64) })),\n async (c) => {\n requireSecretConfigured()\n const { name } = c.req.valid('json')\n const { challenge, options } = Registration.getOptions({\n name,\n rp: { id: getRpId(c.req.url), name: 'webauthx Demo' }\n })\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/register',\n zValidator(\n 'json',\n z.object({ credential: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { credential } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const result = Registration.verify(credential, {\n challenge,\n origin: getOrigin(c.req.url),\n rpId: getRpId(c.req.url)\n })\n\n const record = {\n aaguid: result.aaguid,\n credentialId: result.credential.id,\n publicKey: result.credential.publicKey\n } satisfies CredentialRecord\n\n await putCredentialRecord(c, record)\n await setSignedCookie(\n c,\n 'session',\n result.credential.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n\n return c.json({\n authenticator: result.aaguid\n ? await Aaguid.lookup({ id: result.aaguid })\n : null,\n aaguid: result.aaguid ?? null,\n id: result.credential.id,\n publicKey: result.credential.publicKey\n })\n }\n)\n\napp.post(\n '/authenticate/options',\n zValidator(\n 'json',\n z.object({\n useAnotherProvider: z.boolean().optional()\n })\n ),\n async (c) => {\n requireSecretConfigured()\n const { useAnotherProvider } = c.req.valid('json')\n const stored = await getStoredCredentials(c)\n if (stored.credentials.length === 0) {\n return c.json({ error: 'No registered credential for this browser' }, 400)\n }\n\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n const preferredCredentialId =\n !useAnotherProvider && sessionCredentialId &&\n typeof sessionCredentialId === 'string'\n ? sessionCredentialId\n : stored.credentials[stored.credentials.length - 1]?.credentialId\n\n const { challenge, options } = Authentication.getOptions({\n ...(useAnotherProvider\n ? {}\n : preferredCredentialId\n ? { credentialId: preferredCredentialId }\n : {}),\n rpId: getRpId(c.req.url)\n })\n\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/authenticate',\n zValidator(\n 'json',\n z.object({ response: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { response } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const credential = await getCredentialRecord(c, response.id)\n if (!credential) return c.json({ error: 'Unknown credential' }, 400)\n\n if (\n !Authentication.verify(response, {\n challenge,\n origin: getOrigin(c.req.url),\n publicKey: credential.publicKey,\n rpId: getRpId(c.req.url)\n })\n ) {\n return c.json({ error: 'Verification failed' }, 401)\n }\n\n await setSignedCookie(\n c,\n 'session',\n response.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n return c.json({ credentialId: response.id })\n }\n)\n\napp.get('/me', async (c) => {\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n if (!sessionCredentialId || typeof sessionCredentialId !== 'string') {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const credential = await getCredentialRecord(c, sessionCredentialId)\n if (!credential) {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const stored = await getStoredCredentials(c)\n const providers = await Promise.all(\n stored.credentials.map(async (item) => {\n const aaguid = item.aaguid ?? null\n return {\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: item.credentialId,\n publicKey: item.publicKey\n }\n })\n )\n\n const aaguid = credential.aaguid ?? null\n return c.json({\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: credential.credentialId,\n publicKey: credential.publicKey,\n providers\n })\n})\n\napp.post('/logout', async (c) => {\n deleteCookie(c, 'session', { path: '/' })\n return c.json({ ok: true })\n})\n\nexport default app.fetch","webauthn-aaguid",[],[78],"bd523b84-3cd8-11f1-8317-42b51c65c3df","README.md","ec565a74-3cd7-11f1-860e-42b51c65c3df",16,["D",1776703701103],1,"# Val Town deployment\n\nThis folder contains a Val Town version of the demo.\n\n## Notes\n\n- It uses the `webauthx` build from `https://pkg.pr.new/webauthx@308444c`.\n- Because Val Town's runtime currently chokes on direct imports from that PR package URL, the server-side `webauthx` code used by this Val is vendored from that exact installed package into `vendor/webauthx/`.\n- It serves the UI and API from a single Val.\n- For Val Town portability, it stores the registered credential in a signed cookie instead of Cloudflare KV.\n - This means the passkey is remembered per browser profile, not in a shared server database.\n- Set a `SECRET_KEY` environment variable in Val Town before using it in production.\n\n## Create + push\n\n```sh\ncd valtown\nvt create webauth-aaguid --private --upload-if-exists\nvt push\n```\n\nThen open the Val in the browser and add an environment variable named `SECRET_KEY` in Val Town settings.\nUse a long random string.\n\nIf you rename the Val, that is fine — WebAuthn origin and RP ID are derived from the request URL at runtime.\n",[],[89],"bcdaef20-3cd8-11f1-9c50-42b51c65c3df",9,["D",1776703700417],[102],[57],{"_34":59,"_13":58,"_37":40,"_39":60,"_41":42,"_43":61,"_45":46,"_47":103,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_74":104,"_18":105},["D",1776703700587],[106],[57,58],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":107,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_74":108,"_18":109},["D",1776703700736],[110,111,112,113],[57,58,36],{"_34":138,"_13":139,"_37":140,"_39":38,"_41":42,"_43":141,"_45":46,"_47":142,"_17":49,"_50":118,"_52":143,"_53":54,"_55":-5,"_74":144,"_18":145},{"_34":130,"_13":131,"_37":132,"_39":38,"_41":42,"_43":133,"_45":46,"_47":134,"_17":49,"_50":118,"_52":135,"_53":54,"_55":-5,"_74":136,"_18":137},{"_34":122,"_13":123,"_37":124,"_39":38,"_41":42,"_43":125,"_45":46,"_47":126,"_17":49,"_50":118,"_52":127,"_53":54,"_55":-5,"_74":128,"_18":129},{"_34":114,"_13":78,"_37":115,"_39":38,"_41":42,"_43":116,"_45":46,"_47":117,"_17":49,"_50":118,"_52":119,"_53":54,"_55":-5,"_74":120,"_18":121},"bd38460c-3cd8-11f1-8b5f-42b51c65c3df","bd3846ca-3cd8-11f1-8b5f-42b51c65c3df",14,["D",1776703701026],"script","export * as Authentication from './Authentication.ts'\nexport * as Registration from './Registration.ts'\nexport * as Aaguid from './Aaguid.ts'\n",[],[57,58,36,78],"bd6bbf14-3cd8-11f1-a0fa-42b51c65c3df","Registration.ts","bd6bc00e-3cd8-11f1-a0fa-42b51c65c3df",17,["D",1776703701042],"import { Hex } from 'npm:ox@0.14.18'\nimport { Credential as Credential_, Registration } from 'npm:ox@0.14.18/webauthn'\nimport * as Aaguid from './Aaguid.ts'\n\nexport type Credential = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Registration.serializeOptions(Registration.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n credential: Credential,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n rpId?: string\n },\n) {\n const deserialized = Credential_.deserialize(credential)\n const result = Registration.verify({ ...options, credential: deserialized })\n return {\n ...Registration.serializeResponse(result),\n aaguid: Aaguid.extract(credential),\n }\n}\n",[],[57,58,36,123],"bd255dee-3cd8-11f1-9fbe-42b51c65c3df","Authentication.ts","bd255eca-3cd8-11f1-9fbe-42b51c65c3df",12,["D",1776703700901],"import { Hex, PublicKey } from 'npm:ox@0.14.18'\nimport { Authentication } from 'npm:ox@0.14.18/webauthn'\n\nexport type Response = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Authentication.serializeOptions(Authentication.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n response: Response,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n publicKey: `0x${string}`\n rpId?: string\n },\n) {\n const deserialized = Authentication.deserializeResponse(response)\n return Authentication.verify({\n ...options,\n metadata: deserialized.metadata,\n publicKey: PublicKey.from(options.publicKey),\n signature: deserialized.signature,\n })\n}\n",[],[57,58,36,131],"bd2b7dbe-3cd8-11f1-a19f-42b51c65c3df","Aaguid.ts","bd2b7e86-3cd8-11f1-a19f-42b51c65c3df",13,["D",1776703700906],"import { Base64, Cbor, Hex } from 'npm:ox@0.14.18'\n\nconst cache = new Map>>()\n\ntype AuthenticatorInfo = {\n iconDark?: string\n iconLight?: string\n name: string\n}\n\n/** Default remote registry. */\nexport const remoteList =\n 'https://github.com/passkeydeveloper/passkey-authenticator-aaguids/raw/refs/heads/main/combined_aaguid.json'\n\nexport function extract(credential: { attestationObject: string }) {\n try {\n const { authData } = Cbor.decode<{ authData: Uint8Array }>(\n Base64.toBytes(credential.attestationObject),\n )\n if (authData.length < 53) return undefined\n return format(authData.subarray(37, 53))\n } catch {\n return undefined\n }\n}\n\nexport async function lookup(options: {\n cache?: boolean\n fetchFn?: typeof fetch\n id: string\n remoteList?: string\n}) {\n const registry = await getRegistry(options)\n return registry[normalize(options.id)] ?? null\n}\n\nfunction format(bytes: Uint8Array) {\n const hex = Hex.fromBytes(bytes).slice(2)\n return [\n hex.slice(0, 8),\n hex.slice(8, 12),\n hex.slice(12, 16),\n hex.slice(16, 20),\n hex.slice(20, 32),\n ].join('-')\n}\n\nasync function fetchRegistry(options: { fetchFn?: typeof fetch; remoteList?: string } = {}) {\n const fetchFn = options.fetchFn ?? globalThis.fetch\n if (!fetchFn) throw new Error('`fetch` is not available in this environment.')\n\n const response = await fetchFn(options.remoteList ?? remoteList)\n if (!response.ok) {\n throw new Error(`Failed to fetch AAGUID registry: ${response.status} ${response.statusText}`)\n }\n\n const json = (await response.json()) as Record<\n string,\n { icon_dark?: string; icon_light?: string; iconDark?: string; iconLight?: string; name: string }\n >\n\n const registry: Record = {}\n for (const [id, info] of Object.entries(json)) {\n registry[normalize(id)] = {\n name: info.name,\n ...(info.iconLight || info.icon_light\n ? { iconLight: info.iconLight ?? info.icon_light }\n : {}),\n ...(info.iconDark || info.icon_dark ? { iconDark: info.iconDark ?? info.icon_dark } : {}),\n }\n }\n\n return registry\n}\n\nasync function getRegistry(options: { cache?: boolean; fetchFn?: typeof fetch; remoteList?: string }) {\n const list = options.remoteList ?? remoteList\n if (options.cache === false) return fetchRegistry({ fetchFn: options.fetchFn, remoteList: list })\n\n const cached = cache.get(list)\n if (cached) return cached\n\n const registry = fetchRegistry({\n fetchFn: options.fetchFn,\n remoteList: list,\n }).catch((error) => {\n cache.delete(list)\n throw error\n })\n\n cache.set(list, registry)\n return registry\n}\n\nfunction normalize(aaguid: string) {\n return aaguid.toLowerCase()\n}\n",[],[57,58,36,139],"ebd53da4-3cd7-11f1-a6ee-42b51c65c3df",["D",1776703349741],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","b9e6ccc7-499e-4c99-99f6-d52e7b324153","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","b2100bc6-baf7-410d-9bc0-a9181ab0c74f","tursoName","ebd53da43cd711f1a6ee42b51c65c3df","tursoHostname","ebd53da43cd711f1a6ee42b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512647429],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_202":198},"org",{"_11":12,"_196":-5,"_197":198,"_156":157,"_199":200,"_201":54},"branch",{"_17":80,"_13":16,"_34":42,"_188":146,"_189":-5,"_190":-5,"_191":-5,"_192":-5,"_193":-5,"_194":14,"_195":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/f71f69b9-f78f-40f4-11db-501b802a0900/square512?exp=1789567199&sig=af363cfd854e939031a932419e39875f48e5ed265308f975b69461f0862ad27d","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":146,"_13":14,"_47":264,"_148":-5,"_149":54,"_150":151,"_152":151,"_153":154,"_155":-5,"_156":157,"_158":-5,"_159":54,"_160":-5,"_161":-5,"_162":49,"_163":164,"_165":166,"_167":168,"_169":265,"_171":-5,"_172":173,"_174":173,"_175":176,"_177":176,"_178":176,"_179":173,"_180":173,"_181":266,"_183":267,"_185":268,"_187":54},[234,241,242,243],"files",[234,235,236,237,238,239,240,241,242,243],"counts",{"_225":49,"_226":93,"_227":49,"_32":228,"_229":230},[223],{"_34":59,"_13":58,"_37":40,"_39":60,"_41":42,"_43":61,"_45":46,"_47":62,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_18":222},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[57,58],{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_18":224},[57,58,36],"pulls","branches","forks",{"_231":93,"_233":49},"connections",{"_231":49,"_232":49},"count","unfilledCount","emptyCount",{"_34":97,"_13":57,"_37":60,"_39":-5,"_41":42,"_43":98,"_45":46,"_47":99,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_74":262,"_18":263},{"_34":59,"_13":58,"_37":40,"_39":60,"_41":42,"_43":61,"_45":46,"_47":103,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_74":260,"_18":261},{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":107,"_17":49,"_50":51,"_52":-5,"_53":54,"_55":-5,"_74":258,"_18":259},{"_34":138,"_13":139,"_37":140,"_39":38,"_41":42,"_43":141,"_45":46,"_47":142,"_17":49,"_50":118,"_52":143,"_53":54,"_55":-5,"_74":256,"_18":257},{"_34":130,"_13":131,"_37":132,"_39":38,"_41":42,"_43":133,"_45":46,"_47":134,"_17":49,"_50":118,"_52":135,"_53":54,"_55":-5,"_74":254,"_18":255},{"_34":122,"_13":123,"_37":124,"_39":38,"_41":42,"_43":125,"_45":46,"_47":126,"_17":49,"_50":118,"_52":127,"_53":54,"_55":-5,"_74":252,"_18":253},{"_34":114,"_13":78,"_37":115,"_39":38,"_41":42,"_43":116,"_45":46,"_47":117,"_17":49,"_50":118,"_52":119,"_53":54,"_55":-5,"_74":250,"_18":251},{"_34":88,"_13":89,"_37":90,"_39":-5,"_41":42,"_43":91,"_45":46,"_47":92,"_17":93,"_50":24,"_52":94,"_53":54,"_55":-5,"_74":248,"_18":249},{"_34":77,"_13":78,"_37":79,"_39":-5,"_41":42,"_43":80,"_45":46,"_47":81,"_17":82,"_50":83,"_52":84,"_53":54,"_55":85,"_74":246,"_18":247},{"_34":68,"_13":69,"_37":70,"_39":-5,"_41":42,"_43":71,"_45":46,"_47":72,"_17":49,"_50":24,"_52":73,"_53":54,"_55":-5,"_74":244,"_18":245},[],[69],[],[78],[],[89],[],[57,58,36,78],[],[57,58,36,123],[],[57,58,36,131],[],[57,58,36,139],[237,238,239,240],[57,58,36],[236],[57,58],[235],[57],["D",1776703349741],["D",1789512647429],{"_11":12,"_202":198},{"_11":12,"_196":-5,"_197":198,"_156":157,"_199":200,"_201":54},{"_17":80,"_13":16,"_34":42,"_188":146,"_189":-5,"_190":-5,"_191":-5,"_192":-5,"_193":-5,"_194":14,"_195":12},"ctx",{"_181":-5,"_219":302,"_303":304,"_305":306,"_307":54,"_308":54,"_309":54,"_310":46,"_311":-5,"_312":-7,"_313":-7,"_314":49,"_315":54,"_316":54,"_317":-5,"_318":54,"_319":54,"_320":54,"_321":-5},"ENV",{"_273":274,"_275":276,"_277":16,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299,"_300":301},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]