webauthx AAGUID support

Verify passkey registration and inspect authenticator AAGUID metadata.

\n\n ${\n SECRET_KEY === 'replace-me-with-a-random-secret'\n ? '

Warning: SECRET_KEY is using the default placeholder. Set a Val Town environment variable named SECRET_KEY.

'\n : ''\n }\n\n

Passkey demo

\n \n

\n \n \n \n

\n\n \n\n \n\n

Session

null

\n\n \n \n`\n}\n\napp.get('/', (c) => c.html(html()))\n\napp.post(\n '/register/options',\n zValidator('json', z.object({ name: z.string().min(1).max(64) })),\n async (c) => {\n requireSecretConfigured()\n const { name } = c.req.valid('json')\n const { challenge, options } = Registration.getOptions({\n name,\n rp: { id: getRpId(c.req.url), name: 'webauthx Demo' }\n })\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/register',\n zValidator(\n 'json',\n z.object({ credential: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { credential } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const result = Registration.verify(credential, {\n challenge,\n origin: getOrigin(c.req.url),\n rpId: getRpId(c.req.url)\n })\n\n const record = {\n aaguid: result.aaguid,\n credentialId: result.credential.id,\n publicKey: result.credential.publicKey\n } satisfies CredentialRecord\n\n await putCredentialRecord(c, record)\n await setSignedCookie(\n c,\n 'session',\n result.credential.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n\n return c.json({\n authenticator: result.aaguid\n ? await Aaguid.lookup({ id: result.aaguid })\n : null,\n aaguid: result.aaguid ?? null,\n id: result.credential.id,\n publicKey: result.credential.publicKey\n })\n }\n)\n\napp.post(\n '/authenticate/options',\n zValidator(\n 'json',\n z.object({\n useAnotherProvider: z.boolean().optional()\n })\n ),\n async (c) => {\n requireSecretConfigured()\n const { useAnotherProvider } = c.req.valid('json')\n const stored = await getStoredCredentials(c)\n if (stored.credentials.length === 0) {\n return c.json({ error: 'No registered credential for this browser' }, 400)\n }\n\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n const preferredCredentialId =\n !useAnotherProvider && sessionCredentialId &&\n typeof sessionCredentialId === 'string'\n ? sessionCredentialId\n : stored.credentials[stored.credentials.length - 1]?.credentialId\n\n const { challenge, options } = Authentication.getOptions({\n ...(useAnotherProvider\n ? {}\n : preferredCredentialId\n ? { credentialId: preferredCredentialId }\n : {}),\n rpId: getRpId(c.req.url)\n })\n\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/authenticate',\n zValidator(\n 'json',\n z.object({ response: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { response } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const credential = await getCredentialRecord(c, response.id)\n if (!credential) return c.json({ error: 'Unknown credential' }, 400)\n\n if (\n !Authentication.verify(response, {\n challenge,\n origin: getOrigin(c.req.url),\n publicKey: credential.publicKey,\n rpId: getRpId(c.req.url)\n })\n ) {\n return c.json({ error: 'Verification failed' }, 401)\n }\n\n await setSignedCookie(\n c,\n 'session',\n response.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n return c.json({ credentialId: response.id })\n }\n)\n\napp.get('/me', async (c) => {\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n if (!sessionCredentialId || typeof sessionCredentialId !== 'string') {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const credential = await getCredentialRecord(c, sessionCredentialId)\n if (!credential) {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const stored = await getStoredCredentials(c)\n const providers = await Promise.all(\n stored.credentials.map(async (item) => {\n const aaguid = item.aaguid ?? null\n return {\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: item.credentialId,\n publicKey: item.publicKey\n }\n })\n )\n\n const aaguid = credential.aaguid ?? null\n return c.json({\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: credential.credentialId,\n publicKey: credential.publicKey,\n providers\n })\n})\n\napp.post('/logout', async (c) => {\n deleteCookie(c, 'session', { path: '/' })\n return c.json({ ok: true })\n})\n\nexport default app.fetch","webauthn-aaguid",[135],"bd523b84-3cd8-11f1-8317-42b51c65c3df","README.md","ec565a74-3cd7-11f1-860e-42b51c65c3df",16,["D",1776703701103],1,"# Val Town deployment\n\nThis folder contains a Val Town version of the demo.\n\n## Notes\n\n- It uses the `webauthx` build from `https://pkg.pr.new/webauthx@308444c`.\n- Because Val Town's runtime currently chokes on direct imports from that PR package URL, the server-side `webauthx` code used by this Val is vendored from that exact installed package into `vendor/webauthx/`.\n- It serves the UI and API from a single Val.\n- For Val Town portability, it stores the registered credential in a signed cookie instead of Cloudflare KV.\n - This means the passkey is remembered per browser profile, not in a shared server database.\n- Set a `SECRET_KEY` environment variable in Val Town before using it in production.\n\n## Create + push\n\n```sh\ncd valtown\nvt create webauth-aaguid --private --upload-if-exists\nvt push\n```\n\nThen open the Val in the browser and add an environment variable named `SECRET_KEY` in Val Town settings.\nUse a long random string.\n\nIf you rename the Val, that is fine — WebAuthn origin and RP ID are derived from the request URL at runtime.\n",[144],"bcdaef20-3cd8-11f1-9c50-42b51c65c3df","vendor","bcdaefca-3cd8-11f1-9c50-42b51c65c3df",9,["D",1776703700417],"directory",[152],"pulls","forks","envVars",{"_164":148,"_166":52},"connections",{"_164":52,"_165":52},"count","unfilledCount","emptyCount",{"_20":151,"_13":152,"_120":153,"_122":-5,"_123":21,"_124":154,"_126":109,"_22":233,"_29":52,"_128":156,"_129":-5,"_131":38,"_132":-5,"_178":234,"_91":235},{"_20":228,"_13":196,"_120":223,"_122":153,"_123":21,"_124":229,"_126":109,"_22":230,"_29":52,"_128":156,"_129":-5,"_131":38,"_132":-5,"_178":231,"_91":232},{"_20":222,"_13":197,"_120":189,"_122":223,"_123":21,"_124":224,"_126":109,"_22":225,"_29":52,"_128":156,"_129":-5,"_131":38,"_132":-5,"_178":226,"_91":227},{"_20":214,"_13":215,"_120":216,"_122":189,"_123":21,"_124":217,"_126":109,"_22":218,"_29":52,"_128":192,"_129":219,"_131":38,"_132":-5,"_178":220,"_91":221},{"_20":206,"_13":207,"_120":208,"_122":189,"_123":21,"_124":209,"_126":109,"_22":210,"_29":52,"_128":192,"_129":211,"_131":38,"_132":-5,"_178":212,"_91":213},{"_20":198,"_13":199,"_120":200,"_122":189,"_123":21,"_124":201,"_126":109,"_22":202,"_29":52,"_128":192,"_129":203,"_131":38,"_132":-5,"_178":204,"_91":205},{"_20":187,"_13":135,"_120":188,"_122":189,"_123":21,"_124":190,"_126":109,"_22":191,"_29":52,"_128":192,"_129":193,"_131":38,"_132":-5,"_178":194,"_91":195},{"_20":143,"_13":144,"_120":145,"_122":-5,"_123":21,"_124":146,"_126":109,"_22":184,"_29":148,"_128":102,"_129":149,"_131":38,"_132":-5,"_178":185,"_91":186},{"_20":134,"_13":135,"_120":136,"_122":-5,"_123":21,"_124":30,"_126":109,"_22":181,"_29":138,"_128":139,"_129":140,"_131":38,"_132":141,"_178":182,"_91":183},{"_20":118,"_13":119,"_120":121,"_122":-5,"_123":21,"_124":125,"_126":109,"_22":177,"_29":52,"_128":102,"_129":130,"_131":38,"_132":-5,"_178":179,"_91":180},["D",1776703350499],"children",[],[119],["D",1776718644930],[],[135],["D",1776703701103],[],[144],"bd38460c-3cd8-11f1-8b5f-42b51c65c3df","bd3846ca-3cd8-11f1-8b5f-42b51c65c3df","bd0b6088-3cd8-11f1-8099-42b51c65c3df",14,["D",1776703701026],"script","export * as Authentication from './Authentication.ts'\nexport * as Registration from './Registration.ts'\nexport * as Aaguid from './Aaguid.ts'\n",[],[152,196,197,135],"webauthx","server","bd6bbf14-3cd8-11f1-a0fa-42b51c65c3df","Registration.ts","bd6bc00e-3cd8-11f1-a0fa-42b51c65c3df",17,["D",1776703701042],"import { Hex } from 'npm:ox@0.14.18'\nimport { Credential as Credential_, Registration } from 'npm:ox@0.14.18/webauthn'\nimport * as Aaguid from './Aaguid.ts'\n\nexport type Credential = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Registration.serializeOptions(Registration.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n credential: Credential,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n rpId?: string\n },\n) {\n const deserialized = Credential_.deserialize(credential)\n const result = Registration.verify({ ...options, credential: deserialized })\n return {\n ...Registration.serializeResponse(result),\n aaguid: Aaguid.extract(credential),\n }\n}\n",[],[152,196,197,199],"bd255dee-3cd8-11f1-9fbe-42b51c65c3df","Authentication.ts","bd255eca-3cd8-11f1-9fbe-42b51c65c3df",12,["D",1776703700901],"import { Hex, PublicKey } from 'npm:ox@0.14.18'\nimport { Authentication } from 'npm:ox@0.14.18/webauthn'\n\nexport type Response = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Authentication.serializeOptions(Authentication.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n response: Response,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n publicKey: `0x${string}`\n rpId?: string\n },\n) {\n const deserialized = Authentication.deserializeResponse(response)\n return Authentication.verify({\n ...options,\n metadata: deserialized.metadata,\n publicKey: PublicKey.from(options.publicKey),\n signature: deserialized.signature,\n })\n}\n",[],[152,196,197,207],"bd2b7dbe-3cd8-11f1-a19f-42b51c65c3df","Aaguid.ts","bd2b7e86-3cd8-11f1-a19f-42b51c65c3df",13,["D",1776703700906],"import { Base64, Cbor, Hex } from 'npm:ox@0.14.18'\n\nconst cache = new Map>>()\n\ntype AuthenticatorInfo = {\n iconDark?: string\n iconLight?: string\n name: string\n}\n\n/** Default remote registry. */\nexport const remoteList =\n 'https://github.com/passkeydeveloper/passkey-authenticator-aaguids/raw/refs/heads/main/combined_aaguid.json'\n\nexport function extract(credential: { attestationObject: string }) {\n try {\n const { authData } = Cbor.decode<{ authData: Uint8Array }>(\n Base64.toBytes(credential.attestationObject),\n )\n if (authData.length < 53) return undefined\n return format(authData.subarray(37, 53))\n } catch {\n return undefined\n }\n}\n\nexport async function lookup(options: {\n cache?: boolean\n fetchFn?: typeof fetch\n id: string\n remoteList?: string\n}) {\n const registry = await getRegistry(options)\n return registry[normalize(options.id)] ?? null\n}\n\nfunction format(bytes: Uint8Array) {\n const hex = Hex.fromBytes(bytes).slice(2)\n return [\n hex.slice(0, 8),\n hex.slice(8, 12),\n hex.slice(12, 16),\n hex.slice(16, 20),\n hex.slice(20, 32),\n ].join('-')\n}\n\nasync function fetchRegistry(options: { fetchFn?: typeof fetch; remoteList?: string } = {}) {\n const fetchFn = options.fetchFn ?? globalThis.fetch\n if (!fetchFn) throw new Error('`fetch` is not available in this environment.')\n\n const response = await fetchFn(options.remoteList ?? remoteList)\n if (!response.ok) {\n throw new Error(`Failed to fetch AAGUID registry: ${response.status} ${response.statusText}`)\n }\n\n const json = (await response.json()) as Record<\n string,\n { icon_dark?: string; icon_light?: string; iconDark?: string; iconLight?: string; name: string }\n >\n\n const registry: Record = {}\n for (const [id, info] of Object.entries(json)) {\n registry[normalize(id)] = {\n name: info.name,\n ...(info.iconLight || info.icon_light\n ? { iconLight: info.iconLight ?? info.icon_light }\n : {}),\n ...(info.iconDark || info.icon_dark ? { iconDark: info.iconDark ?? info.icon_dark } : {}),\n }\n }\n\n return registry\n}\n\nasync function getRegistry(options: { cache?: boolean; fetchFn?: typeof fetch; remoteList?: string }) {\n const list = options.remoteList ?? remoteList\n if (options.cache === false) return fetchRegistry({ fetchFn: options.fetchFn, remoteList: list })\n\n const cached = cache.get(list)\n if (cached) return cached\n\n const registry = fetchRegistry({\n fetchFn: options.fetchFn,\n remoteList: list,\n }).catch((error) => {\n cache.delete(list)\n throw error\n })\n\n cache.set(list, registry)\n return registry\n}\n\nfunction normalize(aaguid: string) {\n return aaguid.toLowerCase()\n}\n",[],[152,196,197,215],"bd0b5fac-3cd8-11f1-8099-42b51c65c3df","bcf4c486-3cd8-11f1-9fbe-42b51c65c3df",11,["D",1776703700736],[170,171,172,173],[152,196,197],"bcf4c3d2-3cd8-11f1-9fbe-42b51c65c3df",10,["D",1776703700587],[169],[152,196],["D",1776703700417],[168],[152],["D",1776703349741],["D",1789512647429],{"_11":12,"_89":85},{"_11":12,"_83":-5,"_84":85,"_45":46,"_86":87,"_88":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_78":-5,"_79":-5,"_80":-5,"_81":14,"_82":12},"ctx",{"_71":-5,"_111":274,"_275":276,"_277":278,"_279":38,"_280":38,"_281":38,"_282":109,"_283":-5,"_284":-7,"_285":-7,"_286":52,"_287":38,"_288":38,"_289":-5,"_290":38,"_291":38,"_292":38,"_293":-5},"ENV",{"_245":246,"_247":248,"_249":26,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1