api/auth/_generateAuthenticationOptions.ts


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

import RELYING_PARTY from './_relyingParty';
import simplewebauthn from '@simplewebauthn/server';
import getUser from '../db/_getUser';
import getAuthenticators from '../db/_getAuthenticators';
import setCurrentChallenge from '../db/_setCurrentChallenge';

/**
 * Generates options for a user with an existing account on the website to
 * authenticate using an authenticator which is already associated with their
 * account in the database.
 * 
 * If a user doesn't currently have an account, they have to create one first,
 * get their account ID and register an authenticator.
 * 
 * The result should be consumed by \@simplewebauthn/browser's
 * `startAuthentication()` method.
 */
export default async function generateAuthenticationOptions(userId: string) {
  const user = await getUser(userId);
  if (!user) {
    return Promise.reject(`
      Failed to generate authentication options because user with ID ${userId}
      did not exist.
    `);
  }

  const userAuthenticators = await getAuthenticators(userId, ['id', 'transports', 'type']);
  const textEncoder = new TextEncoder();

  const options = await simplewebauthn.generateAuthenticationOptions({
    rpID: RELYING_PARTY.id,

    // Users must use one of the authenticators they've already registered
    allowCredentials: userAuthenticators.map((authenticator) => {
      return {
        ...authenticator,
        id: textEncoder.encode(authenticator.id),
      };
    }),

    userVerification: 'preferred',
  });

  setCurrentChallenge(userId, options.challenge);

  return options;
}