jeffemmett
/
rspace-online
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'dev'
CI/CD / deploy (push) Successful in 3m15s Details

This commit is contained in:
Jeff Emmett 2026-04-17 10:27:58 -04:00
parent 609bae45f5 1471d1d578
commit 97a61d6bec
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/encryptid/server.ts
View File

@ -579,8 +579,17 @@ app.post('/api/register/start', async (c) => {
// Generate challenge
const challenge = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
// Generate user ID
const userId = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
// Derive userId deterministically from username so repeated /start calls for
// the same username produce the same WebAuthn user.id. Per WebAuthn spec, a
// repeated create() ceremony with the same (rpId, user.id) overwrites the
// existing passkey instead of creating a new one — stops failed retries from
// leaving orphan passkeys behind in the user's password manager.
const userIdSalt = process.env.USER_ID_SALT || process.env.JWT_SECRET || 'encryptid-user-id';
const userIdBuf = await crypto.subtle.digest(
'SHA-256',
new TextEncoder().encode(`${userIdSalt}:${username.toLowerCase()}`),
);
const userId = Buffer.from(userIdBuf).toString('base64url');
// Store challenge in database
const challengeRecord: StoredChallenge = {