diff --git a/apps/browser/src/_locales/en/messages.json b/apps/browser/src/_locales/en/messages.json index 2233090157..9a68f8bb9f 100644 --- a/apps/browser/src/_locales/en/messages.json +++ b/apps/browser/src/_locales/en/messages.json @@ -1253,6 +1253,9 @@ "typeIdentity": { "message": "Identity" }, + "typePasskey": { + "message": "Passkey" + }, "passwordHistory": { "message": "Password history" }, @@ -2445,5 +2448,56 @@ "turnOffMasterPasswordPromptToEditField": { "message": "Turn off master password re-prompt to edit this field", "description": "Message appearing below the autofill on load message when master password reprompt is set for a vault item." + }, + "passkeyNotCopied": { + "message": "Passkey will not be copied" + }, + "passkeyNotCopiedAlert": { + "message": "The passkey will not be copied to the cloned item. Do you want to continue cloning this item?" + }, + "passkeyFeatureIsNotImplementedForAccountsWithoutMasterPassword": { + "message": "Verification required by the initiating site. This feature is not yet implemented for accounts without master password." + }, + "logInWithPasskey": { + "message": "Log in with passkey?" + }, + "passkeyAlreadyExists": { + "message": "A passkey already exists for this application." + }, + "noPasskeysFoundForThisApplication": { + "message": "No passkeys found for this application." + }, + "noMatchingPasskeyLogin": { + "message": "You do not have a matching login for this site." + }, + "confirm": { + "message": "Confirm" + }, + "savePasskey": { + "message": "Save passkey" + }, + "savePasskeyNewLogin": { + "message": "Save passkey as new login" + }, + "choosePasskey": { + "message": "Choose a login to save this passkey to" + }, + "passkeyItem": { + "message": "Passkey Item" + }, + "overwritePasskey": { + "message": "Overwrite passkey?" + }, + "overwritePasskeyAlert": { + "message": "This item already contains a passkey. Are you sure you want to overwrite the current passkey?" + }, + "featureNotSupported": { + "message": "Feature not yet supported" + }, + "yourPasskeyIsLocked": { + "message": "Authentication required to use passkey. Verify your identity to continue." + }, + "useBrowserName": { + "message": "Use browser" } } diff --git a/apps/browser/src/auth/guards/fido2-auth.guard.ts b/apps/browser/src/auth/guards/fido2-auth.guard.ts new file mode 100644 index 0000000000..7ff0060663 --- /dev/null +++ b/apps/browser/src/auth/guards/fido2-auth.guard.ts @@ -0,0 +1,34 @@ +import { inject } from "@angular/core"; +import { + ActivatedRouteSnapshot, + CanActivateFn, + Router, + RouterStateSnapshot, +} from "@angular/router"; + +import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service"; +import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status"; + +import { BrowserRouterService } from "../../platform/popup/services/browser-router.service"; + +/** + * This guard verifies the user's authetication status. + * If "Locked", it saves the intended route in memory and redirects to the lock screen. Otherwise, the intended route is allowed. + */ +export const fido2AuthGuard: CanActivateFn = async ( + route: ActivatedRouteSnapshot, + state: RouterStateSnapshot +) => { + const routerService = inject(BrowserRouterService); + const authService = inject(AuthService); + const router = inject(Router); + + const authStatus = await authService.getAuthStatus(); + + if (authStatus === AuthenticationStatus.Locked) { + routerService.setPreviousUrl(state.url); + return router.createUrlTree(["/lock"], { queryParams: route.queryParams }); + } + + return true; +}; diff --git a/apps/browser/src/auth/popup/lock.component.html b/apps/browser/src/auth/popup/lock.component.html index e787e0106d..989dc8a953 100644 --- a/apps/browser/src/auth/popup/lock.component.html +++ b/apps/browser/src/auth/popup/lock.component.html @@ -11,81 +11,91 @@
-
-
-
-
- - -
-
- - -
-
- + +
+
+
+
+ + +
+
+ + +
+
+ +
+
- -
-
- -
-
-

- -

- - {{ biometricError }} -

- {{ "awaitDesktop" | i18n }} -

+

+ +

+ + {{ biometricError }} +

+ {{ "awaitDesktop" | i18n }} +

+ + +
diff --git a/apps/browser/src/auth/popup/lock.component.ts b/apps/browser/src/auth/popup/lock.component.ts index f5f8a29eb6..4a0c752a5d 100644 --- a/apps/browser/src/auth/popup/lock.component.ts +++ b/apps/browser/src/auth/popup/lock.component.ts @@ -22,6 +22,8 @@ import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/pass import { DialogService } from "@bitwarden/components"; import { BiometricErrors, BiometricErrorTypes } from "../../models/biometricErrors"; +import { BrowserRouterService } from "../../platform/popup/services/browser-router.service"; +import { fido2PopoutSessionData$ } from "../../vault/fido2/browser-fido2-user-interface.service"; @Component({ selector: "app-lock", @@ -32,6 +34,7 @@ export class LockComponent extends BaseLockComponent { biometricError: string; pendingBiometric = false; + fido2PopoutSessionData$ = fido2PopoutSessionData$(); constructor( router: Router, @@ -52,7 +55,8 @@ export class LockComponent extends BaseLockComponent { private authService: AuthService, dialogService: DialogService, deviceTrustCryptoService: DeviceTrustCryptoServiceAbstraction, - userVerificationService: UserVerificationService + userVerificationService: UserVerificationService, + private routerService: BrowserRouterService ) { super( router, @@ -76,6 +80,15 @@ export class LockComponent extends BaseLockComponent { ); this.successRoute = "/tabs/current"; this.isInitialLockScreen = (window as any).previousPopupUrl == null; + + super.onSuccessfulSubmit = async () => { + const previousUrl = this.routerService.getPreviousUrl(); + if (previousUrl) { + this.router.navigateByUrl(previousUrl); + } else { + this.router.navigate([this.successRoute]); + } + }; } async ngOnInit() { diff --git a/apps/browser/src/autofill/background/context-menus.background.ts b/apps/browser/src/autofill/background/context-menus.background.ts index bc26353cbd..add392f329 100644 --- a/apps/browser/src/autofill/background/context-menus.background.ts +++ b/apps/browser/src/autofill/background/context-menus.background.ts @@ -20,17 +20,16 @@ export default class ContextMenusBackground { BrowserApi.messageListener( "contextmenus.background", - async ( + ( msg: { command: string; data: LockedVaultPendingNotificationsItem }, - sender: chrome.runtime.MessageSender, - sendResponse: any + sender: chrome.runtime.MessageSender ) => { if (msg.command === "unlockCompleted" && msg.data.target === "contextmenus.background") { - await this.contextMenuClickedHandler.cipherAction( - msg.data.commandToRetry.msg.data, - msg.data.commandToRetry.sender.tab - ); - await BrowserApi.tabSendMessageData(sender.tab, "closeNotificationBar"); + this.contextMenuClickedHandler + .cipherAction(msg.data.commandToRetry.msg.data, msg.data.commandToRetry.sender.tab) + .then(() => { + BrowserApi.tabSendMessageData(sender.tab, "closeNotificationBar"); + }); } } ); diff --git a/apps/browser/src/autofill/background/notification.background.ts b/apps/browser/src/autofill/background/notification.background.ts index 73bdc2cd16..f95ca60bab 100644 --- a/apps/browser/src/autofill/background/notification.background.ts +++ b/apps/browser/src/autofill/background/notification.background.ts @@ -47,8 +47,8 @@ export default class NotificationBackground { BrowserApi.messageListener( "notification.background", - async (msg: any, sender: chrome.runtime.MessageSender) => { - await this.processMessage(msg, sender); + (msg: any, sender: chrome.runtime.MessageSender) => { + this.processMessage(msg, sender); } ); diff --git a/apps/browser/src/background/commands.background.ts b/apps/browser/src/background/commands.background.ts index 0cbf91c666..77300272d2 100644 --- a/apps/browser/src/background/commands.background.ts +++ b/apps/browser/src/background/commands.background.ts @@ -25,17 +25,11 @@ export default class CommandsBackground { } async init() { - BrowserApi.messageListener( - "commands.background", - async (msg: any, sender: chrome.runtime.MessageSender, sendResponse: any) => { - if (msg.command === "unlockCompleted" && msg.data.target === "commands.background") { - await this.processCommand( - msg.data.commandToRetry.msg.command, - msg.data.commandToRetry.sender - ); - } + BrowserApi.messageListener("commands.background", (msg: any) => { + if (msg.command === "unlockCompleted" && msg.data.target === "commands.background") { + this.processCommand(msg.data.commandToRetry.msg.command, msg.data.commandToRetry.sender); } - ); + }); if (chrome && chrome.commands) { chrome.commands.onCommand.addListener(async (command: string) => { diff --git a/apps/browser/src/background/main.background.ts b/apps/browser/src/background/main.background.ts index caac8e6bb8..4fcfa68527 100644 --- a/apps/browser/src/background/main.background.ts +++ b/apps/browser/src/background/main.background.ts @@ -87,6 +87,9 @@ import { SendApiService as SendApiServiceAbstraction } from "@bitwarden/common/t import { InternalSendService as InternalSendServiceAbstraction } from "@bitwarden/common/tools/send/services/send.service.abstraction"; import { CipherService as CipherServiceAbstraction } from "@bitwarden/common/vault/abstractions/cipher.service"; import { CollectionService as CollectionServiceAbstraction } from "@bitwarden/common/vault/abstractions/collection.service"; +import { Fido2AuthenticatorService as Fido2AuthenticatorServiceAbstraction } from "@bitwarden/common/vault/abstractions/fido2/fido2-authenticator.service.abstraction"; +import { Fido2ClientService as Fido2ClientServiceAbstraction } from "@bitwarden/common/vault/abstractions/fido2/fido2-client.service.abstraction"; +import { Fido2UserInterfaceService as Fido2UserInterfaceServiceAbstraction } from "@bitwarden/common/vault/abstractions/fido2/fido2-user-interface.service.abstraction"; import { CipherFileUploadService as CipherFileUploadServiceAbstraction } from "@bitwarden/common/vault/abstractions/file-upload/cipher-file-upload.service"; import { FolderApiServiceAbstraction } from "@bitwarden/common/vault/abstractions/folder/folder-api.service.abstraction"; import { InternalFolderService as InternalFolderServiceAbstraction } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction"; @@ -95,6 +98,8 @@ import { SyncService as SyncServiceAbstraction } from "@bitwarden/common/vault/a import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view"; import { CipherService } from "@bitwarden/common/vault/services/cipher.service"; import { CollectionService } from "@bitwarden/common/vault/services/collection.service"; +import { Fido2AuthenticatorService } from "@bitwarden/common/vault/services/fido2/fido2-authenticator.service"; +import { Fido2ClientService } from "@bitwarden/common/vault/services/fido2/fido2-client.service"; import { CipherFileUploadService } from "@bitwarden/common/vault/services/file-upload/cipher-file-upload.service"; import { FolderApiService } from "@bitwarden/common/vault/services/folder/folder-api.service"; import { SyncNotifierService } from "@bitwarden/common/vault/services/sync/sync-notifier.service"; @@ -138,9 +143,11 @@ import BrowserPlatformUtilsService from "../platform/services/browser-platform-u import { BrowserStateService } from "../platform/services/browser-state.service"; import { KeyGenerationService } from "../platform/services/key-generation.service"; import { LocalBackedSessionStorageService } from "../platform/services/local-backed-session-storage.service"; +import { PopupUtilsService } from "../popup/services/popup-utils.service"; import { BrowserSendService } from "../services/browser-send.service"; import { BrowserSettingsService } from "../services/browser-settings.service"; import VaultTimeoutService from "../services/vault-timeout/vault-timeout.service"; +import { BrowserFido2UserInterfaceService } from "../vault/fido2/browser-fido2-user-interface.service"; import { BrowserFolderService } from "../vault/services/browser-folder.service"; import { VaultFilterService } from "../vault/services/vault-filter.service"; @@ -204,6 +211,9 @@ export default class MainBackground { sendApiService: SendApiServiceAbstraction; userVerificationApiService: UserVerificationApiServiceAbstraction; syncNotifierService: SyncNotifierServiceAbstraction; + fido2UserInterfaceService: Fido2UserInterfaceServiceAbstraction; + fido2AuthenticatorService: Fido2AuthenticatorServiceAbstraction; + fido2ClientService: Fido2ClientServiceAbstraction; avatarUpdateService: AvatarUpdateServiceAbstraction; mainContextMenuHandler: MainContextMenuHandler; cipherContextMenuHandler: CipherContextMenuHandler; @@ -213,6 +223,7 @@ export default class MainBackground { devicesService: DevicesServiceAbstraction; deviceTrustCryptoService: DeviceTrustCryptoServiceAbstraction; authRequestCryptoService: AuthRequestCryptoServiceAbstraction; + popupUtilsService: PopupUtilsService; browserPopoutWindowService: BrowserPopoutWindowService; // Passed to the popup for Safari to workaround issues with theming, downloading, etc. @@ -370,7 +381,7 @@ export default class MainBackground { // AuthService should send the messages to the background not popup. send = (subscriber: string, arg: any = {}) => { const message = Object.assign({}, { command: subscriber }, arg); - that.runtimeBackground.processMessage(message, that as any, null); + that.runtimeBackground.processMessage(message, that as any); }; })(); @@ -569,6 +580,22 @@ export default class MainBackground { this.browserPopoutWindowService = new BrowserPopoutWindowService(); + this.fido2UserInterfaceService = new BrowserFido2UserInterfaceService( + this.browserPopoutWindowService + ); + this.fido2AuthenticatorService = new Fido2AuthenticatorService( + this.cipherService, + this.fido2UserInterfaceService, + this.syncService, + this.logService + ); + this.fido2ClientService = new Fido2ClientService( + this.fido2AuthenticatorService, + this.configService, + this.authService, + this.logService + ); + const systemUtilsServiceReloadCallback = () => { const forceWindowReload = this.platformUtilsService.isSafari() || diff --git a/apps/browser/src/background/nativeMessaging.background.ts b/apps/browser/src/background/nativeMessaging.background.ts index 88fd81a3a7..f4eed16823 100644 --- a/apps/browser/src/background/nativeMessaging.background.ts +++ b/apps/browser/src/background/nativeMessaging.background.ts @@ -383,7 +383,7 @@ export class NativeMessagingBackground { return; } - this.runtimeBackground.processMessage({ command: "unlocked" }, null, null); + this.runtimeBackground.processMessage({ command: "unlocked" }, null); } break; } diff --git a/apps/browser/src/background/runtime.background.ts b/apps/browser/src/background/runtime.background.ts index e921a736f7..53711c1dc1 100644 --- a/apps/browser/src/background/runtime.background.ts +++ b/apps/browser/src/background/runtime.background.ts @@ -14,6 +14,7 @@ import { BrowserPopoutWindowService } from "../platform/popup/abstractions/brows import { BrowserStateService } from "../platform/services/abstractions/browser-state.service"; import { BrowserEnvironmentService } from "../platform/services/browser-environment.service"; import BrowserPlatformUtilsService from "../platform/services/browser-platform-utils.service"; +import { AbortManager } from "../vault/background/abort-manager"; import MainBackground from "./main.background"; import LockedVaultPendingNotificationsItem from "./models/lockedVaultPendingNotificationsItem"; @@ -23,6 +24,7 @@ export default class RuntimeBackground { private pageDetailsToAutoFill: any[] = []; private onInstalledReason: string = null; private lockedVaultPendingNotifications: LockedVaultPendingNotificationsItem[] = []; + private abortManager = new AbortManager(); constructor( private main: MainBackground, @@ -50,12 +52,27 @@ export default class RuntimeBackground { } await this.checkOnInstalled(); - const backgroundMessageListener = async ( + const backgroundMessageListener = ( msg: any, sender: chrome.runtime.MessageSender, sendResponse: any ) => { - await this.processMessage(msg, sender, sendResponse); + const messagesWithResponse = [ + "checkFido2FeatureEnabled", + "fido2RegisterCredentialRequest", + "fido2GetCredentialRequest", + ]; + + if (messagesWithResponse.includes(msg.command)) { + this.processMessage(msg, sender).then( + (value) => sendResponse({ result: value }), + (error) => sendResponse({ error: { ...error, message: error.message } }) + ); + return true; + } + + this.processMessage(msg, sender); + return false; }; BrowserApi.messageListener("runtime.background", backgroundMessageListener); @@ -64,7 +81,7 @@ export default class RuntimeBackground { } } - async processMessage(msg: any, sender: chrome.runtime.MessageSender, sendResponse: any) { + async processMessage(msg: any, sender: chrome.runtime.MessageSender) { const cipherId = msg.data?.cipherId; switch (msg.command) { @@ -282,8 +299,19 @@ export default class RuntimeBackground { case "getClickedElementResponse": this.platformUtilsService.copyToClipboard(msg.identifier, { window: window }); break; - default: + case "fido2AbortRequest": + this.abortManager.abort(msg.abortedRequestId); break; + case "checkFido2FeatureEnabled": + return await this.main.fido2ClientService.isFido2FeatureEnabled(); + case "fido2RegisterCredentialRequest": + return await this.abortManager.runWithAbortController(msg.requestId, (abortController) => + this.main.fido2ClientService.createCredential(msg.data, sender.tab, abortController) + ); + case "fido2GetCredentialRequest": + return await this.abortManager.runWithAbortController(msg.requestId, (abortController) => + this.main.fido2ClientService.assertCredential(msg.data, sender.tab, abortController) + ); } } diff --git a/apps/browser/src/manifest.json b/apps/browser/src/manifest.json index 41efa59632..f0da7195f2 100644 --- a/apps/browser/src/manifest.json +++ b/apps/browser/src/manifest.json @@ -17,7 +17,7 @@ "content_scripts": [ { "all_frames": true, - "js": ["content/trigger-autofill-script-injection.js"], + "js": ["content/trigger-autofill-script-injection.js", "content/fido2/content-script.js"], "matches": ["http://*/*", "https://*/*", "file:///*"], "run_at": "document_start" }, @@ -93,6 +93,7 @@ } }, "web_accessible_resources": [ + "content/fido2/page-script.js", "notification/bar.html", "images/icon38.png", "images/icon38_locked.png" diff --git a/apps/browser/src/manifest.v3.json b/apps/browser/src/manifest.v3.json index ba8668984d..e87cdc0023 100644 --- a/apps/browser/src/manifest.v3.json +++ b/apps/browser/src/manifest.v3.json @@ -106,7 +106,12 @@ }, "web_accessible_resources": [ { - "resources": ["notification/bar.html", "images/icon38.png", "images/icon38_locked.png"], + "resources": [ + "content/webauthn/page-script.js", + "notification/bar.html", + "images/icon38.png", + "images/icon38_locked.png" + ], "matches": [""] } ], diff --git a/apps/browser/src/platform/browser/browser-api.ts b/apps/browser/src/platform/browser/browser-api.ts index 5d0c2f1a51..e8070f0d34 100644 --- a/apps/browser/src/platform/browser/browser-api.ts +++ b/apps/browser/src/platform/browser/browser-api.ts @@ -1,3 +1,5 @@ +import { Observable } from "rxjs"; + import { DeviceType } from "@bitwarden/common/enums"; import { TabMessage } from "../../types/tab-messages"; @@ -35,6 +37,10 @@ export class BrowserApi { ); } + static async removeWindow(windowId: number) { + await chrome.windows.remove(windowId); + } + static async getTabFromCurrentWindowId(): Promise | null { return await BrowserApi.tabsQueryFirst({ active: true, @@ -199,6 +205,14 @@ export class BrowserApi { BrowserApi.removeTab(tabToClose.id); } + static createNewWindow( + url: string, + focused = true, + type: chrome.windows.createTypeEnum = "normal" + ) { + chrome.windows.create({ url, focused, type }); + } + // Keep track of all the events registered in a Safari popup so we can remove // them when the popup gets unloaded, otherwise we cause a memory leak private static registeredMessageListeners: any[] = []; @@ -206,7 +220,11 @@ export class BrowserApi { static messageListener( name: string, - callback: (message: any, sender: chrome.runtime.MessageSender, response: any) => void + callback: ( + message: any, + sender: chrome.runtime.MessageSender, + sendResponse: any + ) => boolean | void ) { // eslint-disable-next-line no-restricted-syntax chrome.runtime.onMessage.addListener(callback); @@ -244,6 +262,27 @@ export class BrowserApi { }; } + static messageListener$() { + return new Observable((subscriber) => { + const handler = (message: unknown) => { + subscriber.next(message); + }; + + BrowserApi.messageListener("message", handler); + + return () => { + chrome.runtime.onMessage.removeListener(handler); + + if (BrowserApi.isSafariApi) { + const index = BrowserApi.registeredMessageListeners.indexOf(handler); + if (index !== -1) { + BrowserApi.registeredMessageListeners.splice(index, 1); + } + } + }; + }); + } + static sendMessage(subscriber: string, arg: any = {}) { const message = Object.assign({}, { command: subscriber }, arg); return chrome.runtime.sendMessage(message); diff --git a/apps/browser/src/platform/decorators/session-sync-observable/session-syncer.ts b/apps/browser/src/platform/decorators/session-sync-observable/session-syncer.ts index 001c546b9c..120c4b8b58 100644 --- a/apps/browser/src/platform/decorators/session-sync-observable/session-syncer.ts +++ b/apps/browser/src/platform/decorators/session-sync-observable/session-syncer.ts @@ -73,10 +73,9 @@ export class SessionSyncer { private listenForUpdates() { // This is an unawaited promise, but it will be executed asynchronously in the background. - BrowserApi.messageListener( - this.updateMessageCommand, - async (message) => await this.updateFromMessage(message) - ); + BrowserApi.messageListener(this.updateMessageCommand, (message) => { + this.updateFromMessage(message); + }); } async updateFromMessage(message: any) { diff --git a/apps/browser/src/platform/popup/abstractions/browser-popout-window.service.ts b/apps/browser/src/platform/popup/abstractions/browser-popout-window.service.ts index 0ded45bea9..f48649c4f2 100644 --- a/apps/browser/src/platform/popup/abstractions/browser-popout-window.service.ts +++ b/apps/browser/src/platform/popup/abstractions/browser-popout-window.service.ts @@ -28,6 +28,15 @@ interface BrowserPopoutWindowService { } ): Promise; closePasswordRepromptPrompt(): Promise; + openFido2Popout( + senderWindow: chrome.tabs.Tab, + promptData: { + sessionId: string; + senderTabId: number; + fallbackSupported: boolean; + } + ): Promise; + closeFido2Popout(): Promise; } export { BrowserPopoutWindowService }; diff --git a/apps/browser/src/platform/popup/browser-popout-window.service.ts b/apps/browser/src/platform/popup/browser-popout-window.service.ts index f5ac2f3128..f72f7bfb3e 100644 --- a/apps/browser/src/platform/popup/browser-popout-window.service.ts +++ b/apps/browser/src/platform/popup/browser-popout-window.service.ts @@ -95,29 +95,71 @@ class BrowserPopoutWindowService implements BrowserPopupWindowServiceInterface { await this.closeSingleActionPopout("passwordReprompt"); } + async openFido2Popout( + senderWindow: chrome.tabs.Tab, + { + sessionId, + senderTabId, + fallbackSupported, + }: { + sessionId: string; + senderTabId: number; + fallbackSupported: boolean; + } + ): Promise { + await this.closeFido2Popout(); + + const promptWindowPath = + "popup/index.html#/fido2" + + "?uilocation=popout" + + `&sessionId=${sessionId}` + + `&fallbackSupported=${fallbackSupported}` + + `&senderTabId=${senderTabId}` + + `&senderUrl=${encodeURIComponent(senderWindow.url)}`; + + return await this.openSingleActionPopout( + senderWindow.windowId, + promptWindowPath, + "fido2Popout", + { + width: 200, + height: 500, + } + ); + } + + async closeFido2Popout(): Promise { + await this.closeSingleActionPopout("fido2Popout"); + } + private async openSingleActionPopout( senderWindowId: number, popupWindowURL: string, - singleActionPopoutKey: string - ) { + singleActionPopoutKey: string, + options: chrome.windows.CreateData = {} + ): Promise { const senderWindow = senderWindowId && (await BrowserApi.getWindow(senderWindowId)); const url = chrome.extension.getURL(popupWindowURL); const offsetRight = 15; const offsetTop = 90; - const popupWidth = this.defaultPopoutWindowOptions.width; + /// Use overrides in `options` if provided, otherwise use default + const popupWidth = options?.width || this.defaultPopoutWindowOptions.width; const windowOptions = senderWindow ? { ...this.defaultPopoutWindowOptions, - url, left: senderWindow.left + senderWindow.width - popupWidth - offsetRight, top: senderWindow.top + offsetTop, + ...options, + url, } - : { ...this.defaultPopoutWindowOptions, url }; + : { ...this.defaultPopoutWindowOptions, url, ...options }; const popupWindow = await BrowserApi.createWindow(windowOptions); await this.closeSingleActionPopout(singleActionPopoutKey); this.singleActionPopoutTabIds[singleActionPopoutKey] = popupWindow?.tabs[0].id; + + return popupWindow.id; } private async closeSingleActionPopout(popoutKey: string) { diff --git a/apps/browser/src/platform/popup/services/browser-router.service.ts b/apps/browser/src/platform/popup/services/browser-router.service.ts new file mode 100644 index 0000000000..dfc816f4cc --- /dev/null +++ b/apps/browser/src/platform/popup/services/browser-router.service.ts @@ -0,0 +1,37 @@ +import { Injectable } from "@angular/core"; +import { ActivatedRouteSnapshot, NavigationEnd, Router } from "@angular/router"; +import { filter } from "rxjs"; + +@Injectable({ + providedIn: "root", +}) +export class BrowserRouterService { + private previousUrl?: string = undefined; + + constructor(router: Router) { + router.events + .pipe(filter((e) => e instanceof NavigationEnd)) + .subscribe((event: NavigationEnd) => { + const state: ActivatedRouteSnapshot = router.routerState.snapshot.root; + + let child = state.firstChild; + while (child.firstChild) { + child = child.firstChild; + } + + const updateUrl = !child?.data?.doNotSaveUrl ?? true; + + if (updateUrl) { + this.setPreviousUrl(event.url); + } + }); + } + + getPreviousUrl() { + return this.previousUrl; + } + + setPreviousUrl(url: string) { + this.previousUrl = url; + } +} diff --git a/apps/browser/src/popup/app-routing.module.ts b/apps/browser/src/popup/app-routing.module.ts index 8ef51913f6..10159a715f 100644 --- a/apps/browser/src/popup/app-routing.module.ts +++ b/apps/browser/src/popup/app-routing.module.ts @@ -11,6 +11,7 @@ import { import { canAccessFeature } from "@bitwarden/angular/guard/feature-flag.guard"; import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum"; +import { fido2AuthGuard } from "../auth/guards/fido2-auth.guard"; import { EnvironmentComponent } from "../auth/popup/environment.component"; import { HintComponent } from "../auth/popup/hint.component"; import { HomeComponent } from "../auth/popup/home.component"; @@ -31,6 +32,7 @@ import { SendAddEditComponent } from "../tools/popup/send/send-add-edit.componen import { SendGroupingsComponent } from "../tools/popup/send/send-groupings.component"; import { SendTypeComponent } from "../tools/popup/send/send-type.component"; import { ExportComponent } from "../tools/popup/settings/export.component"; +import { Fido2Component } from "../vault/popup/components/fido2/fido2.component"; import { AddEditComponent } from "../vault/popup/components/vault/add-edit.component"; import { AttachmentsComponent } from "../vault/popup/components/vault/attachments.component"; import { CollectionsComponent } from "../vault/popup/components/vault/collections.component"; @@ -73,6 +75,12 @@ const routes: Routes = [ canActivate: [UnauthGuard], data: { state: "home" }, }, + { + path: "fido2", + component: Fido2Component, + canActivate: [fido2AuthGuard], + data: { state: "fido2" }, + }, { path: "login", component: LoginComponent, @@ -95,7 +103,7 @@ const routes: Routes = [ path: "lock", component: LockComponent, canActivate: [lockGuard()], - data: { state: "lock" }, + data: { state: "lock", doNotSaveUrl: true }, }, { path: "2fa", diff --git a/apps/browser/src/popup/app.component.ts b/apps/browser/src/popup/app.component.ts index 93f824a7dd..16ef77ed8f 100644 --- a/apps/browser/src/popup/app.component.ts +++ b/apps/browser/src/popup/app.component.ts @@ -80,11 +80,7 @@ export class AppComponent implements OnInit, OnDestroy { window.onkeypress = () => this.recordActivity(); }); - (window as any).bitwardenPopupMainMessageListener = async ( - msg: any, - sender: any, - sendResponse: any - ) => { + const bitwardenPopupMainMessageListener = (msg: any, sender: any) => { if (msg.command === "doneLoggingOut") { this.authService.logOut(async () => { if (msg.expired) { @@ -102,15 +98,13 @@ export class AppComponent implements OnInit, OnDestroy { this.changeDetectorRef.detectChanges(); } else if (msg.command === "authBlocked") { this.router.navigate(["home"]); - } else if (msg.command === "locked") { - if (msg.userId == null || msg.userId === (await this.stateService.getUserId())) { - this.router.navigate(["lock"]); - } + } else if (msg.command === "locked" && msg.userId == null) { + this.router.navigate(["lock"]); } else if (msg.command === "showDialog") { - await this.ngZone.run(() => this.showDialog(msg)); + this.showDialog(msg); } else if (msg.command === "showNativeMessagingFinterprintDialog") { // TODO: Should be refactored to live in another service. - await this.ngZone.run(() => this.showNativeMessagingFingerprintDialog(msg)); + this.showNativeMessagingFingerprintDialog(msg); } else if (msg.command === "showToast") { this.showToast(msg); } else if (msg.command === "reloadProcess") { @@ -133,7 +127,8 @@ export class AppComponent implements OnInit, OnDestroy { } }; - BrowserApi.messageListener("app.component", (window as any).bitwardenPopupMainMessageListener); + (window as any).bitwardenPopupMainMessageListener = bitwardenPopupMainMessageListener; + BrowserApi.messageListener("app.component", bitwardenPopupMainMessageListener); // eslint-disable-next-line rxjs/no-async-subscribe this.router.events.pipe(takeUntil(this.destroy$)).subscribe(async (event) => { diff --git a/apps/browser/src/popup/app.module.ts b/apps/browser/src/popup/app.module.ts index 9dbd87cff5..dd27a419a3 100644 --- a/apps/browser/src/popup/app.module.ts +++ b/apps/browser/src/popup/app.module.ts @@ -39,6 +39,9 @@ import { SendTypeComponent } from "../tools/popup/send/send-type.component"; import { ExportComponent } from "../tools/popup/settings/export.component"; import { ActionButtonsComponent } from "../vault/popup/components/action-buttons.component"; import { CipherRowComponent } from "../vault/popup/components/cipher-row.component"; +import { Fido2CipherRowComponent } from "../vault/popup/components/fido2/fido2-cipher-row.component"; +import { Fido2UseBrowserLinkComponent } from "../vault/popup/components/fido2/fido2-use-browser-link.component"; +import { Fido2Component } from "../vault/popup/components/fido2/fido2.component"; import { AddEditCustomFieldsComponent } from "../vault/popup/components/vault/add-edit-custom-fields.component"; import { AddEditComponent } from "../vault/popup/components/vault/add-edit.component"; import { AttachmentsComponent } from "../vault/popup/components/vault/attachments.component"; @@ -111,6 +114,8 @@ import "../platform/popup/locales"; EnvironmentComponent, ExcludedDomainsComponent, ExportComponent, + Fido2CipherRowComponent, + Fido2UseBrowserLinkComponent, FolderAddEditComponent, FoldersComponent, VaultFilterComponent, @@ -148,6 +153,7 @@ import "../platform/popup/locales"; ViewCustomFieldsComponent, RemovePasswordComponent, VaultSelectComponent, + Fido2Component, HelpAndFeedbackComponent, AutofillComponent, EnvironmentSelectorComponent, diff --git a/apps/browser/src/popup/images/bwi-passkey.png b/apps/browser/src/popup/images/bwi-passkey.png new file mode 100644 index 0000000000..702be33446 Binary files /dev/null and b/apps/browser/src/popup/images/bwi-passkey.png differ diff --git a/apps/browser/src/popup/scss/pages.scss b/apps/browser/src/popup/scss/pages.scss index e104570e56..8c2e69092b 100644 --- a/apps/browser/src/popup/scss/pages.scss +++ b/apps/browser/src/popup/scss/pages.scss @@ -153,6 +153,14 @@ body.body-full { margin: 15px 0 15px 0; } +.useBrowserlink { + padding: 0 10px 5px 10px; + position: fixed; + bottom: 10px; + left: 0; + right: 0; +} + app-options { .box { margin: 10px 0; @@ -175,3 +183,170 @@ app-vault-attachments { } } } + +app-fido2 { + .auth-wrapper { + display: flex; + flex-direction: column; + padding: 12px 24px 12px 24px; + + .auth-header { + display: flex; + justify-content: space-between; + align-items: center; + + .left { + padding-right: 10px; + + .logo { + display: inline-flex; + align-items: center; + + i.bwi { + font-size: 35px; + margin-right: 3px; + @include themify($themes) { + color: themed("primaryColor"); + } + } + + span { + font-size: 45px; + font-weight: 300; + margin-top: -3px; + @include themify($themes) { + color: themed("primaryColor"); + } + } + } + } + + .search { + padding: 7px 10px; + width: 100%; + text-align: left; + position: relative; + display: flex; + + .bwi { + position: absolute; + top: 15px; + left: 20px; + + @include themify($themes) { + color: themed("labelColor"); + } + } + + input { + width: 100%; + margin: 0; + border: none; + padding: 5px 10px 5px 30px; + border-radius: $border-radius; + + &:focus { + border-radius: $border-radius; + outline: none; + } + + &[type="search"]::-webkit-search-cancel-button { + -webkit-appearance: none; + appearance: none; + background-repeat: no-repeat; + mask-image: none; + -webkit-mask-image: none; + } + } + } + } + + .auth-flow { + display: flex; + align-items: flex-start; + flex-direction: column; + margin-top: 32px; + margin-bottom: 32px; + + .subtitle { + font-family: Open Sans; + font-size: 24px; + font-style: normal; + font-weight: 600; + line-height: 32px; + } + + .box.list { + overflow-y: auto; + } + + .box-content { + max-height: 140px; + } + + @media screen and (min-height: 501px) and (max-height: 600px) { + .box-content { + max-height: 200px; + } + } + + @media screen and (min-height: 601px) { + .box-content { + max-height: 260px; + } + } + + .box-content-row { + display: flex; + justify-content: center; + align-items: center; + margin: 0px; + padding: 0px; + margin-bottom: 12px; + + button { + min-height: 44px; + } + + .row-main { + border-radius: 6px; + padding: 5px 0px 5px 12px; + + &:focus { + @include themify($themes) { + padding: 3px 0px 3px 10px; + border: 2px solid themed("headerInputBackgroundFocusColor"); + } + } + + &.row-selected { + @include themify($themes) { + outline: none; + padding-left: 7px; + border-left: 5px solid themed("primaryColor"); + background-color: themed("headerBackgroundHoverColor"); + color: themed("headerColor"); + } + } + } + + .row-main-content { + display: flex; + flex-direction: column; + justify-content: center; + + .detail { + min-height: 15px; + display: block; + } + } + } + + .btn { + width: 100%; + font-size: 16px; + font-weight: 600; + } + } + } +} diff --git a/apps/browser/src/popup/services/popup-utils.service.ts b/apps/browser/src/popup/services/popup-utils.service.ts index 1ab80a4564..b5a5a05817 100644 --- a/apps/browser/src/popup/services/popup-utils.service.ts +++ b/apps/browser/src/popup/services/popup-utils.service.ts @@ -3,6 +3,16 @@ import { fromEvent, Subscription } from "rxjs"; import { BrowserApi } from "../../platform/browser/browser-api"; +export type Popout = + | { + type: "window"; + window: chrome.windows.Window; + } + | { + type: "tab"; + tab: chrome.tabs.Tab; + }; + @Injectable() export class PopupUtilsService { private unloadSubscription: Subscription; @@ -45,12 +55,16 @@ export class PopupUtilsService { } } - popOut(win: Window, href: string = null): void { + async popOut( + win: Window, + href: string = null, + options: { center?: boolean } = {} + ): Promise { if (href === null) { href = win.location.href; } - if (typeof chrome !== "undefined" && chrome.windows && chrome.windows.create) { + if (typeof chrome !== "undefined" && chrome?.windows?.create != null) { if (href.indexOf("?uilocation=") > -1) { href = href .replace("uilocation=popup", "uilocation=popout") @@ -63,24 +77,43 @@ export class PopupUtilsService { } const bodyRect = document.querySelector("body").getBoundingClientRect(); - chrome.windows.create({ + const width = Math.round(bodyRect.width ? bodyRect.width + 60 : 375); + const height = Math.round(bodyRect.height || 600); + const top = options.center ? Math.round((screen.height - height) / 2) : undefined; + const left = options.center ? Math.round((screen.width - width) / 2) : undefined; + const window = await BrowserApi.createWindow({ url: href, type: "popup", - width: Math.round(bodyRect.width ? bodyRect.width + 60 : 375), - height: Math.round(bodyRect.height || 600), + width, + height, + top, + left, }); - if (this.inPopup(win)) { + if (win && this.inPopup(win)) { BrowserApi.closePopup(win); } - } else if (typeof chrome !== "undefined" && chrome.tabs && chrome.tabs.create) { + + return { type: "window", window }; + } else if (chrome?.tabs?.create != null) { href = href .replace("uilocation=popup", "uilocation=tab") .replace("uilocation=popout", "uilocation=tab") .replace("uilocation=sidebar", "uilocation=tab"); - chrome.tabs.create({ - url: href, - }); + + const tab = await BrowserApi.createNewTab(href); + return { type: "tab", tab }; + } else { + throw new Error("Cannot open tab or window"); + } + } + + closePopOut(popout: Popout): Promise { + switch (popout.type) { + case "window": + return BrowserApi.removeWindow(popout.window.id); + case "tab": + return BrowserApi.removeTab(popout.tab.id); } } diff --git a/apps/browser/src/vault/background/abort-manager.ts b/apps/browser/src/vault/background/abort-manager.ts new file mode 100644 index 0000000000..8e61ca7a7b --- /dev/null +++ b/apps/browser/src/vault/background/abort-manager.ts @@ -0,0 +1,21 @@ +type Runner = (abortController: AbortController) => Promise; + +/** + * Manages abort controllers for long running tasks and allow separate + * execution contexts to abort each other by using ids. + */ +export class AbortManager { + private abortControllers = new Map(); + + runWithAbortController(id: string, runner: Runner): Promise { + const abortController = new AbortController(); + this.abortControllers.set(id, abortController); + return runner(abortController).finally(() => { + this.abortControllers.delete(id); + }); + } + + abort(id: string) { + this.abortControllers.get(id)?.abort(); + } +} diff --git a/apps/browser/src/vault/fido2/browser-fido2-user-interface.service.ts b/apps/browser/src/vault/fido2/browser-fido2-user-interface.service.ts new file mode 100644 index 0000000000..80af1e0513 --- /dev/null +++ b/apps/browser/src/vault/fido2/browser-fido2-user-interface.service.ts @@ -0,0 +1,366 @@ +import { inject } from "@angular/core"; +import { ActivatedRoute } from "@angular/router"; +import { + BehaviorSubject, + EmptyError, + filter, + firstValueFrom, + fromEvent, + fromEventPattern, + map, + merge, + Observable, + Subject, + switchMap, + take, + takeUntil, + throwError, +} from "rxjs"; + +import { Utils } from "@bitwarden/common/platform/misc/utils"; +import { UserRequestedFallbackAbortReason } from "@bitwarden/common/vault/abstractions/fido2/fido2-client.service.abstraction"; +import { + Fido2UserInterfaceService as Fido2UserInterfaceServiceAbstraction, + Fido2UserInterfaceSession, + NewCredentialParams, + PickCredentialParams, +} from "@bitwarden/common/vault/abstractions/fido2/fido2-user-interface.service.abstraction"; + +import { BrowserApi } from "../../platform/browser/browser-api"; +import { BrowserPopoutWindowService } from "../../platform/popup/abstractions/browser-popout-window.service"; + +const BrowserFido2MessageName = "BrowserFido2UserInterfaceServiceMessage"; + +/** + * Function to retrieve FIDO2 session data from query parameters. + * Expected to be used within components tied to routes with these query parameters. + */ +export function fido2PopoutSessionData$() { + const route = inject(ActivatedRoute); + + return route.queryParams.pipe( + map((queryParams) => ({ + isFido2Session: queryParams.sessionId != null, + sessionId: queryParams.sessionId as string, + fallbackSupported: queryParams.fallbackSupported === "true", + userVerification: queryParams.userVerification === "true", + })) + ); +} + +export class SessionClosedError extends Error { + constructor() { + super("Fido2UserInterfaceSession was closed"); + } +} + +export type BrowserFido2Message = { sessionId: string } & ( + | /** + * This message is used by popouts to announce that they are ready + * to recieve messages. + **/ { + type: "ConnectResponse"; + } + /** + * This message is used to announce the creation of a new session. + * It is used by popouts to know when to close. + **/ + | { + type: "NewSessionCreatedRequest"; + } + | { + type: "PickCredentialRequest"; + cipherIds: string[]; + userVerification: boolean; + fallbackSupported: boolean; + } + | { + type: "PickCredentialResponse"; + cipherId?: string; + userVerified: boolean; + } + | { + type: "ConfirmNewCredentialRequest"; + credentialName: string; + userName: string; + userVerification: boolean; + fallbackSupported: boolean; + } + | { + type: "ConfirmNewCredentialResponse"; + cipherId: string; + userVerified: boolean; + } + | { + type: "InformExcludedCredentialRequest"; + existingCipherIds: string[]; + fallbackSupported: boolean; + } + | { + type: "InformCredentialNotFoundRequest"; + fallbackSupported: boolean; + } + | { + type: "AbortRequest"; + } + | { + type: "AbortResponse"; + fallbackRequested: boolean; + } +); + +/** + * Browser implementation of the {@link Fido2UserInterfaceService}. + * The user interface is implemented as a popout and the service uses the browser's messaging API to communicate with it. + */ +export class BrowserFido2UserInterfaceService implements Fido2UserInterfaceServiceAbstraction { + constructor(private browserPopoutWindowService: BrowserPopoutWindowService) {} + + async newSession( + fallbackSupported: boolean, + tab: chrome.tabs.Tab, + abortController?: AbortController + ): Promise { + return await BrowserFido2UserInterfaceSession.create( + this.browserPopoutWindowService, + fallbackSupported, + tab, + abortController + ); + } +} + +export class BrowserFido2UserInterfaceSession implements Fido2UserInterfaceSession { + static async create( + browserPopoutWindowService: BrowserPopoutWindowService, + fallbackSupported: boolean, + tab: chrome.tabs.Tab, + abortController?: AbortController + ): Promise { + return new BrowserFido2UserInterfaceSession( + browserPopoutWindowService, + fallbackSupported, + tab, + abortController + ); + } + + static sendMessage(msg: BrowserFido2Message) { + BrowserApi.sendMessage(BrowserFido2MessageName, msg); + } + + static abortPopout(sessionId: string, fallbackRequested = false) { + this.sendMessage({ + sessionId: sessionId, + type: "AbortResponse", + fallbackRequested: fallbackRequested, + }); + } + + static confirmNewCredentialResponse(sessionId: string, cipherId: string, userVerified: boolean) { + this.sendMessage({ + sessionId: sessionId, + type: "ConfirmNewCredentialResponse", + cipherId, + userVerified, + }); + } + + private closed = false; + private messages$ = (BrowserApi.messageListener$() as Observable).pipe( + filter((msg) => msg.sessionId === this.sessionId) + ); + private connected$ = new BehaviorSubject(false); + private windowClosed$: Observable; + private destroy$ = new Subject(); + + private constructor( + private readonly browserPopoutWindowService: BrowserPopoutWindowService, + private readonly fallbackSupported: boolean, + private readonly tab: chrome.tabs.Tab, + readonly abortController = new AbortController(), + readonly sessionId = Utils.newGuid() + ) { + this.messages$ + .pipe( + filter((msg) => msg.type === "ConnectResponse"), + take(1), + takeUntil(this.destroy$) + ) + .subscribe(() => { + this.connected$.next(true); + }); + + // Handle session aborted by RP + fromEvent(abortController.signal, "abort") + .pipe(takeUntil(this.destroy$)) + .subscribe(() => { + this.close(); + BrowserFido2UserInterfaceSession.sendMessage({ + type: "AbortRequest", + sessionId: this.sessionId, + }); + }); + + // Handle session aborted by user + this.messages$ + .pipe( + filter((msg) => msg.type === "AbortResponse"), + take(1), + takeUntil(this.destroy$) + ) + .subscribe((msg) => { + if (msg.type === "AbortResponse") { + this.close(); + this.abort(msg.fallbackRequested); + } + }); + + this.windowClosed$ = fromEventPattern( + (handler: any) => chrome.windows.onRemoved.addListener(handler), + (handler: any) => chrome.windows.onRemoved.removeListener(handler) + ); + + BrowserFido2UserInterfaceSession.sendMessage({ + type: "NewSessionCreatedRequest", + sessionId, + }); + } + + async pickCredential({ + cipherIds, + userVerification, + }: PickCredentialParams): Promise<{ cipherId: string; userVerified: boolean }> { + const data: BrowserFido2Message = { + type: "PickCredentialRequest", + cipherIds, + sessionId: this.sessionId, + userVerification, + fallbackSupported: this.fallbackSupported, + }; + + await this.send(data); + const response = await this.receive("PickCredentialResponse"); + + return { cipherId: response.cipherId, userVerified: response.userVerified }; + } + + async confirmNewCredential({ + credentialName, + userName, + userVerification, + }: NewCredentialParams): Promise<{ cipherId: string; userVerified: boolean }> { + const data: BrowserFido2Message = { + type: "ConfirmNewCredentialRequest", + sessionId: this.sessionId, + credentialName, + userName, + userVerification, + fallbackSupported: this.fallbackSupported, + }; + + await this.send(data); + const response = await this.receive("ConfirmNewCredentialResponse"); + + return { cipherId: response.cipherId, userVerified: response.userVerified }; + } + + async informExcludedCredential(existingCipherIds: string[]): Promise { + const data: BrowserFido2Message = { + type: "InformExcludedCredentialRequest", + sessionId: this.sessionId, + existingCipherIds, + fallbackSupported: this.fallbackSupported, + }; + + await this.send(data); + await this.receive("AbortResponse"); + } + + async ensureUnlockedVault(): Promise { + await this.connect(); + } + + async informCredentialNotFound(): Promise { + const data: BrowserFido2Message = { + type: "InformCredentialNotFoundRequest", + sessionId: this.sessionId, + fallbackSupported: this.fallbackSupported, + }; + + await this.send(data); + await this.receive("AbortResponse"); + } + + async close() { + await this.browserPopoutWindowService.closeFido2Popout(); + this.closed = true; + this.destroy$.next(); + this.destroy$.complete(); + } + + private async abort(fallback = false) { + this.abortController.abort(fallback ? UserRequestedFallbackAbortReason : undefined); + } + + private async send(msg: BrowserFido2Message): Promise { + if (!this.connected$.value) { + await this.connect(); + } + BrowserFido2UserInterfaceSession.sendMessage(msg); + } + + private async receive( + type: T + ): Promise { + try { + const response = await firstValueFrom( + this.messages$.pipe( + filter((msg) => msg.sessionId === this.sessionId && msg.type === type), + takeUntil(this.destroy$) + ) + ); + return response as BrowserFido2Message & { type: T }; + } catch (error) { + if (error instanceof EmptyError) { + throw new SessionClosedError(); + } + throw error; + } + } + + private async connect(): Promise { + if (this.closed) { + throw new Error("Cannot re-open closed session"); + } + + const connectPromise = firstValueFrom( + merge( + this.connected$.pipe(filter((connected) => connected === true)), + fromEvent(this.abortController.signal, "abort").pipe( + switchMap(() => throwError(() => new SessionClosedError())) + ) + ) + ); + + const popoutId = await this.browserPopoutWindowService.openFido2Popout(this.tab, { + sessionId: this.sessionId, + senderTabId: this.tab.id, + fallbackSupported: this.fallbackSupported, + }); + + this.windowClosed$ + .pipe( + filter((windowId) => { + return popoutId === windowId; + }), + takeUntil(this.destroy$) + ) + .subscribe(() => { + this.close(); + this.abort(); + }); + + await connectPromise; + } +} diff --git a/apps/browser/src/vault/fido2/content/content-script.ts b/apps/browser/src/vault/fido2/content/content-script.ts new file mode 100644 index 0000000000..bf147c4b58 --- /dev/null +++ b/apps/browser/src/vault/fido2/content/content-script.ts @@ -0,0 +1,81 @@ +import { Message, MessageType } from "./messaging/message"; +import { Messenger } from "./messaging/messenger"; + +function checkFido2FeatureEnabled() { + chrome.runtime.sendMessage( + { command: "checkFido2FeatureEnabled" }, + (response: { result?: boolean }) => initializeFido2ContentScript(response.result) + ); +} + +function initializeFido2ContentScript(isFido2FeatureEnabled: boolean) { + if (isFido2FeatureEnabled !== true) { + return; + } + + const s = document.createElement("script"); + s.src = chrome.runtime.getURL("content/fido2/page-script.js"); + (document.head || document.documentElement).appendChild(s); + + const messenger = Messenger.forDOMCommunication(window); + + messenger.handler = async (message, abortController) => { + const requestId = Date.now().toString(); + const abortHandler = () => + chrome.runtime.sendMessage({ + command: "fido2AbortRequest", + abortedRequestId: requestId, + }); + abortController.signal.addEventListener("abort", abortHandler); + + if (message.type === MessageType.CredentialCreationRequest) { + return new Promise((resolve, reject) => { + chrome.runtime.sendMessage( + { + command: "fido2RegisterCredentialRequest", + data: message.data, + requestId: requestId, + }, + (response) => { + if (response.error !== undefined) { + return reject(response.error); + } + + resolve({ + type: MessageType.CredentialCreationResponse, + result: response.result, + }); + } + ); + }); + } + + if (message.type === MessageType.CredentialGetRequest) { + return new Promise((resolve, reject) => { + chrome.runtime.sendMessage( + { + command: "fido2GetCredentialRequest", + data: message.data, + requestId: requestId, + }, + (response) => { + if (response.error !== undefined) { + return reject(response.error); + } + + resolve({ + type: MessageType.CredentialGetResponse, + result: response.result, + }); + } + ); + }).finally(() => + abortController.signal.removeEventListener("abort", abortHandler) + ) as Promise; + } + + return undefined; + }; +} + +checkFido2FeatureEnabled(); diff --git a/apps/browser/src/vault/fido2/content/messaging/message.ts b/apps/browser/src/vault/fido2/content/messaging/message.ts new file mode 100644 index 0000000000..01a19a1f8a --- /dev/null +++ b/apps/browser/src/vault/fido2/content/messaging/message.ts @@ -0,0 +1,60 @@ +import { + CreateCredentialParams, + CreateCredentialResult, + AssertCredentialParams, + AssertCredentialResult, +} from "@bitwarden/common/vault/abstractions/fido2/fido2-client.service.abstraction"; + +export enum MessageType { + CredentialCreationRequest, + CredentialCreationResponse, + CredentialGetRequest, + CredentialGetResponse, + AbortRequest, + AbortResponse, + ErrorResponse, +} + +export type CredentialCreationRequest = { + type: MessageType.CredentialCreationRequest; + data: CreateCredentialParams; +}; + +export type CredentialCreationResponse = { + type: MessageType.CredentialCreationResponse; + result?: CreateCredentialResult; +}; + +export type CredentialGetRequest = { + type: MessageType.CredentialGetRequest; + data: AssertCredentialParams; +}; + +export type CredentialGetResponse = { + type: MessageType.CredentialGetResponse; + result?: AssertCredentialResult; +}; + +export type AbortRequest = { + type: MessageType.AbortRequest; + abortedRequestId: string; +}; + +export type ErrorResponse = { + type: MessageType.ErrorResponse; + error: string; +}; + +export type AbortResponse = { + type: MessageType.AbortResponse; + abortedRequestId: string; +}; + +export type Message = + | CredentialCreationRequest + | CredentialCreationResponse + | CredentialGetRequest + | CredentialGetResponse + | AbortRequest + | AbortResponse + | ErrorResponse; diff --git a/apps/browser/src/vault/fido2/content/messaging/messenger.spec.ts b/apps/browser/src/vault/fido2/content/messaging/messenger.spec.ts new file mode 100644 index 0000000000..505682d997 --- /dev/null +++ b/apps/browser/src/vault/fido2/content/messaging/messenger.spec.ts @@ -0,0 +1,154 @@ +import { Utils } from "@bitwarden/common/platform/misc/utils"; + +import { Message } from "./message"; +import { Channel, MessageWithMetadata, Messenger } from "./messenger"; + +describe("Messenger", () => { + let messengerA: Messenger; + let messengerB: Messenger; + let handlerA: TestMessageHandler; + let handlerB: TestMessageHandler; + + beforeEach(() => { + // jest does not support MessageChannel + window.MessageChannel = MockMessageChannel as any; + + const channelPair = new TestChannelPair(); + messengerA = new Messenger(channelPair.channelA); + messengerB = new Messenger(channelPair.channelB); + + handlerA = new TestMessageHandler(); + handlerB = new TestMessageHandler(); + messengerA.handler = handlerA.handler; + messengerB.handler = handlerB.handler; + }); + + it("should deliver message to B when sending request from A", () => { + const request = createRequest(); + messengerA.request(request); + + const received = handlerB.recieve(); + + expect(received.length).toBe(1); + expect(received[0].message).toMatchObject(request); + }); + + it("should return response from B when sending request from A", async () => { + const request = createRequest(); + const response = createResponse(); + const requestPromise = messengerA.request(request); + const received = handlerB.recieve(); + received[0].respond(response); + + const returned = await requestPromise; + + expect(returned).toMatchObject(response); + }); + + it("should throw error from B when sending request from A that fails", async () => { + const request = createRequest(); + const error = new Error("Test error"); + const requestPromise = messengerA.request(request); + const received = handlerB.recieve(); + + received[0].reject(error); + + await expect(requestPromise).rejects.toThrow(); + }); + + it("should deliver abort signal to B when requesting abort", () => { + const abortController = new AbortController(); + messengerA.request(createRequest(), abortController); + abortController.abort(); + + const received = handlerB.recieve(); + + expect(received[0].abortController.signal.aborted).toBe(true); + }); +}); + +type TestMessage = MessageWithMetadata & { testId: string }; + +function createRequest(): TestMessage { + return { testId: Utils.newGuid(), type: "TestRequest" } as any; +} + +function createResponse(): TestMessage { + return { testId: Utils.newGuid(), type: "TestResponse" } as any; +} + +class TestChannelPair { + readonly channelA: Channel; + readonly channelB: Channel; + + constructor() { + const broadcastChannel = new MockMessageChannel(); + + this.channelA = { + addEventListener: (listener) => (broadcastChannel.port1.onmessage = listener), + postMessage: (message, port) => broadcastChannel.port1.postMessage(message, port), + }; + + this.channelB = { + addEventListener: (listener) => (broadcastChannel.port2.onmessage = listener), + postMessage: (message, port) => broadcastChannel.port2.postMessage(message, port), + }; + } +} + +class TestMessageHandler { + readonly handler: ( + message: TestMessage, + abortController?: AbortController + ) => Promise; + + private recievedMessages: { + message: TestMessage; + respond: (response: TestMessage) => void; + reject: (error: Error) => void; + abortController?: AbortController; + }[] = []; + + constructor() { + this.handler = (message, abortController) => + new Promise((resolve, reject) => { + this.recievedMessages.push({ + message, + abortController, + respond: (response) => resolve(response), + reject: (error) => reject(error), + }); + }); + } + + recieve() { + const received = this.recievedMessages; + this.recievedMessages = []; + return received; + } +} + +class MockMessageChannel { + port1 = new MockMessagePort(); + port2 = new MockMessagePort(); + + constructor() { + this.port1.remotePort = this.port2; + this.port2.remotePort = this.port1; + } +} + +class MockMessagePort { + onmessage: ((ev: MessageEvent) => any) | null; + remotePort: MockMessagePort; + + postMessage(message: T, port?: MessagePort) { + this.remotePort.onmessage( + new MessageEvent("message", { data: message, ports: port ? [port] : [] }) + ); + } + + close() { + // Do nothing + } +} diff --git a/apps/browser/src/vault/fido2/content/messaging/messenger.ts b/apps/browser/src/vault/fido2/content/messaging/messenger.ts new file mode 100644 index 0000000000..aeb835e2d5 --- /dev/null +++ b/apps/browser/src/vault/fido2/content/messaging/messenger.ts @@ -0,0 +1,130 @@ +import { Message, MessageType } from "./message"; + +const SENDER = "bitwarden-webauthn"; + +type PostMessageFunction = (message: MessageWithMetadata, remotePort: MessagePort) => void; + +export type Channel = { + addEventListener: (listener: (message: MessageEvent) => void) => void; + postMessage: PostMessageFunction; +}; + +export type Metadata = { SENDER: typeof SENDER }; +export type MessageWithMetadata = Message & Metadata; +type Handler = ( + message: MessageWithMetadata, + abortController?: AbortController +) => Promise; + +/** + * A class that handles communication between the page and content script. It converts + * the browser's broadcasting API into a request/response API with support for seamlessly + * handling aborts and exceptions across separate execution contexts. + */ +export class Messenger { + /** + * Creates a messenger that uses the browser's `window.postMessage` API to initiate + * requests in the content script. Every request will then create it's own + * `MessageChannel` through which all subsequent communication will be sent through. + * + * @param window the window object to use for communication + * @returns a `Messenger` instance + */ + static forDOMCommunication(window: Window) { + const windowOrigin = window.location.origin; + + return new Messenger({ + postMessage: (message, port) => window.postMessage(message, windowOrigin, [port]), + addEventListener: (listener) => + window.addEventListener("message", (event: MessageEvent) => { + if (event.origin !== windowOrigin) { + return; + } + + listener(event as MessageEvent); + }), + }); + } + + /** + * The handler that will be called when a message is recieved. The handler should return + * a promise that resolves to the response message. If the handler throws an error, the + * error will be sent back to the sender. + */ + handler?: Handler; + + constructor(private broadcastChannel: Channel) { + this.broadcastChannel.addEventListener(async (event) => { + if (this.handler === undefined) { + return; + } + + const message = event.data; + const port = event.ports?.[0]; + if (message?.SENDER !== SENDER || message == null || port == null) { + return; + } + + const abortController = new AbortController(); + port.onmessage = (event: MessageEvent) => { + if (event.data.type === MessageType.AbortRequest) { + abortController.abort(); + } + }; + + try { + const handlerResponse = await this.handler(message, abortController); + port.postMessage({ ...handlerResponse, SENDER }); + } catch (error) { + port.postMessage({ + SENDER, + type: MessageType.ErrorResponse, + error: JSON.stringify(error, Object.getOwnPropertyNames(error)), + }); + } finally { + port.close(); + } + }); + } + + /** + * Sends a request to the content script and returns the response. + * AbortController signals will be forwarded to the content script. + * + * @param request data to send to the content script + * @param abortController the abort controller that might be used to abort the request + * @returns the response from the content script + */ + async request(request: Message, abortController?: AbortController): Promise { + const requestChannel = new MessageChannel(); + const { port1: localPort, port2: remotePort } = requestChannel; + + try { + const promise = new Promise((resolve) => { + localPort.onmessage = (event: MessageEvent) => resolve(event.data); + }); + + const abortListener = () => + localPort.postMessage({ + metadata: { SENDER }, + type: MessageType.AbortRequest, + }); + abortController?.signal.addEventListener("abort", abortListener); + + this.broadcastChannel.postMessage({ ...request, SENDER }, remotePort); + const response = await promise; + + abortController?.signal.removeEventListener("abort", abortListener); + + if (response.type === MessageType.ErrorResponse) { + const error = new Error(); + Object.assign(error, JSON.parse(response.error)); + throw error; + } + + return response; + } finally { + localPort.close(); + } + } +} diff --git a/apps/browser/src/vault/fido2/content/page-script.ts b/apps/browser/src/vault/fido2/content/page-script.ts new file mode 100644 index 0000000000..1f5d98289b --- /dev/null +++ b/apps/browser/src/vault/fido2/content/page-script.ts @@ -0,0 +1,140 @@ +import { FallbackRequestedError } from "@bitwarden/common/vault/abstractions/fido2/fido2-client.service.abstraction"; + +import { WebauthnUtils } from "../webauthn-utils"; + +import { MessageType } from "./messaging/message"; +import { Messenger } from "./messaging/messenger"; + +const BrowserPublicKeyCredential = window.PublicKeyCredential; + +const browserNativeWebauthnSupport = window.PublicKeyCredential != undefined; +let browserNativeWebauthnPlatformAuthenticatorSupport = false; +if (!browserNativeWebauthnSupport) { + // Polyfill webauthn support + try { + // credentials is read-only if supported, use type-casting to force assignment + (navigator as any).credentials = { + async create() { + throw new Error("Webauthn not supported in this browser."); + }, + async get() { + throw new Error("Webauthn not supported in this browser."); + }, + }; + window.PublicKeyCredential = class PolyfillPublicKeyCredential { + static isUserVerifyingPlatformAuthenticatorAvailable() { + return Promise.resolve(true); + } + } as any; + window.AuthenticatorAttestationResponse = + class PolyfillAuthenticatorAttestationResponse {} as any; + } catch { + /* empty */ + } +} + +if (browserNativeWebauthnSupport) { + BrowserPublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable().then((available) => { + browserNativeWebauthnPlatformAuthenticatorSupport = available; + + if (!available) { + // Polyfill platform authenticator support + window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable = () => + Promise.resolve(true); + } + }); +} + +const browserCredentials = { + create: navigator.credentials.create.bind( + navigator.credentials + ) as typeof navigator.credentials.create, + get: navigator.credentials.get.bind(navigator.credentials) as typeof navigator.credentials.get, +}; + +const messenger = Messenger.forDOMCommunication(window); + +function isSameOriginWithAncestors() { + try { + return window.self === window.top; + } catch { + return false; + } +} + +navigator.credentials.create = async ( + options?: CredentialCreationOptions, + abortController?: AbortController +): Promise => { + const fallbackSupported = + (options?.publicKey?.authenticatorSelection.authenticatorAttachment === "platform" && + browserNativeWebauthnPlatformAuthenticatorSupport) || + (options?.publicKey?.authenticatorSelection.authenticatorAttachment !== "platform" && + browserNativeWebauthnSupport); + try { + const isNotIframe = isSameOriginWithAncestors(); + + const response = await messenger.request( + { + type: MessageType.CredentialCreationRequest, + data: WebauthnUtils.mapCredentialCreationOptions( + options, + window.location.origin, + isNotIframe, + fallbackSupported + ), + }, + abortController + ); + + if (response.type !== MessageType.CredentialCreationResponse) { + throw new Error("Something went wrong."); + } + + return WebauthnUtils.mapCredentialRegistrationResult(response.result); + } catch (error) { + if (error && error.fallbackRequested && fallbackSupported) { + return await browserCredentials.create(options); + } + + throw error; + } +}; + +navigator.credentials.get = async ( + options?: CredentialRequestOptions, + abortController?: AbortController +): Promise => { + const fallbackSupported = browserNativeWebauthnSupport; + + try { + if (options?.mediation && options.mediation !== "optional") { + throw new FallbackRequestedError(); + } + + const response = await messenger.request( + { + type: MessageType.CredentialGetRequest, + data: WebauthnUtils.mapCredentialRequestOptions( + options, + window.location.origin, + true, + fallbackSupported + ), + }, + abortController + ); + + if (response.type !== MessageType.CredentialGetResponse) { + throw new Error("Something went wrong."); + } + + return WebauthnUtils.mapCredentialAssertResult(response.result); + } catch (error) { + if (error && error.fallbackRequested && fallbackSupported) { + return await browserCredentials.get(options); + } + + throw error; + } +}; diff --git a/apps/browser/src/vault/fido2/webauthn-utils.ts b/apps/browser/src/vault/fido2/webauthn-utils.ts new file mode 100644 index 0000000000..2422736077 --- /dev/null +++ b/apps/browser/src/vault/fido2/webauthn-utils.ts @@ -0,0 +1,141 @@ +import { + CreateCredentialParams, + CreateCredentialResult, + AssertCredentialParams, + AssertCredentialResult, +} from "@bitwarden/common/vault/abstractions/fido2/fido2-client.service.abstraction"; +import { Fido2Utils } from "@bitwarden/common/vault/services/fido2/fido2-utils"; + +export class WebauthnUtils { + static mapCredentialCreationOptions( + options: CredentialCreationOptions, + origin: string, + sameOriginWithAncestors: boolean, + fallbackSupported: boolean + ): CreateCredentialParams { + const keyOptions = options.publicKey; + + if (keyOptions == undefined) { + throw new Error("Public-key options not found"); + } + + return { + origin, + attestation: keyOptions.attestation, + authenticatorSelection: { + requireResidentKey: keyOptions.authenticatorSelection?.requireResidentKey, + residentKey: keyOptions.authenticatorSelection?.residentKey, + userVerification: keyOptions.authenticatorSelection?.userVerification, + }, + challenge: Fido2Utils.bufferToString(keyOptions.challenge), + excludeCredentials: keyOptions.excludeCredentials?.map((credential) => ({ + id: Fido2Utils.bufferToString(credential.id), + transports: credential.transports, + type: credential.type, + })), + extensions: undefined, // extensions not currently supported + pubKeyCredParams: keyOptions.pubKeyCredParams.map((params) => ({ + alg: params.alg, + type: params.type, + })), + rp: { + id: keyOptions.rp.id, + name: keyOptions.rp.name, + }, + user: { + id: Fido2Utils.bufferToString(keyOptions.user.id), + displayName: keyOptions.user.displayName, + }, + timeout: keyOptions.timeout, + sameOriginWithAncestors, + fallbackSupported, + }; + } + + static mapCredentialRegistrationResult(result: CreateCredentialResult): PublicKeyCredential { + const credential = { + id: result.credentialId, + rawId: Fido2Utils.stringToBuffer(result.credentialId), + type: "public-key", + authenticatorAttachment: "cross-platform", + response: { + clientDataJSON: Fido2Utils.stringToBuffer(result.clientDataJSON), + attestationObject: Fido2Utils.stringToBuffer(result.attestationObject), + + getAuthenticatorData(): ArrayBuffer { + return Fido2Utils.stringToBuffer(result.authData); + }, + + getPublicKey(): ArrayBuffer { + return null; + }, + + getPublicKeyAlgorithm(): number { + return result.publicKeyAlgorithm; + }, + + getTransports(): string[] { + return result.transports; + }, + } as AuthenticatorAttestationResponse, + getClientExtensionResults: () => ({}), + } as PublicKeyCredential; + + // Modify prototype chains to fix `instanceof` calls. + // This makes these objects indistinguishable from the native classes. + // Unfortunately PublicKeyCredential does not have a javascript constructor so `extends` does not work here. + Object.setPrototypeOf(credential.response, AuthenticatorAttestationResponse.prototype); + Object.setPrototypeOf(credential, PublicKeyCredential.prototype); + + return credential; + } + + static mapCredentialRequestOptions( + options: CredentialRequestOptions, + origin: string, + sameOriginWithAncestors: boolean, + fallbackSupported: boolean + ): AssertCredentialParams { + const keyOptions = options.publicKey; + + if (keyOptions == undefined) { + throw new Error("Public-key options not found"); + } + + return { + origin, + allowedCredentialIds: + keyOptions.allowCredentials?.map((c) => Fido2Utils.bufferToString(c.id)) ?? [], + challenge: Fido2Utils.bufferToString(keyOptions.challenge), + rpId: keyOptions.rpId, + userVerification: keyOptions.userVerification, + timeout: keyOptions.timeout, + sameOriginWithAncestors, + fallbackSupported, + }; + } + + static mapCredentialAssertResult(result: AssertCredentialResult): PublicKeyCredential { + const credential = { + id: result.credentialId, + rawId: Fido2Utils.stringToBuffer(result.credentialId), + type: "public-key", + response: { + authenticatorData: Fido2Utils.stringToBuffer(result.authenticatorData), + clientDataJSON: Fido2Utils.stringToBuffer(result.clientDataJSON), + signature: Fido2Utils.stringToBuffer(result.signature), + userHandle: Fido2Utils.stringToBuffer(result.userHandle), + } as AuthenticatorAssertionResponse, + getClientExtensionResults: () => ({}), + authenticatorAttachment: "cross-platform", + } as PublicKeyCredential; + + // Modify prototype chains to fix `instanceof` calls. + // This makes these objects indistinguishable from the native classes. + // Unfortunately PublicKeyCredential does not have a javascript constructor so `extends` does not work here. + Object.setPrototypeOf(credential.response, AuthenticatorAssertionResponse.prototype); + Object.setPrototypeOf(credential, PublicKeyCredential.prototype); + + return credential; + } +} diff --git a/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.html b/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.html new file mode 100644 index 0000000000..42e8a6b629 --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.html @@ -0,0 +1,27 @@ +
+
+ +
+
diff --git a/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.ts b/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.ts new file mode 100644 index 0000000000..21ff136bf4 --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2-cipher-row.component.ts @@ -0,0 +1,20 @@ +import { Component, EventEmitter, Input, Output } from "@angular/core"; + +import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view"; + +@Component({ + selector: "app-fido2-cipher-row", + templateUrl: "fido2-cipher-row.component.html", +}) +export class Fido2CipherRowComponent { + @Output() onSelected = new EventEmitter(); + @Input() cipher: CipherView; + @Input() last: boolean; + @Input() title: string; + @Input() isSearching: boolean; + @Input() isSelected: boolean; + + selectCipher(c: CipherView) { + this.onSelected.emit(c); + } +} diff --git a/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.html b/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.html new file mode 100644 index 0000000000..3e71675aa2 --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.html @@ -0,0 +1,5 @@ +
+ +
diff --git a/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.ts b/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.ts new file mode 100644 index 0000000000..712f728c32 --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2-use-browser-link.component.ts @@ -0,0 +1,21 @@ +import { Component } from "@angular/core"; +import { firstValueFrom } from "rxjs"; + +import { + BrowserFido2UserInterfaceSession, + fido2PopoutSessionData$, +} from "../../../fido2/browser-fido2-user-interface.service"; + +@Component({ + selector: "app-fido2-use-browser-link", + templateUrl: "fido2-use-browser-link.component.html", +}) +export class Fido2UseBrowserLinkComponent { + fido2PopoutSessionData$ = fido2PopoutSessionData$(); + + async abort() { + const sessionData = await firstValueFrom(this.fido2PopoutSessionData$); + BrowserFido2UserInterfaceSession.abortPopout(sessionData.sessionId, true); + return; + } +} diff --git a/apps/browser/src/vault/popup/components/fido2/fido2.component.html b/apps/browser/src/vault/popup/components/fido2/fido2.component.html new file mode 100644 index 0000000000..0f298b67fb --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2.component.html @@ -0,0 +1,139 @@ + +
+
+
+ + + + + + +
+ +
+ + +
+
+ +
+ +
+ + + +
+

+ {{ subtitleText | i18n }} +

+ + +
+
+ +
+
+ +
+ +
+ + + +
+ +
+ +
+ + +
+

{{ "passkeyAlreadyExists" | i18n }}

+
+
+ +
+
+ +
+ + +
+

{{ "noPasskeysFoundForThisApplication" | i18n }}

+
+ + + +
+ +
+
+ diff --git a/apps/browser/src/vault/popup/components/fido2/fido2.component.ts b/apps/browser/src/vault/popup/components/fido2/fido2.component.ts new file mode 100644 index 0000000000..ed0ddbd144 --- /dev/null +++ b/apps/browser/src/vault/popup/components/fido2/fido2.component.ts @@ -0,0 +1,427 @@ +import { Component, OnDestroy, OnInit } from "@angular/core"; +import { ActivatedRoute, Router } from "@angular/router"; +import { + BehaviorSubject, + combineLatest, + concatMap, + filter, + map, + Observable, + Subject, + take, + takeUntil, +} from "rxjs"; + +import { SearchService } from "@bitwarden/common/abstractions/search.service"; +import { SettingsService } from "@bitwarden/common/abstractions/settings.service"; +import { SecureNoteType } from "@bitwarden/common/enums"; +import { LogService } from "@bitwarden/common/platform/abstractions/log.service"; +import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service"; +import { Utils } from "@bitwarden/common/platform/misc/utils"; +import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service"; +import { CipherRepromptType } from "@bitwarden/common/vault/enums/cipher-reprompt-type"; +import { CipherType } from "@bitwarden/common/vault/enums/cipher-type"; +import { CardView } from "@bitwarden/common/vault/models/view/card.view"; +import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view"; +import { IdentityView } from "@bitwarden/common/vault/models/view/identity.view"; +import { LoginUriView } from "@bitwarden/common/vault/models/view/login-uri.view"; +import { LoginView } from "@bitwarden/common/vault/models/view/login.view"; +import { SecureNoteView } from "@bitwarden/common/vault/models/view/secure-note.view"; +import { DialogService } from "@bitwarden/components"; +import { PasswordRepromptService } from "@bitwarden/vault"; + +import { BrowserApi } from "../../../../platform/browser/browser-api"; +import { + BrowserFido2Message, + BrowserFido2UserInterfaceSession, +} from "../../../fido2/browser-fido2-user-interface.service"; + +interface ViewData { + message: BrowserFido2Message; + fallbackSupported: boolean; +} + +@Component({ + selector: "app-fido2", + templateUrl: "fido2.component.html", + styleUrls: [], +}) +export class Fido2Component implements OnInit, OnDestroy { + private destroy$ = new Subject(); + private hasSearched = false; + private searchTimeout: any = null; + private hasLoadedAllCiphers = false; + + protected cipher: CipherView; + protected searchTypeSearch = false; + protected searchPending = false; + protected searchText: string; + protected url: string; + protected hostname: string; + protected data$: Observable; + protected sessionId?: string; + protected senderTabId?: string; + protected ciphers?: CipherView[] = []; + protected displayedCiphers?: CipherView[] = []; + protected loading = false; + protected subtitleText: string; + protected credentialText: string; + + private message$ = new BehaviorSubject(null); + + constructor( + private router: Router, + private activatedRoute: ActivatedRoute, + private cipherService: CipherService, + private passwordRepromptService: PasswordRepromptService, + private platformUtilsService: PlatformUtilsService, + private settingsService: SettingsService, + private searchService: SearchService, + private logService: LogService, + private dialogService: DialogService + ) {} + + ngOnInit() { + this.searchTypeSearch = !this.platformUtilsService.isSafari(); + + const queryParams$ = this.activatedRoute.queryParamMap.pipe( + take(1), + map((queryParamMap) => ({ + sessionId: queryParamMap.get("sessionId"), + senderTabId: queryParamMap.get("senderTabId"), + senderUrl: queryParamMap.get("senderUrl"), + })) + ); + + combineLatest([queryParams$, BrowserApi.messageListener$() as Observable]) + .pipe( + concatMap(async ([queryParams, message]) => { + this.sessionId = queryParams.sessionId; + this.senderTabId = queryParams.senderTabId; + this.url = queryParams.senderUrl; + // For a 'NewSessionCreatedRequest', abort if it doesn't belong to the current session. + if ( + message.type === "NewSessionCreatedRequest" && + message.sessionId !== queryParams.sessionId + ) { + this.abort(false); + return; + } + + // Ignore messages that don't belong to the current session. + if (message.sessionId !== queryParams.sessionId) { + return; + } + + if (message.type === "AbortRequest") { + this.abort(false); + return; + } + + // Show dialog if user account does not have master password + if (!(await this.passwordRepromptService.enabled())) { + await this.dialogService.openSimpleDialog({ + title: { key: "featureNotSupported" }, + content: { key: "passkeyFeatureIsNotImplementedForAccountsWithoutMasterPassword" }, + acceptButtonText: { key: "ok" }, + cancelButtonText: null, + type: "info", + }); + + this.abort(true); + return; + } + + return message; + }), + filter((message) => !!message), + takeUntil(this.destroy$) + ) + .subscribe((message) => { + this.message$.next(message); + }); + + this.data$ = this.message$.pipe( + filter((message) => message != undefined), + concatMap(async (message) => { + switch (message.type) { + case "ConfirmNewCredentialRequest": { + const equivalentDomains = this.settingsService.getEquivalentDomains(this.url); + + this.ciphers = (await this.cipherService.getAllDecrypted()).filter( + (cipher) => cipher.type === CipherType.Login && !cipher.isDeleted + ); + this.displayedCiphers = this.ciphers.filter((cipher) => + cipher.login.matchesUri(this.url, equivalentDomains) + ); + + if (this.displayedCiphers.length > 0) { + this.selectedPasskey(this.displayedCiphers[0]); + } + break; + } + + case "PickCredentialRequest": { + this.ciphers = await Promise.all( + message.cipherIds.map(async (cipherId) => { + const cipher = await this.cipherService.get(cipherId); + return cipher.decrypt( + await this.cipherService.getKeyForCipherKeyDecryption(cipher) + ); + }) + ); + this.displayedCiphers = [...this.ciphers]; + if (this.displayedCiphers.length > 0) { + this.selectedPasskey(this.displayedCiphers[0]); + } + break; + } + + case "InformExcludedCredentialRequest": { + this.ciphers = await Promise.all( + message.existingCipherIds.map(async (cipherId) => { + const cipher = await this.cipherService.get(cipherId); + return cipher.decrypt( + await this.cipherService.getKeyForCipherKeyDecryption(cipher) + ); + }) + ); + this.displayedCiphers = [...this.ciphers]; + + if (this.displayedCiphers.length > 0) { + this.selectedPasskey(this.displayedCiphers[0]); + } + break; + } + } + + this.subtitleText = + this.displayedCiphers.length > 0 + ? this.getCredentialSubTitleText(message.type) + : "noMatchingPasskeyLogin"; + + this.credentialText = this.getCredentialButtonText(message.type); + return { + message, + fallbackSupported: "fallbackSupported" in message && message.fallbackSupported, + }; + }), + takeUntil(this.destroy$) + ); + + queryParams$.pipe(takeUntil(this.destroy$)).subscribe((queryParams) => { + this.send({ + sessionId: queryParams.sessionId, + type: "ConnectResponse", + }); + }); + } + + async submit() { + const data = this.message$.value; + if (data?.type === "PickCredentialRequest") { + const userVerified = await this.handleUserVerification(data.userVerification, this.cipher); + + this.send({ + sessionId: this.sessionId, + cipherId: this.cipher.id, + type: "PickCredentialResponse", + userVerified, + }); + } else if (data?.type === "ConfirmNewCredentialRequest") { + if (this.cipher.login.hasFido2Credentials) { + const confirmed = await this.dialogService.openSimpleDialog({ + title: { key: "overwritePasskey" }, + content: { key: "overwritePasskeyAlert" }, + type: "info", + }); + + if (!confirmed) { + return false; + } + } + + const userVerified = await this.handleUserVerification(data.userVerification, this.cipher); + + this.send({ + sessionId: this.sessionId, + cipherId: this.cipher.id, + type: "ConfirmNewCredentialResponse", + userVerified, + }); + } + + this.loading = true; + } + + async saveNewLogin() { + const data = this.message$.value; + if (data?.type === "ConfirmNewCredentialRequest") { + let userVerified = false; + if (data.userVerification) { + userVerified = await this.passwordRepromptService.showPasswordPrompt(); + } + + if (!data.userVerification || userVerified) { + await this.createNewCipher(); + } + + this.send({ + sessionId: this.sessionId, + cipherId: this.cipher?.id, + type: "ConfirmNewCredentialResponse", + userVerified, + }); + } + + this.loading = true; + } + + getCredentialSubTitleText(messageType: string): string { + return messageType == "ConfirmNewCredentialRequest" ? "choosePasskey" : "logInWithPasskey"; + } + + getCredentialButtonText(messageType: string): string { + return messageType == "ConfirmNewCredentialRequest" ? "savePasskey" : "confirm"; + } + + selectedPasskey(item: CipherView) { + this.cipher = item; + } + + viewPasskey() { + this.router.navigate(["/view-cipher"], { + queryParams: { + cipherId: this.cipher.id, + uilocation: "popout", + senderTabId: this.senderTabId, + sessionId: this.sessionId, + }, + }); + } + + addCipher() { + const data = this.message$.value; + + if (data?.type !== "ConfirmNewCredentialRequest") { + return; + } + + this.router.navigate(["/add-cipher"], { + queryParams: { + name: Utils.getHostname(this.url), + uri: this.url, + uilocation: "popout", + senderTabId: this.senderTabId, + sessionId: this.sessionId, + userVerification: data.userVerification, + }, + }); + } + + async loadLoginCiphers() { + this.ciphers = (await this.cipherService.getAllDecrypted()).filter( + (cipher) => cipher.type === CipherType.Login && !cipher.isDeleted + ); + if (!this.hasLoadedAllCiphers) { + this.hasLoadedAllCiphers = !this.searchService.isSearchable(this.searchText); + } + await this.search(null); + } + + async search(timeout: number = null) { + this.searchPending = false; + if (this.searchTimeout != null) { + clearTimeout(this.searchTimeout); + } + + if (timeout == null) { + this.hasSearched = this.searchService.isSearchable(this.searchText); + this.displayedCiphers = await this.searchService.searchCiphers( + this.searchText, + null, + this.ciphers + ); + return; + } + this.searchPending = true; + this.searchTimeout = setTimeout(async () => { + this.hasSearched = this.searchService.isSearchable(this.searchText); + if (!this.hasLoadedAllCiphers && !this.hasSearched) { + await this.loadLoginCiphers(); + } else { + this.displayedCiphers = await this.searchService.searchCiphers( + this.searchText, + null, + this.ciphers + ); + } + this.searchPending = false; + this.selectedPasskey(this.displayedCiphers[0]); + }, timeout); + } + + abort(fallback: boolean) { + this.unload(fallback); + window.close(); + } + + unload(fallback = false) { + this.send({ + sessionId: this.sessionId, + type: "AbortResponse", + fallbackRequested: fallback, + }); + } + + ngOnDestroy(): void { + this.destroy$.next(); + this.destroy$.complete(); + } + + private buildCipher() { + this.cipher = new CipherView(); + this.cipher.name = Utils.getHostname(this.url); + this.cipher.type = CipherType.Login; + this.cipher.login = new LoginView(); + this.cipher.login.uris = [new LoginUriView()]; + this.cipher.login.uris[0].uri = this.url; + this.cipher.card = new CardView(); + this.cipher.identity = new IdentityView(); + this.cipher.secureNote = new SecureNoteView(); + this.cipher.secureNote.type = SecureNoteType.Generic; + this.cipher.reprompt = CipherRepromptType.None; + } + + private async createNewCipher() { + this.buildCipher(); + const cipher = await this.cipherService.encrypt(this.cipher); + try { + await this.cipherService.createWithServer(cipher); + this.cipher.id = cipher.id; + } catch (e) { + this.logService.error(e); + } + } + + private async handleUserVerification( + userVerification: boolean, + cipher: CipherView + ): Promise { + const masterPasswordRepromptRequiered = cipher && cipher.reprompt !== 0; + const verificationRequired = userVerification || masterPasswordRepromptRequiered; + + if (!verificationRequired) { + return false; + } + + return await this.passwordRepromptService.showPasswordPrompt(); + } + + private send(msg: BrowserFido2Message) { + BrowserFido2UserInterfaceSession.sendMessage({ + sessionId: this.sessionId, + ...msg, + }); + } +} diff --git a/apps/browser/src/vault/popup/components/vault/add-edit.component.html b/apps/browser/src/vault/popup/components/vault/add-edit.component.html index dda71cb0d6..b2a42776e1 100644 --- a/apps/browser/src/vault/popup/components/vault/add-edit.component.html +++ b/apps/browser/src/vault/popup/components/vault/add-edit.component.html @@ -129,6 +129,18 @@ + + +
+
+
+ {{ "typePasskey" | i18n }} + {{ "dateCreated" | i18n }} + {{ cipher.login.fido2Credentials[0].creationDate | date : "short" }} +
+
+
+
{ + const fido2SessionData = await firstValueFrom(this.fido2PopoutSessionData$); + // Would be refactored after rework is done on the windows popout service + if ( + this.inPopout && + fido2SessionData.isFido2Session && + !(await this.handleFido2UserVerification( + fido2SessionData.sessionId, + fido2SessionData.userVerification + )) + ) { + return false; + } + const success = await super.submit(); if (!success) { return false; } + if (this.inPopout && fido2SessionData.isFido2Session) { + BrowserFido2UserInterfaceSession.confirmNewCredentialResponse( + fido2SessionData.sessionId, + this.cipher.id, + fido2SessionData.userVerification + ); + return true; + } + if (this.popupUtilsService.inTab(window)) { this.popupUtilsService.disableCloseTabWarning(); this.messagingService.send("closeTab", { delay: 1000 }); @@ -204,9 +233,16 @@ export class AddEditComponent extends BaseAddEditComponent { } } - cancel() { + async cancel() { super.cancel(); + // Would be refactored after rework is done on the windows popout service + const sessionData = await firstValueFrom(this.fido2PopoutSessionData$); + if (this.inPopout && sessionData.isFido2Session) { + BrowserFido2UserInterfaceSession.abortPopout(sessionData.sessionId); + return; + } + if (this.senderTabId && this.inPopout) { this.close(); return; @@ -291,6 +327,18 @@ export class AddEditComponent extends BaseAddEditComponent { }, 200); } + private async handleFido2UserVerification( + sessionId: string, + userVerification: boolean + ): Promise { + if (userVerification && !(await this.passwordRepromptService.showPasswordPrompt())) { + BrowserFido2UserInterfaceSession.abortPopout(sessionId); + return false; + } + + return true; + } + repromptChanged() { super.repromptChanged(); diff --git a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html index 8e459a2600..564cf19f2c 100644 --- a/apps/browser/src/vault/popup/components/vault/vault-filter.component.html +++ b/apps/browser/src/vault/popup/components/vault/vault-filter.component.html @@ -70,7 +70,9 @@
{{ "typeLogin" | i18n }}
- {{ typeCounts.get(cipherType.Login) || 0 }} + + {{ typeCounts.get(cipherType.Login) || 0 }} + + +
+ {{ "typePasskey" | i18n }} + {{ "dateCreated" | i18n }} + {{ cipher.login.fido2Credentials[0].creationDate | date : "short" }} +
+
+ +
+ {{ "typePasskey" | i18n }} + {{ "dateCreated" | i18n }} + {{ cipher.login.fido2Credentials[0].creationDate | date : "short" }} +
; showPasswordless = false; - private destroy$ = new Subject(); - constructor( devicesApiService: DevicesApiServiceAbstraction, appIdService: AppIdService, @@ -146,11 +145,6 @@ export class LoginComponent extends BaseLoginComponent implements OnInit, OnDest } } - ngOnDestroy(): void { - this.destroy$.next(); - this.destroy$.complete(); - } - async goAfterLogIn() { const masterPassword = this.formGroup.value.masterPassword; diff --git a/apps/web/src/app/auth/settings/emergency-access/emergency-add-edit.component.ts b/apps/web/src/app/auth/settings/emergency-access/emergency-add-edit.component.ts index fdb72518b1..0e82a5c76a 100644 --- a/apps/web/src/app/auth/settings/emergency-access/emergency-add-edit.component.ts +++ b/apps/web/src/app/auth/settings/emergency-access/emergency-add-edit.component.ts @@ -1,3 +1,4 @@ +import { DatePipe } from "@angular/common"; import { Component } from "@angular/core"; import { AuditService } from "@bitwarden/common/abstractions/audit.service"; @@ -47,7 +48,8 @@ export class EmergencyAddEditComponent extends BaseAddEditComponent { organizationService: OrganizationService, logService: LogService, sendApiService: SendApiService, - dialogService: DialogService + dialogService: DialogService, + datePipe: DatePipe ) { super( cipherService, @@ -66,7 +68,8 @@ export class EmergencyAddEditComponent extends BaseAddEditComponent { logService, passwordRepromptService, sendApiService, - dialogService + dialogService, + datePipe ); } diff --git a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html index 934062fa69..0564512ac3 100644 --- a/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html +++ b/apps/web/src/app/vault/components/vault-items/vault-cipher-row.component.html @@ -100,6 +100,7 @@ {{ "launch" | i18n }} +
+ +
+
+ +
+ +
+
+
+
diff --git a/apps/web/src/app/vault/individual-vault/add-edit.component.ts b/apps/web/src/app/vault/individual-vault/add-edit.component.ts index 74e7a9e6e3..cf998c5c8f 100644 --- a/apps/web/src/app/vault/individual-vault/add-edit.component.ts +++ b/apps/web/src/app/vault/individual-vault/add-edit.component.ts @@ -1,3 +1,4 @@ +import { DatePipe } from "@angular/common"; import { Component, OnDestroy, OnInit } from "@angular/core"; import { AddEditComponent as BaseAddEditComponent } from "@bitwarden/angular/vault/components/add-edit.component"; @@ -18,7 +19,7 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi import { CollectionService } from "@bitwarden/common/vault/abstractions/collection.service"; import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction"; import { CipherType } from "@bitwarden/common/vault/enums/cipher-type"; -import { LoginUriView } from "@bitwarden/common/vault/models/view/login-uri.view"; +import { Launchable } from "@bitwarden/common/vault/interfaces/launchable"; import { DialogService } from "@bitwarden/components"; import { PasswordRepromptService } from "@bitwarden/vault"; @@ -42,6 +43,15 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On protected totpInterval: number; protected override componentName = "app-vault-add-edit"; + get fido2CredentialCreationDateValue(): string { + const dateCreated = this.i18nService.t("dateCreated"); + const creationDate = this.datePipe.transform( + this.cipher?.login?.fido2Credentials?.[0]?.creationDate, + "short" + ); + return `${dateCreated} ${creationDate}`; + } + constructor( cipherService: CipherService, folderService: FolderService, @@ -59,7 +69,8 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On logService: LogService, passwordRepromptService: PasswordRepromptService, sendApiService: SendApiService, - dialogService: DialogService + dialogService: DialogService, + private datePipe: DatePipe ) { super( cipherService, @@ -131,7 +142,7 @@ export class AddEditComponent extends BaseAddEditComponent implements OnInit, On } } - launch(uri: LoginUriView) { + launch(uri: Launchable) { if (!uri.canLaunch) { return; } diff --git a/apps/web/src/app/vault/individual-vault/vault.component.ts b/apps/web/src/app/vault/individual-vault/vault.component.ts index 3b8d60d263..aae45d27e2 100644 --- a/apps/web/src/app/vault/individual-vault/vault.component.ts +++ b/apps/web/src/app/vault/individual-vault/vault.component.ts @@ -721,6 +721,18 @@ export class VaultComponent implements OnInit, OnDestroy { } async cloneCipher(cipher: CipherView) { + if (cipher.login?.hasFido2Credentials) { + const confirmed = await this.dialogService.openSimpleDialog({ + title: { key: "passkeyNotCopied" }, + content: { key: "passkeyNotCopiedAlert" }, + type: "info", + }); + + if (!confirmed) { + return false; + } + } + const component = await this.editCipher(cipher); component.cloneMode = true; } diff --git a/apps/web/src/app/vault/org-vault/add-edit.component.ts b/apps/web/src/app/vault/org-vault/add-edit.component.ts index c8a37c087a..93be56f1a0 100644 --- a/apps/web/src/app/vault/org-vault/add-edit.component.ts +++ b/apps/web/src/app/vault/org-vault/add-edit.component.ts @@ -1,3 +1,4 @@ +import { DatePipe } from "@angular/common"; import { Component } from "@angular/core"; import { ApiService } from "@bitwarden/common/abstractions/api.service"; @@ -49,7 +50,8 @@ export class AddEditComponent extends BaseAddEditComponent { passwordRepromptService: PasswordRepromptService, organizationService: OrganizationService, sendApiService: SendApiService, - dialogService: DialogService + dialogService: DialogService, + datePipe: DatePipe ) { super( cipherService, @@ -68,7 +70,8 @@ export class AddEditComponent extends BaseAddEditComponent { logService, passwordRepromptService, sendApiService, - dialogService + dialogService, + datePipe ); } diff --git a/apps/web/src/app/vault/org-vault/vault.component.ts b/apps/web/src/app/vault/org-vault/vault.component.ts index dcdd73da3c..22aa277fc2 100644 --- a/apps/web/src/app/vault/org-vault/vault.component.ts +++ b/apps/web/src/app/vault/org-vault/vault.component.ts @@ -644,6 +644,18 @@ export class VaultComponent implements OnInit, OnDestroy { } async cloneCipher(cipher: CipherView) { + if (cipher.login?.hasFido2Credentials) { + const confirmed = await this.dialogService.openSimpleDialog({ + title: { key: "passkeyNotCopied" }, + content: { key: "passkeyNotCopiedAlert" }, + type: "info", + }); + + if (!confirmed) { + return false; + } + } + const collections = (await firstValueFrom(this.vaultFilterService.filteredCollections$)).filter( (c) => !c.readOnly && c.id != Unassigned ); diff --git a/apps/web/src/images/bwi-passkey.png b/apps/web/src/images/bwi-passkey.png new file mode 100644 index 0000000000..702be33446 Binary files /dev/null and b/apps/web/src/images/bwi-passkey.png differ diff --git a/apps/web/src/locales/en/messages.json b/apps/web/src/locales/en/messages.json index 60fed7a538..390b7f71ad 100644 --- a/apps/web/src/locales/en/messages.json +++ b/apps/web/src/locales/en/messages.json @@ -7277,5 +7277,14 @@ }, "customBillingEnd": { "message": " page for latest invoicing." + }, + "typePasskey": { + "message": "Passkey" + }, + "passkeyNotCopied": { + "message": "Passkey will not be copied" + }, + "passkeyNotCopiedAlert": { + "message": "The passkey will not be copied to the cloned item. Do you want to continue cloning this item?" } } diff --git a/libs/angular/src/auth/components/login.component.ts b/libs/angular/src/auth/components/login.component.ts index 02ba54e6f1..74a8388a3a 100644 --- a/libs/angular/src/auth/components/login.component.ts +++ b/libs/angular/src/auth/components/login.component.ts @@ -1,7 +1,8 @@ -import { Directive, ElementRef, NgZone, OnInit, ViewChild } from "@angular/core"; +import { Directive, ElementRef, NgZone, OnDestroy, OnInit, ViewChild } from "@angular/core"; import { FormBuilder, Validators } from "@angular/forms"; import { ActivatedRoute, Router } from "@angular/router"; -import { take } from "rxjs/operators"; +import { Subject } from "rxjs"; +import { take, takeUntil } from "rxjs/operators"; import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service"; import { DevicesApiServiceAbstraction } from "@bitwarden/common/auth/abstractions/devices-api.service.abstraction"; @@ -27,7 +28,7 @@ import { import { CaptchaProtectedComponent } from "./captcha-protected.component"; @Directive() -export class LoginComponent extends CaptchaProtectedComponent implements OnInit { +export class LoginComponent extends CaptchaProtectedComponent implements OnInit, OnDestroy { @ViewChild("masterPasswordInput", { static: true }) masterPasswordInput: ElementRef; showPassword = false; @@ -53,6 +54,8 @@ export class LoginComponent extends CaptchaProtectedComponent implements OnInit protected successRoute = "vault"; protected forcePasswordResetRoute = "update-temp-password"; + protected destroy$ = new Subject(); + get loggedEmail() { return this.formGroup.value.email; } @@ -83,14 +86,17 @@ export class LoginComponent extends CaptchaProtectedComponent implements OnInit } async ngOnInit() { - this.route?.queryParams.subscribe((params) => { - if (params != null) { - const queryParamsEmail = params["email"]; - if (queryParamsEmail != null && queryParamsEmail.indexOf("@") > -1) { - this.formGroup.get("email").setValue(queryParamsEmail); - this.loginService.setEmail(queryParamsEmail); - this.paramEmailSet = true; - } + this.route?.queryParams.pipe(takeUntil(this.destroy$)).subscribe((params) => { + if (!params) { + return; + } + + const queryParamsEmail = params.email; + + if (queryParamsEmail != null && queryParamsEmail.indexOf("@") > -1) { + this.formGroup.get("email").setValue(queryParamsEmail); + this.loginService.setEmail(queryParamsEmail); + this.paramEmailSet = true; } }); let email = this.loginService.getEmail(); @@ -109,6 +115,11 @@ export class LoginComponent extends CaptchaProtectedComponent implements OnInit this.formGroup.get("rememberEmail")?.setValue(rememberEmail); } + ngOnDestroy() { + this.destroy$.next(); + this.destroy$.complete(); + } + async submit(showToast = true) { const data = this.formGroup.value; diff --git a/libs/angular/src/scss/bwicons/fonts/bwi-font.svg b/libs/angular/src/scss/bwicons/fonts/bwi-font.svg index 6ea0809317..e815389126 100644 --- a/libs/angular/src/scss/bwicons/fonts/bwi-font.svg +++ b/libs/angular/src/scss/bwicons/fonts/bwi-font.svg @@ -53,7 +53,7 @@ - + @@ -71,7 +71,7 @@ - + @@ -131,9 +131,9 @@ - + - + @@ -185,6 +185,8 @@ + + diff --git a/libs/angular/src/scss/bwicons/fonts/bwi-font.ttf b/libs/angular/src/scss/bwicons/fonts/bwi-font.ttf index f3d2459393..f9b63283e0 100644 Binary files a/libs/angular/src/scss/bwicons/fonts/bwi-font.ttf and b/libs/angular/src/scss/bwicons/fonts/bwi-font.ttf differ diff --git a/libs/angular/src/scss/bwicons/fonts/bwi-font.woff b/libs/angular/src/scss/bwicons/fonts/bwi-font.woff index c17abc55a6..1e57b1aab3 100644 Binary files a/libs/angular/src/scss/bwicons/fonts/bwi-font.woff and b/libs/angular/src/scss/bwicons/fonts/bwi-font.woff differ diff --git a/libs/angular/src/scss/bwicons/fonts/bwi-font.woff2 b/libs/angular/src/scss/bwicons/fonts/bwi-font.woff2 index 1685db2454..88036b7b3e 100644 Binary files a/libs/angular/src/scss/bwicons/fonts/bwi-font.woff2 and b/libs/angular/src/scss/bwicons/fonts/bwi-font.woff2 differ diff --git a/libs/angular/src/scss/bwicons/styles/style.scss b/libs/angular/src/scss/bwicons/styles/style.scss index 8263aaed00..de86d1f35a 100644 --- a/libs/angular/src/scss/bwicons/styles/style.scss +++ b/libs/angular/src/scss/bwicons/styles/style.scss @@ -130,7 +130,7 @@ $icons: ( "hamburger": "\e972", "bw-folder-open-f1": "\e93e", "desktop": "\e96a", - "angle-up": "\e96b", + "angle-up": "\e969", "user": "\e900", "user-f": "\e901", "key": "\e902", @@ -158,7 +158,7 @@ $icons: ( "plus": "\e918", "star": "\e919", "list": "\e91a", - "angle-down": "\e91b", + "angle-down": "\e92d", "external-link": "\e91c", "refresh": "\e91d", "search": "\e91f", @@ -175,7 +175,7 @@ $icons: ( "sign-out": "\e92a", "share": "\e92b", "clock": "\e92c", - "angle-left": "\e92d", + "angle-left": "\e96b", "caret-left": "\e92e", "square": "\e92f", "collection": "\e930", @@ -225,7 +225,7 @@ $icons: ( "wrench": "\e965", "ban": "\e967", "camera": "\e968", - "angle-right": "\e969", + "angle-right": "\e91b", "eye-slash": "\e96d", "file": "\e96e", "paste": "\e96f", @@ -262,6 +262,8 @@ $icons: ( "up-down-btn": "\e99c", "caret-up": "\e99d", "caret-down": "\e99e", + "passkey": "\e99f", + "lock-encrypted": "\e9a0", ); @each $name, $glyph in $icons { diff --git a/libs/angular/src/vault/components/add-edit.component.ts b/libs/angular/src/vault/components/add-edit.component.ts index fb065587bf..f99b96d1c2 100644 --- a/libs/angular/src/vault/components/add-edit.component.ts +++ b/libs/angular/src/vault/components/add-edit.component.ts @@ -267,6 +267,11 @@ export class AddEditComponent implements OnInit, OnDestroy { } } + // We don't want to copy passkeys when we clone a cipher + if (this.cloneMode && this.cipher?.login?.hasFido2Credentials) { + this.cipher.login.fido2Credentials = null; + } + this.folders$ = this.folderService.folderViews$; if (this.editMode && this.previousCipherId !== this.cipherId) { @@ -324,7 +329,7 @@ export class AddEditComponent implements OnInit, OnDestroy { : this.collections.filter((c) => (c as any).checked).map((c) => c.id); } - // Clear current Cipher Id to trigger "Add" cipher flow + // Clear current Cipher Id if exists to trigger "Add" cipher flow if (this.cloneMode) { this.cipher.id = null; } diff --git a/libs/angular/src/vault/components/view.component.ts b/libs/angular/src/vault/components/view.component.ts index 781034aa9f..90032617b4 100644 --- a/libs/angular/src/vault/components/view.component.ts +++ b/libs/angular/src/vault/components/view.component.ts @@ -29,10 +29,10 @@ import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.servi import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction"; import { CipherRepromptType } from "@bitwarden/common/vault/enums/cipher-reprompt-type"; import { CipherType } from "@bitwarden/common/vault/enums/cipher-type"; +import { Launchable } from "@bitwarden/common/vault/interfaces/launchable"; import { AttachmentView } from "@bitwarden/common/vault/models/view/attachment.view"; import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view"; import { FolderView } from "@bitwarden/common/vault/models/view/folder.view"; -import { LoginUriView } from "@bitwarden/common/vault/models/view/login-uri.view"; import { DialogService } from "@bitwarden/components"; import { PasswordRepromptService } from "@bitwarden/vault"; @@ -62,6 +62,7 @@ export class ViewComponent implements OnDestroy, OnInit { fieldType = FieldType; checkPasswordPromise: Promise; folder: FolderView; + cipherType = CipherType; private totpInterval: any; private previousCipherId: string; @@ -156,6 +157,18 @@ export class ViewComponent implements OnDestroy, OnInit { } async clone() { + if (this.cipher.login?.hasFido2Credentials) { + const confirmed = await this.dialogService.openSimpleDialog({ + title: { key: "passkeyNotCopied" }, + content: { key: "passkeyNotCopiedAlert" }, + type: "info", + }); + + if (!confirmed) { + return false; + } + } + if (await this.promptPassword()) { this.onCloneCipher.emit(this.cipher); return true; @@ -295,7 +308,7 @@ export class ViewComponent implements OnDestroy, OnInit { } } - launch(uri: LoginUriView, cipherId?: string) { + launch(uri: Launchable, cipherId?: string) { if (!uri.canLaunch) { return; } diff --git a/libs/common/src/enums/feature-flag.enum.ts b/libs/common/src/enums/feature-flag.enum.ts index cc0873351b..398d63fe96 100644 --- a/libs/common/src/enums/feature-flag.enum.ts +++ b/libs/common/src/enums/feature-flag.enum.ts @@ -1,6 +1,7 @@ export enum FeatureFlag { DisplayEuEnvironmentFlag = "display-eu-environment", DisplayLowKdfIterationWarningFlag = "display-kdf-iteration-warning", + Fido2VaultCredentials = "fido2-vault-credentials", TrustedDeviceEncryption = "trusted-device-encryption", PasswordlessLogin = "passwordless-login", AutofillV2 = "autofill-v2", diff --git a/libs/common/src/models/api/login.api.ts b/libs/common/src/models/api/login.api.ts index 82e28dd0a3..934d2e99b5 100644 --- a/libs/common/src/models/api/login.api.ts +++ b/libs/common/src/models/api/login.api.ts @@ -1,3 +1,6 @@ +import { JsonObject } from "type-fest"; + +import { Fido2CredentialApi } from "../../vault/api/fido2-credential.api"; import { BaseResponse } from "../response/base.response"; import { LoginUriApi } from "./login-uri.api"; @@ -9,6 +12,7 @@ export class LoginApi extends BaseResponse { passwordRevisionDate: string; totp: string; autofillOnPageLoad: boolean; + fido2Credentials?: Fido2CredentialApi[]; constructor(data: any = null) { super(data); @@ -25,5 +29,12 @@ export class LoginApi extends BaseResponse { if (uris != null) { this.uris = uris.map((u: any) => new LoginUriApi(u)); } + + const fido2Credentials = this.getResponseProperty("Fido2Credentials"); + if (fido2Credentials != null) { + this.fido2Credentials = fido2Credentials.map( + (key: JsonObject) => new Fido2CredentialApi(key) + ); + } } } diff --git a/libs/common/src/models/export/fido2-credential.export.ts b/libs/common/src/models/export/fido2-credential.export.ts new file mode 100644 index 0000000000..258699c8da --- /dev/null +++ b/libs/common/src/models/export/fido2-credential.export.ts @@ -0,0 +1,125 @@ +import { EncString } from "../../platform/models/domain/enc-string"; +import { Fido2Credential } from "../../vault/models/domain/fido2-credential"; +import { Fido2CredentialView } from "../../vault/models/view/fido2-credential.view"; + +/** + * Represents format of Fido2 Credentials in JSON exports. + */ +export class Fido2CredentialExport { + /** + * Generates a template for Fido2CredentialExport + * @returns Instance of Fido2CredentialExport with predefined values. + */ + static template(): Fido2CredentialExport { + const req = new Fido2CredentialExport(); + req.credentialId = "keyId"; + req.keyType = "keyType"; + req.keyAlgorithm = "keyAlgorithm"; + req.keyCurve = "keyCurve"; + req.keyValue = "keyValue"; + req.rpId = "rpId"; + req.userHandle = "userHandle"; + req.counter = "counter"; + req.rpName = "rpName"; + req.userDisplayName = "userDisplayName"; + req.discoverable = "false"; + req.creationDate = null; + return req; + } + + /** + * Converts a Fido2CredentialExport object to its view representation. + * @param req - The Fido2CredentialExport object to be converted. + * @param view - (Optional) The Fido2CredentialView object to popualte with Fido2CredentialExport data + * @returns Fido2CredentialView - The populated view, or a new instance if none was provided. + */ + static toView(req: Fido2CredentialExport, view = new Fido2CredentialView()) { + view.credentialId = req.credentialId; + view.keyType = req.keyType as "public-key"; + view.keyAlgorithm = req.keyAlgorithm as "ECDSA"; + view.keyCurve = req.keyCurve as "P-256"; + view.keyValue = req.keyValue; + view.rpId = req.rpId; + view.userHandle = req.userHandle; + view.counter = parseInt(req.counter); + view.rpName = req.rpName; + view.userDisplayName = req.userDisplayName; + view.discoverable = req.discoverable === "true"; + view.creationDate = new Date(req.creationDate); + return view; + } + + /** + * Converts a Fido2CredentialExport object to its domain representation. + * @param req - The Fido2CredentialExport object to be converted. + * @param domain - (Optional) The Fido2Credential object to popualte with Fido2CredentialExport data + * @returns Fido2Credential - The populated domain, or a new instance if none was provided. + */ + static toDomain(req: Fido2CredentialExport, domain = new Fido2Credential()) { + domain.credentialId = req.credentialId != null ? new EncString(req.credentialId) : null; + domain.keyType = req.keyType != null ? new EncString(req.keyType) : null; + domain.keyAlgorithm = req.keyAlgorithm != null ? new EncString(req.keyAlgorithm) : null; + domain.keyCurve = req.keyCurve != null ? new EncString(req.keyCurve) : null; + domain.keyValue = req.keyValue != null ? new EncString(req.keyValue) : null; + domain.rpId = req.rpId != null ? new EncString(req.rpId) : null; + domain.userHandle = req.userHandle != null ? new EncString(req.userHandle) : null; + domain.counter = req.counter != null ? new EncString(req.counter) : null; + domain.rpName = req.rpName != null ? new EncString(req.rpName) : null; + domain.userDisplayName = + req.userDisplayName != null ? new EncString(req.userDisplayName) : null; + domain.discoverable = req.discoverable != null ? new EncString(req.discoverable) : null; + domain.creationDate = req.creationDate; + return domain; + } + + credentialId: string; + keyType: string; + keyAlgorithm: string; + keyCurve: string; + keyValue: string; + rpId: string; + userHandle: string; + counter: string; + rpName: string; + userDisplayName: string; + discoverable: string; + creationDate: Date; + + /** + * Constructs a new Fid2CredentialExport instance. + * + * @param o - The credential storing the data being exported. When not provided, an empty export is created instead. + */ + constructor(o?: Fido2CredentialView | Fido2Credential) { + if (o == null) { + return; + } + + if (o instanceof Fido2CredentialView) { + this.credentialId = o.credentialId; + this.keyType = o.keyType; + this.keyAlgorithm = o.keyAlgorithm; + this.keyCurve = o.keyCurve; + this.keyValue = o.keyValue; + this.rpId = o.rpId; + this.userHandle = o.userHandle; + this.counter = String(o.counter); + this.rpName = o.rpName; + this.userDisplayName = o.userDisplayName; + this.discoverable = String(o.discoverable); + } else { + this.credentialId = o.credentialId?.encryptedString; + this.keyType = o.keyType?.encryptedString; + this.keyAlgorithm = o.keyAlgorithm?.encryptedString; + this.keyCurve = o.keyCurve?.encryptedString; + this.keyValue = o.keyValue?.encryptedString; + this.rpId = o.rpId?.encryptedString; + this.userHandle = o.userHandle?.encryptedString; + this.counter = o.counter?.encryptedString; + this.rpName = o.rpName?.encryptedString; + this.userDisplayName = o.userDisplayName?.encryptedString; + this.discoverable = o.discoverable?.encryptedString; + } + this.creationDate = o.creationDate; + } +} diff --git a/libs/common/src/models/export/index.ts b/libs/common/src/models/export/index.ts index b92c68d814..0b33857220 100644 --- a/libs/common/src/models/export/index.ts +++ b/libs/common/src/models/export/index.ts @@ -9,3 +9,4 @@ export { FolderExport } from "./folder.export"; export { IdentityExport } from "./identity.export"; export { LoginUriExport } from "./login-uri.export"; export { SecureNoteExport } from "./secure-note.export"; +export { Fido2CredentialExport } from "./fido2-credential.export"; diff --git a/libs/common/src/models/export/login.export.ts b/libs/common/src/models/export/login.export.ts index 7a22b12537..a5d9348c2c 100644 --- a/libs/common/src/models/export/login.export.ts +++ b/libs/common/src/models/export/login.export.ts @@ -2,6 +2,7 @@ import { EncString } from "../../platform/models/domain/enc-string"; import { Login as LoginDomain } from "../../vault/models/domain/login"; import { LoginView } from "../../vault/models/view/login.view"; +import { Fido2CredentialExport } from "./fido2-credential.export"; import { LoginUriExport } from "./login-uri.export"; export class LoginExport { @@ -11,6 +12,7 @@ export class LoginExport { req.username = "jdoe"; req.password = "myp@ssword123"; req.totp = "JBSWY3DPEHPK3PXP"; + req.fido2Credentials = [Fido2CredentialExport.template()]; return req; } @@ -21,6 +23,9 @@ export class LoginExport { view.username = req.username; view.password = req.password; view.totp = req.totp; + if (req.fido2Credentials != null) { + view.fido2Credentials = req.fido2Credentials.map((key) => Fido2CredentialExport.toView(key)); + } return view; } @@ -31,6 +36,8 @@ export class LoginExport { domain.username = req.username != null ? new EncString(req.username) : null; domain.password = req.password != null ? new EncString(req.password) : null; domain.totp = req.totp != null ? new EncString(req.totp) : null; + // Fido2credentials are currently not supported for exports. + return domain; } @@ -38,6 +45,7 @@ export class LoginExport { username: string; password: string; totp: string; + fido2Credentials: Fido2CredentialExport[] = []; constructor(o?: LoginView | LoginDomain) { if (o == null) { @@ -52,6 +60,10 @@ export class LoginExport { } } + if (o.fido2Credentials != null) { + this.fido2Credentials = o.fido2Credentials.map((key) => new Fido2CredentialExport(key)); + } + if (o instanceof LoginView) { this.username = o.username; this.password = o.password; diff --git a/libs/common/src/vault/abstractions/fido2/fido2-authenticator.service.abstraction.ts b/libs/common/src/vault/abstractions/fido2/fido2-authenticator.service.abstraction.ts new file mode 100644 index 0000000000..5a406aeb14 --- /dev/null +++ b/libs/common/src/vault/abstractions/fido2/fido2-authenticator.service.abstraction.ts @@ -0,0 +1,143 @@ +/** + * This class represents an abstraction of the WebAuthn Authenticator model as described by W3C: + * https://www.w3.org/TR/webauthn-3/#sctn-authenticator-model + * + * The authenticator provides key management and cryptographic signatures. + */ +export abstract class Fido2AuthenticatorService { + /** + * Create and save a new credential as described in: + * https://www.w3.org/TR/webauthn-3/#sctn-op-make-cred + * + * @param params Parameters for creating a new credential + * @param abortController An AbortController that can be used to abort the operation. + * @returns A promise that resolves with the new credential and an attestation signature. + **/ + makeCredential: ( + params: Fido2AuthenticatorMakeCredentialsParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ) => Promise; + + /** + * Generate an assertion using an existing credential as describe in: + * https://www.w3.org/TR/webauthn-3/#sctn-op-get-assertion + * + * @param params Parameters for generating an assertion + * @param abortController An AbortController that can be used to abort the operation. + * @returns A promise that resolves with the asserted credential and an assertion signature. + */ + getAssertion: ( + params: Fido2AuthenticatorGetAssertionParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ) => Promise; +} + +export enum Fido2AlgorithmIdentifier { + ES256 = -7, + RS256 = -257, +} + +export enum Fido2AutenticatorErrorCode { + Unknown = "UnknownError", + NotSupported = "NotSupportedError", + InvalidState = "InvalidStateError", + NotAllowed = "NotAllowedError", + Constraint = "ConstraintError", +} + +export class Fido2AutenticatorError extends Error { + constructor(readonly errorCode: Fido2AutenticatorErrorCode) { + super(errorCode); + } +} + +export interface PublicKeyCredentialDescriptor { + id: BufferSource; + transports?: ("ble" | "hybrid" | "internal" | "nfc" | "usb")[]; + type: "public-key"; +} + +/** + * Parameters for {@link Fido2AuthenticatorService.makeCredential} + * + * This interface represents the input parameters described in + * https://www.w3.org/TR/webauthn-3/#sctn-op-make-cred + */ +export interface Fido2AuthenticatorMakeCredentialsParams { + /** The hash of the serialized client data, provided by the client. */ + hash: BufferSource; + /** The Relying Party's PublicKeyCredentialRpEntity. */ + rpEntity: { + name: string; + id?: string; + }; + /** The user account’s PublicKeyCredentialUserEntity, containing the user handle given by the Relying Party. */ + userEntity: { + id: BufferSource; + name?: string; + displayName?: string; + icon?: string; + }; + /** A sequence of pairs of PublicKeyCredentialType and public key algorithms (COSEAlgorithmIdentifier) requested by the Relying Party. This sequence is ordered from most preferred to least preferred. The authenticator makes a best-effort to create the most preferred credential that it can. */ + credTypesAndPubKeyAlgs: { + alg: number; + type: "public-key"; // not used + }[]; + /** An OPTIONAL list of PublicKeyCredentialDescriptor objects provided by the Relying Party with the intention that, if any of these are known to the authenticator, it SHOULD NOT create a new credential. excludeCredentialDescriptorList contains a list of known credentials. */ + excludeCredentialDescriptorList?: PublicKeyCredentialDescriptor[]; + /** A map from extension identifiers to their authenticator extension inputs, created by the client based on the extensions requested by the Relying Party, if any. */ + extensions?: { + appid?: string; + appidExclude?: string; + credProps?: boolean; + uvm?: boolean; + }; + /** A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator. */ + enterpriseAttestationPossible?: boolean; // Ignored by bitwarden at the moment + /** The effective resident key requirement for credential creation, a Boolean value determined by the client. Resident is synonymous with discoverable. */ + requireResidentKey: boolean; + requireUserVerification: boolean; + /** Forwarded to user interface */ + fallbackSupported: boolean; + /** The constant Boolean value true. It is included here as a pseudo-parameter to simplify applying this abstract authenticator model to implementations that may wish to make a test of user presence optional although WebAuthn does not. */ + // requireUserPresence: true; // Always required +} + +export interface Fido2AuthenticatorMakeCredentialResult { + credentialId: BufferSource; + attestationObject: BufferSource; + authData: BufferSource; + publicKeyAlgorithm: number; +} + +/** + * Parameters for {@link Fido2AuthenticatorService.getAssertion} + + * This interface represents the input parameters described in + * https://www.w3.org/TR/webauthn-3/#sctn-op-get-assertion + */ +export interface Fido2AuthenticatorGetAssertionParams { + /** The caller’s RP ID, as determined by the user agent and the client. */ + rpId: string; + /** The hash of the serialized client data, provided by the client. */ + hash: BufferSource; + allowCredentialDescriptorList: PublicKeyCredentialDescriptor[]; + /** The effective user verification requirement for assertion, a Boolean value provided by the client. */ + requireUserVerification: boolean; + /** The constant Boolean value true. It is included here as a pseudo-parameter to simplify applying this abstract authenticator model to implementations that may wish to make a test of user presence optional although WebAuthn does not. */ + // requireUserPresence: boolean; // Always required + extensions: unknown; + /** Forwarded to user interface */ + fallbackSupported: boolean; +} + +export interface Fido2AuthenticatorGetAssertionResult { + selectedCredential: { + id: Uint8Array; + userHandle?: Uint8Array; + }; + authenticatorData: Uint8Array; + signature: Uint8Array; +} diff --git a/libs/common/src/vault/abstractions/fido2/fido2-client.service.abstraction.ts b/libs/common/src/vault/abstractions/fido2/fido2-client.service.abstraction.ts new file mode 100644 index 0000000000..fca73c8d99 --- /dev/null +++ b/libs/common/src/vault/abstractions/fido2/fido2-client.service.abstraction.ts @@ -0,0 +1,174 @@ +export const UserRequestedFallbackAbortReason = "UserRequestedFallback"; + +export type UserVerification = "discouraged" | "preferred" | "required"; + +/** + * This class represents an abstraction of the WebAuthn Client as described by W3C: + * https://www.w3.org/TR/webauthn-3/#webauthn-client + * + * The WebAuthn Client is an intermediary entity typically implemented in the user agent + * (in whole, or in part). Conceptually, it underlies the Web Authentication API and embodies + * the implementation of the Web Authentication API's operations. + * + * It is responsible for both marshalling the inputs for the underlying authenticator operations, + * and for returning the results of the latter operations to the Web Authentication API's callers. + */ +export abstract class Fido2ClientService { + /** + * Allows WebAuthn Relying Party scripts to request the creation of a new public key credential source. + * For more information please see: https://www.w3.org/TR/webauthn-3/#sctn-createCredential + * + * @param params The parameters for the credential creation operation. + * @param abortController An AbortController that can be used to abort the operation. + * @returns A promise that resolves with the new credential. + */ + createCredential: ( + params: CreateCredentialParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ) => Promise; + + /** + * Allows WebAuthn Relying Party scripts to discover and use an existing public key credential, with the user’s consent. + * Relying Party script can optionally specify some criteria to indicate what credential sources are acceptable to it. + * For more information please see: https://www.w3.org/TR/webauthn-3/#sctn-getAssertion + * + * @param params The parameters for the credential assertion operation. + * @param abortController An AbortController that can be used to abort the operation. + * @returns A promise that resolves with the asserted credential. + */ + assertCredential: ( + params: AssertCredentialParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ) => Promise; + + isFido2FeatureEnabled: () => Promise; +} + +/** + * Parameters for creating a new credential. + */ +export interface CreateCredentialParams { + /** The Relaying Parties origin, see: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin */ + origin: string; + /** + * A value which is true if and only if the caller’s environment settings object is same-origin with its ancestors. + * It is false if caller is cross-origin. + * */ + sameOriginWithAncestors: boolean; + /** The Relying Party's preference for attestation conveyance */ + attestation?: "direct" | "enterprise" | "indirect" | "none"; + /** The Relying Party's requirements of the authenticator used in the creation of the credential. */ + authenticatorSelection?: { + // authenticatorAttachment?: AuthenticatorAttachment; // not used + requireResidentKey?: boolean; + residentKey?: "discouraged" | "preferred" | "required"; + userVerification?: UserVerification; + }; + /** Challenge intended to be used for generating the newly created credential's attestation object. */ + challenge: string; // b64 encoded + /** + * This member is intended for use by Relying Parties that wish to limit the creation of multiple credentials for + * the same account on a single authenticator. The client is requested to return an error if the new credential would + * be created on an authenticator that also contains one of the credentials enumerated in this parameter. + * */ + excludeCredentials?: { + id: string; // b64 encoded + transports?: ("ble" | "hybrid" | "internal" | "nfc" | "usb")[]; + type: "public-key"; + }[]; + /** + * This member contains additional parameters requesting additional processing by the client and authenticator. + * Not currently supported. + **/ + extensions?: { + appid?: string; + appidExclude?: string; + credProps?: boolean; + uvm?: boolean; + }; + /** + * This member contains information about the desired properties of the credential to be created. + * The sequence is ordered from most preferred to least preferred. + * The client makes a best-effort to create the most preferred credential that it can. + */ + pubKeyCredParams: PublicKeyCredentialParam[]; + /** Data about the Relying Party responsible for the request. */ + rp: { + id?: string; + name: string; + }; + /** Data about the user account for which the Relying Party is requesting attestation. */ + user: { + id: string; // b64 encoded + displayName: string; + }; + /** Forwarded to user interface */ + fallbackSupported: boolean; + /** + * This member specifies a time, in milliseconds, that the caller is willing to wait for the call to complete. + * This is treated as a hint, and MAY be overridden by the client. + **/ + timeout?: number; +} + +/** + * The result of creating a new credential. + */ +export interface CreateCredentialResult { + credentialId: string; + clientDataJSON: string; + attestationObject: string; + authData: string; + publicKeyAlgorithm: number; + transports: string[]; +} + +/** + * Parameters for asserting a credential. + */ +export interface AssertCredentialParams { + allowedCredentialIds: string[]; + rpId: string; + origin: string; + challenge: string; + userVerification?: UserVerification; + timeout: number; + sameOriginWithAncestors: boolean; + fallbackSupported: boolean; +} + +/** + * The result of asserting a credential. + */ +export interface AssertCredentialResult { + credentialId: string; + clientDataJSON: string; + authenticatorData: string; + signature: string; + userHandle: string; +} + +/** + * A description of a key type and algorithm. + * + * @example { + * alg: -7, // ES256 + * type: "public-key" + * } + */ +export interface PublicKeyCredentialParam { + alg: number; + type: "public-key"; +} + +/** + * Error thrown when the user requests a fallback to the browser's built-in WebAuthn implementation. + */ +export class FallbackRequestedError extends Error { + readonly fallbackRequested = true; + constructor() { + super("FallbackRequested"); + } +} diff --git a/libs/common/src/vault/abstractions/fido2/fido2-user-interface.service.abstraction.ts b/libs/common/src/vault/abstractions/fido2/fido2-user-interface.service.abstraction.ts new file mode 100644 index 0000000000..fe15aec0fd --- /dev/null +++ b/libs/common/src/vault/abstractions/fido2/fido2-user-interface.service.abstraction.ts @@ -0,0 +1,103 @@ +/** + * Parameters used to ask the user to confirm the creation of a new credential. + */ +export interface NewCredentialParams { + /** + * The name of the credential. + */ + credentialName: string; + + /** + * The name of the user. + */ + userName: string; + + /** + * Whether or not the user must be verified before completing the operation. + */ + userVerification: boolean; +} + +/** + * Parameters used to ask the user to pick a credential from a list of existing credentials. + */ +export interface PickCredentialParams { + /** + * The IDs of the credentials that the user can pick from. + */ + cipherIds: string[]; + + /** + * Whether or not the user must be verified before completing the operation. + */ + userVerification: boolean; +} + +/** + * This service is used to provide a user interface with which the user can control FIDO2 operations. + * It acts as a way to remote control the user interface from the background script. + * + * The service is session based and is intended to be used by the FIDO2 authenticator to open a window, + * and then use this window to ask the user for input and/or display messages to the user. + */ +export abstract class Fido2UserInterfaceService { + /** + * Creates a new session. + * Note: This will not necessarily open a window until it is needed to request something from the user. + * + * @param fallbackSupported Whether or not the browser natively supports WebAuthn. + * @param abortController An abort controller that can be used to cancel/close the session. + */ + newSession: ( + fallbackSupported: boolean, + tab: chrome.tabs.Tab, + abortController?: AbortController + ) => Promise; +} + +export abstract class Fido2UserInterfaceSession { + /** + * Ask the user to pick a credential from a list of existing credentials. + * + * @param params The parameters to use when asking the user to pick a credential. + * @param abortController An abort controller that can be used to cancel/close the session. + * @returns The ID of the cipher that contains the credentials the user picked. + */ + pickCredential: ( + params: PickCredentialParams + ) => Promise<{ cipherId: string; userVerified: boolean }>; + + /** + * Ask the user to confirm the creation of a new credential. + * + * @param params The parameters to use when asking the user to confirm the creation of a new credential. + * @param abortController An abort controller that can be used to cancel/close the session. + * @returns The ID of the cipher where the new credential should be saved. + */ + confirmNewCredential: ( + params: NewCredentialParams + ) => Promise<{ cipherId: string; userVerified: boolean }>; + + /** + * Make sure that the vault is unlocked. + * This will open a window and ask the user to login or unlock the vault if necessary. + */ + ensureUnlockedVault: () => Promise; + + /** + * Inform the user that the operation was cancelled because their vault contains excluded credentials. + * + * @param existingCipherIds The IDs of the excluded credentials. + */ + informExcludedCredential: (existingCipherIds: string[]) => Promise; + + /** + * Inform the user that the operation was cancelled because their vault does not contain any useable credentials. + */ + informCredentialNotFound: (abortController?: AbortController) => Promise; + + /** + * Close the session, including any windows that may be open. + */ + close: () => void; +} diff --git a/libs/common/src/vault/api/fido2-credential.api.ts b/libs/common/src/vault/api/fido2-credential.api.ts new file mode 100644 index 0000000000..bfe32fc9b5 --- /dev/null +++ b/libs/common/src/vault/api/fido2-credential.api.ts @@ -0,0 +1,36 @@ +import { BaseResponse } from "../../models/response/base.response"; + +export class Fido2CredentialApi extends BaseResponse { + credentialId: string; + keyType: "public-key"; + keyAlgorithm: "ECDSA"; + keyCurve: "P-256"; + keyValue: string; + rpId: string; + userHandle: string; + counter: string; + rpName: string; + userDisplayName: string; + discoverable: string; + creationDate: string; + + constructor(data: any = null) { + super(data); + if (data == null) { + return; + } + + this.credentialId = this.getResponseProperty("CredentialId"); + this.keyType = this.getResponseProperty("KeyType"); + this.keyAlgorithm = this.getResponseProperty("KeyAlgorithm"); + this.keyCurve = this.getResponseProperty("KeyCurve"); + this.keyValue = this.getResponseProperty("keyValue"); + this.rpId = this.getResponseProperty("RpId"); + this.userHandle = this.getResponseProperty("UserHandle"); + this.counter = this.getResponseProperty("Counter"); + this.rpName = this.getResponseProperty("RpName"); + this.userDisplayName = this.getResponseProperty("UserDisplayName"); + this.discoverable = this.getResponseProperty("Discoverable"); + this.creationDate = this.getResponseProperty("CreationDate"); + } +} diff --git a/libs/common/src/vault/interfaces/launchable.ts b/libs/common/src/vault/interfaces/launchable.ts new file mode 100644 index 0000000000..512fc15419 --- /dev/null +++ b/libs/common/src/vault/interfaces/launchable.ts @@ -0,0 +1,4 @@ +export interface Launchable { + launchUri: string; + canLaunch: boolean; +} diff --git a/libs/common/src/vault/models/data/fido2-credential.data.ts b/libs/common/src/vault/models/data/fido2-credential.data.ts new file mode 100644 index 0000000000..8f5160d91b --- /dev/null +++ b/libs/common/src/vault/models/data/fido2-credential.data.ts @@ -0,0 +1,35 @@ +import { Fido2CredentialApi } from "../../api/fido2-credential.api"; + +export class Fido2CredentialData { + credentialId: string; + keyType: "public-key"; + keyAlgorithm: "ECDSA"; + keyCurve: "P-256"; + keyValue: string; + rpId: string; + userHandle: string; + counter: string; + rpName: string; + userDisplayName: string; + discoverable: string; + creationDate: string; + + constructor(data?: Fido2CredentialApi) { + if (data == null) { + return; + } + + this.credentialId = data.credentialId; + this.keyType = data.keyType; + this.keyAlgorithm = data.keyAlgorithm; + this.keyCurve = data.keyCurve; + this.keyValue = data.keyValue; + this.rpId = data.rpId; + this.userHandle = data.userHandle; + this.counter = data.counter; + this.rpName = data.rpName; + this.userDisplayName = data.userDisplayName; + this.discoverable = data.discoverable; + this.creationDate = data.creationDate; + } +} diff --git a/libs/common/src/vault/models/data/login.data.ts b/libs/common/src/vault/models/data/login.data.ts index 585b46ac05..0d8c71e77b 100644 --- a/libs/common/src/vault/models/data/login.data.ts +++ b/libs/common/src/vault/models/data/login.data.ts @@ -1,5 +1,6 @@ import { LoginApi } from "../../../models/api/login.api"; +import { Fido2CredentialData } from "./fido2-credential.data"; import { LoginUriData } from "./login-uri.data"; export class LoginData { @@ -9,6 +10,7 @@ export class LoginData { passwordRevisionDate: string; totp: string; autofillOnPageLoad: boolean; + fido2Credentials?: Fido2CredentialData[]; constructor(data?: LoginApi) { if (data == null) { @@ -24,5 +26,9 @@ export class LoginData { if (data.uris) { this.uris = data.uris.map((u) => new LoginUriData(u)); } + + if (data.fido2Credentials) { + this.fido2Credentials = data.fido2Credentials?.map((key) => new Fido2CredentialData(key)); + } } } diff --git a/libs/common/src/vault/models/domain/fido2-credential.spec.ts b/libs/common/src/vault/models/domain/fido2-credential.spec.ts new file mode 100644 index 0000000000..0b2b76a19c --- /dev/null +++ b/libs/common/src/vault/models/domain/fido2-credential.spec.ts @@ -0,0 +1,167 @@ +import { mockEnc } from "../../../../spec"; +import { EncryptionType } from "../../../enums"; +import { EncString } from "../../../platform/models/domain/enc-string"; +import { Fido2CredentialData } from "../data/fido2-credential.data"; + +import { Fido2Credential } from "./fido2-credential"; + +describe("Fido2Credential", () => { + let mockDate: Date; + + beforeEach(() => { + mockDate = new Date("2023-01-01T12:00:00.000Z"); + }); + + describe("constructor", () => { + it("returns all fields null when given empty data parameter", () => { + const data = new Fido2CredentialData(); + const credential = new Fido2Credential(data); + + expect(credential).toEqual({ + credentialId: null, + keyType: null, + keyAlgorithm: null, + keyCurve: null, + keyValue: null, + rpId: null, + userHandle: null, + rpName: null, + userDisplayName: null, + counter: null, + discoverable: null, + creationDate: null, + }); + }); + + it("returns all fields as EncStrings except creationDate when given full Fido2CredentialData", () => { + const data: Fido2CredentialData = { + credentialId: "credentialId", + keyType: "public-key", + keyAlgorithm: "ECDSA", + keyCurve: "P-256", + keyValue: "keyValue", + rpId: "rpId", + userHandle: "userHandle", + counter: "counter", + rpName: "rpName", + userDisplayName: "userDisplayName", + discoverable: "discoverable", + creationDate: mockDate.toISOString(), + }; + const credential = new Fido2Credential(data); + + expect(credential).toEqual({ + credentialId: { encryptedString: "credentialId", encryptionType: 0 }, + keyType: { encryptedString: "public-key", encryptionType: 0 }, + keyAlgorithm: { encryptedString: "ECDSA", encryptionType: 0 }, + keyCurve: { encryptedString: "P-256", encryptionType: 0 }, + keyValue: { encryptedString: "keyValue", encryptionType: 0 }, + rpId: { encryptedString: "rpId", encryptionType: 0 }, + userHandle: { encryptedString: "userHandle", encryptionType: 0 }, + counter: { encryptedString: "counter", encryptionType: 0 }, + rpName: { encryptedString: "rpName", encryptionType: 0 }, + userDisplayName: { encryptedString: "userDisplayName", encryptionType: 0 }, + discoverable: { encryptedString: "discoverable", encryptionType: 0 }, + creationDate: mockDate, + }); + }); + + it("should not populate fields when data parameter is not given", () => { + const credential = new Fido2Credential(); + + expect(credential).toEqual({ + credentialId: null, + }); + }); + }); + + describe("decrypt", () => { + it("decrypts and populates all fields when populated with EncStrings", async () => { + const credential = new Fido2Credential(); + credential.credentialId = mockEnc("credentialId"); + credential.keyType = mockEnc("keyType"); + credential.keyAlgorithm = mockEnc("keyAlgorithm"); + credential.keyCurve = mockEnc("keyCurve"); + credential.keyValue = mockEnc("keyValue"); + credential.rpId = mockEnc("rpId"); + credential.userHandle = mockEnc("userHandle"); + credential.counter = mockEnc("2"); + credential.rpName = mockEnc("rpName"); + credential.userDisplayName = mockEnc("userDisplayName"); + credential.discoverable = mockEnc("true"); + credential.creationDate = mockDate; + + const credentialView = await credential.decrypt(null); + + expect(credentialView).toEqual({ + credentialId: "credentialId", + keyType: "keyType", + keyAlgorithm: "keyAlgorithm", + keyCurve: "keyCurve", + keyValue: "keyValue", + rpId: "rpId", + userHandle: "userHandle", + rpName: "rpName", + userDisplayName: "userDisplayName", + counter: 2, + discoverable: true, + creationDate: mockDate, + }); + }); + }); + + describe("toFido2CredentialData", () => { + it("encodes to data object when converted from Fido2CredentialData and back", () => { + const data: Fido2CredentialData = { + credentialId: "credentialId", + keyType: "public-key", + keyAlgorithm: "ECDSA", + keyCurve: "P-256", + keyValue: "keyValue", + rpId: "rpId", + userHandle: "userHandle", + counter: "2", + rpName: "rpName", + userDisplayName: "userDisplayName", + discoverable: "true", + creationDate: mockDate.toISOString(), + }; + + const credential = new Fido2Credential(data); + const result = credential.toFido2CredentialData(); + + expect(result).toEqual(data); + }); + }); + + describe("fromJSON", () => { + it("recreates equivalent object when converted to JSON and back", () => { + const credential = new Fido2Credential(); + credential.credentialId = createEncryptedEncString("credentialId"); + credential.keyType = createEncryptedEncString("keyType"); + credential.keyAlgorithm = createEncryptedEncString("keyAlgorithm"); + credential.keyCurve = createEncryptedEncString("keyCurve"); + credential.keyValue = createEncryptedEncString("keyValue"); + credential.rpId = createEncryptedEncString("rpId"); + credential.userHandle = createEncryptedEncString("userHandle"); + credential.counter = createEncryptedEncString("2"); + credential.rpName = createEncryptedEncString("rpName"); + credential.userDisplayName = createEncryptedEncString("userDisplayName"); + credential.discoverable = createEncryptedEncString("discoverable"); + credential.creationDate = mockDate; + + const json = JSON.stringify(credential); + const result = Fido2Credential.fromJSON(JSON.parse(json)); + + expect(result).toEqual(credential); + }); + + it("returns null if input is null", () => { + expect(Fido2Credential.fromJSON(null)).toBeNull(); + }); + }); +}); + +function createEncryptedEncString(s: string): EncString { + return new EncString(`${EncryptionType.AesCbc256_HmacSha256_B64}.${s}`); +} diff --git a/libs/common/src/vault/models/domain/fido2-credential.ts b/libs/common/src/vault/models/domain/fido2-credential.ts new file mode 100644 index 0000000000..84f075458a --- /dev/null +++ b/libs/common/src/vault/models/domain/fido2-credential.ts @@ -0,0 +1,146 @@ +import { Jsonify } from "type-fest"; + +import Domain from "../../../platform/models/domain/domain-base"; +import { EncString } from "../../../platform/models/domain/enc-string"; +import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key"; +import { Fido2CredentialData } from "../data/fido2-credential.data"; +import { Fido2CredentialView } from "../view/fido2-credential.view"; + +export class Fido2Credential extends Domain { + credentialId: EncString | null = null; + keyType: EncString; + keyAlgorithm: EncString; + keyCurve: EncString; + keyValue: EncString; + rpId: EncString; + userHandle: EncString; + counter: EncString; + rpName: EncString; + userDisplayName: EncString; + discoverable: EncString; + creationDate: Date; + + constructor(obj?: Fido2CredentialData) { + super(); + if (obj == null) { + return; + } + + this.buildDomainModel( + this, + obj, + { + credentialId: null, + keyType: null, + keyAlgorithm: null, + keyCurve: null, + keyValue: null, + rpId: null, + userHandle: null, + counter: null, + rpName: null, + userDisplayName: null, + discoverable: null, + }, + [] + ); + this.creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null; + } + + async decrypt(orgId: string, encKey?: SymmetricCryptoKey): Promise { + const view = await this.decryptObj( + new Fido2CredentialView(), + { + credentialId: null, + keyType: null, + keyAlgorithm: null, + keyCurve: null, + keyValue: null, + rpId: null, + userHandle: null, + rpName: null, + userDisplayName: null, + discoverable: null, + }, + orgId, + encKey + ); + + const { counter } = await this.decryptObj( + { counter: "" }, + { + counter: null, + }, + orgId, + encKey + ); + // Counter will end up as NaN if this fails + view.counter = parseInt(counter); + + const { discoverable } = await this.decryptObj( + { discoverable: "" }, + { + discoverable: null, + }, + orgId, + encKey + ); + view.discoverable = discoverable === "true"; + view.creationDate = this.creationDate; + + return view; + } + + toFido2CredentialData(): Fido2CredentialData { + const i = new Fido2CredentialData(); + i.creationDate = this.creationDate.toISOString(); + this.buildDataModel(this, i, { + credentialId: null, + keyType: null, + keyAlgorithm: null, + keyCurve: null, + keyValue: null, + rpId: null, + userHandle: null, + counter: null, + rpName: null, + userDisplayName: null, + discoverable: null, + }); + return i; + } + + static fromJSON(obj: Jsonify): Fido2Credential { + if (obj == null) { + return null; + } + + const credentialId = EncString.fromJSON(obj.credentialId); + const keyType = EncString.fromJSON(obj.keyType); + const keyAlgorithm = EncString.fromJSON(obj.keyAlgorithm); + const keyCurve = EncString.fromJSON(obj.keyCurve); + const keyValue = EncString.fromJSON(obj.keyValue); + const rpId = EncString.fromJSON(obj.rpId); + const userHandle = EncString.fromJSON(obj.userHandle); + const counter = EncString.fromJSON(obj.counter); + const rpName = EncString.fromJSON(obj.rpName); + const userDisplayName = EncString.fromJSON(obj.userDisplayName); + const discoverable = EncString.fromJSON(obj.discoverable); + const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null; + + return Object.assign(new Fido2Credential(), obj, { + credentialId, + keyType, + keyAlgorithm, + keyCurve, + keyValue, + rpId, + userHandle, + counter, + rpName, + userDisplayName, + discoverable, + creationDate, + }); + } +} diff --git a/libs/common/src/vault/models/domain/login.spec.ts b/libs/common/src/vault/models/domain/login.spec.ts index 0bd395b340..d0b24d8c17 100644 --- a/libs/common/src/vault/models/domain/login.spec.ts +++ b/libs/common/src/vault/models/domain/login.spec.ts @@ -3,10 +3,15 @@ import { mock } from "jest-mock-extended"; import { mockEnc, mockFromJson } from "../../../../spec"; import { UriMatchType } from "../../../enums"; import { EncryptedString, EncString } from "../../../platform/models/domain/enc-string"; +import { Fido2CredentialApi } from "../../api/fido2-credential.api"; import { LoginData } from "../../models/data/login.data"; import { Login } from "../../models/domain/login"; import { LoginUri } from "../../models/domain/login-uri"; import { LoginUriView } from "../../models/view/login-uri.view"; +import { Fido2CredentialData } from "../data/fido2-credential.data"; +import { Fido2CredentialView } from "../view/fido2-credential.view"; + +import { Fido2Credential } from "./fido2-credential"; describe("Login DTO", () => { it("Convert from empty LoginData", () => { @@ -23,6 +28,7 @@ describe("Login DTO", () => { }); it("Convert from full LoginData", () => { + const fido2CredentialData = initializeFido2Credential(new Fido2CredentialData()); const data: LoginData = { uris: [{ uri: "uri", match: UriMatchType.Domain }], username: "username", @@ -30,6 +36,7 @@ describe("Login DTO", () => { passwordRevisionDate: "2022-01-31T12:00:00.000Z", totp: "123", autofillOnPageLoad: false, + fido2Credentials: [fido2CredentialData], }; const login = new Login(data); @@ -40,6 +47,7 @@ describe("Login DTO", () => { password: { encryptedString: "password", encryptionType: 0 }, totp: { encryptedString: "123", encryptionType: 0 }, uris: [{ match: 0, uri: { encryptedString: "uri", encryptionType: 0 } }], + fido2Credentials: [encryptFido2Credential(fido2CredentialData)], }); }); @@ -56,12 +64,16 @@ describe("Login DTO", () => { loginUri.decrypt.mockResolvedValue(loginUriView); const login = new Login(); + const decryptedFido2Credential = Symbol(); login.uris = [loginUri]; login.username = mockEnc("encrypted username"); login.password = mockEnc("encrypted password"); login.passwordRevisionDate = new Date("2022-01-31T12:00:00.000Z"); login.totp = mockEnc("encrypted totp"); login.autofillOnPageLoad = true; + login.fido2Credentials = [ + { decrypt: jest.fn().mockReturnValue(decryptedFido2Credential) } as any, + ]; const loginView = await login.decrypt(null); expect(loginView).toEqual({ @@ -80,6 +92,7 @@ describe("Login DTO", () => { }, ], autofillOnPageLoad: true, + fido2Credentials: [decryptedFido2Credential], }); }); @@ -91,6 +104,7 @@ describe("Login DTO", () => { passwordRevisionDate: "2022-01-31T12:00:00.000Z", totp: "123", autofillOnPageLoad: false, + fido2Credentials: [initializeFido2Credential(new Fido2CredentialData())], }; const login = new Login(data); @@ -104,6 +118,7 @@ describe("Login DTO", () => { jest.spyOn(EncString, "fromJSON").mockImplementation(mockFromJson); jest.spyOn(LoginUri, "fromJSON").mockImplementation(mockFromJson); const passwordRevisionDate = new Date("2022-01-31T12:00:00.000Z"); + const fido2CreationDate = new Date("2023-01-01T12:00:00.000Z"); const actual = Login.fromJSON({ uris: ["loginUri1", "loginUri2"] as any, @@ -111,6 +126,22 @@ describe("Login DTO", () => { password: "myPassword" as EncryptedString, passwordRevisionDate: passwordRevisionDate.toISOString(), totp: "myTotp" as EncryptedString, + fido2Credentials: [ + { + credentialId: "keyId" as EncryptedString, + keyType: "keyType" as EncryptedString, + keyAlgorithm: "keyAlgorithm" as EncryptedString, + keyCurve: "keyCurve" as EncryptedString, + keyValue: "keyValue" as EncryptedString, + rpId: "rpId" as EncryptedString, + userHandle: "userHandle" as EncryptedString, + counter: "counter" as EncryptedString, + rpName: "rpName" as EncryptedString, + userDisplayName: "userDisplayName" as EncryptedString, + discoverable: "discoverable" as EncryptedString, + creationDate: fido2CreationDate.toISOString(), + }, + ], }); expect(actual).toEqual({ @@ -119,6 +150,22 @@ describe("Login DTO", () => { password: "myPassword_fromJSON", passwordRevisionDate: passwordRevisionDate, totp: "myTotp_fromJSON", + fido2Credentials: [ + { + credentialId: "keyId_fromJSON", + keyType: "keyType_fromJSON", + keyAlgorithm: "keyAlgorithm_fromJSON", + keyCurve: "keyCurve_fromJSON", + keyValue: "keyValue_fromJSON", + rpId: "rpId_fromJSON", + userHandle: "userHandle_fromJSON", + counter: "counter_fromJSON", + rpName: "rpName_fromJSON", + userDisplayName: "userDisplayName_fromJSON", + discoverable: "discoverable_fromJSON", + creationDate: fido2CreationDate, + }, + ], }); expect(actual).toBeInstanceOf(Login); }); @@ -128,3 +175,42 @@ describe("Login DTO", () => { }); }); }); + +type Fido2CredentialLike = Fido2CredentialData | Fido2CredentialView | Fido2CredentialApi; +function initializeFido2Credential(key: T): T { + key.credentialId = "credentialId"; + key.keyType = "public-key"; + key.keyAlgorithm = "ECDSA"; + key.keyCurve = "P-256"; + key.keyValue = "keyValue"; + key.rpId = "rpId"; + key.userHandle = "userHandle"; + key.counter = "counter"; + key.rpName = "rpName"; + key.userDisplayName = "userDisplayName"; + key.discoverable = "discoverable"; + key.creationDate = "2023-01-01T12:00:00.000Z"; + return key; +} + +function encryptFido2Credential(key: Fido2CredentialLike): Fido2Credential { + const encrypted = new Fido2Credential(); + encrypted.credentialId = { encryptedString: key.credentialId, encryptionType: 0 } as EncString; + encrypted.keyType = { encryptedString: key.keyType, encryptionType: 0 } as EncString; + encrypted.keyAlgorithm = { encryptedString: key.keyAlgorithm, encryptionType: 0 } as EncString; + encrypted.keyCurve = { encryptedString: key.keyCurve, encryptionType: 0 } as EncString; + encrypted.keyValue = { encryptedString: key.keyValue, encryptionType: 0 } as EncString; + encrypted.rpId = { encryptedString: key.rpId, encryptionType: 0 } as EncString; + encrypted.userHandle = { encryptedString: key.userHandle, encryptionType: 0 } as EncString; + encrypted.counter = { encryptedString: key.counter, encryptionType: 0 } as EncString; + encrypted.rpName = { encryptedString: key.rpName, encryptionType: 0 } as EncString; + encrypted.userDisplayName = { + encryptedString: key.userDisplayName, + encryptionType: 0, + } as EncString; + encrypted.discoverable = { encryptedString: key.discoverable, encryptionType: 0 } as EncString; + + // not encrypted + encrypted.creationDate = new Date(key.creationDate); + return encrypted; +} diff --git a/libs/common/src/vault/models/domain/login.ts b/libs/common/src/vault/models/domain/login.ts index bc046e784d..64517b0755 100644 --- a/libs/common/src/vault/models/domain/login.ts +++ b/libs/common/src/vault/models/domain/login.ts @@ -6,6 +6,7 @@ import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-cr import { LoginData } from "../data/login.data"; import { LoginView } from "../view/login.view"; +import { Fido2Credential } from "./fido2-credential"; import { LoginUri } from "./login-uri"; export class Login extends Domain { @@ -15,6 +16,7 @@ export class Login extends Domain { passwordRevisionDate?: Date; totp: EncString; autofillOnPageLoad: boolean; + fido2Credentials: Fido2Credential[]; constructor(obj?: LoginData) { super(); @@ -42,6 +44,10 @@ export class Login extends Domain { this.uris.push(new LoginUri(u)); }); } + + if (obj.fido2Credentials) { + this.fido2Credentials = obj.fido2Credentials.map((key) => new Fido2Credential(key)); + } } async decrypt(orgId: string, encKey?: SymmetricCryptoKey): Promise { @@ -64,6 +70,12 @@ export class Login extends Domain { } } + if (this.fido2Credentials != null) { + view.fido2Credentials = await Promise.all( + this.fido2Credentials.map((key) => key.decrypt(orgId, encKey)) + ); + } + return view; } @@ -85,6 +97,10 @@ export class Login extends Domain { }); } + if (this.fido2Credentials != null && this.fido2Credentials.length > 0) { + l.fido2Credentials = this.fido2Credentials.map((key) => key.toFido2CredentialData()); + } + return l; } @@ -99,13 +115,16 @@ export class Login extends Domain { const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate); const uris = obj.uris?.map((uri: any) => LoginUri.fromJSON(uri)); + const fido2Credentials = + obj.fido2Credentials?.map((key) => Fido2Credential.fromJSON(key)) ?? []; return Object.assign(new Login(), obj, { username, password, totp, - passwordRevisionDate: passwordRevisionDate, - uris: uris, + passwordRevisionDate, + uris, + fido2Credentials, }); } } diff --git a/libs/common/src/vault/models/request/cipher.request.ts b/libs/common/src/vault/models/request/cipher.request.ts index 0f34200e79..949d36ab05 100644 --- a/libs/common/src/vault/models/request/cipher.request.ts +++ b/libs/common/src/vault/models/request/cipher.request.ts @@ -4,6 +4,7 @@ import { IdentityApi } from "../../../models/api/identity.api"; import { LoginUriApi } from "../../../models/api/login-uri.api"; import { LoginApi } from "../../../models/api/login.api"; import { SecureNoteApi } from "../../../models/api/secure-note.api"; +import { Fido2CredentialApi } from "../../api/fido2-credential.api"; import { CipherRepromptType } from "../../enums/cipher-reprompt-type"; import { CipherType } from "../../enums/cipher-type"; import { Cipher } from "../domain/cipher"; @@ -63,6 +64,31 @@ export class CipherRequest { return uri; }); } + + if (cipher.login.fido2Credentials != null) { + this.login.fido2Credentials = cipher.login.fido2Credentials.map((key) => { + const keyApi = new Fido2CredentialApi(); + keyApi.credentialId = + key.credentialId != null ? key.credentialId.encryptedString : null; + keyApi.keyType = + key.keyType != null ? (key.keyType.encryptedString as "public-key") : null; + keyApi.keyAlgorithm = + key.keyAlgorithm != null ? (key.keyAlgorithm.encryptedString as "ECDSA") : null; + keyApi.keyCurve = + key.keyCurve != null ? (key.keyCurve.encryptedString as "P-256") : null; + keyApi.keyValue = key.keyValue != null ? key.keyValue.encryptedString : null; + keyApi.rpId = key.rpId != null ? key.rpId.encryptedString : null; + keyApi.rpName = key.rpName != null ? key.rpName.encryptedString : null; + keyApi.counter = key.counter != null ? key.counter.encryptedString : null; + keyApi.userHandle = key.userHandle != null ? key.userHandle.encryptedString : null; + keyApi.userDisplayName = + key.userDisplayName != null ? key.userDisplayName.encryptedString : null; + keyApi.discoverable = + key.discoverable != null ? key.discoverable.encryptedString : null; + keyApi.creationDate = key.creationDate != null ? key.creationDate.toISOString() : null; + return keyApi; + }); + } break; case CipherType.SecureNote: this.secureNote = new SecureNoteApi(); diff --git a/libs/common/src/vault/models/view/fido2-credential.view.ts b/libs/common/src/vault/models/view/fido2-credential.view.ts new file mode 100644 index 0000000000..b6894e84ff --- /dev/null +++ b/libs/common/src/vault/models/view/fido2-credential.view.ts @@ -0,0 +1,29 @@ +import { Jsonify } from "type-fest"; + +import { ItemView } from "./item.view"; + +export class Fido2CredentialView extends ItemView { + credentialId: string; + keyType: "public-key"; + keyAlgorithm: "ECDSA"; + keyCurve: "P-256"; + keyValue: string; + rpId: string; + userHandle: string; + counter: number; + rpName: string; + userDisplayName: string; + discoverable: boolean; + creationDate: Date = null; + + get subTitle(): string { + return this.userDisplayName; + } + + static fromJSON(obj: Partial>): Fido2CredentialView { + const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null; + return Object.assign(new Fido2CredentialView(), obj, { + creationDate, + }); + } +} diff --git a/libs/common/src/vault/models/view/login.view.ts b/libs/common/src/vault/models/view/login.view.ts index 954a14fe8e..fa05189ba0 100644 --- a/libs/common/src/vault/models/view/login.view.ts +++ b/libs/common/src/vault/models/view/login.view.ts @@ -5,6 +5,7 @@ import { linkedFieldOption } from "../../../misc/linkedFieldOption.decorator"; import { Utils } from "../../../platform/misc/utils"; import { Login } from "../domain/login"; +import { Fido2CredentialView } from "./fido2-credential.view"; import { ItemView } from "./item.view"; import { LoginUriView } from "./login-uri.view"; @@ -18,6 +19,7 @@ export class LoginView extends ItemView { totp: string = null; uris: LoginUriView[] = null; autofillOnPageLoad: boolean = null; + fido2Credentials: Fido2CredentialView[] = null; constructor(l?: Login) { super(); @@ -63,6 +65,10 @@ export class LoginView extends ItemView { return this.uris != null && this.uris.length > 0; } + get hasFido2Credentials(): boolean { + return this.fido2Credentials != null && this.fido2Credentials.length > 0; + } + matchesUri( targetUri: string, equivalentDomains: Set, @@ -79,10 +85,12 @@ export class LoginView extends ItemView { const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate); const uris = obj.uris?.map((uri: any) => LoginUriView.fromJSON(uri)); + const fido2Credentials = obj.fido2Credentials?.map((key) => Fido2CredentialView.fromJSON(key)); return Object.assign(new LoginView(), obj, { - passwordRevisionDate: passwordRevisionDate, - uris: uris, + passwordRevisionDate, + uris, + fido2Credentials, }); } } diff --git a/libs/common/src/vault/services/cipher.service.ts b/libs/common/src/vault/services/cipher.service.ts index b9bbc3e291..b5090a1488 100644 --- a/libs/common/src/vault/services/cipher.service.ts +++ b/libs/common/src/vault/services/cipher.service.ts @@ -30,6 +30,7 @@ import { CipherData } from "../models/data/cipher.data"; import { Attachment } from "../models/domain/attachment"; import { Card } from "../models/domain/card"; import { Cipher } from "../models/domain/cipher"; +import { Fido2Credential } from "../models/domain/fido2-credential"; import { Field } from "../models/domain/field"; import { Identity } from "../models/domain/identity"; import { Login } from "../models/domain/login"; @@ -1136,6 +1137,38 @@ export class CipherService implements CipherServiceAbstraction { cipher.login.uris.push(loginUri); } } + + if (model.login.fido2Credentials != null) { + cipher.login.fido2Credentials = await Promise.all( + model.login.fido2Credentials.map(async (viewKey) => { + const domainKey = new Fido2Credential(); + await this.encryptObjProperty( + viewKey, + domainKey, + { + credentialId: null, + keyType: null, + keyAlgorithm: null, + keyCurve: null, + keyValue: null, + rpId: null, + rpName: null, + userHandle: null, + userDisplayName: null, + origin: null, + }, + key + ); + domainKey.counter = await this.cryptoService.encrypt(String(viewKey.counter), key); + domainKey.discoverable = await this.cryptoService.encrypt( + String(viewKey.discoverable), + key + ); + domainKey.creationDate = viewKey.creationDate; + return domainKey; + }) + ); + } return; case CipherType.SecureNote: cipher.secureNote = new SecureNote(); diff --git a/libs/common/src/vault/services/fido2/cbor.ts b/libs/common/src/vault/services/fido2/cbor.ts new file mode 100644 index 0000000000..b74822fd4b --- /dev/null +++ b/libs/common/src/vault/services/fido2/cbor.ts @@ -0,0 +1,494 @@ +/** +The MIT License (MIT) + +Copyright (c) 2014-2016 Patrick Gansterer +Copyright (c) 2020-present Aaron Huggins + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +Exported from GitHub release version 0.4.0 +*/ + +/* eslint-disable */ +/** @hidden */ +const POW_2_24 = 5.960464477539063e-8; +/** @hidden */ +const POW_2_32 = 4294967296; +/** @hidden */ +const POW_2_53 = 9007199254740992; +/** @hidden */ +const DECODE_CHUNK_SIZE = 8192; + +/** @hidden */ +function objectIs(x: any, y: any) { + if (typeof Object.is === "function") return Object.is(x, y); + + // SameValue algorithm + // Steps 1-5, 7-10 + if (x === y) { + // Steps 6.b-6.e: +0 != -0 + return x !== 0 || 1 / x === 1 / y; + } + + // Step 6.a: NaN == NaN + return x !== x && y !== y; +} + +/** A function that extracts tagged values. */ +type TaggedValueFunction = (value: any, tag: number) => TaggedValue; +/** A function that extracts simple values. */ +type SimpleValueFunction = (value: any) => SimpleValue; + +/** Convenience class for structuring a tagged value. */ +export class TaggedValue { + constructor(value: any, tag: number) { + this.value = value; + this.tag = tag; + } + + value: any; + tag: number; +} + +/** Convenience class for structuring a simple value. */ +export class SimpleValue { + constructor(value: any) { + this.value = value; + } + + value: any; +} + +/** + * Converts a Concise Binary Object Representation (CBOR) buffer into an object. + * @param {ArrayBuffer|SharedArrayBuffer} data - A valid CBOR buffer. + * @param {Function} [tagger] - A function that extracts tagged values. This function is called for each member of the object. + * @param {Function} [simpleValue] - A function that extracts simple values. This function is called for each member of the object. + * @returns {any} The CBOR buffer converted to a JavaScript value. + */ +export function decode( + data: ArrayBuffer | SharedArrayBuffer, + tagger?: TaggedValueFunction, + simpleValue?: SimpleValueFunction +): T { + let dataView = new DataView(data); + let ta = new Uint8Array(data); + let offset = 0; + let tagValueFunction: TaggedValueFunction = function (value: number, tag: number): any { + return new TaggedValue(value, tag); + }; + let simpleValFunction: SimpleValueFunction = function (value: number): SimpleValue { + return undefined as unknown as SimpleValue; + }; + + if (typeof tagger === "function") tagValueFunction = tagger; + if (typeof simpleValue === "function") simpleValFunction = simpleValue; + + function commitRead(length: number, value: T): T { + offset += length; + return value; + } + function readArrayBuffer(length: number) { + return commitRead(length, new Uint8Array(data, offset, length)); + } + function readFloat16() { + let tempArrayBuffer = new ArrayBuffer(4); + let tempDataView = new DataView(tempArrayBuffer); + let value = readUint16(); + + let sign = value & 0x8000; + let exponent = value & 0x7c00; + let fraction = value & 0x03ff; + + if (exponent === 0x7c00) exponent = 0xff << 10; + else if (exponent !== 0) exponent += (127 - 15) << 10; + else if (fraction !== 0) return (sign ? -1 : 1) * fraction * POW_2_24; + + tempDataView.setUint32(0, (sign << 16) | (exponent << 13) | (fraction << 13)); + return tempDataView.getFloat32(0); + } + function readFloat32(): number { + return commitRead(4, dataView.getFloat32(offset)); + } + function readFloat64(): number { + return commitRead(8, dataView.getFloat64(offset)); + } + function readUint8(): number { + return commitRead(1, ta[offset]); + } + function readUint16(): number { + return commitRead(2, dataView.getUint16(offset)); + } + function readUint32(): number { + return commitRead(4, dataView.getUint32(offset)); + } + function readUint64(): number { + return readUint32() * POW_2_32 + readUint32(); + } + function readBreak(): boolean { + if (ta[offset] !== 0xff) return false; + offset += 1; + return true; + } + function readLength(additionalInformation: number): number { + if (additionalInformation < 24) return additionalInformation; + if (additionalInformation === 24) return readUint8(); + if (additionalInformation === 25) return readUint16(); + if (additionalInformation === 26) return readUint32(); + if (additionalInformation === 27) return readUint64(); + if (additionalInformation === 31) return -1; + throw new Error("Invalid length encoding"); + } + function readIndefiniteStringLength(majorType: number): number { + let initialByte = readUint8(); + if (initialByte === 0xff) return -1; + let length = readLength(initialByte & 0x1f); + if (length < 0 || initialByte >> 5 !== majorType) + throw new Error("Invalid indefinite length element"); + return length; + } + + function appendUtf16Data(utf16data: number[], length: number) { + for (let i = 0; i < length; ++i) { + let value = readUint8(); + if (value & 0x80) { + if (value < 0xe0) { + value = ((value & 0x1f) << 6) | (readUint8() & 0x3f); + length -= 1; + } else if (value < 0xf0) { + value = ((value & 0x0f) << 12) | ((readUint8() & 0x3f) << 6) | (readUint8() & 0x3f); + length -= 2; + } else { + value = + ((value & 0x0f) << 18) | + ((readUint8() & 0x3f) << 12) | + ((readUint8() & 0x3f) << 6) | + (readUint8() & 0x3f); + length -= 3; + } + } + + if (value < 0x10000) { + utf16data.push(value); + } else { + value -= 0x10000; + utf16data.push(0xd800 | (value >> 10)); + utf16data.push(0xdc00 | (value & 0x3ff)); + } + } + } + + function decodeItem(): any { + let initialByte = readUint8(); + let majorType = initialByte >> 5; + let additionalInformation = initialByte & 0x1f; + let i; + let length; + + if (majorType === 7) { + switch (additionalInformation) { + case 25: + return readFloat16(); + case 26: + return readFloat32(); + case 27: + return readFloat64(); + } + } + + length = readLength(additionalInformation); + if (length < 0 && (majorType < 2 || 6 < majorType)) throw new Error("Invalid length"); + + switch (majorType) { + case 0: + return length; + case 1: + return -1 - length; + case 2: + if (length < 0) { + let elements = []; + let fullArrayLength = 0; + while ((length = readIndefiniteStringLength(majorType)) >= 0) { + fullArrayLength += length; + elements.push(readArrayBuffer(length)); + } + let fullArray = new Uint8Array(fullArrayLength); + let fullArrayOffset = 0; + for (i = 0; i < elements.length; ++i) { + fullArray.set(elements[i], fullArrayOffset); + fullArrayOffset += elements[i].length; + } + return fullArray; + } + return readArrayBuffer(length); + case 3: + let utf16data: number[] = []; + if (length < 0) { + while ((length = readIndefiniteStringLength(majorType)) >= 0) + appendUtf16Data(utf16data, length); + } else { + appendUtf16Data(utf16data, length); + } + let string = ""; + for (i = 0; i < utf16data.length; i += DECODE_CHUNK_SIZE) { + string += String.fromCharCode.apply(null, utf16data.slice(i, i + DECODE_CHUNK_SIZE)); + } + return string; + case 4: + let retArray; + if (length < 0) { + retArray = []; + while (!readBreak()) retArray.push(decodeItem()); + } else { + retArray = new Array(length); + for (i = 0; i < length; ++i) retArray[i] = decodeItem(); + } + return retArray; + case 5: + let retObject: any = {}; + for (i = 0; i < length || (length < 0 && !readBreak()); ++i) { + let key = decodeItem(); + retObject[key] = decodeItem(); + } + return retObject; + case 6: + return tagValueFunction(decodeItem(), length); + case 7: + switch (length) { + case 20: + return false; + case 21: + return true; + case 22: + return null; + case 23: + return undefined; + default: + return simpleValFunction(length); + } + } + } + + let ret = decodeItem(); + if (offset !== data.byteLength) throw new Error("Remaining bytes"); + return ret; +} + +/** + * Converts a JavaScript value to a Concise Binary Object Representation (CBOR) buffer. + * @param {any} value - A JavaScript value, usually an object or array, to be converted. + * @returns {ArrayBuffer} The JavaScript value converted to CBOR format. + */ +export function encode(value: T): ArrayBuffer { + let data = new ArrayBuffer(256); + let dataView = new DataView(data); + let byteView = new Uint8Array(data); + let lastLength: number; + let offset = 0; + + function prepareWrite(length: number): DataView { + let newByteLength = data.byteLength; + let requiredLength = offset + length; + while (newByteLength < requiredLength) newByteLength <<= 1; + if (newByteLength !== data.byteLength) { + let oldDataView = dataView; + data = new ArrayBuffer(newByteLength); + dataView = new DataView(data); + byteView = new Uint8Array(data); + let uint32count = (offset + 3) >> 2; + for (let i = 0; i < uint32count; ++i) + dataView.setUint32(i << 2, oldDataView.getUint32(i << 2)); + } + + lastLength = length; + return dataView; + } + function commitWrite(...args: any[]) { + offset += lastLength; + } + function writeFloat64(val: number) { + commitWrite(prepareWrite(8).setFloat64(offset, val)); + } + function writeUint8(val: number) { + commitWrite(prepareWrite(1).setUint8(offset, val)); + } + function writeUint8Array(val: number[] | Uint8Array) { + prepareWrite(val.length); + byteView.set(val, offset); + commitWrite(); + } + function writeUint16(val: number) { + commitWrite(prepareWrite(2).setUint16(offset, val)); + } + function writeUint32(val: number) { + commitWrite(prepareWrite(4).setUint32(offset, val)); + } + function writeUint64(val: number) { + let low = val % POW_2_32; + let high = (val - low) / POW_2_32; + let view = prepareWrite(8); + view.setUint32(offset, high); + view.setUint32(offset + 4, low); + commitWrite(); + } + function writeVarUint(val: number, mod: number = 0) { + if (val <= 0xff) { + if (val < 24) { + writeUint8(val | mod); + } else { + writeUint8(0x18 | mod); + writeUint8(val); + } + } else if (val <= 0xffff) { + writeUint8(0x19 | mod); + writeUint16(val); + } else if (val <= 0xffffffff) { + writeUint8(0x1a | mod); + writeUint32(val); + } else { + writeUint8(0x1b | mod); + writeUint64(val); + } + } + function writeTypeAndLength(type: number, length: number) { + if (length < 24) { + writeUint8((type << 5) | length); + } else if (length < 0x100) { + writeUint8((type << 5) | 24); + writeUint8(length); + } else if (length < 0x10000) { + writeUint8((type << 5) | 25); + writeUint16(length); + } else if (length < 0x100000000) { + writeUint8((type << 5) | 26); + writeUint32(length); + } else { + writeUint8((type << 5) | 27); + writeUint64(length); + } + } + + function encodeItem(val: any) { + let i; + + if (val === false) return writeUint8(0xf4); + if (val === true) return writeUint8(0xf5); + if (val === null) return writeUint8(0xf6); + if (val === undefined) return writeUint8(0xf7); + if (objectIs(val, -0)) return writeUint8Array([0xf9, 0x80, 0x00]); + + switch (typeof val) { + case "number": + if (Math.floor(val) === val) { + if (0 <= val && val <= POW_2_53) return writeTypeAndLength(0, val); + if (-POW_2_53 <= val && val < 0) return writeTypeAndLength(1, -(val + 1)); + } + writeUint8(0xfb); + return writeFloat64(val); + + case "string": + let utf8data = []; + for (i = 0; i < val.length; ++i) { + let charCode = val.charCodeAt(i); + if (charCode < 0x80) { + utf8data.push(charCode); + } else if (charCode < 0x800) { + utf8data.push(0xc0 | (charCode >> 6)); + utf8data.push(0x80 | (charCode & 0x3f)); + } else if (charCode < 0xd800 || charCode >= 0xe000) { + utf8data.push(0xe0 | (charCode >> 12)); + utf8data.push(0x80 | ((charCode >> 6) & 0x3f)); + utf8data.push(0x80 | (charCode & 0x3f)); + } else { + charCode = (charCode & 0x3ff) << 10; + charCode |= val.charCodeAt(++i) & 0x3ff; + charCode += 0x10000; + + utf8data.push(0xf0 | (charCode >> 18)); + utf8data.push(0x80 | ((charCode >> 12) & 0x3f)); + utf8data.push(0x80 | ((charCode >> 6) & 0x3f)); + utf8data.push(0x80 | (charCode & 0x3f)); + } + } + + writeTypeAndLength(3, utf8data.length); + return writeUint8Array(utf8data); + + default: + let length; + let converted; + if (Array.isArray(val)) { + length = val.length; + writeTypeAndLength(4, length); + for (i = 0; i < length; i += 1) encodeItem(val[i]); + } else if (val instanceof Uint8Array) { + writeTypeAndLength(2, val.length); + writeUint8Array(val); + } else if (ArrayBuffer.isView(val)) { + converted = new Uint8Array(val.buffer); + writeTypeAndLength(2, converted.length); + writeUint8Array(converted); + } else if ( + val instanceof ArrayBuffer || + (typeof SharedArrayBuffer === "function" && val instanceof SharedArrayBuffer) + ) { + converted = new Uint8Array(val); + writeTypeAndLength(2, converted.length); + writeUint8Array(converted); + } else if (val instanceof TaggedValue) { + writeVarUint(val.tag, 0b11000000); + encodeItem(val.value); + } else { + let keys = Object.keys(val); + length = keys.length; + writeTypeAndLength(5, length); + for (i = 0; i < length; i += 1) { + let key = keys[i]; + encodeItem(key); + encodeItem(val[key]); + } + } + } + } + + encodeItem(value); + + if ("slice" in data) return data.slice(0, offset); + + let ret = new ArrayBuffer(offset); + let retView = new DataView(ret); + for (let i = 0; i < offset; ++i) retView.setUint8(i, dataView.getUint8(i)); + return ret; +} + +/** + * An intrinsic object that provides functions to convert JavaScript values + * to and from the Concise Binary Object Representation (CBOR) format. + */ +export const CBOR: { + decode: ( + data: ArrayBuffer | SharedArrayBuffer, + tagger?: TaggedValueFunction, + simpleValue?: SimpleValueFunction + ) => T; + encode: (value: T) => ArrayBuffer; +} = { + decode, + encode, +}; diff --git a/libs/common/src/vault/services/fido2/domain-utils.spec.ts b/libs/common/src/vault/services/fido2/domain-utils.spec.ts new file mode 100644 index 0000000000..7c9c27869a --- /dev/null +++ b/libs/common/src/vault/services/fido2/domain-utils.spec.ts @@ -0,0 +1,53 @@ +import { isValidRpId } from "./domain-utils"; + +// Spec: If options.rp.id is not a registrable domain suffix of and is not equal to effectiveDomain, return a DOMException whose name is "SecurityError", and terminate this algorithm. +describe("validateRpId", () => { + it("should not be valid when rpId is more specific than origin", () => { + const rpId = "sub.login.bitwarden.com"; + const origin = "https://login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(false); + }); + + it("should not be valid when effective domains of rpId and origin do not match", () => { + const rpId = "passwordless.dev"; + const origin = "https://login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(false); + }); + + it("should not be valid when subdomains are the same but effective domains of rpId and origin do not match", () => { + const rpId = "login.passwordless.dev"; + const origin = "https://login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(false); + }); + + it("should be valid when domains of rpId and origin are the same", () => { + const rpId = "bitwarden.com"; + const origin = "https://bitwarden.com"; + + expect(isValidRpId(rpId, origin)).toBe(true); + }); + + it("should be valid when origin is a subdomain of rpId", () => { + const rpId = "bitwarden.com"; + const origin = "https://login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(true); + }); + + it("should be valid when domains of rpId and origin are the same and they are both subdomains", () => { + const rpId = "login.bitwarden.com"; + const origin = "https://login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(true); + }); + + it("should be valid when origin is a subdomain of rpId and they are both subdomains", () => { + const rpId = "login.bitwarden.com"; + const origin = "https://sub.login.bitwarden.com:1337"; + + expect(isValidRpId(rpId, origin)).toBe(true); + }); +}); diff --git a/libs/common/src/vault/services/fido2/domain-utils.ts b/libs/common/src/vault/services/fido2/domain-utils.ts new file mode 100644 index 0000000000..20b6e41700 --- /dev/null +++ b/libs/common/src/vault/services/fido2/domain-utils.ts @@ -0,0 +1,11 @@ +import { parse } from "tldts"; + +export function isValidRpId(rpId: string, origin: string) { + const parsedOrigin = parse(origin, { allowPrivateDomains: true }); + const parsedRpId = parse(rpId, { allowPrivateDomains: true }); + + return ( + parsedOrigin.domain === parsedRpId.domain && + parsedOrigin.subdomain.endsWith(parsedRpId.subdomain) + ); +} diff --git a/libs/common/src/vault/services/fido2/ecdsa-utils.ts b/libs/common/src/vault/services/fido2/ecdsa-utils.ts new file mode 100644 index 0000000000..1a4bf64de6 --- /dev/null +++ b/libs/common/src/vault/services/fido2/ecdsa-utils.ts @@ -0,0 +1,124 @@ +/* + Copyright 2015 D2L Corporation + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. */ + +// Changes: +// - Cherry-pick the methods that we have a need for. +// - Add typings. +// - Original code is made for running in node, this version is adapted to work in the browser. + +// https://github.com/Brightspace/node-ecdsa-sig-formatter/blob/master/src/param-bytes-for-alg.js + +function getParamSize(keySize: number) { + const result = ((keySize / 8) | 0) + (keySize % 8 === 0 ? 0 : 1); + return result; +} + +const paramBytesForAlg = { + ES256: getParamSize(256), + ES384: getParamSize(384), + ES512: getParamSize(521), +}; + +type Alg = keyof typeof paramBytesForAlg; + +function getParamBytesForAlg(alg: Alg) { + const paramBytes = paramBytesForAlg[alg]; + if (paramBytes) { + return paramBytes; + } + + throw new Error('Unknown algorithm "' + alg + '"'); +} + +// https://github.com/Brightspace/node-ecdsa-sig-formatter/blob/master/src/ecdsa-sig-formatter.js + +const MAX_OCTET = 0x80, + CLASS_UNIVERSAL = 0, + PRIMITIVE_BIT = 0x20, + TAG_SEQ = 0x10, + TAG_INT = 0x02, + ENCODED_TAG_SEQ = TAG_SEQ | PRIMITIVE_BIT | (CLASS_UNIVERSAL << 6), + ENCODED_TAG_INT = TAG_INT | (CLASS_UNIVERSAL << 6); + +function countPadding(buf: Uint8Array, start: number, stop: number) { + let padding = 0; + while (start + padding < stop && buf[start + padding] === 0) { + ++padding; + } + + const needsSign = buf[start + padding] >= MAX_OCTET; + if (needsSign) { + --padding; + } + + return padding; +} + +export function joseToDer(signature: Uint8Array, alg: Alg) { + const paramBytes = getParamBytesForAlg(alg); + + const signatureBytes = signature.length; + if (signatureBytes !== paramBytes * 2) { + throw new TypeError( + '"' + + alg + + '" signatures must be "' + + paramBytes * 2 + + '" bytes, saw "' + + signatureBytes + + '"' + ); + } + + const rPadding = countPadding(signature, 0, paramBytes); + const sPadding = countPadding(signature, paramBytes, signature.length); + const rLength = paramBytes - rPadding; + const sLength = paramBytes - sPadding; + + const rsBytes = 1 + 1 + rLength + 1 + 1 + sLength; + + const shortLength = rsBytes < MAX_OCTET; + + const dst = new Uint8Array((shortLength ? 2 : 3) + rsBytes); + + let offset = 0; + dst[offset++] = ENCODED_TAG_SEQ; + if (shortLength) { + dst[offset++] = rsBytes; + } else { + dst[offset++] = MAX_OCTET | 1; + dst[offset++] = rsBytes & 0xff; + } + dst[offset++] = ENCODED_TAG_INT; + dst[offset++] = rLength; + if (rPadding < 0) { + dst[offset++] = 0; + dst.set(signature.subarray(0, paramBytes), offset); + offset += paramBytes; + } else { + dst.set(signature.subarray(rPadding, paramBytes), offset); + offset += paramBytes; + } + dst[offset++] = ENCODED_TAG_INT; + dst[offset++] = sLength; + if (sPadding < 0) { + dst[offset++] = 0; + dst.set(signature.subarray(paramBytes), offset); + } else { + dst.set(signature.subarray(paramBytes + sPadding), offset); + } + + return dst; +} diff --git a/libs/common/src/vault/services/fido2/fido2-authenticator.service.spec.ts b/libs/common/src/vault/services/fido2/fido2-authenticator.service.spec.ts new file mode 100644 index 0000000000..c519fccffc --- /dev/null +++ b/libs/common/src/vault/services/fido2/fido2-authenticator.service.spec.ts @@ -0,0 +1,826 @@ +import { TextEncoder } from "util"; + +import { mock, MockProxy } from "jest-mock-extended"; + +import { Utils } from "../../../platform/misc/utils"; +import { CipherService } from "../../abstractions/cipher.service"; +import { + Fido2AutenticatorErrorCode, + Fido2AuthenticatorGetAssertionParams, + Fido2AuthenticatorMakeCredentialsParams, +} from "../../abstractions/fido2/fido2-authenticator.service.abstraction"; +import { + Fido2UserInterfaceService, + Fido2UserInterfaceSession, + NewCredentialParams, +} from "../../abstractions/fido2/fido2-user-interface.service.abstraction"; +import { SyncService } from "../../abstractions/sync/sync.service.abstraction"; +import { CipherRepromptType } from "../../enums/cipher-reprompt-type"; +import { CipherType } from "../../enums/cipher-type"; +import { Cipher } from "../../models/domain/cipher"; +import { CipherView } from "../../models/view/cipher.view"; +import { Fido2CredentialView } from "../../models/view/fido2-credential.view"; +import { LoginView } from "../../models/view/login.view"; + +import { CBOR } from "./cbor"; +import { AAGUID, Fido2AuthenticatorService } from "./fido2-authenticator.service"; +import { Fido2Utils } from "./fido2-utils"; +import { guidToRawFormat } from "./guid-utils"; + +const RpId = "bitwarden.com"; + +describe("FidoAuthenticatorService", () => { + let cipherService!: MockProxy; + let userInterface!: MockProxy; + let userInterfaceSession!: MockProxy; + let syncService!: MockProxy; + let authenticator!: Fido2AuthenticatorService; + let tab!: chrome.tabs.Tab; + + beforeEach(async () => { + cipherService = mock(); + userInterface = mock(); + userInterfaceSession = mock(); + userInterface.newSession.mockResolvedValue(userInterfaceSession); + syncService = mock(); + authenticator = new Fido2AuthenticatorService(cipherService, userInterface, syncService); + tab = { id: 123, windowId: 456 } as chrome.tabs.Tab; + }); + + describe("makeCredential", () => { + let invalidParams!: InvalidParams; + + beforeEach(async () => { + invalidParams = await createInvalidParams(); + }); + + describe("invalid input parameters", () => { + // Spec: Check if at least one of the specified combinations of PublicKeyCredentialType and cryptographic parameters in credTypesAndPubKeyAlgs is supported. If not, return an error code equivalent to "NotSupportedError" and terminate the operation. + it("should throw error when input does not contain any supported algorithms", async () => { + const result = async () => + await authenticator.makeCredential(invalidParams.unsupportedAlgorithm, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotSupported); + }); + + it("should throw error when requireResidentKey has invalid value", async () => { + const result = async () => await authenticator.makeCredential(invalidParams.invalidRk, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + + it("should throw error when requireUserVerification has invalid value", async () => { + const result = async () => await authenticator.makeCredential(invalidParams.invalidUv, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + + /** + * Spec: If requireUserVerification is true and the authenticator cannot perform user verification, return an error code equivalent to "ConstraintError" and terminate the operation. + * Deviation: User verification is checked before checking for excluded credentials + **/ + /** TODO: This test should only be activated if we disable support for user verification */ + it.skip("should throw error if requireUserVerification is set to true", async () => { + const params = await createParams({ requireUserVerification: true }); + + const result = async () => await authenticator.makeCredential(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Constraint); + }); + + it("should not request confirmation from user", async () => { + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: "75280e7e-a72e-4d6c-bf1e-d37238352f9b", + userVerified: false, + }); + const invalidParams = await createInvalidParams(); + + for (const p of Object.values(invalidParams)) { + try { + await authenticator.makeCredential(p, tab); + // eslint-disable-next-line no-empty + } catch {} + } + expect(userInterfaceSession.confirmNewCredential).not.toHaveBeenCalled(); + }); + }); + + describe.skip("when extensions parameter is present", () => undefined); + + describe("vault contains excluded credential", () => { + let excludedCipher: CipherView; + let params: Fido2AuthenticatorMakeCredentialsParams; + + beforeEach(async () => { + excludedCipher = createCipherView( + { type: CipherType.Login }, + { credentialId: Utils.newGuid() } + ); + params = await createParams({ + excludeCredentialDescriptorList: [ + { + id: guidToRawFormat(excludedCipher.login.fido2Credentials[0].credentialId), + type: "public-key", + }, + ], + }); + cipherService.get.mockImplementation(async (id) => + id === excludedCipher.id ? ({ decrypt: () => excludedCipher } as any) : undefined + ); + cipherService.getAllDecrypted.mockResolvedValue([excludedCipher]); + }); + + /** + * Spec: collect an authorization gesture confirming user consent for creating a new credential. + * Deviation: Consent is not asked and the user is simply informed of the situation. + **/ + it("should inform user", async () => { + userInterfaceSession.informExcludedCredential.mockResolvedValue(); + + try { + await authenticator.makeCredential(params, tab); + // eslint-disable-next-line no-empty + } catch {} + + expect(userInterfaceSession.informExcludedCredential).toHaveBeenCalled(); + }); + + /** Spec: return an error code equivalent to "NotAllowedError" and terminate the operation. */ + it("should throw error", async () => { + userInterfaceSession.informExcludedCredential.mockResolvedValue(); + + const result = async () => await authenticator.makeCredential(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotAllowed); + }); + + /** Devation: Organization ciphers are not checked against excluded credentials, even if the user has access to them. */ + it("should not inform user of duplication when the excluded credential belongs to an organization", async () => { + userInterfaceSession.informExcludedCredential.mockResolvedValue(); + excludedCipher.organizationId = "someOrganizationId"; + + try { + await authenticator.makeCredential(params, tab); + // eslint-disable-next-line no-empty + } catch {} + + expect(userInterfaceSession.informExcludedCredential).not.toHaveBeenCalled(); + }); + + it("should not inform user of duplication when input data does not pass checks", async () => { + userInterfaceSession.informExcludedCredential.mockResolvedValue(); + const invalidParams = await createInvalidParams(); + + for (const p of Object.values(invalidParams)) { + try { + await authenticator.makeCredential(p, tab); + // eslint-disable-next-line no-empty + } catch {} + } + expect(userInterfaceSession.informExcludedCredential).not.toHaveBeenCalled(); + }); + + it.todo( + "should not throw error if the excluded credential has been marked as deleted in the vault" + ); + }); + + describe("credential creation", () => { + let existingCipher: CipherView; + let params: Fido2AuthenticatorMakeCredentialsParams; + + beforeEach(async () => { + existingCipher = createCipherView({ type: CipherType.Login }); + params = await createParams({ requireResidentKey: false }); + cipherService.get.mockImplementation(async (id) => + id === existingCipher.id ? ({ decrypt: () => existingCipher } as any) : undefined + ); + cipherService.getAllDecrypted.mockResolvedValue([existingCipher]); + }); + + /** + * Spec: Collect an authorization gesture confirming user consent for creating a new credential. The prompt for the authorization gesture is shown by the authenticator if it has its own output capability. The prompt SHOULD display rpEntity.id, rpEntity.name, userEntity.name and userEntity.displayName, if possible. + * Deviation: Only `rpEntity.name` and `userEntity.name` is shown. + * */ + for (const userVerification of [true, false]) { + it(`should request confirmation from user when user verification is ${userVerification}`, async () => { + params.requireUserVerification = userVerification; + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: existingCipher.id, + userVerified: userVerification, + }); + + await authenticator.makeCredential(params, tab); + + expect(userInterfaceSession.confirmNewCredential).toHaveBeenCalledWith({ + credentialName: params.rpEntity.name, + userName: params.userEntity.displayName, + userVerification, + } as NewCredentialParams); + }); + } + + it("should save credential to vault if request confirmed by user", async () => { + const encryptedCipher = Symbol(); + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: existingCipher.id, + userVerified: false, + }); + cipherService.encrypt.mockResolvedValue(encryptedCipher as unknown as Cipher); + + await authenticator.makeCredential(params, tab); + + const saved = cipherService.encrypt.mock.lastCall?.[0]; + expect(saved).toEqual( + expect.objectContaining({ + type: CipherType.Login, + name: existingCipher.name, + + login: expect.objectContaining({ + fido2Credentials: [ + expect.objectContaining({ + credentialId: expect.anything(), + keyType: "public-key", + keyAlgorithm: "ECDSA", + keyCurve: "P-256", + rpId: params.rpEntity.id, + rpName: params.rpEntity.name, + userHandle: Fido2Utils.bufferToString(params.userEntity.id), + counter: 0, + userDisplayName: params.userEntity.displayName, + discoverable: false, + }), + ], + }), + }) + ); + expect(cipherService.updateWithServer).toHaveBeenCalledWith(encryptedCipher); + }); + + /** Spec: If the user does not consent or if user verification fails, return an error code equivalent to "NotAllowedError" and terminate the operation. */ + it("should throw error if user denies creation request", async () => { + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: undefined, + userVerified: false, + }); + const params = await createParams(); + + const result = async () => await authenticator.makeCredential(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotAllowed); + }); + + it("should throw error if user verification fails and cipher requires reprompt", async () => { + params.requireUserVerification = false; + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: existingCipher.id, + userVerified: false, + }); + const encryptedCipher = { ...existingCipher, reprompt: CipherRepromptType.Password }; + cipherService.get.mockResolvedValue(encryptedCipher as unknown as Cipher); + + const result = async () => await authenticator.makeCredential(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + + /** Spec: If any error occurred while creating the new credential object, return an error code equivalent to "UnknownError" and terminate the operation. */ + it("should throw unkown error if creation fails", async () => { + const encryptedCipher = Symbol(); + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId: existingCipher.id, + userVerified: false, + }); + cipherService.encrypt.mockResolvedValue(encryptedCipher as unknown as Cipher); + cipherService.updateWithServer.mockRejectedValue(new Error("Internal error")); + + const result = async () => await authenticator.makeCredential(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + }); + + describe(`attestation of new credential`, () => { + const cipherId = "75280e7e-a72e-4d6c-bf1e-d37238352f9b"; + const credentialId = "52217b91-73f1-4fea-b3f2-54a7959fd5aa"; + const credentialIdBytes = new Uint8Array([ + 0x52, 0x21, 0x7b, 0x91, 0x73, 0xf1, 0x4f, 0xea, 0xb3, 0xf2, 0x54, 0xa7, 0x95, 0x9f, 0xd5, + 0xaa, + ]); + let params: Fido2AuthenticatorMakeCredentialsParams; + + beforeEach(async () => { + const cipher = createCipherView({ id: cipherId, type: CipherType.Login }); + params = await createParams(); + userInterfaceSession.confirmNewCredential.mockResolvedValue({ + cipherId, + userVerified: false, + }); + cipherService.get.mockImplementation(async (cipherId) => + cipherId === cipher.id ? ({ decrypt: () => cipher } as any) : undefined + ); + cipherService.getAllDecrypted.mockResolvedValue([await cipher]); + cipherService.encrypt.mockImplementation(async (cipher) => { + cipher.login.fido2Credentials[0].credentialId = credentialId; // Replace id for testability + return {} as any; + }); + cipherService.createWithServer.mockImplementation(async (cipher) => { + cipher.id = cipherId; + return cipher; + }); + cipherService.updateWithServer.mockImplementation(async (cipher) => { + cipher.id = cipherId; + return cipher; + }); + }); + + it("should return attestation object", async () => { + const result = await authenticator.makeCredential(params, tab); + + const attestationObject = CBOR.decode( + Fido2Utils.bufferSourceToUint8Array(result.attestationObject).buffer + ); + + const encAuthData: Uint8Array = attestationObject.authData; + const rpIdHash = encAuthData.slice(0, 32); + const flags = encAuthData.slice(32, 33); + const counter = encAuthData.slice(33, 37); + const aaguid = encAuthData.slice(37, 53); + const credentialIdLength = encAuthData.slice(53, 55); + const credentialId = encAuthData.slice(55, 71); + // Unsure how to test public key + // const publicKey = encAuthData.slice(87); + + expect(encAuthData.length).toBe(71 + 77); + expect(attestationObject.fmt).toBe("none"); + expect(attestationObject.attStmt).toEqual({}); + expect(rpIdHash).toEqual( + new Uint8Array([ + 0x22, 0x6b, 0xb3, 0x92, 0x02, 0xff, 0xf9, 0x22, 0xdc, 0x74, 0x05, 0xcd, 0x28, 0xa8, + 0x34, 0x5a, 0xc4, 0xf2, 0x64, 0x51, 0xd7, 0x3d, 0x0b, 0x40, 0xef, 0xf3, 0x1d, 0xc1, + 0xd0, 0x5c, 0x3d, 0xc3, + ]) + ); + expect(flags).toEqual(new Uint8Array([0b01000001])); // UP = true, AD = true + expect(counter).toEqual(new Uint8Array([0, 0, 0, 0])); // 0 because of new counter + expect(aaguid).toEqual(AAGUID); + expect(credentialIdLength).toEqual(new Uint8Array([0, 16])); // 16 bytes because we're using GUIDs + expect(credentialId).toEqual(credentialIdBytes); + }); + }); + + async function createParams( + params: Partial = {} + ): Promise { + return { + hash: params.hash ?? (await createClientDataHash()), + rpEntity: params.rpEntity ?? { + name: "Bitwarden", + id: RpId, + }, + userEntity: params.userEntity ?? { + id: randomBytes(64), + name: "jane.doe@bitwarden.com", + displayName: "Jane Doe", + icon: " data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAOhJREFUeNpiFI+9E8DAwDAfiAUYSAMfgDiQBVmzlSYnUTqPXf/OANWzngVZ87pKKaIMCGp/BjeEhRjFMKAjx8bQFC2CIs9CpHNxAiYGCsEQM4Cfiwm3AY9f/yZogIcRN4ZahAFv/jAcu4E7xMNtecEYpAakFqsX8me9Yvj07R+G5jR3foaJqWJgOZAaZMAIzAv/kQV05NgZ5hdIMMiKQJIIyEYrDU6wrYkTXjBcefQTvwGwwCoJFGJIBdoMArN3fmToWf+O4SMW14EMeI8rJ8Jcgexn9BwJCoNEaNbEACCN+DSDsjNAgAEAri9Zii/uDMsAAAAASUVORK5CYII=", + }, + credTypesAndPubKeyAlgs: params.credTypesAndPubKeyAlgs ?? [ + { + alg: -7, // ES256 + type: "public-key", + }, + ], + excludeCredentialDescriptorList: params.excludeCredentialDescriptorList ?? [ + { + id: randomBytes(16), + transports: ["internal"], + type: "public-key", + }, + ], + requireResidentKey: params.requireResidentKey ?? false, + requireUserVerification: params.requireUserVerification ?? false, + fallbackSupported: params.fallbackSupported ?? false, + extensions: params.extensions ?? { + appid: undefined, + appidExclude: undefined, + credProps: undefined, + uvm: false as boolean, + }, + }; + } + + type InvalidParams = Awaited>; + async function createInvalidParams() { + return { + unsupportedAlgorithm: await createParams({ + credTypesAndPubKeyAlgs: [{ alg: 9001, type: "public-key" }], + }), + invalidRk: await createParams({ requireResidentKey: "invalid-value" as any }), + invalidUv: await createParams({ + requireUserVerification: "invalid-value" as any, + }), + }; + } + }); + + describe("getAssertion", () => { + let invalidParams!: InvalidParams; + + beforeEach(async () => { + invalidParams = await createInvalidParams(); + }); + + describe("invalid input parameters", () => { + it("should throw error when requireUserVerification has invalid value", async () => { + const result = async () => await authenticator.getAssertion(invalidParams.invalidUv, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + + /** + * Spec: If requireUserVerification is true and the authenticator cannot perform user verification, return an error code equivalent to "ConstraintError" and terminate the operation. + * Deviation: User verification is checked before checking for excluded credentials + **/ + /** NOTE: This test should only be activated if we disable support for user verification */ + it.skip("should throw error if requireUserVerification is set to true", async () => { + const params = await createParams({ requireUserVerification: true }); + + const result = async () => await authenticator.getAssertion(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Constraint); + }); + }); + + describe("vault is missing non-discoverable credential", () => { + let credentialId: string; + let params: Fido2AuthenticatorGetAssertionParams; + + beforeEach(async () => { + credentialId = Utils.newGuid(); + params = await createParams({ + allowCredentialDescriptorList: [ + { id: guidToRawFormat(credentialId), type: "public-key" }, + ], + rpId: RpId, + }); + }); + + /** + * Spec: If credentialOptions is now empty, return an error code equivalent to "NotAllowedError" and terminate the operation. + * Deviation: We do not throw error but instead inform the user and allow the user to fallback to browser implementation. + **/ + it("should inform user if no credential exists", async () => { + cipherService.getAllDecrypted.mockResolvedValue([]); + userInterfaceSession.informCredentialNotFound.mockResolvedValue(); + + try { + await authenticator.getAssertion(params, tab); + // eslint-disable-next-line no-empty + } catch {} + + expect(userInterfaceSession.informCredentialNotFound).toHaveBeenCalled(); + }); + + it("should inform user if credential exists but rpId does not match", async () => { + const cipher = await createCipherView({ type: CipherType.Login }); + cipher.login.fido2Credentials[0].credentialId = credentialId; + cipher.login.fido2Credentials[0].rpId = "mismatch-rpid"; + cipherService.getAllDecrypted.mockResolvedValue([cipher]); + userInterfaceSession.informCredentialNotFound.mockResolvedValue(); + + try { + await authenticator.getAssertion(params, tab); + // eslint-disable-next-line no-empty + } catch {} + + expect(userInterfaceSession.informCredentialNotFound).toHaveBeenCalled(); + }); + }); + + describe("vault is missing discoverable credential", () => { + let params: Fido2AuthenticatorGetAssertionParams; + + beforeEach(async () => { + params = await createParams({ + allowCredentialDescriptorList: [], + rpId: RpId, + }); + cipherService.getAllDecrypted.mockResolvedValue([]); + }); + + /** Spec: If credentialOptions is now empty, return an error code equivalent to "NotAllowedError" and terminate the operation. */ + it("should throw error", async () => { + const result = async () => await authenticator.getAssertion(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotAllowed); + }); + }); + + describe("vault contains credential", () => { + let credentialIds: string[]; + let ciphers: CipherView[]; + let params: Fido2AuthenticatorGetAssertionParams; + + beforeEach(async () => { + credentialIds = [Utils.newGuid(), Utils.newGuid()]; + ciphers = [ + await createCipherView( + { type: CipherType.Login }, + { credentialId: credentialIds[0], rpId: RpId, discoverable: false } + ), + await createCipherView( + { type: CipherType.Login }, + { credentialId: credentialIds[1], rpId: RpId, discoverable: true } + ), + ]; + params = await createParams({ + allowCredentialDescriptorList: credentialIds.map((credentialId) => ({ + id: guidToRawFormat(credentialId), + type: "public-key", + })), + rpId: RpId, + }); + cipherService.getAllDecrypted.mockResolvedValue(ciphers); + }); + + it("should ask for all credentials in list when `params` contains allowedCredentials list", async () => { + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: ciphers[0].id, + userVerified: false, + }); + + await authenticator.getAssertion(params, tab); + + expect(userInterfaceSession.pickCredential).toHaveBeenCalledWith({ + cipherIds: ciphers.map((c) => c.id), + userVerification: false, + }); + }); + + it("should only ask for discoverable credentials matched by rpId when params does not contains allowedCredentials list", async () => { + params.allowCredentialDescriptorList = undefined; + const discoverableCiphers = ciphers.filter((c) => c.login.fido2Credentials[0].discoverable); + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: discoverableCiphers[0].id, + userVerified: false, + }); + + await authenticator.getAssertion(params, tab); + + expect(userInterfaceSession.pickCredential).toHaveBeenCalledWith({ + cipherIds: [discoverableCiphers[0].id], + userVerification: false, + }); + }); + + for (const userVerification of [true, false]) { + /** Spec: Prompt the user to select a public key credential source selectedCredential from credentialOptions. */ + it(`should request confirmation from user when user verification is ${userVerification}`, async () => { + params.requireUserVerification = userVerification; + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: ciphers[0].id, + userVerified: userVerification, + }); + + await authenticator.getAssertion(params, tab); + + expect(userInterfaceSession.pickCredential).toHaveBeenCalledWith({ + cipherIds: ciphers.map((c) => c.id), + userVerification, + }); + }); + } + + /** Spec: If the user does not consent, return an error code equivalent to "NotAllowedError" and terminate the operation. */ + it("should throw error", async () => { + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: undefined, + userVerified: false, + }); + + const result = async () => await authenticator.getAssertion(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotAllowed); + }); + + it("should throw error if user verification fails and cipher requires reprompt", async () => { + ciphers[0].reprompt = CipherRepromptType.Password; + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: ciphers[0].id, + userVerified: false, + }); + + const result = async () => await authenticator.getAssertion(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.NotAllowed); + }); + }); + + describe("assertion of credential", () => { + let keyPair: CryptoKeyPair; + let credentialIds: string[]; + let selectedCredentialId: string; + let ciphers: CipherView[]; + let fido2Credentials: Fido2CredentialView[]; + let params: Fido2AuthenticatorGetAssertionParams; + + const init = async () => { + keyPair = await createKeyPair(); + credentialIds = [Utils.newGuid(), Utils.newGuid()]; + const keyValue = Fido2Utils.bufferToString( + await crypto.subtle.exportKey("pkcs8", keyPair.privateKey) + ); + ciphers = credentialIds.map((id) => + createCipherView( + { type: CipherType.Login }, + { credentialId: id, rpId: RpId, counter: 9000, keyValue } + ) + ); + fido2Credentials = ciphers.map((c) => c.login.fido2Credentials[0]); + selectedCredentialId = credentialIds[0]; + params = await createParams({ + allowCredentialDescriptorList: credentialIds.map((credentialId) => ({ + id: guidToRawFormat(credentialId), + type: "public-key", + })), + rpId: RpId, + }); + cipherService.getAllDecrypted.mockResolvedValue(ciphers); + userInterfaceSession.pickCredential.mockResolvedValue({ + cipherId: ciphers[0].id, + userVerified: false, + }); + }; + beforeEach(init); + + /** Spec: Increment the credential associated signature counter */ + it("should increment counter", async () => { + const encrypted = Symbol(); + cipherService.encrypt.mockResolvedValue(encrypted as any); + + await authenticator.getAssertion(params, tab); + + expect(cipherService.updateWithServer).toHaveBeenCalledWith(encrypted); + + expect(cipherService.encrypt).toHaveBeenCalledWith( + expect.objectContaining({ + id: ciphers[0].id, + login: expect.objectContaining({ + fido2Credentials: [ + expect.objectContaining({ + counter: 9001, + }), + ], + }), + }) + ); + }); + + it("should return an assertion result", async () => { + const result = await authenticator.getAssertion(params, tab); + + const encAuthData = result.authenticatorData; + const rpIdHash = encAuthData.slice(0, 32); + const flags = encAuthData.slice(32, 33); + const counter = encAuthData.slice(33, 37); + + expect(result.selectedCredential.id).toEqual(guidToRawFormat(selectedCredentialId)); + expect(result.selectedCredential.userHandle).toEqual( + Fido2Utils.stringToBuffer(fido2Credentials[0].userHandle) + ); + expect(rpIdHash).toEqual( + new Uint8Array([ + 0x22, 0x6b, 0xb3, 0x92, 0x02, 0xff, 0xf9, 0x22, 0xdc, 0x74, 0x05, 0xcd, 0x28, 0xa8, + 0x34, 0x5a, 0xc4, 0xf2, 0x64, 0x51, 0xd7, 0x3d, 0x0b, 0x40, 0xef, 0xf3, 0x1d, 0xc1, + 0xd0, 0x5c, 0x3d, 0xc3, + ]) + ); + expect(flags).toEqual(new Uint8Array([0b00000001])); // UP = true + expect(counter).toEqual(new Uint8Array([0, 0, 0x23, 0x29])); // 9001 in hex + + // Verify signature + // TODO: Cannot verify signature because it has been converted into DER format + // const sigBase = new Uint8Array([ + // ...result.authenticatorData, + // ...Fido2Utils.bufferSourceToUint8Array(params.hash), + // ]); + // const isValidSignature = await crypto.subtle.verify( + // { name: "ECDSA", hash: { name: "SHA-256" } }, + // keyPair.publicKey, + // result.signature, + // sigBase + // ); + // expect(isValidSignature).toBe(true); + }); + + it("should always generate unique signatures even if the input is the same", async () => { + const signatures = new Set(); + + for (let i = 0; i < 10; ++i) { + await init(); // Reset inputs + const result = await authenticator.getAssertion(params, tab); + + const counter = result.authenticatorData.slice(33, 37); + expect(counter).toEqual(new Uint8Array([0, 0, 0x23, 0x29])); // double check that the counter doesn't change + + const signature = Fido2Utils.bufferToString(result.signature); + if (signatures.has(signature)) { + throw new Error("Found duplicate signature"); + } + signatures.add(signature); + } + }); + + /** Spec: If any error occurred while generating the assertion signature, return an error code equivalent to "UnknownError" and terminate the operation. */ + it("should throw unkown error if creation fails", async () => { + cipherService.updateWithServer.mockRejectedValue(new Error("Internal error")); + + const result = async () => await authenticator.getAssertion(params, tab); + + await expect(result).rejects.toThrowError(Fido2AutenticatorErrorCode.Unknown); + }); + }); + + async function createParams( + params: Partial = {} + ): Promise { + return { + rpId: params.rpId ?? RpId, + hash: params.hash ?? (await createClientDataHash()), + allowCredentialDescriptorList: params.allowCredentialDescriptorList ?? [], + requireUserVerification: params.requireUserVerification ?? false, + extensions: params.extensions ?? {}, + fallbackSupported: params.fallbackSupported ?? false, + }; + } + + type InvalidParams = Awaited>; + async function createInvalidParams() { + const emptyRpId = await createParams(); + emptyRpId.rpId = undefined as any; + return { + emptyRpId, + invalidUv: await createParams({ + requireUserVerification: "invalid-value" as any, + }), + }; + } + }); +}); + +function createCipherView( + data: Partial> = {}, + fido2Credential: Partial = {} +): CipherView { + const cipher = new CipherView(); + cipher.id = data.id ?? Utils.newGuid(); + cipher.type = CipherType.Login; + cipher.localData = {}; + + const fido2CredentialView = new Fido2CredentialView(); + fido2CredentialView.credentialId = fido2Credential.credentialId ?? Utils.newGuid(); + fido2CredentialView.rpId = fido2Credential.rpId ?? RpId; + fido2CredentialView.counter = fido2Credential.counter ?? 0; + fido2CredentialView.userHandle = + fido2Credential.userHandle ?? Fido2Utils.bufferToString(randomBytes(16)); + fido2CredentialView.keyAlgorithm = fido2Credential.keyAlgorithm ?? "ECDSA"; + fido2CredentialView.keyCurve = fido2Credential.keyCurve ?? "P-256"; + fido2CredentialView.discoverable = fido2Credential.discoverable ?? true; + fido2CredentialView.keyValue = + fido2CredentialView.keyValue ?? + "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgTC-7XDZipXbaVBlnkjlBgO16ZmqBZWejK2iYo6lV0dehRANCAASOcM2WduNq1DriRYN7ZekvZz-bRhA-qNT4v0fbp5suUFJyWmgOQ0bybZcLXHaerK5Ep1JiSrQcewtQNgLtry7f"; + + cipher.login = new LoginView(); + cipher.login.fido2Credentials = [fido2CredentialView]; + + return cipher; +} + +async function createClientDataHash() { + const encoder = new TextEncoder(); + const clientData = encoder.encode( + JSON.stringify({ + type: "webauthn.create", + challenge: Fido2Utils.bufferToString(randomBytes(16)), + origin: RpId, + crossOrigin: false, + }) + ); + return await crypto.subtle.digest({ name: "SHA-256" }, clientData); +} + +/** This is a fake function that always returns the same byte sequence */ +function randomBytes(length: number) { + return new Uint8Array(Array.from({ length }, (_, k) => k % 255)); +} + +async function createKeyPair() { + return await crypto.subtle.generateKey( + { + name: "ECDSA", + namedCurve: "P-256", + }, + true, + ["sign", "verify"] + ); +} diff --git a/libs/common/src/vault/services/fido2/fido2-authenticator.service.ts b/libs/common/src/vault/services/fido2/fido2-authenticator.service.ts new file mode 100644 index 0000000000..e009d8b18c --- /dev/null +++ b/libs/common/src/vault/services/fido2/fido2-authenticator.service.ts @@ -0,0 +1,545 @@ +import { LogService } from "../../../platform/abstractions/log.service"; +import { Utils } from "../../../platform/misc/utils"; +import { CipherService } from "../../abstractions/cipher.service"; +import { + Fido2AlgorithmIdentifier, + Fido2AutenticatorError, + Fido2AutenticatorErrorCode, + Fido2AuthenticatorGetAssertionParams, + Fido2AuthenticatorGetAssertionResult, + Fido2AuthenticatorMakeCredentialResult, + Fido2AuthenticatorMakeCredentialsParams, + Fido2AuthenticatorService as Fido2AuthenticatorServiceAbstraction, + PublicKeyCredentialDescriptor, +} from "../../abstractions/fido2/fido2-authenticator.service.abstraction"; +import { Fido2UserInterfaceService } from "../../abstractions/fido2/fido2-user-interface.service.abstraction"; +import { SyncService } from "../../abstractions/sync/sync.service.abstraction"; +import { CipherRepromptType } from "../../enums/cipher-reprompt-type"; +import { CipherType } from "../../enums/cipher-type"; +import { CipherView } from "../../models/view/cipher.view"; +import { Fido2CredentialView } from "../../models/view/fido2-credential.view"; + +import { CBOR } from "./cbor"; +import { joseToDer } from "./ecdsa-utils"; +import { Fido2Utils } from "./fido2-utils"; +import { guidToRawFormat, guidToStandardFormat } from "./guid-utils"; + +// AAGUID: 6e8248d5-b479-40db-a3d8-11116f7e8349 +export const AAGUID = new Uint8Array([ + 0xd5, 0x48, 0x82, 0x6e, 0x79, 0xb4, 0xdb, 0x40, 0xa3, 0xd8, 0x11, 0x11, 0x6f, 0x7e, 0x83, 0x49, +]); + +const KeyUsages: KeyUsage[] = ["sign"]; + +/** + * Bitwarden implementation of the WebAuthn Authenticator Model as described by W3C + * https://www.w3.org/TR/webauthn-3/#sctn-authenticator-model + * + * It is highly recommended that the W3C specification is used a reference when reading this code. + */ +export class Fido2AuthenticatorService implements Fido2AuthenticatorServiceAbstraction { + constructor( + private cipherService: CipherService, + private userInterface: Fido2UserInterfaceService, + private syncService: SyncService, + private logService?: LogService + ) {} + + async makeCredential( + params: Fido2AuthenticatorMakeCredentialsParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ): Promise { + const userInterfaceSession = await this.userInterface.newSession( + params.fallbackSupported, + tab, + abortController + ); + + try { + if (params.credTypesAndPubKeyAlgs.every((p) => p.alg !== Fido2AlgorithmIdentifier.ES256)) { + const requestedAlgorithms = params.credTypesAndPubKeyAlgs.map((p) => p.alg).join(", "); + this.logService?.warning( + `[Fido2Authenticator] No compatible algorithms found, RP requested: ${requestedAlgorithms}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotSupported); + } + + if ( + params.requireResidentKey != undefined && + typeof params.requireResidentKey !== "boolean" + ) { + this.logService?.error( + `[Fido2Authenticator] Invalid 'requireResidentKey' value: ${String( + params.requireResidentKey + )}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + + if ( + params.requireUserVerification != undefined && + typeof params.requireUserVerification !== "boolean" + ) { + this.logService?.error( + `[Fido2Authenticator] Invalid 'requireUserVerification' value: ${String( + params.requireUserVerification + )}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + + await userInterfaceSession.ensureUnlockedVault(); + await this.syncService.fullSync(false); + + const existingCipherIds = await this.findExcludedCredentials( + params.excludeCredentialDescriptorList + ); + if (existingCipherIds.length > 0) { + this.logService?.info( + `[Fido2Authenticator] Aborting due to excluded credential found in vault.` + ); + await userInterfaceSession.informExcludedCredential(existingCipherIds); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + let cipher: CipherView; + let fido2Credential: Fido2CredentialView; + let keyPair: CryptoKeyPair; + let userVerified = false; + let credentialId: string; + const response = await userInterfaceSession.confirmNewCredential({ + credentialName: params.rpEntity.name, + userName: params.userEntity.displayName, + userVerification: params.requireUserVerification, + }); + const cipherId = response.cipherId; + userVerified = response.userVerified; + + if (cipherId === undefined) { + this.logService?.warning( + `[Fido2Authenticator] Aborting because user confirmation was not recieved.` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + try { + keyPair = await createKeyPair(); + + const encrypted = await this.cipherService.get(cipherId); + cipher = await encrypted.decrypt( + await this.cipherService.getKeyForCipherKeyDecryption(encrypted) + ); + + if ( + !userVerified && + (params.requireUserVerification || cipher.reprompt !== CipherRepromptType.None) + ) { + this.logService?.warning( + `[Fido2Authenticator] Aborting because user verification was unsuccessful.` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + fido2Credential = await createKeyView(params, keyPair.privateKey); + cipher.login.fido2Credentials = [fido2Credential]; + const reencrypted = await this.cipherService.encrypt(cipher); + await this.cipherService.updateWithServer(reencrypted); + credentialId = fido2Credential.credentialId; + } catch (error) { + this.logService?.error( + `[Fido2Authenticator] Aborting because of unknown error when creating credential: ${error}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + + const authData = await generateAuthData({ + rpId: params.rpEntity.id, + credentialId: guidToRawFormat(credentialId), + counter: fido2Credential.counter, + userPresence: true, + userVerification: userVerified, + keyPair, + }); + const attestationObject = new Uint8Array( + CBOR.encode({ + fmt: "none", + attStmt: {}, + authData, + }) + ); + + return { + credentialId: guidToRawFormat(credentialId), + attestationObject, + authData, + publicKeyAlgorithm: -7, + }; + } finally { + userInterfaceSession.close(); + } + } + + async getAssertion( + params: Fido2AuthenticatorGetAssertionParams, + tab: chrome.tabs.Tab, + abortController?: AbortController + ): Promise { + const userInterfaceSession = await this.userInterface.newSession( + params.fallbackSupported, + tab, + abortController + ); + try { + if ( + params.requireUserVerification != undefined && + typeof params.requireUserVerification !== "boolean" + ) { + this.logService?.error( + `[Fido2Authenticator] Invalid 'requireUserVerification' value: ${String( + params.requireUserVerification + )}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + + let cipherOptions: CipherView[]; + + await userInterfaceSession.ensureUnlockedVault(); + await this.syncService.fullSync(false); + + if (params.allowCredentialDescriptorList?.length > 0) { + cipherOptions = await this.findCredentialsById( + params.allowCredentialDescriptorList, + params.rpId + ); + } else { + cipherOptions = await this.findCredentialsByRp(params.rpId); + } + + if (cipherOptions.length === 0) { + this.logService?.info( + `[Fido2Authenticator] Aborting because no matching credentials were found in the vault.` + ); + await userInterfaceSession.informCredentialNotFound(); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + const response = await userInterfaceSession.pickCredential({ + cipherIds: cipherOptions.map((cipher) => cipher.id), + userVerification: params.requireUserVerification, + }); + const selectedCipherId = response.cipherId; + const userVerified = response.userVerified; + const selectedCipher = cipherOptions.find((c) => c.id === selectedCipherId); + + if (selectedCipher === undefined) { + this.logService?.error( + `[Fido2Authenticator] Aborting because the selected credential could not be found.` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + if ( + !userVerified && + (params.requireUserVerification || selectedCipher.reprompt !== CipherRepromptType.None) + ) { + this.logService?.warning( + `[Fido2Authenticator] Aborting because user verification was unsuccessful.` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed); + } + + try { + const selectedFido2Credential = selectedCipher.login.fido2Credentials[0]; + const selectedCredentialId = selectedFido2Credential.credentialId; + + ++selectedFido2Credential.counter; + + selectedCipher.localData = { + ...selectedCipher.localData, + lastUsedDate: new Date().getTime(), + }; + const encrypted = await this.cipherService.encrypt(selectedCipher); + await this.cipherService.updateWithServer(encrypted); + + const authenticatorData = await generateAuthData({ + rpId: selectedFido2Credential.rpId, + credentialId: guidToRawFormat(selectedCredentialId), + counter: selectedFido2Credential.counter, + userPresence: true, + userVerification: userVerified, + }); + + const signature = await generateSignature({ + authData: authenticatorData, + clientDataHash: params.hash, + privateKey: await getPrivateKeyFromFido2Credential(selectedFido2Credential), + }); + + return { + authenticatorData, + selectedCredential: { + id: guidToRawFormat(selectedCredentialId), + userHandle: Fido2Utils.stringToBuffer(selectedFido2Credential.userHandle), + }, + signature, + }; + } catch (error) { + this.logService?.error( + `[Fido2Authenticator] Aborting because of unknown error when asserting credential: ${error}` + ); + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + } finally { + userInterfaceSession.close(); + } + } + + /** Finds existing crendetials and returns the `cipherId` for each one */ + private async findExcludedCredentials( + credentials: PublicKeyCredentialDescriptor[] + ): Promise { + const ids: string[] = []; + + for (const credential of credentials) { + try { + ids.push(guidToStandardFormat(credential.id)); + // eslint-disable-next-line no-empty + } catch {} + } + + if (ids.length === 0) { + return []; + } + + const ciphers = await this.cipherService.getAllDecrypted(); + return ciphers + .filter( + (cipher) => + !cipher.isDeleted && + cipher.organizationId == undefined && + cipher.type === CipherType.Login && + cipher.login.hasFido2Credentials && + ids.includes(cipher.login.fido2Credentials[0].credentialId) + ) + .map((cipher) => cipher.id); + } + + private async findCredentialsById( + credentials: PublicKeyCredentialDescriptor[], + rpId: string + ): Promise { + const ids: string[] = []; + + for (const credential of credentials) { + try { + ids.push(guidToStandardFormat(credential.id)); + // eslint-disable-next-line no-empty + } catch {} + } + + if (ids.length === 0) { + return []; + } + + const ciphers = await this.cipherService.getAllDecrypted(); + return ciphers.filter( + (cipher) => + !cipher.isDeleted && + cipher.type === CipherType.Login && + cipher.login.hasFido2Credentials && + cipher.login.fido2Credentials[0].rpId === rpId && + ids.includes(cipher.login.fido2Credentials[0].credentialId) + ); + } + + private async findCredentialsByRp(rpId: string): Promise { + const ciphers = await this.cipherService.getAllDecrypted(); + return ciphers.filter( + (cipher) => + !cipher.isDeleted && + cipher.type === CipherType.Login && + cipher.login.hasFido2Credentials && + cipher.login.fido2Credentials[0].rpId === rpId && + cipher.login.fido2Credentials[0].discoverable + ); + } +} + +async function createKeyPair() { + return await crypto.subtle.generateKey( + { + name: "ECDSA", + namedCurve: "P-256", + }, + true, + KeyUsages + ); +} + +async function createKeyView( + params: Fido2AuthenticatorMakeCredentialsParams, + keyValue: CryptoKey +): Promise { + if (keyValue.algorithm.name !== "ECDSA" && (keyValue.algorithm as any).namedCurve !== "P-256") { + throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.Unknown); + } + + const pkcs8Key = await crypto.subtle.exportKey("pkcs8", keyValue); + const fido2Credential = new Fido2CredentialView(); + fido2Credential.credentialId = Utils.newGuid(); + fido2Credential.keyType = "public-key"; + fido2Credential.keyAlgorithm = "ECDSA"; + fido2Credential.keyCurve = "P-256"; + fido2Credential.keyValue = Fido2Utils.bufferToString(pkcs8Key); + fido2Credential.rpId = params.rpEntity.id; + fido2Credential.userHandle = Fido2Utils.bufferToString(params.userEntity.id); + fido2Credential.counter = 0; + fido2Credential.rpName = params.rpEntity.name; + fido2Credential.userDisplayName = params.userEntity.displayName; + fido2Credential.discoverable = params.requireResidentKey; + fido2Credential.creationDate = new Date(); + + return fido2Credential; +} + +async function getPrivateKeyFromFido2Credential( + fido2Credential: Fido2CredentialView +): Promise { + const keyBuffer = Fido2Utils.stringToBuffer(fido2Credential.keyValue); + return await crypto.subtle.importKey( + "pkcs8", + keyBuffer, + { + name: fido2Credential.keyAlgorithm, + namedCurve: fido2Credential.keyCurve, + } as EcKeyImportParams, + true, + KeyUsages + ); +} + +interface AuthDataParams { + rpId: string; + credentialId: BufferSource; + userPresence: boolean; + userVerification: boolean; + counter: number; + keyPair?: CryptoKeyPair; +} + +async function generateAuthData(params: AuthDataParams) { + const authData: Array = []; + + const rpIdHash = new Uint8Array( + await crypto.subtle.digest({ name: "SHA-256" }, Utils.fromByteStringToArray(params.rpId)) + ); + authData.push(...rpIdHash); + + const flags = authDataFlags({ + extensionData: false, + attestationData: params.keyPair != undefined, + userVerification: params.userVerification, + userPresence: params.userPresence, + }); + authData.push(flags); + + // add 4 bytes of counter - we use time in epoch seconds as monotonic counter + // TODO: Consider changing this to a cryptographically safe random number + const counter = params.counter; + authData.push( + ((counter & 0xff000000) >> 24) & 0xff, + ((counter & 0x00ff0000) >> 16) & 0xff, + ((counter & 0x0000ff00) >> 8) & 0xff, + counter & 0x000000ff + ); + + if (params.keyPair) { + // attestedCredentialData + const attestedCredentialData: Array = []; + + attestedCredentialData.push(...AAGUID); + + // credentialIdLength (2 bytes) and credential Id + const rawId = Fido2Utils.bufferSourceToUint8Array(params.credentialId); + const credentialIdLength = [(rawId.length - (rawId.length & 0xff)) / 256, rawId.length & 0xff]; + attestedCredentialData.push(...credentialIdLength); + attestedCredentialData.push(...rawId); + + const publicKeyJwk = await crypto.subtle.exportKey("jwk", params.keyPair.publicKey); + // COSE format of the EC256 key + const keyX = Utils.fromUrlB64ToArray(publicKeyJwk.x); + const keyY = Utils.fromUrlB64ToArray(publicKeyJwk.y); + + // Can't get `cbor-redux` to encode in CTAP2 canonical CBOR. So we do it manually: + const coseBytes = new Uint8Array(77); + coseBytes.set([0xa5, 0x01, 0x02, 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20], 0); + coseBytes.set(keyX, 10); + coseBytes.set([0x22, 0x58, 0x20], 10 + 32); + coseBytes.set(keyY, 10 + 32 + 3); + + // credential public key - convert to array from CBOR encoded COSE key + attestedCredentialData.push(...coseBytes); + + authData.push(...attestedCredentialData); + } + + return new Uint8Array(authData); +} + +interface SignatureParams { + authData: Uint8Array; + clientDataHash: BufferSource; + privateKey: CryptoKey; +} + +async function generateSignature(params: SignatureParams) { + const sigBase = new Uint8Array([ + ...params.authData, + ...Fido2Utils.bufferSourceToUint8Array(params.clientDataHash), + ]); + const p1336_signature = new Uint8Array( + await crypto.subtle.sign( + { + name: "ECDSA", + hash: { name: "SHA-256" }, + }, + params.privateKey, + sigBase + ) + ); + + const asn1Der_signature = joseToDer(p1336_signature, "ES256"); + + return asn1Der_signature; +} + +interface Flags { + extensionData: boolean; + attestationData: boolean; + userVerification: boolean; + userPresence: boolean; +} + +function authDataFlags(options: Flags): number { + let flags = 0; + + if (options.extensionData) { + flags |= 0b1000000; + } + + if (options.attestationData) { + flags |= 0b01000000; + } + + if (options.userVerification) { + flags |= 0b00000100; + } + + if (options.userPresence) { + flags |= 0b00000001; + } + + return flags; +} diff --git a/libs/common/src/vault/services/fido2/fido2-client.service.spec.ts b/libs/common/src/vault/services/fido2/fido2-client.service.spec.ts new file mode 100644 index 0000000000..a8b2a071c1 --- /dev/null +++ b/libs/common/src/vault/services/fido2/fido2-client.service.spec.ts @@ -0,0 +1,463 @@ +import { mock, MockProxy } from "jest-mock-extended"; + +import { AuthService } from "../../../auth/abstractions/auth.service"; +import { AuthenticationStatus } from "../../../auth/enums/authentication-status"; +import { ConfigServiceAbstraction } from "../../../platform/abstractions/config/config.service.abstraction"; +import { Utils } from "../../../platform/misc/utils"; +import { + Fido2AutenticatorError, + Fido2AutenticatorErrorCode, + Fido2AuthenticatorGetAssertionResult, + Fido2AuthenticatorMakeCredentialResult, +} from "../../abstractions/fido2/fido2-authenticator.service.abstraction"; +import { + AssertCredentialParams, + CreateCredentialParams, + FallbackRequestedError, +} from "../../abstractions/fido2/fido2-client.service.abstraction"; + +import { Fido2AuthenticatorService } from "./fido2-authenticator.service"; +import { Fido2ClientService } from "./fido2-client.service"; +import { Fido2Utils } from "./fido2-utils"; +import { guidToRawFormat } from "./guid-utils"; + +const RpId = "bitwarden.com"; + +describe("FidoAuthenticatorService", () => { + let authenticator!: MockProxy; + let configService!: MockProxy; + let authService!: MockProxy; + let client!: Fido2ClientService; + let tab!: chrome.tabs.Tab; + + beforeEach(async () => { + authenticator = mock(); + configService = mock(); + authService = mock(); + + client = new Fido2ClientService(authenticator, configService, authService); + configService.getFeatureFlag.mockResolvedValue(true); + tab = { id: 123, windowId: 456 } as chrome.tabs.Tab; + }); + + describe("createCredential", () => { + describe("input parameters validation", () => { + // Spec: If sameOriginWithAncestors is false, return a "NotAllowedError" DOMException. + it("should throw error if sameOriginWithAncestors is false", async () => { + const params = createParams({ sameOriginWithAncestors: false }); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "NotAllowedError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // Spec: If the length of options.user.id is not between 1 and 64 bytes (inclusive) then return a TypeError. + it("should throw error if user.id is too small", async () => { + const params = createParams({ user: { id: "", displayName: "name" } }); + + const result = async () => await client.createCredential(params, tab); + + await expect(result).rejects.toBeInstanceOf(TypeError); + }); + + // Spec: If the length of options.user.id is not between 1 and 64 bytes (inclusive) then return a TypeError. + it("should throw error if user.id is too large", async () => { + const params = createParams({ + user: { + id: "YWJzb2x1dGVseS13YXktd2F5LXRvby1sYXJnZS1iYXNlNjQtZW5jb2RlZC11c2VyLWlkLWJpbmFyeS1zZXF1ZW5jZQ", + displayName: "name", + }, + }); + + const result = async () => await client.createCredential(params, tab); + + await expect(result).rejects.toBeInstanceOf(TypeError); + }); + + // Spec: If callerOrigin is an opaque origin, return a DOMException whose name is "NotAllowedError", and terminate this algorithm. + // Not sure how to check this, or if it matters. + it.todo("should throw error if origin is an opaque origin"); + + // Spec: Let effectiveDomain be the callerOrigin’s effective domain. If effective domain is not a valid domain, then return a DOMException whose name is "SecurityError" and terminate this algorithm. + it("should throw error if origin is not a valid domain name", async () => { + const params = createParams({ + origin: "invalid-domain-name", + }); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // Spec: If options.rp.id is not a registrable domain suffix of and is not equal to effectiveDomain, return a DOMException whose name is "SecurityError", and terminate this algorithm. + it("should throw error if rp.id is not valid for this origin", async () => { + const params = createParams({ + origin: "https://passwordless.dev", + rp: { id: "bitwarden.com", name: "Bitwraden" }, + }); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + it("should throw error if origin is not an https domain", async () => { + const params = createParams({ + origin: "http://passwordless.dev", + rp: { id: "bitwarden.com", name: "Bitwraden" }, + }); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // Spec: If credTypesAndPubKeyAlgs is empty, return a DOMException whose name is "NotSupportedError", and terminate this algorithm. + it("should throw error if no support key algorithms were found", async () => { + const params = createParams({ + pubKeyCredParams: [ + { alg: -9001, type: "public-key" }, + { alg: -7, type: "not-supported" as any }, + ], + }); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "NotSupportedError" }); + await rejects.toBeInstanceOf(DOMException); + }); + }); + + describe("aborting", () => { + // Spec: If the options.signal is present and its aborted flag is set to true, return a DOMException whose name is "AbortError" and terminate this algorithm. + it("should throw error if aborting using abort controller", async () => { + const params = createParams({}); + const abortController = new AbortController(); + abortController.abort(); + + const result = async () => await client.createCredential(params, tab, abortController); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "AbortError" }); + await rejects.toBeInstanceOf(DOMException); + }); + }); + + describe("creating a new credential", () => { + it("should call authenticator.makeCredential", async () => { + const params = createParams({ + authenticatorSelection: { residentKey: "required", userVerification: "required" }, + }); + authenticator.makeCredential.mockResolvedValue(createAuthenticatorMakeResult()); + + await client.createCredential(params, tab); + + expect(authenticator.makeCredential).toHaveBeenCalledWith( + expect.objectContaining({ + requireResidentKey: true, + requireUserVerification: true, + rpEntity: expect.objectContaining({ + id: RpId, + }), + userEntity: expect.objectContaining({ + displayName: params.user.displayName, + }), + }), + tab, + expect.anything() + ); + }); + + // Spec: If any authenticator returns an error status equivalent to "InvalidStateError", Return a DOMException whose name is "InvalidStateError" and terminate this algorithm. + it("should throw error if authenticator throws InvalidState", async () => { + const params = createParams(); + authenticator.makeCredential.mockRejectedValue( + new Fido2AutenticatorError(Fido2AutenticatorErrorCode.InvalidState) + ); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "InvalidStateError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // This keeps sensetive information form leaking + it("should throw NotAllowedError if authenticator throws unknown error", async () => { + const params = createParams(); + authenticator.makeCredential.mockRejectedValue(new Error("unknown error")); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "NotAllowedError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + it("should throw FallbackRequestedError if feature flag is not enabled", async () => { + const params = createParams(); + configService.getFeatureFlag.mockResolvedValue(false); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toThrow(FallbackRequestedError); + }); + + it("should throw FallbackRequestedError if user is logged out", async () => { + const params = createParams(); + authService.getAuthStatus.mockResolvedValue(AuthenticationStatus.LoggedOut); + + const result = async () => await client.createCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toThrow(FallbackRequestedError); + }); + }); + + function createParams(params: Partial = {}): CreateCredentialParams { + return { + origin: params.origin ?? "https://bitwarden.com", + sameOriginWithAncestors: params.sameOriginWithAncestors ?? true, + attestation: params.attestation, + authenticatorSelection: params.authenticatorSelection, + challenge: params.challenge ?? "MzItYnl0ZXMtYmFzZTY0LWVuY29kZS1jaGFsbGVuZ2U", + excludeCredentials: params.excludeCredentials, + extensions: params.extensions, + pubKeyCredParams: params.pubKeyCredParams ?? [ + { + alg: -7, + type: "public-key", + }, + ], + rp: params.rp ?? { + id: RpId, + name: "Bitwarden", + }, + user: params.user ?? { + id: "YmFzZTY0LWVuY29kZWQtdXNlci1pZA", + displayName: "User Name", + }, + fallbackSupported: params.fallbackSupported ?? false, + timeout: params.timeout, + }; + } + + function createAuthenticatorMakeResult(): Fido2AuthenticatorMakeCredentialResult { + return { + credentialId: guidToRawFormat(Utils.newGuid()), + attestationObject: randomBytes(128), + authData: randomBytes(64), + publicKeyAlgorithm: -7, + }; + } + }); + + describe("assertCredential", () => { + describe("invalid params", () => { + // Spec: If callerOrigin is an opaque origin, return a DOMException whose name is "NotAllowedError", and terminate this algorithm. + // Not sure how to check this, or if it matters. + it.todo("should throw error if origin is an opaque origin"); + + // Spec: Let effectiveDomain be the callerOrigin’s effective domain. If effective domain is not a valid domain, then return a DOMException whose name is "SecurityError" and terminate this algorithm. + it("should throw error if origin is not a valid domain name", async () => { + const params = createParams({ + origin: "invalid-domain-name", + }); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // Spec: If options.rp.id is not a registrable domain suffix of and is not equal to effectiveDomain, return a DOMException whose name is "SecurityError", and terminate this algorithm. + it("should throw error if rp.id is not valid for this origin", async () => { + const params = createParams({ + origin: "https://passwordless.dev", + rpId: "bitwarden.com", + }); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + it("should throw error if origin is not an http domain", async () => { + const params = createParams({ + origin: "http://passwordless.dev", + rpId: "bitwarden.com", + }); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "SecurityError" }); + await rejects.toBeInstanceOf(DOMException); + }); + }); + + describe("aborting", () => { + // Spec: If the options.signal is present and its aborted flag is set to true, return a DOMException whose name is "AbortError" and terminate this algorithm. + it("should throw error if aborting using abort controller", async () => { + const params = createParams({}); + const abortController = new AbortController(); + abortController.abort(); + + const result = async () => await client.assertCredential(params, tab, abortController); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "AbortError" }); + await rejects.toBeInstanceOf(DOMException); + }); + }); + + describe("assert credential", () => { + // Spec: If any authenticator returns an error status equivalent to "InvalidStateError", Return a DOMException whose name is "InvalidStateError" and terminate this algorithm. + it("should throw error if authenticator throws InvalidState", async () => { + const params = createParams(); + authenticator.getAssertion.mockRejectedValue( + new Fido2AutenticatorError(Fido2AutenticatorErrorCode.InvalidState) + ); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "InvalidStateError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + // This keeps sensetive information form leaking + it("should throw NotAllowedError if authenticator throws unknown error", async () => { + const params = createParams(); + authenticator.getAssertion.mockRejectedValue(new Error("unknown error")); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toMatchObject({ name: "NotAllowedError" }); + await rejects.toBeInstanceOf(DOMException); + }); + + it("should throw FallbackRequestedError if feature flag is not enabled", async () => { + const params = createParams(); + configService.getFeatureFlag.mockResolvedValue(false); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toThrow(FallbackRequestedError); + }); + + it("should throw FallbackRequestedError if user is logged out", async () => { + const params = createParams(); + authService.getAuthStatus.mockResolvedValue(AuthenticationStatus.LoggedOut); + + const result = async () => await client.assertCredential(params, tab); + + const rejects = expect(result).rejects; + await rejects.toThrow(FallbackRequestedError); + }); + }); + + describe("assert non-discoverable credential", () => { + it("should call authenticator.assertCredential", async () => { + const allowedCredentialIds = [ + Fido2Utils.bufferToString(guidToRawFormat(Utils.newGuid())), + Fido2Utils.bufferToString(guidToRawFormat(Utils.newGuid())), + Fido2Utils.bufferToString(Utils.fromByteStringToArray("not-a-guid")), + ]; + const params = createParams({ + userVerification: "required", + allowedCredentialIds, + }); + authenticator.getAssertion.mockResolvedValue(createAuthenticatorAssertResult()); + + await client.assertCredential(params, tab); + + expect(authenticator.getAssertion).toHaveBeenCalledWith( + expect.objectContaining({ + requireUserVerification: true, + rpId: RpId, + allowCredentialDescriptorList: [ + expect.objectContaining({ + id: Fido2Utils.stringToBuffer(allowedCredentialIds[0]), + }), + expect.objectContaining({ + id: Fido2Utils.stringToBuffer(allowedCredentialIds[1]), + }), + expect.objectContaining({ + id: Fido2Utils.stringToBuffer(allowedCredentialIds[2]), + }), + ], + }), + tab, + expect.anything() + ); + }); + }); + + describe("assert discoverable credential", () => { + it("should call authenticator.assertCredential", async () => { + const params = createParams({ + userVerification: "required", + allowedCredentialIds: [], + }); + authenticator.getAssertion.mockResolvedValue(createAuthenticatorAssertResult()); + + await client.assertCredential(params, tab); + + expect(authenticator.getAssertion).toHaveBeenCalledWith( + expect.objectContaining({ + requireUserVerification: true, + rpId: RpId, + allowCredentialDescriptorList: [], + }), + tab, + expect.anything() + ); + }); + }); + + function createParams(params: Partial = {}): AssertCredentialParams { + return { + allowedCredentialIds: params.allowedCredentialIds ?? [], + challenge: params.challenge ?? Fido2Utils.bufferToString(randomBytes(16)), + origin: params.origin ?? "https://bitwarden.com", + rpId: params.rpId ?? RpId, + timeout: params.timeout, + userVerification: params.userVerification, + sameOriginWithAncestors: true, + fallbackSupported: params.fallbackSupported ?? false, + }; + } + + function createAuthenticatorAssertResult(): Fido2AuthenticatorGetAssertionResult { + return { + selectedCredential: { + id: randomBytes(32), + userHandle: randomBytes(32), + }, + authenticatorData: randomBytes(64), + signature: randomBytes(64), + }; + } + }); +}); + +/** This is a fake function that always returns the same byte sequence */ +function randomBytes(length: number) { + return new Uint8Array(Array.from({ length }, (_, k) => k % 255)); +} diff --git a/libs/common/src/vault/services/fido2/fido2-client.service.ts b/libs/common/src/vault/services/fido2/fido2-client.service.ts new file mode 100644 index 0000000000..16049fd08a --- /dev/null +++ b/libs/common/src/vault/services/fido2/fido2-client.service.ts @@ -0,0 +1,409 @@ +import { parse } from "tldts"; + +import { AuthService } from "../../../auth/abstractions/auth.service"; +import { AuthenticationStatus } from "../../../auth/enums/authentication-status"; +import { FeatureFlag } from "../../../enums/feature-flag.enum"; +import { ConfigServiceAbstraction } from "../../../platform/abstractions/config/config.service.abstraction"; +import { LogService } from "../../../platform/abstractions/log.service"; +import { Utils } from "../../../platform/misc/utils"; +import { + Fido2AutenticatorError, + Fido2AutenticatorErrorCode, + Fido2AuthenticatorGetAssertionParams, + Fido2AuthenticatorMakeCredentialsParams, + Fido2AuthenticatorService, + PublicKeyCredentialDescriptor, +} from "../../abstractions/fido2/fido2-authenticator.service.abstraction"; +import { + AssertCredentialParams, + AssertCredentialResult, + CreateCredentialParams, + CreateCredentialResult, + FallbackRequestedError, + Fido2ClientService as Fido2ClientServiceAbstraction, + PublicKeyCredentialParam, + UserRequestedFallbackAbortReason, + UserVerification, +} from "../../abstractions/fido2/fido2-client.service.abstraction"; + +import { isValidRpId } from "./domain-utils"; +import { Fido2Utils } from "./fido2-utils"; + +/** + * Bitwarden implementation of the Web Authentication API as described by W3C + * https://www.w3.org/TR/webauthn-3/#sctn-api + * + * It is highly recommended that the W3C specification is used a reference when reading this code. + */ +export class Fido2ClientService implements Fido2ClientServiceAbstraction { + constructor( + private authenticator: Fido2AuthenticatorService, + private configService: ConfigServiceAbstraction, + private authService: AuthService, + private logService?: LogService + ) {} + + async isFido2FeatureEnabled(): Promise { + return await this.configService.getFeatureFlag(FeatureFlag.Fido2VaultCredentials); + } + + async createCredential( + params: CreateCredentialParams, + tab: chrome.tabs.Tab, + abortController = new AbortController() + ): Promise { + const enableFido2VaultCredentials = await this.isFido2FeatureEnabled(); + + if (!enableFido2VaultCredentials) { + this.logService?.warning(`[Fido2Client] Fido2VaultCredential is not enabled`); + throw new FallbackRequestedError(); + } + + const authStatus = await this.authService.getAuthStatus(); + + if (authStatus === AuthenticationStatus.LoggedOut) { + this.logService?.warning(`[Fido2Client] Fido2VaultCredential is not enabled`); + throw new FallbackRequestedError(); + } + + if (!params.sameOriginWithAncestors) { + this.logService?.warning( + `[Fido2Client] Invalid 'sameOriginWithAncestors' value: ${params.sameOriginWithAncestors}` + ); + throw new DOMException("Invalid 'sameOriginWithAncestors' value", "NotAllowedError"); + } + + const userId = Fido2Utils.stringToBuffer(params.user.id); + if (userId.length < 1 || userId.length > 64) { + this.logService?.warning( + `[Fido2Client] Invalid 'user.id' length: ${params.user.id} (${userId.length})` + ); + throw new TypeError("Invalid 'user.id' length"); + } + + const parsedOrigin = parse(params.origin, { allowPrivateDomains: true }); + params.rp.id = params.rp.id ?? parsedOrigin.hostname; + + if (parsedOrigin.hostname == undefined || !params.origin.startsWith("https://")) { + this.logService?.warning(`[Fido2Client] Invalid https origin: ${params.origin}`); + throw new DOMException("'origin' is not a valid https origin", "SecurityError"); + } + + if (!isValidRpId(params.rp.id, params.origin)) { + this.logService?.warning( + `[Fido2Client] 'rp.id' cannot be used with the current origin: rp.id = ${params.rp.id}; origin = ${params.origin}` + ); + throw new DOMException("'rp.id' cannot be used with the current origin", "SecurityError"); + } + + let credTypesAndPubKeyAlgs: PublicKeyCredentialParam[]; + if (params.pubKeyCredParams?.length > 0) { + // Filter out all unsupported algorithms + credTypesAndPubKeyAlgs = params.pubKeyCredParams.filter( + (kp) => kp.alg === -7 && kp.type === "public-key" + ); + } else { + // Assign default algorithms + credTypesAndPubKeyAlgs = [ + { alg: -7, type: "public-key" }, + { alg: -257, type: "public-key" }, + ]; + } + + if (credTypesAndPubKeyAlgs.length === 0) { + const requestedAlgorithms = credTypesAndPubKeyAlgs.map((p) => p.alg).join(", "); + this.logService?.warning( + `[Fido2Client] No compatible algorithms found, RP requested: ${requestedAlgorithms}` + ); + throw new DOMException("No supported key algorithms were found", "NotSupportedError"); + } + + const collectedClientData = { + type: "webauthn.create", + challenge: params.challenge, + origin: params.origin, + crossOrigin: !params.sameOriginWithAncestors, + // tokenBinding: {} // Not currently supported + }; + const clientDataJSON = JSON.stringify(collectedClientData); + const clientDataJSONBytes = Utils.fromByteStringToArray(clientDataJSON); + const clientDataHash = await crypto.subtle.digest({ name: "SHA-256" }, clientDataJSONBytes); + const makeCredentialParams = mapToMakeCredentialParams({ + params, + credTypesAndPubKeyAlgs, + clientDataHash, + }); + + // Set timeout before invoking authenticator + if (abortController.signal.aborted) { + this.logService?.info(`[Fido2Client] Aborted with AbortController`); + throw new DOMException("The operation either timed out or was not allowed.", "AbortError"); + } + const timeout = setAbortTimeout( + abortController, + params.authenticatorSelection?.userVerification, + params.timeout + ); + + let makeCredentialResult; + try { + makeCredentialResult = await this.authenticator.makeCredential( + makeCredentialParams, + tab, + abortController + ); + } catch (error) { + if ( + abortController.signal.aborted && + abortController.signal.reason === UserRequestedFallbackAbortReason + ) { + this.logService?.info(`[Fido2Client] Aborting because user requested fallback`); + throw new FallbackRequestedError(); + } + + if ( + error instanceof Fido2AutenticatorError && + error.errorCode === Fido2AutenticatorErrorCode.InvalidState + ) { + this.logService?.warning(`[Fido2Client] Unknown error: ${error}`); + throw new DOMException("Unknown error occured.", "InvalidStateError"); + } + + this.logService?.info(`[Fido2Client] Aborted by user: ${error}`); + throw new DOMException( + "The operation either timed out or was not allowed.", + "NotAllowedError" + ); + } + + if (abortController.signal.aborted) { + this.logService?.info(`[Fido2Client] Aborted with AbortController`); + throw new DOMException("The operation either timed out or was not allowed.", "AbortError"); + } + + clearTimeout(timeout); + return { + credentialId: Fido2Utils.bufferToString(makeCredentialResult.credentialId), + attestationObject: Fido2Utils.bufferToString(makeCredentialResult.attestationObject), + authData: Fido2Utils.bufferToString(makeCredentialResult.authData), + clientDataJSON: Fido2Utils.bufferToString(clientDataJSONBytes), + publicKeyAlgorithm: makeCredentialResult.publicKeyAlgorithm, + transports: ["internal"], + }; + } + + async assertCredential( + params: AssertCredentialParams, + tab: chrome.tabs.Tab, + abortController = new AbortController() + ): Promise { + const enableFido2VaultCredentials = await this.isFido2FeatureEnabled(); + + if (!enableFido2VaultCredentials) { + this.logService?.warning(`[Fido2Client] Fido2VaultCredential is not enabled`); + throw new FallbackRequestedError(); + } + + const authStatus = await this.authService.getAuthStatus(); + + if (authStatus === AuthenticationStatus.LoggedOut) { + this.logService?.warning(`[Fido2Client] Fido2VaultCredential is not enabled`); + throw new FallbackRequestedError(); + } + + const { domain: effectiveDomain } = parse(params.origin, { allowPrivateDomains: true }); + if (effectiveDomain == undefined) { + this.logService?.warning(`[Fido2Client] Invalid origin: ${params.origin}`); + throw new DOMException("'origin' is not a valid domain", "SecurityError"); + } + + const parsedOrigin = parse(params.origin, { allowPrivateDomains: true }); + params.rpId = params.rpId ?? parsedOrigin.hostname; + + if (parsedOrigin.hostname == undefined || !params.origin.startsWith("https://")) { + this.logService?.warning(`[Fido2Client] Invalid https origin: ${params.origin}`); + throw new DOMException("'origin' is not a valid https origin", "SecurityError"); + } + + if (!isValidRpId(params.rpId, params.origin)) { + this.logService?.warning( + `[Fido2Client] 'rp.id' cannot be used with the current origin: rp.id = ${params.rpId}; origin = ${params.origin}` + ); + throw new DOMException("'rp.id' cannot be used with the current origin", "SecurityError"); + } + + const collectedClientData = { + type: "webauthn.get", + challenge: params.challenge, + origin: params.origin, + crossOrigin: !params.sameOriginWithAncestors, + // tokenBinding: {} // Not currently supported + }; + const clientDataJSON = JSON.stringify(collectedClientData); + const clientDataJSONBytes = Utils.fromByteStringToArray(clientDataJSON); + const clientDataHash = await crypto.subtle.digest({ name: "SHA-256" }, clientDataJSONBytes); + const getAssertionParams = mapToGetAssertionParams({ params, clientDataHash }); + + if (abortController.signal.aborted) { + this.logService?.info(`[Fido2Client] Aborted with AbortController`); + throw new DOMException("The operation either timed out or was not allowed.", "AbortError"); + } + + const timeout = setAbortTimeout(abortController, params.userVerification, params.timeout); + + let getAssertionResult; + try { + getAssertionResult = await this.authenticator.getAssertion( + getAssertionParams, + tab, + abortController + ); + } catch (error) { + if ( + abortController.signal.aborted && + abortController.signal.reason === UserRequestedFallbackAbortReason + ) { + this.logService?.info(`[Fido2Client] Aborting because user requested fallback`); + throw new FallbackRequestedError(); + } + + if ( + error instanceof Fido2AutenticatorError && + error.errorCode === Fido2AutenticatorErrorCode.InvalidState + ) { + this.logService?.warning(`[Fido2Client] Unknown error: ${error}`); + throw new DOMException("Unknown error occured.", "InvalidStateError"); + } + + this.logService?.info(`[Fido2Client] Aborted by user: ${error}`); + throw new DOMException( + "The operation either timed out or was not allowed.", + "NotAllowedError" + ); + } + + if (abortController.signal.aborted) { + this.logService?.info(`[Fido2Client] Aborted with AbortController`); + throw new DOMException("The operation either timed out or was not allowed.", "AbortError"); + } + clearTimeout(timeout); + + return { + authenticatorData: Fido2Utils.bufferToString(getAssertionResult.authenticatorData), + clientDataJSON: Fido2Utils.bufferToString(clientDataJSONBytes), + credentialId: Fido2Utils.bufferToString(getAssertionResult.selectedCredential.id), + userHandle: + getAssertionResult.selectedCredential.userHandle !== undefined + ? Fido2Utils.bufferToString(getAssertionResult.selectedCredential.userHandle) + : undefined, + signature: Fido2Utils.bufferToString(getAssertionResult.signature), + }; + } +} + +const TIMEOUTS = { + NO_VERIFICATION: { + DEFAULT: 120000, + MIN: 30000, + MAX: 180000, + }, + WITH_VERIFICATION: { + DEFAULT: 300000, + MIN: 30000, + MAX: 600000, + }, +}; + +function setAbortTimeout( + abortController: AbortController, + userVerification?: UserVerification, + timeout?: number +): number { + let clampedTimeout: number; + + if (userVerification === "required") { + timeout = timeout ?? TIMEOUTS.WITH_VERIFICATION.DEFAULT; + clampedTimeout = Math.max( + TIMEOUTS.WITH_VERIFICATION.MIN, + Math.min(timeout, TIMEOUTS.WITH_VERIFICATION.MAX) + ); + } else { + timeout = timeout ?? TIMEOUTS.NO_VERIFICATION.DEFAULT; + clampedTimeout = Math.max( + TIMEOUTS.NO_VERIFICATION.MIN, + Math.min(timeout, TIMEOUTS.NO_VERIFICATION.MAX) + ); + } + + return window.setTimeout(() => abortController.abort(), clampedTimeout); +} + +/** + * Convert data gathered by the WebAuthn Client to a format that can be used by the authenticator. + */ +function mapToMakeCredentialParams({ + params, + credTypesAndPubKeyAlgs, + clientDataHash, +}: { + params: CreateCredentialParams; + credTypesAndPubKeyAlgs: PublicKeyCredentialParam[]; + clientDataHash: ArrayBuffer; +}): Fido2AuthenticatorMakeCredentialsParams { + const excludeCredentialDescriptorList: PublicKeyCredentialDescriptor[] = + params.excludeCredentials?.map((credential) => ({ + id: Fido2Utils.stringToBuffer(credential.id), + transports: credential.transports, + type: credential.type, + })) ?? []; + + const requireResidentKey = + params.authenticatorSelection?.residentKey === "required" || + params.authenticatorSelection?.residentKey === "preferred" || + (params.authenticatorSelection?.residentKey === undefined && + params.authenticatorSelection?.requireResidentKey === true); + + return { + requireResidentKey, + requireUserVerification: params.authenticatorSelection?.userVerification === "required", + enterpriseAttestationPossible: params.attestation === "enterprise", + excludeCredentialDescriptorList, + credTypesAndPubKeyAlgs, + hash: clientDataHash, + rpEntity: { + id: params.rp.id, + name: params.rp.name, + }, + userEntity: { + id: Fido2Utils.stringToBuffer(params.user.id), + displayName: params.user.displayName, + }, + fallbackSupported: params.fallbackSupported, + }; +} + +/** + * Convert data gathered by the WebAuthn Client to a format that can be used by the authenticator. + */ +function mapToGetAssertionParams({ + params, + clientDataHash, +}: { + params: AssertCredentialParams; + clientDataHash: ArrayBuffer; +}): Fido2AuthenticatorGetAssertionParams { + const allowCredentialDescriptorList: PublicKeyCredentialDescriptor[] = + params.allowedCredentialIds.map((id) => ({ + id: Fido2Utils.stringToBuffer(id), + type: "public-key", + })); + + return { + rpId: params.rpId, + requireUserVerification: params.userVerification === "required", + hash: clientDataHash, + allowCredentialDescriptorList, + extensions: {}, + fallbackSupported: params.fallbackSupported, + }; +} diff --git a/libs/common/src/vault/services/fido2/fido2-utils.ts b/libs/common/src/vault/services/fido2/fido2-utils.ts new file mode 100644 index 0000000000..a2de137550 --- /dev/null +++ b/libs/common/src/vault/services/fido2/fido2-utils.ts @@ -0,0 +1,26 @@ +import { Utils } from "../../../platform/misc/utils"; + +export class Fido2Utils { + static bufferToString(bufferSource: BufferSource): string { + const buffer = Fido2Utils.bufferSourceToUint8Array(bufferSource); + + return Utils.fromBufferToUrlB64(buffer); + } + + static stringToBuffer(str: string): Uint8Array { + return Utils.fromUrlB64ToArray(str); + } + + static bufferSourceToUint8Array(bufferSource: BufferSource) { + if (Fido2Utils.isArrayBuffer(bufferSource)) { + return new Uint8Array(bufferSource); + } else { + return new Uint8Array(bufferSource.buffer); + } + } + + /** Utility function to identify type of bufferSource. Necessary because of differences between runtimes */ + private static isArrayBuffer(bufferSource: BufferSource): bufferSource is ArrayBuffer { + return bufferSource instanceof ArrayBuffer || bufferSource.buffer === undefined; + } +} diff --git a/libs/common/src/vault/services/fido2/guid-utils.ts b/libs/common/src/vault/services/fido2/guid-utils.ts new file mode 100644 index 0000000000..66e6cbb1d7 --- /dev/null +++ b/libs/common/src/vault/services/fido2/guid-utils.ts @@ -0,0 +1,95 @@ +/* + License for: guidToRawFormat, guidToStandardFormat + Source: https://github.com/uuidjs/uuid/ + The MIT License (MIT) + Copyright (c) 2010-2020 Robert Kieffer and other contributors + Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.*/ + +import { Utils } from "../../../platform/misc/utils"; + +/** Private array used for optimization */ +const byteToHex = Array.from({ length: 256 }, (_, i) => (i + 0x100).toString(16).substring(1)); + +/** Convert standard format (XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX) UUID to raw 16 byte array. */ +export function guidToRawFormat(guid: string) { + if (!Utils.isGuid(guid)) { + throw TypeError("GUID parameter is invalid"); + } + + let v; + const arr = new Uint8Array(16); + + // Parse ########-....-....-....-............ + arr[0] = (v = parseInt(guid.slice(0, 8), 16)) >>> 24; + arr[1] = (v >>> 16) & 0xff; + arr[2] = (v >>> 8) & 0xff; + arr[3] = v & 0xff; + + // Parse ........-####-....-....-............ + arr[4] = (v = parseInt(guid.slice(9, 13), 16)) >>> 8; + arr[5] = v & 0xff; + + // Parse ........-....-####-....-............ + arr[6] = (v = parseInt(guid.slice(14, 18), 16)) >>> 8; + arr[7] = v & 0xff; + + // Parse ........-....-....-####-............ + arr[8] = (v = parseInt(guid.slice(19, 23), 16)) >>> 8; + arr[9] = v & 0xff; + + // Parse ........-....-....-....-############ + // (Use "/" to avoid 32-bit truncation when bit-shifting high-order bytes) + arr[10] = ((v = parseInt(guid.slice(24, 36), 16)) / 0x10000000000) & 0xff; + arr[11] = (v / 0x100000000) & 0xff; + arr[12] = (v >>> 24) & 0xff; + arr[13] = (v >>> 16) & 0xff; + arr[14] = (v >>> 8) & 0xff; + arr[15] = v & 0xff; + + return arr; +} + +/** Convert raw 16 byte array to standard format (XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX) UUID. */ +export function guidToStandardFormat(bufferSource: BufferSource) { + const arr = + bufferSource instanceof ArrayBuffer + ? new Uint8Array(bufferSource) + : new Uint8Array(bufferSource.buffer); + // Note: Be careful editing this code! It's been tuned for performance + // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434 + const guid = ( + byteToHex[arr[0]] + + byteToHex[arr[1]] + + byteToHex[arr[2]] + + byteToHex[arr[3]] + + "-" + + byteToHex[arr[4]] + + byteToHex[arr[5]] + + "-" + + byteToHex[arr[6]] + + byteToHex[arr[7]] + + "-" + + byteToHex[arr[8]] + + byteToHex[arr[9]] + + "-" + + byteToHex[arr[10]] + + byteToHex[arr[11]] + + byteToHex[arr[12]] + + byteToHex[arr[13]] + + byteToHex[arr[14]] + + byteToHex[arr[15]] + ).toLowerCase(); + + // Consistency check for valid UUID. If this throws, it's likely due to one + // of the following: + // - One or more input array values don't map to a hex octet (leading to + // "undefined" in the uuid) + // - Invalid input values for the RFC `version` or `variant` fields + if (!Utils.isGuid(guid)) { + throw TypeError("Converted GUID is invalid"); + } + + return guid; +} diff --git a/libs/common/src/vault/services/fido2/noop-fido2-user-interface.service.ts b/libs/common/src/vault/services/fido2/noop-fido2-user-interface.service.ts new file mode 100644 index 0000000000..440bd51900 --- /dev/null +++ b/libs/common/src/vault/services/fido2/noop-fido2-user-interface.service.ts @@ -0,0 +1,14 @@ +import { + Fido2UserInterfaceService as Fido2UserInterfaceServiceAbstraction, + Fido2UserInterfaceSession, +} from "../../abstractions/fido2/fido2-user-interface.service.abstraction"; + +/** + * Noop implementation of the {@link Fido2UserInterfaceService}. + * This implementation does not provide any user interface. + */ +export class Fido2UserInterfaceService implements Fido2UserInterfaceServiceAbstraction { + newSession(): Promise { + throw new Error("Not implemented exception"); + } +} diff --git a/package-lock.json b/package-lock.json index 70cf905b80..cdff4a8c21 100644 --- a/package-lock.json +++ b/package-lock.json @@ -35,6 +35,7 @@ "bootstrap": "4.6.0", "braintree-web-drop-in": "1.40.0", "bufferutil": "4.0.7", + "cbor-redux": "^0.4.0", "chalk": "4.1.2", "commander": "7.2.0", "core-js": "3.32.0", @@ -17669,6 +17670,11 @@ "integrity": "sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==", "dev": true }, + "node_modules/cbor-redux": { + "version": "0.4.0", + "resolved": "https://registry.npmjs.org/cbor-redux/-/cbor-redux-0.4.0.tgz", + "integrity": "sha512-jP8BB9zF2uVTwbNXe7kRNIQRmKFMNKZcx0A+TCc6v3kJHoIKzKexQ+DjvXP/G5HuPF88myDdVE2grBOizsbMxg==" + }, "node_modules/ccount": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",