openvibers/openvibe.sdk Commits

SDK 0.151.0: related-origin passkey sign-in for sso (#228)

OP OpenVibers committed 2 days ago · 69365f2195 · 9 files, +133 −11

Opt-in relatedPasskeys adds POST /auth/passkey/options and
POST /auth/passkey/verify to openvibe-sdk/sso. The site's server brokers a
WebAuthn ceremony for its exact origin through Network as its OAuth client,
keeps the random browser binding in its own __Host- cookie, and turns
Network's single-use result into the site's ordinary session. Network
verifies the signed origin and RP ID; no Network cookie or token reaches the
browser. Browsers without PublicKeyCredential.getClientCapabilities()
.relatedOrigins keep the existing OAuth/passkey path.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 0f59730..f9698dc 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,13 @@
  # Changelog
  
++## 0.151.0 — 2026-11-11
++
++- Add related-origin passkey sign-in to `openvibe-sdk/sso` (opt-in `relatedPasskeys: true`): `POST /auth/passkey/options`
++  and `POST /auth/passkey/verify` broker a WebAuthn ceremony for this site's exact origin through OpenVibe.Network as
++  its OAuth client. The random browser binding stays in the site's own `__Host-` cookie; Network verifies the exact
++  origin and RP ID and returns a single-use result that becomes the site's ordinary session. Browsers without
++  `PublicKeyCredential.getClientCapabilities().relatedOrigins` keep the existing OAuth/passkey path.
++
  ## 0.150.0 — 2026-11-11
  
  - Add `ai.turn(input, options)` for file-capable `ai.complete` runs. Its typed `output_file` option stores a text, Markdown, CSV or JSON answer in Media and returns private `ai.file` artifact references; existing `ai.files.read()` reads a returned object.
ddiff --git a/README.md b/README.md
iindex e6df453..70d609f 100644
---- a/README.md
++++ b/README.md
@@@ -8,12 +8,12 @@
  **Install and test:** `npm ci && npm test` (Node 20 or newer)
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.150.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.151.0
  ```
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.150.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.151.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.150.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.151.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex fee62b8..b96072a 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.150.0",
++  "version": "0.151.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 399c1e2..a894f94 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.150.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.151.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, composer, cam, mediaUpload, ui, community, homeFeed, feed, bot, search, bench, meme, vision, themes, design, redact, chat, ai, credentials, jobs, agents, tools, projects, geo, history, userCard, player, agentSheet). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -64,7 +64,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.150.0';
++const SDK_VERSION = '0.151.0';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex 56f0b10..978cf0d 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.150.0",
++  "version": "0.151.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.150.0",
++      "version": "0.151.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex cac5b11..8955126 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.150.0",
++  "version": "0.151.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex f7a8ad9..281df7d 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.150.0';
++const SDK_VERSION = '0.151.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/sso/index.js b/src/sso/index.js
iindex 4fd77c3..414fe08 100644
---- a/src/sso/index.js
++++ b/src/sso/index.js
@@@ -36,6 +36,8 @@
   *   GET  /health    → { ok, client: 'ok' | 'invalid' | 'unknown' }: does the Network accept this site's OAuth client?
   *                     (a token request with a code that cannot exist: invalid_grant means the client is fine,
   *                     invalid_client means its id or secret is wrong; cached 10 minutes; 503 only for 'invalid')
++ *   POST /passkey/options → { state, options }: a related-origin passkey ceremony (opt-in relatedPasskeys)
++ *   POST /passkey/verify  → the browser's assertion, exchanged for this site's ordinary session
   *   POST /handoff   → { ticket, expires_in }: a one-time 60 s ticket for a link to another OpenVibe site
   *                     (the caller's session proves the person; body: the destination's client_id + redirect_uri).
   *                     Mount sso.handoff() early: an arrival carrying ?ov_handoff= redeems for this site's session
@@@ -68,6 +70,7 @@ const QUIET_FIRST = '2';
  const VERIFIER_COOKIE = 'ov_oauth_verifier';
  const FLOW_COOKIES = [STATE_COOKIE, NEXT_COOKIE, SILENT_COOKIE, VERIFIER_COOKIE];
  const RETRY_COOKIE = 'ov_oauth_retry';
++const PASSKEY_BIND_COOKIE = '__Host-ov_passkey_bind';
  // A code no sign-in can ever have: the health check presents it and reads which way the Network refuses it.
  const HEALTH_CODE = 'ov_health_check_never_issued';
  
@@@ -194,6 +197,8 @@ function createSsoClient(opts = {}) {
      const fetchImpl = opts.fetch || globalThis.fetch;
      const log = opts.log || console;
      const accessMaxAgeMs = opts.accessMaxAgeMs || 24 * 3600e3;
++    // Related-origin passkeys are opt-in per site (the well-known list and the Network decide the rest).
++    const relatedPasskeys = opts.relatedPasskeys === true;
      if (!baseUrl || !opts.clientId) throw new TypeError('createSsoClient: baseUrl and clientId are required');
      const next = (value) => sanitizeNext(value, { baseUrl, networkUrl });
      const siteName = String(opts.siteName || `OpenVibe.${site.charAt(0).toUpperCase()}${site.slice(1)}`);
@@@ -312,6 +317,24 @@ function createSsoClient(opts = {}) {
          throw lastErr || new Error('Network unreachable');
      }
  
++    /** A related-passkey POST to Network as this site's OAuth client. */
++    async function networkClientPost(path, body) {
++        return networkPost(path, { client_id: opts.clientId, client_secret: opts.clientSecret, ...body });
++    }
++
++    /** Only this site's own page may start or finish a passkey ceremony. */
++    function sameOrigin(req) {
++        let origin;
++        try { origin = new URL(baseUrl).origin; } catch { return false; }
++        const given = req.headers && req.headers.origin;
++        if (given) return given === origin;
++        return !!(req.headers && req.headers['sec-fetch-site'] === 'same-origin');
++    }
++
++    function passkeyUnavailable(res) {
++        return res.status(404).json({ error: 'not_found' });
++    }
++
      /** The authorize URL for a sign-in (pure; exported for tests). → { url, state, verifier } */
      function authorizeUrl({ silent = false, prompt = '', loginHint = '' } = {}) {
          const verifier = crypto.randomBytes(32).toString('base64url');
@@@ -414,6 +437,49 @@ function createSsoClient(opts = {}) {
              }
          },
  
++        /**
++         * A related-origin passkey ceremony: Network issues the options for this exact origin, and the
++         * product keeps the random browser binding in its own __Host- cookie (Network only stores its hash).
++         */
++        async passkeyOptions(req, res) {
++            if (!relatedPasskeys) return passkeyUnavailable(res);
++            if (!sameOrigin(req)) return res.status(403).json({ error: 'forbidden', error_description: 'Same-origin request required' });
++            const binding = crypto.randomBytes(32).toString('base64url');
++            try {
++                const data = await networkClientPost('/api/auth/passkeys/related/options', { origin: new URL(baseUrl).origin, purpose: 'login', binding });
++                if (!data || !data.state || !data.options) throw new Error('Network issued no ceremony');
++                res.cookie(PASSKEY_BIND_COOKIE, binding, { httpOnly: true, secure, sameSite: 'strict', path: '/', maxAge: 5 * 60e3 });
++                return res.json({ state: data.state, options: data.options });
++            } catch (err) {
++                if (err.status && err.status < 500) return res.status(401).json({ error: err.error || 'invalid_request', error_description: err.error_description || 'Passkey sign-in is not available' });
++                log.error(`[${site} auth] passkey options failed: ${err.message}`);
++                return res.status(502).json({ error: 'server_error', error_description: 'OpenVibe.Network could not be reached' });
++            }
++        },
++
++        /** The assertion is verified by Network; only its single-use result becomes this site's session. */
++        async passkeyVerify(req, res) {
++            if (!relatedPasskeys) return passkeyUnavailable(res);
++            if (!sameOrigin(req)) return res.status(403).json({ error: 'forbidden', error_description: 'Same-origin request required' });
++            const binding = parseCookies(req)[PASSKEY_BIND_COOKIE];
++            const body = req.body || {};
++            if (!binding || typeof body.state !== 'string' || !body.response) return res.status(401).json({ error: 'invalid_request', error_description: 'Passkey sign-in expired; try again' });
++            try {
++                const verified = await networkClientPost('/api/auth/passkeys/related/verify', { origin: new URL(baseUrl).origin, binding, state: body.state, response: body.response });
++                if (!verified || typeof verified.result !== 'string') throw new Error('Network issued no result');
++                const tokens = await networkClientPost('/api/auth/passkeys/related/redeem', { origin: new URL(baseUrl).origin, result: verified.result });
++                if (!tokens || typeof tokens.access_token !== 'string') throw new Error('Network issued no session');
++                setSession(res, tokens.access_token, tokens.refresh_token);
++                res.clearCookie(PASSKEY_BIND_COOKIE, { path: '/' });
++                return res.json({ ok: true, user: tokens.user || claimsToUser(await verify(tokens.access_token)) });
++            } catch (err) {
++                res.clearCookie(PASSKEY_BIND_COOKIE, { path: '/' });
++                if (err.status && err.status < 500) return res.status(401).json({ error: err.error || 'invalid_grant', error_description: err.error_description || 'Passkey sign-in failed' });
++                log.error(`[${site} auth] passkey verify failed: ${err.message}`);
++                return res.status(502).json({ error: 'server_error', error_description: 'OpenVibe.Network could not be reached' });
++            }
++        },
++
          async logout(req, res) {
              // Best-effort revocation: the Network's rotating refresh tokens invalidate themselves anyway.
              const refresh = readRefresh(req);
@@@ -515,6 +581,8 @@ function createSsoClient(opts = {}) {
          r.get('/logout', wrap(handlers.logout));
          r.get('/me', wrap(handlers.me));
          r.post('/refresh', wrap(handlers.refresh));
++        r.post('/passkey/options', json, badJson, wrap(handlers.passkeyOptions));
++        r.post('/passkey/verify', json, badJson, wrap(handlers.passkeyVerify));
          r.get('/health', wrap(handlers.health));
          r.post('/handoff', json, badJson, wrap(handlers.handoffMint));
          return r;
@@@ -569,7 +637,7 @@ function createSsoClient(opts = {}) {
          };
      }
  
--    return { router, handlers, handoff, optionalAuth, requireAuth, verify, extractToken, authorizeUrl, tokenGrant, checkClient, redirectUri, audience };
++    return { router, handlers, handoff, optionalAuth, requireAuth, verify, extractToken, authorizeUrl, tokenGrant, checkClient, redirectUri, audience, relatedPasskeys };
  }
  
  module.exports = {
ddiff --git a/test/sso.test.js b/test/sso.test.js
iindex 4991101..10bcbf1 100644
---- a/test/sso.test.js
++++ b/test/sso.test.js
@@@ -15,6 +15,7 @@ const session = (over = {}) => sign({ sub: 7, id: 7, username: 'ana', iss: ISS,
  
  // A stub Network: /oauth/token (code, refresh, jwt-bearer), /oauth/revoke, the JWKS.
  const net = { grants: [], revoked: [], refuseRefresh: false };
++const passkey = { options: [], verify: [], redeem: [] };
  const server = http.createServer((req, res) => {
      let raw = ''; req.on('data', (c) => { raw += c; });
      req.on('end', () => {
@@@ -22,6 +23,19 @@ const server = http.createServer((req, res) => {
          if (req.url === '/api/.well-known/jwks') return send(200, { keys: [{ ...keys.publicKey.export({ format: 'jwk' }), kid: 'k1', use: 'sig', alg: 'RS256' }] });
          const body = raw ? JSON.parse(raw) : {};
          if (req.url === '/oauth/revoke') { net.revoked.push(body.token); return send(200, { revoked: true }); }
++        if (req.url === '/api/auth/passkeys/related/options') {
++            passkey.options.push(body);
++            if (body.client_secret !== 'secret') return send(401, { error: 'invalid_client' });
++            return send(200, { state: 'pk_state', options: { challenge: 'pk_challenge', rp: { id: 'openvibe.network' }, allowCredentials: [] } });
++        }
++        if (req.url === '/api/auth/passkeys/related/verify') {
++            passkey.verify.push(body);
++            return send(200, { result: 'pk_result' });
++        }
++        if (req.url === '/api/auth/passkeys/related/redeem') {
++            passkey.redeem.push(body);
++            return send(200, { access_token: session(), refresh_token: 'rt_pk', user: { username: 'ana' } });
++        }
          if (req.url === '/oauth/token') {
              net.grants.push(body);
              if (body.client_secret !== 'secret') return send(401, { error: 'invalid_client' });
@@@ -226,6 +240,38 @@ run([
          assert.ok(ok.cookies.ov_token);
      }],
  
++    ['passkeys: the related-origin ceremony is same-origin, bound in a __Host- cookie, and only its result becomes a session', async () => {
++        const pk = createSsoClient({ site: 'trade', baseUrl: 'https://openvibe.trade', clientId: 'trade', clientSecret: 'secret', networkUrl: ISS, networkInternalUrl: base, issuer: ISS, relatedPasskeys: true, log: { warn() {}, error() {}, info() {} } });
++        const off = createSsoClient({ site: 'trade', baseUrl: 'https://openvibe.trade', clientId: 'trade', clientSecret: 'secret', networkUrl: ISS, networkInternalUrl: base, issuer: ISS, log: { warn() {}, error() {}, info() {} } });
++        const disabled = fakeRes();
++        await off.handlers.passkeyOptions({ headers: { origin: 'https://openvibe.trade' }, body: {} }, disabled);
++        assert.equal(disabled.statusCode, 404, 'related passkeys are opt-in');
++        const cross = fakeRes();
++        await pk.handlers.passkeyOptions({ headers: { origin: 'https://evil.example' }, body: {} }, cross);
++        assert.equal(cross.statusCode, 403, 'only this origin starts a ceremony');
++        const before = passkey.options.length;
++        const start = fakeRes();
++        await pk.handlers.passkeyOptions({ headers: { origin: 'https://openvibe.trade' }, body: {} }, start);
++        assert.equal(start.statusCode, 200); assert.equal(start.body.state, 'pk_state');
++        const bind = start.cookies['__Host-ov_passkey_bind'];
++        assert.ok(bind && bind.v); assert.deepEqual([bind.o.httpOnly, bind.o.secure, bind.o.sameSite, bind.o.path], [true, true, 'strict', '/']);
++        const asked = passkey.options.at(-1);
++        assert.deepEqual([asked.origin, asked.purpose, asked.binding, asked.client_id, asked.client_secret], ['https://openvibe.trade', 'login', bind.v, 'trade', 'secret']);
++        const missing = fakeRes();
++        await pk.handlers.passkeyVerify({ headers: { origin: 'https://openvibe.trade' }, body: { state: 'pk_state', response: { id: 'x' } } }, missing);
++        assert.equal(missing.statusCode, 401, 'a missing browser binding never reaches Network');
++        assert.equal(passkey.verify.length, 0);
++        const crossVerify = fakeRes();
++        await pk.handlers.passkeyVerify({ headers: { origin: 'https://evil.example', cookie: cookieHeader({ '__Host-ov_passkey_bind': bind.v }) }, body: { state: 'pk_state', response: { id: 'x' } } }, crossVerify);
++        assert.equal(crossVerify.statusCode, 403);
++        const done = fakeRes();
++        await pk.handlers.passkeyVerify({ headers: { origin: 'https://openvibe.trade', cookie: cookieHeader({ '__Host-ov_passkey_bind': bind.v }) }, body: { state: 'pk_state', response: { id: 'x' } } }, done);
++        assert.equal(done.statusCode, 200); assert.equal(done.body.ok, true);
++        assert.deepEqual([passkey.verify.at(-1).origin, passkey.verify.at(-1).binding], ['https://openvibe.trade', bind.v]);
++        assert.deepEqual([passkey.redeem.at(-1).origin, passkey.redeem.at(-1).result, passkey.redeem.at(-1).client_secret], ['https://openvibe.trade', 'pk_result', 'secret']);
++        assert.ok(done.cookies.ov_token.v); assert.equal(done.cookies.ov_sso_hint.v, 'account'); assert.ok(done.cleared.includes('__Host-ov_passkey_bind'));
++    }],
++
      ['refresh rotates; a refused refresh ends the session; logout revokes and hints guest', async () => {
          const r = fakeRes();
          await sso.handlers.refresh({ headers: { cookie: cookieHeader({ ov_refresh: 'rt_a' }) } }, r);