From 96043efe4651a3c9c2088c5cddbd3495fa79a2e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Reinhard=20X=2E=20F=C3=BCrst?= Date: Sun, 9 Aug 2026 20:17:11 +0200 Subject: [PATCH] V 1.3.0 Anmeldung per Passkey (WebAuthn) Passkey-Login wie in ausgaben-next/werte-next: auf der Login-Seite "Mit Passkey anmelden", Verwaltung der eigenen Passkeys unter /einstellungen (Button oben rechts). Das Passwort bleibt als Alternative bestehen. - lib/webauthn.ts, lib/passkeys.ts sowie API-Routen unter /api/passkey - proxy.ts: /api/passkey/authenticate ohne Session erreichbar - Styles als eigene CSS-Klassen in globals.css (kein Tailwind in diesem Projekt), passend zum vorhandenen login-*/app-*-Schema - Tabelle tabletten_passkeys in der DB medizin: app-spezifischer Name, damit sich Apps desselben Stacks nicht gegenseitig Passkeys anzeigen oder loeschen - RP-Konfiguration ueber TABLETTEN_RP_*, da sich die .env auf dem Server mit anderen Apps teilt, die RP_ID/RP_ORIGIN bereits belegen Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 19 ++ app/api/passkey/authenticate/route.ts | 28 +++ app/api/passkey/register/route.ts | 36 ++++ app/api/passkey/route.ts | 40 ++++ app/einstellungen/page.tsx | 15 ++ app/globals.css | 150 +++++++++++++++ app/login/page.tsx | 57 ++++++ components/AppLayout.tsx | 10 +- components/Passkeys.tsx | 135 +++++++++++++ compose.yml | 6 + docker-compose.yml | 4 + lib/auth.ts | 5 + lib/passkeys.ts | 144 ++++++++++++++ lib/webauthn.ts | 176 +++++++++++++++++ package-lock.json | 267 +++++++++++++++++++++++++- package.json | 4 +- proxy.ts | 3 +- 17 files changed, 1094 insertions(+), 5 deletions(-) create mode 100644 app/api/passkey/authenticate/route.ts create mode 100644 app/api/passkey/register/route.ts create mode 100644 app/api/passkey/route.ts create mode 100644 app/einstellungen/page.tsx create mode 100644 components/Passkeys.tsx create mode 100644 lib/passkeys.ts create mode 100644 lib/webauthn.ts diff --git a/README.md b/README.md index e215bc4..3a3698d 100644 --- a/README.md +++ b/README.md @@ -34,3 +34,22 @@ You can check out [the Next.js GitHub repository](https://github.com/vercel/next The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js. Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details. + +## Anmeldung & Passkeys + +Benutzer und bcrypt-Passworthashes stehen in `AUTH_USERS` (Format `name:hash,name2:hash2`), +die Session ist ein JWT-Cookie (`AUTH_SECRET`). + +Zusätzlich kann sich jeder Benutzer per **Passkey** anmelden (Fingerabdruck, +Gesichtserkennung oder Geräte-PIN). Das Passwort bleibt als Alternative bestehen. + +- **Registrieren**: nach der Anmeldung oben rechts auf *Einstellungen* → „Passkey hinzufügen". +- **Anmelden**: auf der Login-Seite „Mit Passkey anmelden". +- **Speicherung**: Tabelle `tabletten_passkeys` in der Datenbank `medizin`; sie wird beim + ersten Zugriff automatisch angelegt, falls der DB-Benutzer CREATE-Rechte hat. Der + app-spezifische Name verhindert Kollisionen mit anderen Apps desselben Stacks. +- **Konfiguration**: Im Container `RP_ID` (nur der Host), `RP_ORIGIN` (volle URL) und + `RP_NAME`. In den Compose-Dateien werden diese aus `TABLETTEN_RP_*` befüllt, weil sich + die `.env` auf dem Server mit anderen Apps teilt, die `RP_ID`/`RP_ORIGIN` bereits belegen. +- **Wichtig**: WebAuthn funktioniert nur über **HTTPS** oder auf `localhost`. Ändert sich + `RP_ID`, werden bereits registrierte Passkeys ungültig. diff --git a/app/api/passkey/authenticate/route.ts b/app/api/passkey/authenticate/route.ts new file mode 100644 index 0000000..2d61442 --- /dev/null +++ b/app/api/passkey/authenticate/route.ts @@ -0,0 +1,28 @@ +import { NextRequest, NextResponse } from 'next/server'; +import { buildAuthenticationOptions, finishAuthentication } from '@/lib/webauthn'; +import { createSession } from '@/lib/session'; + +// Öffentlich (kein Login): Optionen für die Anmeldung per Passkey. +export async function GET() { + try { + return NextResponse.json(await buildAuthenticationOptions()); + } catch (error) { + console.error('GET /api/passkey/authenticate:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} + +// Öffentlich: Verifiziert die Anmelde-Antwort und erstellt bei Erfolg die Session. +export async function POST(request: NextRequest) { + try { + const body = await request.json(); + const result = await finishAuthentication(body?.response); + if (!result.ok) return NextResponse.json({ error: result.error }, { status: 401 }); + + await createSession(result.username); + return NextResponse.json({ ok: true }); + } catch (error) { + console.error('POST /api/passkey/authenticate:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} diff --git a/app/api/passkey/register/route.ts b/app/api/passkey/register/route.ts new file mode 100644 index 0000000..af684c7 --- /dev/null +++ b/app/api/passkey/register/route.ts @@ -0,0 +1,36 @@ +import { NextRequest, NextResponse } from 'next/server'; +import { getSession } from '@/lib/session'; +import { buildRegistrationOptions, finishRegistration } from '@/lib/webauthn'; + +// Optionen für die Registrierung eines neuen Passkeys (Session erforderlich). +export async function GET() { + const session = await getSession(); + if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 }); + + try { + return NextResponse.json(await buildRegistrationOptions(session.username)); + } catch (error) { + console.error('GET /api/passkey/register:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} + +// Verifiziert die Registrierungs-Antwort und speichert den Passkey. +export async function POST(request: NextRequest) { + const session = await getSession(); + if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 }); + + try { + const body = await request.json(); + const result = await finishRegistration( + session.username, + body?.response, + String(body?.label ?? '') + ); + if (!result.ok) return NextResponse.json({ error: result.error }, { status: 400 }); + return NextResponse.json({ ok: true }); + } catch (error) { + console.error('POST /api/passkey/register:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} diff --git a/app/api/passkey/route.ts b/app/api/passkey/route.ts new file mode 100644 index 0000000..86291ec --- /dev/null +++ b/app/api/passkey/route.ts @@ -0,0 +1,40 @@ +import { NextRequest, NextResponse } from 'next/server'; +import { getSession } from '@/lib/session'; +import { listPasskeys, deletePasskey } from '@/lib/passkeys'; + +// Liste der eigenen Passkeys (ohne öffentlichen Schlüssel). +export async function GET() { + const session = await getSession(); + if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 }); + + try { + const passkeys = (await listPasskeys(session.username)).map((pk) => ({ + credentialId: pk.credentialId, + label: pk.label, + createdAt: pk.createdAt, + lastUsedAt: pk.lastUsedAt, + })); + return NextResponse.json({ passkeys }); + } catch (error) { + console.error('GET /api/passkey:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} + +// Löscht einen eigenen Passkey anhand seiner credentialId (?id=...). +export async function DELETE(request: NextRequest) { + const session = await getSession(); + if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 }); + + const id = request.nextUrl.searchParams.get('id'); + if (!id) return NextResponse.json({ error: 'Keine ID angegeben.' }, { status: 400 }); + + try { + const removed = await deletePasskey(id, session.username); + if (!removed) return NextResponse.json({ error: 'Passkey nicht gefunden.' }, { status: 404 }); + return NextResponse.json({ ok: true }); + } catch (error) { + console.error('DELETE /api/passkey:', error); + return NextResponse.json({ error: 'Serverfehler' }, { status: 500 }); + } +} diff --git a/app/einstellungen/page.tsx b/app/einstellungen/page.tsx new file mode 100644 index 0000000..d1c4ef0 --- /dev/null +++ b/app/einstellungen/page.tsx @@ -0,0 +1,15 @@ +import Link from 'next/link'; +import AppLayout from '@/components/AppLayout'; +import Passkeys from '@/components/Passkeys'; + +export default function EinstellungenPage() { + return ( + +

Einstellungen

+ +

+ ← Zurück zur Übersicht +

+ + ); +} diff --git a/app/globals.css b/app/globals.css index 133b981..c7cbff3 100644 --- a/app/globals.css +++ b/app/globals.css @@ -146,9 +146,22 @@ main { .app-logout-bar { display: flex; justify-content: flex-end; + align-items: center; + gap: 8px; margin-bottom: -2px; } +.btn-settings { + padding: 8px 16px; + background-color: #85B7D7; + color: black; + font-size: 0.875rem; + border-radius: 8px; + box-shadow: 0 1px 3px rgba(0,0,0,0.2); + text-decoration: none; +} +.btn-settings:hover { background-color: #6a9fc5; } + .btn-logout { padding: 8px 16px; background-color: #dc2626; @@ -314,3 +327,140 @@ main { } .login-footer a { color: #2563eb; } .login-footer a:hover { text-decoration: underline; } + +/* ---------- Passkeys / Anmeldung per Passkey ---------- */ + +.login-divider { + display: flex; + align-items: center; + gap: 12px; + margin: 20px 0; + color: #9ca3af; + font-size: 0.75rem; +} +.login-divider::before, +.login-divider::after { + content: ""; + flex: 1; + height: 1px; + background: #e5e7eb; +} + +.login-passkey-btn { + width: 100%; + padding: 8px 16px; + display: flex; + align-items: center; + justify-content: center; + gap: 8px; + background: none; + color: #111827; + font-weight: 500; + font-size: 0.875rem; + border: 2px solid #9ca3af; + border-radius: 8px; + cursor: pointer; +} +.login-passkey-btn:hover:not(:disabled) { border-color: #3b82f6; } +.login-passkey-btn:disabled { opacity: 0.5; cursor: not-allowed; } + +.login-error-passkey { margin-top: 16px; } + +.settings-title { + margin: 0 0 16px; + font-size: 1.25rem; + font-weight: 600; +} +.settings-back { margin-top: 20px; font-size: 0.875rem; } + +.passkeys { max-width: 28rem; } +.passkeys-title { + margin: 0 0 4px; + font-size: 0.875rem; + font-weight: 600; +} +.passkeys-hint { + margin: 0 0 12px; + font-size: 0.75rem; + color: #6b7280; +} +.passkeys-empty { + margin: 0 0 12px; + font-size: 0.875rem; + color: #6b7280; +} + +.passkeys-list { + list-style: none; + margin: 0 0 16px; + padding: 0; + display: flex; + flex-direction: column; + gap: 8px; +} +.passkeys-item { + display: flex; + align-items: center; + justify-content: space-between; + gap: 12px; + padding: 8px 12px; + background: white; + border: 2px solid #d1d5db; + border-radius: 8px; +} +.passkeys-item-info { min-width: 0; } +.passkeys-item-label { + font-size: 0.875rem; + font-weight: 500; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; +} +.passkeys-item-meta { font-size: 0.75rem; color: #6b7280; } +.passkeys-remove { + flex-shrink: 0; + padding: 4px 8px; + background: none; + border: none; + color: #dc2626; + font-size: 0.75rem; + cursor: pointer; +} +.passkeys-remove:hover { color: #991b1b; } + +.passkeys-add { + display: flex; + align-items: flex-end; + gap: 8px; +} +.passkeys-add-field { flex: 1; } +.passkeys-add-label { + display: block; + margin-bottom: 4px; + font-size: 0.75rem; + font-weight: 500; +} +.passkeys-input { + width: 100%; + padding: 8px 12px; + background: white; + border: 2px solid #9ca3af; + border-radius: 8px; + font-size: 0.875rem; +} +.passkeys-input:focus { border-color: #3b82f6; outline: none; } +.passkeys-add-btn { + flex-shrink: 0; + padding: 8px 16px; + background-color: #85B7D7; + color: black; + font-weight: 500; + font-size: 0.875rem; + border: none; + border-radius: 8px; + cursor: pointer; +} +.passkeys-add-btn:hover:not(:disabled) { background-color: #6a9fc5; } +.passkeys-add-btn:disabled { opacity: 0.5; cursor: not-allowed; } + +.passkeys-error { margin-top: 12px; } diff --git a/app/login/page.tsx b/app/login/page.tsx index bfebb5a..3959bf7 100644 --- a/app/login/page.tsx +++ b/app/login/page.tsx @@ -1,12 +1,47 @@ 'use client'; import { useActionState, useState } from 'react'; +import { startAuthentication } from '@simplewebauthn/browser'; import { login } from './actions'; import packageJson from '@/package.json'; export default function LoginPage() { const [state, loginAction, isPending] = useActionState(login, undefined); const [showPassword, setShowPassword] = useState(false); + const [passkeyBusy, setPasskeyBusy] = useState(false); + const [passkeyError, setPasskeyError] = useState(null); + + async function handlePasskeyLogin() { + setPasskeyError(null); + setPasskeyBusy(true); + try { + const optRes = await fetch('/api/passkey/authenticate'); + if (!optRes.ok) throw new Error('Optionen konnten nicht geladen werden.'); + const optionsJSON = await optRes.json(); + + const response = await startAuthentication({ optionsJSON }); + + const verifyRes = await fetch('/api/passkey/authenticate', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ response }), + }); + if (!verifyRes.ok) { + const data = await verifyRes.json().catch(() => null); + throw new Error(data?.error ?? 'Anmeldung mit Passkey fehlgeschlagen.'); + } + window.location.href = '/'; + } catch (err) { + // Abbruch durch Nutzer (NotAllowedError) nicht als Fehler anzeigen. + if (err instanceof Error && err.name === 'NotAllowedError') { + setPasskeyError(null); + } else { + setPasskeyError(err instanceof Error ? err.message : 'Anmeldung mit Passkey fehlgeschlagen.'); + } + } finally { + setPasskeyBusy(false); + } + } const version = packageJson.version; const buildDate = process.env.NEXT_PUBLIC_BUILD_DATE || new Date().toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric' }); @@ -89,6 +124,28 @@ export default function LoginPage() { {isPending ? 'Anmeldung läuft...' : 'Anmelden'} + +
+ oder +
+ + + + {passkeyError && ( +
+ {passkeyError} +
+ )} diff --git a/components/AppLayout.tsx b/components/AppLayout.tsx index d6ca47c..51e5f6d 100644 --- a/components/AppLayout.tsx +++ b/components/AppLayout.tsx @@ -1,6 +1,8 @@ 'use client'; import { useState } from 'react'; +import Link from 'next/link'; +import { usePathname } from 'next/navigation'; import LogoutButton from '@/components/LogoutButton'; import packageJson from '@/package.json'; @@ -9,6 +11,7 @@ interface AppLayoutProps { } export default function AppLayout({ children }: AppLayoutProps) { + const pathname = usePathname(); const version = packageJson.version; const [buildDate] = useState(() => process.env.NEXT_PUBLIC_BUILD_DATE || new Date().toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric' }) @@ -23,8 +26,13 @@ export default function AppLayout({ children }: AppLayoutProps) {
- {/* Logout-Button oben rechts */} + {/* Einstellungen und Logout oben rechts */}
+ {pathname !== '/einstellungen' && ( + + Einstellungen + + )}
diff --git a/components/Passkeys.tsx b/components/Passkeys.tsx new file mode 100644 index 0000000..b60ef27 --- /dev/null +++ b/components/Passkeys.tsx @@ -0,0 +1,135 @@ +'use client'; + +import { useEffect, useState } from 'react'; +import { startRegistration } from '@simplewebauthn/browser'; + +interface Passkey { + credentialId: string; + label: string; + createdAt: string | null; + lastUsedAt: string | null; +} + +function formatDate(iso: string | null): string { + if (!iso) return '—'; + const d = new Date(iso); + if (isNaN(d.getTime())) return '—'; + return d.toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric' }); +} + +export default function Passkeys() { + const [passkeys, setPasskeys] = useState([]); + const [loading, setLoading] = useState(true); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + const [label, setLabel] = useState(''); + + function load() { + return fetch('/api/passkey') + .then((r) => (r.ok ? r.json() : Promise.reject(new Error()))) + .then((data) => setPasskeys(data.passkeys ?? [])) + .catch(() => setError('Passkeys konnten nicht geladen werden.')) + .finally(() => setLoading(false)); + } + + useEffect(() => { + load(); + }, []); + + async function handleRegister() { + setError(null); + setBusy(true); + try { + const optRes = await fetch('/api/passkey/register'); + if (!optRes.ok) throw new Error('Optionen konnten nicht geladen werden.'); + const optionsJSON = await optRes.json(); + + const response = await startRegistration({ optionsJSON }); + + const verifyRes = await fetch('/api/passkey/register', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ response, label }), + }); + if (!verifyRes.ok) { + const data = await verifyRes.json().catch(() => null); + throw new Error(data?.error ?? 'Passkey konnte nicht registriert werden.'); + } + setLabel(''); + await load(); + } catch (err) { + if (err instanceof Error && err.name === 'NotAllowedError') { + setError(null); // Abbruch durch Nutzer + } else { + setError(err instanceof Error ? err.message : 'Passkey konnte nicht registriert werden.'); + } + } finally { + setBusy(false); + } + } + + async function handleDelete(credentialId: string) { + if (!confirm('Diesen Passkey wirklich entfernen?')) return; + setError(null); + try { + const res = await fetch(`/api/passkey?id=${encodeURIComponent(credentialId)}`, { + method: 'DELETE', + }); + if (!res.ok) throw new Error(); + await load(); + } catch { + setError('Passkey konnte nicht entfernt werden.'); + } + } + + return ( +
+

Passkeys

+

+ Melde dich künftig per Fingerabdruck, Gesichtserkennung oder Geräte-PIN an. Das Passwort + bleibt als Alternative bestehen. +

+ + {loading ? ( +

Lädt…

+ ) : passkeys.length === 0 ? ( +

Noch keine Passkeys registriert.

+ ) : ( +
    + {passkeys.map((pk) => ( +
  • +
    +
    {pk.label}
    +
    + Erstellt {formatDate(pk.createdAt)} · Zuletzt {formatDate(pk.lastUsedAt)} +
    +
    + +
    • + ))} +
+ )} + +
+
+ + setLabel(e.target.value)} + placeholder="z. B. iPhone" + maxLength={80} + className="passkeys-input" + /> +
+ +
+ + {error &&
{error}
} +
+ ); +} diff --git a/compose.yml b/compose.yml index c2ff985..4a74142 100644 --- a/compose.yml +++ b/compose.yml @@ -12,6 +12,12 @@ services: - DB_NAME=${DB_NAME} - AUTH_USERS=${AUTH_USERS} - AUTH_SECRET=${AUTH_SECRET} + # Passkeys (WebAuthn): Host bzw. volle URL der Anwendung. + # Eigene Variablennamen, weil sich mehrere Apps im Stack eine .env teilen + # und RP_ID/RP_ORIGIN dort bereits von werte-next belegt sind. + - RP_ID=${TABLETTEN_RP_ID:-tabletten.fuerst-stuttgart.de} + - RP_ORIGIN=${TABLETTEN_RP_ORIGIN:-https://tabletten.fuerst-stuttgart.de} + - RP_NAME=${TABLETTEN_RP_NAME:-Tabletten-Check} labels: - traefik.enable=true - traefik.http.routers.tabletten.entrypoints=http diff --git a/docker-compose.yml b/docker-compose.yml index c84b09c..0ef6dd8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -42,5 +42,9 @@ services: CHECK_SECRET: ${CHECK_SECRET} AUTH_USERS: ${AUTH_USERS} AUTH_SECRET: ${AUTH_SECRET} + # Passkeys (WebAuthn) — braucht HTTPS oder localhost + RP_ID: ${TABLETTEN_RP_ID:-localhost} + RP_ORIGIN: ${TABLETTEN_RP_ORIGIN:-http://localhost:3000} + RP_NAME: ${TABLETTEN_RP_NAME:-Tabletten-Check} env_file: - .env.local diff --git a/lib/auth.ts b/lib/auth.ts index d7198ad..59257be 100644 --- a/lib/auth.ts +++ b/lib/auth.ts @@ -29,6 +29,11 @@ export async function verifyCredentials(username: string, password: string): Pro return bcrypt.compare(password, user.password); } +/** Prüft, ob der Benutzername (noch) in AUTH_USERS hinterlegt ist. */ +export function isKnownUser(username: string): boolean { + return getUsers().some(u => u.username === username); +} + export function isAuthEnabled(): boolean { return !!process.env.AUTH_USERS; } diff --git a/lib/passkeys.ts b/lib/passkeys.ts new file mode 100644 index 0000000..b04201d --- /dev/null +++ b/lib/passkeys.ts @@ -0,0 +1,144 @@ +import pool from './mysql'; +import type { RowDataPacket, ResultSetHeader } from 'mysql2/promise'; + +// Eigener Tabellenname je Anwendung: Die DB-Zugangsdaten sind auf dem Server für +// alle Apps im Stack dieselben. Ein generisches `passkeys` würde sich mit anderen +// Apps überschneiden — sie sähen und löschten dann gegenseitig ihre Passkeys. +const TABLE = 'tabletten_passkeys'; + +/** Ein gespeicherter Passkey (WebAuthn-Credential), einem Benutzer zugeordnet. */ +export interface PasskeyRecord { + credentialId: string; // base64url + username: string; + publicKey: Uint8Array; + counter: number; + transports: string[]; + label: string; + createdAt: Date; + lastUsedAt: Date | null; +} + +interface PasskeyRow extends RowDataPacket { + credential_id: string; + username: string; + public_key: Buffer; + counter: number; + transports: string; + label: string; + created_at: Date; + last_used_at: Date | null; +} + +let schemaReady: Promise | null = null; + +/** + * Legt die Passkey-Tabelle beim ersten Zugriff an (einmal pro Prozess). + */ +function ensureSchema(): Promise { + if (!schemaReady) { + schemaReady = pool + .query( + `CREATE TABLE IF NOT EXISTS ${TABLE} ( + credential_id VARCHAR(255) CHARACTER SET ascii COLLATE ascii_bin NOT NULL PRIMARY KEY, + username VARCHAR(64) NOT NULL, + public_key VARBINARY(1024) NOT NULL, + counter INT UNSIGNED NOT NULL DEFAULT 0, + transports VARCHAR(255) NOT NULL DEFAULT '[]', + label VARCHAR(80) NOT NULL DEFAULT '', + created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + last_used_at DATETIME NULL, + INDEX idx_tabletten_passkeys_username (username) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci` + ) + .then(() => undefined) + .catch((error) => { + schemaReady = null; // nächster Aufruf darf es erneut versuchen + throw error; + }); + } + return schemaReady; +} + +function fromRow(row: PasskeyRow): PasskeyRecord { + let transports: string[] = []; + try { + const parsed = JSON.parse(row.transports); + if (Array.isArray(parsed)) transports = parsed; + } catch { + /* fehlerhafte transports ignorieren */ + } + return { + credentialId: row.credential_id, + username: row.username, + // Uint8Array.from kopiert in einen frischen ArrayBuffer (passt zum von + // @simplewebauthn erwarteten Uint8Array). + publicKey: Uint8Array.from(row.public_key), + counter: row.counter, + transports, + label: row.label, + createdAt: row.created_at, + lastUsedAt: row.last_used_at, + }; +} + +/** Alle Passkeys eines Benutzers, neueste zuerst. */ +export async function listPasskeys(username: string): Promise { + await ensureSchema(); + const [rows] = await pool.execute( + `SELECT * FROM ${TABLE} WHERE username = ? ORDER BY created_at DESC`, + [username] + ); + return rows.map(fromRow); +} + +/** Passkey anhand der Credential-ID — benutzerübergreifend, für die Anmeldung. */ +export async function getPasskey(credentialId: string): Promise { + await ensureSchema(); + const [rows] = await pool.execute( + `SELECT * FROM ${TABLE} WHERE credential_id = ?`, + [credentialId] + ); + return rows.length > 0 ? fromRow(rows[0]) : undefined; +} + +export async function insertPasskey(record: { + credentialId: string; + username: string; + publicKey: Uint8Array; + counter: number; + transports: string[]; + label: string; +}): Promise { + await ensureSchema(); + await pool.execute( + `INSERT INTO ${TABLE} (credential_id, username, public_key, counter, transports, label) + VALUES (?, ?, ?, ?, ?, ?)`, + [ + record.credentialId, + record.username, + Buffer.from(record.publicKey), + record.counter, + JSON.stringify(record.transports ?? []), + record.label, + ] + ); +} + +/** Aktualisiert Counter und last_used_at nach erfolgreicher Anmeldung (Replay-Schutz). */ +export async function updatePasskeyUsage(credentialId: string, counter: number): Promise { + await ensureSchema(); + await pool.execute( + `UPDATE ${TABLE} SET counter = ?, last_used_at = NOW() WHERE credential_id = ?`, + [counter, credentialId] + ); +} + +/** Löscht einen Passkey — nur wenn er dem angegebenen Benutzer gehört. */ +export async function deletePasskey(credentialId: string, username: string): Promise { + await ensureSchema(); + const [result] = await pool.execute( + `DELETE FROM ${TABLE} WHERE credential_id = ? AND username = ?`, + [credentialId, username] + ); + return result.affectedRows > 0; +} diff --git a/lib/webauthn.ts b/lib/webauthn.ts new file mode 100644 index 0000000..05f4837 --- /dev/null +++ b/lib/webauthn.ts @@ -0,0 +1,176 @@ +import { cookies } from 'next/headers'; +import { + generateRegistrationOptions, + verifyRegistrationResponse, + generateAuthenticationOptions, + verifyAuthenticationResponse, +} from '@simplewebauthn/server'; +import type { + RegistrationResponseJSON, + AuthenticationResponseJSON, + AuthenticatorTransportFuture, +} from '@simplewebauthn/server'; +import { isKnownUser } from './auth'; +import { listPasskeys, getPasskey, insertPasskey, updatePasskeyUsage } from './passkeys'; + +const REG_CHALLENGE_COOKIE = 'tabletten_pk_reg'; +const AUTH_CHALLENGE_COOKIE = 'tabletten_pk_auth'; +const CHALLENGE_TTL_S = 300; // 5 Minuten + +/** + * Relying-Party-Konfiguration. In Produktion über Env-Vars gesetzt + * (RP_ID = Host, RP_ORIGIN = volle URL). Default-Werte für lokale Entwicklung. + */ +export function getRpConfig() { + const rpID = process.env.RP_ID || 'localhost'; + const rpName = process.env.RP_NAME || 'Tabletten-Check'; + const origin = process.env.RP_ORIGIN || 'http://localhost:3000'; + return { rpID, rpName, origin }; +} + +// --- Challenge-Cookie (kurzlebig, httpOnly) ------------------------------ + +async function setChallengeCookie(name: string, challenge: string): Promise { + const cookieStore = await cookies(); + cookieStore.set(name, challenge, { + httpOnly: true, + secure: process.env.NODE_ENV === 'production', + sameSite: 'lax', + path: '/', + maxAge: CHALLENGE_TTL_S, + }); +} + +async function takeChallengeCookie(name: string): Promise { + const cookieStore = await cookies(); + const value = cookieStore.get(name)?.value ?? null; + cookieStore.delete(name); + return value; +} + +// --- Registrierung (Enrollment, Session erforderlich) -------------------- + +export async function buildRegistrationOptions(username: string) { + const { rpID, rpName } = getRpConfig(); + const existing = await listPasskeys(username); + + const options = await generateRegistrationOptions({ + rpName, + rpID, + userName: username, + userDisplayName: username, + userID: new TextEncoder().encode(username), + attestationType: 'none', + excludeCredentials: existing.map((pk) => ({ + id: pk.credentialId, + transports: pk.transports as AuthenticatorTransportFuture[], + })), + authenticatorSelection: { + residentKey: 'preferred', + userVerification: 'preferred', + }, + }); + + await setChallengeCookie(REG_CHALLENGE_COOKIE, options.challenge); + return options; +} + +/** Verifiziert die Registrierungs-Antwort und speichert den Passkey für den Benutzer. */ +export async function finishRegistration( + username: string, + response: RegistrationResponseJSON, + label: string +): Promise<{ ok: true } | { ok: false; error: string }> { + const expectedChallenge = await takeChallengeCookie(REG_CHALLENGE_COOKIE); + if (!expectedChallenge) return { ok: false, error: 'Challenge abgelaufen. Bitte erneut versuchen.' }; + + const { rpID, origin } = getRpConfig(); + let verification; + try { + verification = await verifyRegistrationResponse({ + response, + expectedChallenge, + expectedOrigin: origin, + expectedRPID: rpID, + requireUserVerification: false, + }); + } catch { + return { ok: false, error: 'Passkey konnte nicht verifiziert werden.' }; + } + + if (!verification.verified || !verification.registrationInfo) { + return { ok: false, error: 'Passkey-Registrierung fehlgeschlagen.' }; + } + + const { credential } = verification.registrationInfo; + if (await getPasskey(credential.id)) { + return { ok: false, error: 'Dieser Passkey ist bereits registriert.' }; + } + + await insertPasskey({ + credentialId: credential.id, + username, + publicKey: credential.publicKey, + counter: credential.counter, + transports: credential.transports ?? [], + label: label.trim().slice(0, 80) || 'Passkey', + }); + return { ok: true }; +} + +// --- Anmeldung (öffentlich, keine Session) ------------------------------- + +export async function buildAuthenticationOptions() { + const { rpID } = getRpConfig(); + const options = await generateAuthenticationOptions({ + rpID, + userVerification: 'preferred', + // allowCredentials leer lassen → erlaubt Discoverable Credentials / Browser-Auswahl. + }); + await setChallengeCookie(AUTH_CHALLENGE_COOKIE, options.challenge); + return options; +} + +/** + * Verifiziert die Anmelde-Antwort gegen einen gespeicherten Passkey und liefert + * den zugehörigen Benutzer zurück. + */ +export async function finishAuthentication( + response: AuthenticationResponseJSON +): Promise<{ ok: true; username: string } | { ok: false; error: string }> { + const expectedChallenge = await takeChallengeCookie(AUTH_CHALLENGE_COOKIE); + if (!expectedChallenge) return { ok: false, error: 'Challenge abgelaufen. Bitte erneut versuchen.' }; + + const passkey = await getPasskey(response.id); + if (!passkey) return { ok: false, error: 'Unbekannter Passkey.' }; + + // Benutzer könnte inzwischen aus AUTH_USERS entfernt worden sein. + if (!isKnownUser(passkey.username)) { + return { ok: false, error: 'Benutzer existiert nicht mehr.' }; + } + + const { rpID, origin } = getRpConfig(); + let verification; + try { + verification = await verifyAuthenticationResponse({ + response, + expectedChallenge, + expectedOrigin: origin, + expectedRPID: rpID, + requireUserVerification: false, + credential: { + id: passkey.credentialId, + publicKey: passkey.publicKey, + counter: passkey.counter, + transports: passkey.transports as AuthenticatorTransportFuture[], + }, + }); + } catch { + return { ok: false, error: 'Anmeldung mit Passkey fehlgeschlagen.' }; + } + + if (!verification.verified) return { ok: false, error: 'Anmeldung mit Passkey fehlgeschlagen.' }; + + await updatePasskeyUsage(passkey.credentialId, verification.authenticationInfo.newCounter); + return { ok: true, username: passkey.username }; +} diff --git a/package-lock.json b/package-lock.json index 8797da8..36a9218 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,13 +1,15 @@ { "name": "tabletten_next", - "version": "1.2.1", + "version": "1.2.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "tabletten_next", - "version": "1.2.1", + "version": "1.2.2", "dependencies": { + "@simplewebauthn/browser": "^13.3.0", + "@simplewebauthn/server": "^13.3.2", "bcryptjs": "^3.0.3", "jose": "^6.2.1", "moment": "^2.30.1", @@ -449,6 +451,12 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/@hexagon/base64": { + "version": "1.1.28", + "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz", + "integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==", + "license": "MIT" + }, "node_modules/@humanfs/core": { "version": "0.19.1", "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz", @@ -1017,6 +1025,12 @@ "@jridgewell/sourcemap-codec": "^1.4.14" } }, + "node_modules/@levischuck/tiny-cbor": { + "version": "0.2.11", + "resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz", + "integrity": "sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==", + "license": "MIT" + }, "node_modules/@mongodb-js/saslprep": { "version": "1.4.6", "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.6.tgz", @@ -1232,6 +1246,174 @@ "node": ">=12.4.0" } }, + "node_modules/@peculiar/asn1-android": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-android/-/asn1-android-2.8.0.tgz", + "integrity": "sha512-skLbS+IOGv1lUgDqtChr8xvtvEr3HMse/JGBaL2r1J1o/n7a8wqOrovMtlRq/UXLhxvmLaONP67hwtshgzwfzA==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-cms": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.8.0.tgz", + "integrity": "sha512-NgekZOrSJFSBFLFoLfwePguAWAx7z1+f2TEsWFUMyiqqfntZ4+S/S5hzqME3q4pCA0iOsFKdwiQ35dwY24eVqA==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "@peculiar/asn1-x509-attr": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-csr": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.8.0.tgz", + "integrity": "sha512-akbF8+uvleHs8sejNPQxwmVFuInAg6FMNHOwMILXfP518YfFJwdR3jr6oNUPOaEJfuEhn/vkNOCIT6ASUd4mbg==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-ecc": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.8.0.tgz", + "integrity": "sha512-ohwlk+u9Rv2NOAY1c6MfHj45ATVF8R1DUN/WCgABiRtLi2ZftlZWZX7KvpAbU8v9xPcmoILfELeEABj/rn18AQ==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-pfx": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.8.0.tgz", + "integrity": "sha512-5yof1ytoB++RQtaFbqSUJ8pxDJtZT6vbVqZ8XoJ61ph7UjNVvfFwAilnCodqkNsAodpy13gDhoxZXw00pghnyg==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-cms": "^2.8.0", + "@peculiar/asn1-pkcs8": "^2.8.0", + "@peculiar/asn1-rsa": "^2.8.0", + "@peculiar/asn1-schema": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-pkcs8": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.8.0.tgz", + "integrity": "sha512-qAKXtLpBEw9LqhKpjw3ajZSXlBur+ipW+y2ivVBQAG6F6qRx94yO+1ZR4mvw+YaCfKSaOzLeYEzsPaBp4SJELA==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-pkcs9": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.8.0.tgz", + "integrity": "sha512-b5nDWCnkV60+cQ141D6sVVwK9nz64R5n3zSVnklGd+ECdkW2Ol3U1a6yYFlalpSOaD557yuJB64A+q42jG7lUQ==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-cms": "^2.8.0", + "@peculiar/asn1-pfx": "^2.8.0", + "@peculiar/asn1-pkcs8": "^2.8.0", + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "@peculiar/asn1-x509-attr": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-rsa": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.8.0.tgz", + "integrity": "sha512-zHEUlCqB2mk7x2lxDwHHJy7hWZOPdGHVlsmITWKB5/PbQo61atbu9PJ/0r9dQNMwFzbKPXZ8uK8/91eUhRznSg==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-schema": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.8.0.tgz", + "integrity": "sha512-7YT0U/ze0tF2QOBbE15gKZwy5tvgGyLRiRHLzhlbOpf7BT032oBSd0haZqXn5W6l26WLlu3dyxzjM+2638/z2Q==", + "license": "MIT", + "dependencies": { + "@peculiar/utils": "^2.0.2", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-x509": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.8.0.tgz", + "integrity": "sha512-N0CMuhWUzsWEVq6F1q9X6+VKUnWzSW+cSVg+aPaGGwDdbFoFWTYgin5MHwXgpWd6y9COMBxnfy/Qc+Xc7F0Zwg==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/utils": "^2.0.2", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/asn1-x509-attr": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.8.0.tgz", + "integrity": "sha512-tHjkfS/qhMnmrlB2J9NhflQlQ7In3khO3CfmVrriOlpTeErY9ZIKOso1hQ5JQiyrJ7ShvqVPk7E5fQmbclkSKA==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-schema": "^2.8.0", + "@peculiar/asn1-x509": "^2.8.0", + "asn1js": "^3.0.10", + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/utils": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz", + "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==", + "license": "MIT", + "dependencies": { + "tslib": "^2.8.1" + } + }, + "node_modules/@peculiar/x509": { + "version": "1.14.3", + "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz", + "integrity": "sha512-C2Xj8FZ0uHWeCXXqX5B4/gVFQmtSkiuOolzAgutjTfseNOHT3pUjljDZsTSxXFGgio54bCzVFqmEOUrIVk8RDA==", + "license": "MIT", + "dependencies": { + "@peculiar/asn1-cms": "^2.6.0", + "@peculiar/asn1-csr": "^2.6.0", + "@peculiar/asn1-ecc": "^2.6.0", + "@peculiar/asn1-pkcs9": "^2.6.0", + "@peculiar/asn1-rsa": "^2.6.0", + "@peculiar/asn1-schema": "^2.6.0", + "@peculiar/asn1-x509": "^2.6.0", + "pvtsutils": "^1.3.6", + "reflect-metadata": "^0.2.2", + "tslib": "^2.8.1", + "tsyringe": "^4.10.0" + }, + "engines": { + "node": ">=20.0.0" + } + }, "node_modules/@rtsao/scc": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/@rtsao/scc/-/scc-1.1.0.tgz", @@ -1239,6 +1421,31 @@ "dev": true, "license": "MIT" }, + "node_modules/@simplewebauthn/browser": { + "version": "13.3.0", + "resolved": "https://registry.npmjs.org/@simplewebauthn/browser/-/browser-13.3.0.tgz", + "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==", + "license": "MIT" + }, + "node_modules/@simplewebauthn/server": { + "version": "13.3.2", + "resolved": "https://registry.npmjs.org/@simplewebauthn/server/-/server-13.3.2.tgz", + "integrity": "sha512-KEDhfcGP1PAKRVSDjA3npTQFqS2b/srm+ipoNBNHdkzrHAlaRQUTE+a5f4ywsx6thxAw1NU2rYcLEY1949RGbQ==", + "license": "MIT", + "dependencies": { + "@hexagon/base64": "^1.1.27", + "@levischuck/tiny-cbor": "^0.2.2", + "@peculiar/asn1-android": "^2.6.0", + "@peculiar/asn1-ecc": "^2.6.1", + "@peculiar/asn1-rsa": "^2.6.1", + "@peculiar/asn1-schema": "^2.6.0", + "@peculiar/asn1-x509": "^2.6.1", + "@peculiar/x509": "^1.14.3" + }, + "engines": { + "node": ">=20.0.0" + } + }, "node_modules/@swc/helpers": { "version": "0.5.15", "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz", @@ -2154,6 +2361,20 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/asn1js": { + "version": "3.0.10", + "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz", + "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==", + "license": "BSD-3-Clause", + "dependencies": { + "pvtsutils": "^1.3.6", + "pvutils": "^1.1.5", + "tslib": "^2.8.1" + }, + "engines": { + "node": ">=12.0.0" + } + }, "node_modules/ast-types-flow": { "version": "0.0.8", "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz", @@ -5124,6 +5345,24 @@ "node": ">=6" } }, + "node_modules/pvtsutils": { + "version": "1.3.6", + "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz", + "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==", + "license": "MIT", + "dependencies": { + "tslib": "^2.8.1" + } + }, + "node_modules/pvutils": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz", + "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==", + "license": "MIT", + "engines": { + "node": ">=16.0.0" + } + }, "node_modules/queue-microtask": { "version": "1.2.3", "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", @@ -5175,6 +5414,12 @@ "dev": true, "license": "MIT" }, + "node_modules/reflect-metadata": { + "version": "0.2.2", + "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz", + "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==", + "license": "Apache-2.0" + }, "node_modules/reflect.getprototypeof": { "version": "1.0.10", "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz", @@ -5944,6 +6189,24 @@ "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", "license": "0BSD" }, + "node_modules/tsyringe": { + "version": "4.10.0", + "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz", + "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==", + "license": "MIT", + "dependencies": { + "tslib": "^1.9.3" + }, + "engines": { + "node": ">= 6.0.0" + } + }, + "node_modules/tsyringe/node_modules/tslib": { + "version": "1.14.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz", + "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==", + "license": "0BSD" + }, "node_modules/type-check": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz", diff --git a/package.json b/package.json index 2787af2..ffba390 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "tabletten_next", - "version": "1.2.2", + "version": "1.3.0", "private": true, "scripts": { "dev": "next dev", @@ -9,6 +9,8 @@ "lint": "eslint" }, "dependencies": { + "@simplewebauthn/browser": "^13.3.0", + "@simplewebauthn/server": "^13.3.2", "bcryptjs": "^3.0.3", "jose": "^6.2.1", "moment": "^2.30.1", diff --git a/proxy.ts b/proxy.ts index bab5de2..624f557 100644 --- a/proxy.ts +++ b/proxy.ts @@ -12,7 +12,8 @@ export async function proxy(request: NextRequest) { } // /login und /api/check sind öffentlich - const publicPaths = ['/login', '/api/check']; + // (Passkey-Anmeldung muss ohne Session erreichbar sein) + const publicPaths = ['/login', '/api/check', '/api/passkey/authenticate']; if (publicPaths.some(p => pathname.startsWith(p))) { return NextResponse.next(); }