{{template "shellTop" "passkey"}}
<h1>Passkey</h1>
<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
<div class=flex gap-2>
<button class=btn onclick=enroll()>enroll passkey</button>
<button class=btn onclick=assert()>assert (step-up)</button>
<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
<a href=/tools><button class=btn-primary>→ tools</button></a>
</div>
<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
<div id=msg></div>
{{template "shellBottom"}}
<script>
const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
async function enroll(){try{
 const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
 options.challenge=ub64(options.challenge);
 options.user.id=ub64(options.user.id);
 const c=await navigator.credentials.create({publicKey:options});
 const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
  body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
   clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
 if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
 // The wrapped key can only be written from an assertion: PRF results are
 // not produced at create() time on most authenticators. Enrolment reports
 // whether PRF is available at all so he is not told cold-start works when
 // it cannot.
 const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
 const prfOK=!!(ext.prf&&ext.prf.enabled);
 say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
  'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
}catch(e){say('enroll error: '+e,false);}}
async function assert(explicit){try{
 const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
 options.challenge=ub64(options.challenge);
 const c=await navigator.credentials.get({publicKey:options});
 // The PRF result is the cold-start secret. It never touches localStorage
 // and is posted once, over the same request as the assertion.
 const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
 const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
 const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
  body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
   clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
   signature:b64u(c.response.signature)}}})});
 if(!r.ok){say('assert failed: '+await r.text(),false);return;}
 if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
 say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
  'stepped up ✓ — enable tools now',true);
}catch(e){say('assert error: '+e,false);}}
// Rewriting the wrapped key is a separate gesture, never a side effect of a
// step-up. Only this button sets explicit, and only explicit lets the daemon
// replace a blob that already exists.
async function rewrapKey(){
 if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
 await assert(true);}
</script>