claude
12c2ae1d17
CLAUDE.md says every page is its own embedded .html file next to main.go, and that no page markup lives in Go. Two pages were still Go string constants: passkeyPageHTML in webauthn.go and modelsHTML in models.go. They are now passkey.html and models.html, embedded. The identifiers keep their names, so passkey_prf_test.go still reads passkeyPageHTML and still asserts on the same bytes. Both templates now build through parsePage, and Page and handleModels render through renderPage. handleEcosystem did too and now does the same. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
3.9 KiB
HTML
59 lines
3.9 KiB
HTML
{{template "shellTop" "passkey"}}
|
|
<h1>Passkey</h1>
|
|
<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
|
|
<div class=flex gap-2>
|
|
<button class=btn onclick=enroll()>enroll passkey</button>
|
|
<button class=btn onclick=assert()>assert (step-up)</button>
|
|
<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
|
|
<a href=/tools><button class=btn-primary>→ tools</button></a>
|
|
</div>
|
|
<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
|
|
<div id=msg></div>
|
|
{{template "shellBottom"}}
|
|
<script>
|
|
const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
|
|
const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
|
|
const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
|
|
async function enroll(){try{
|
|
const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
|
|
options.challenge=ub64(options.challenge);
|
|
options.user.id=ub64(options.user.id);
|
|
const c=await navigator.credentials.create({publicKey:options});
|
|
const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
|
|
body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
|
|
clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
|
|
if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
|
|
// The wrapped key can only be written from an assertion: PRF results are
|
|
// not produced at create() time on most authenticators. Enrolment reports
|
|
// whether PRF is available at all so he is not told cold-start works when
|
|
// it cannot.
|
|
const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
|
|
const prfOK=!!(ext.prf&&ext.prf.enabled);
|
|
say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
|
|
'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
|
|
}catch(e){say('enroll error: '+e,false);}}
|
|
async function assert(explicit){try{
|
|
const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
|
|
options.challenge=ub64(options.challenge);
|
|
const c=await navigator.credentials.get({publicKey:options});
|
|
// The PRF result is the cold-start secret. It never touches localStorage
|
|
// and is posted once, over the same request as the assertion.
|
|
const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
|
|
const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
|
|
const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
|
|
body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
|
|
clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
|
|
signature:b64u(c.response.signature)}}})});
|
|
if(!r.ok){say('assert failed: '+await r.text(),false);return;}
|
|
if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
|
|
say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
|
|
'stepped up ✓ — enable tools now',true);
|
|
}catch(e){say('assert error: '+e,false);}}
|
|
// Rewriting the wrapped key is a separate gesture, never a side effect of a
|
|
// step-up. Only this button sets explicit, and only explicit lets the daemon
|
|
// replace a blob that already exists.
|
|
async function rewrapKey(){
|
|
if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
|
|
await assert(true);}
|
|
</script>
|