Passkeys

import { AuthRateLimitStandardLive } from "@effect-auth/core/AuthRateLimit";
import {
  AuthHttpApiConfigLive,
  PasskeyHttpApiLive,
  PasskeyHttpConfigLive,
} from "@effect-auth/core/HttpApi";
import {
  PasskeyCredentialManagementLive,
  PasskeyOptionsLive,
  PasskeyVerificationLive,
} from "@effect-auth/core/Passkey";
import { SimpleWebAuthnPasskeyVerifierLive } from "@effect-auth/core/PasskeySimpleWebAuthn";
import { Layer } from "effect";
import { HttpServer } from "effect/unstable/http";

const PasskeysLive = Layer.mergeAll(
  PasskeyOptionsLive,
  PasskeyCredentialManagementLive,
  PasskeyVerificationLive().pipe(
    Layer.provide(SimpleWebAuthnPasskeyVerifierLive)
  )
);

const AppPasskeyServicesLive = PasskeysLive.pipe(
  Layer.provideMerge(AppAuthRuntimeLive)
);

export const AuthLive = PasskeyHttpApiLive.pipe(
  Layer.provide(AuthRateLimitStandardLive()),
  Layer.provide(
    Layer.mergeAll(AppPasskeyServicesLive, AppRateLimitLive)
  ),
  Layer.provide(
    PasskeyHttpConfigLive({
      relyingParty: { id: "app.example.com", name: "Example" },
      expectedOrigin: "https://app.example.com",
      userVerification: "preferred",
      requireUserVerification: true,
      authenticatorSelection: { residentKey: "preferred" },
      attestation: "none",
      timeout: 60_000,
    })
  ),
  Layer.provide(
    AuthHttpApiConfigLive({
      originCheck: {
        allowedOrigins: ["https://app.example.com"],
      },
    })
  ),
  Layer.provide(HttpServer.layerServices)
);

import { createPasskeyClient } from "@effect-auth/core/Client";
import {
  createPasskeyCredential,
  getPasskeyCredential,
  isPasskeySupported,
} from "@effect-auth/core/PasskeyBrowser";

const passkeys = createPasskeyClient({
  requestInit: { credentials: "include" },
});

export const registerPasskey = async () => {
  if (!isPasskeySupported()) throw new Error("Passkeys are unavailable");

  const started = await passkeys.registration.start();
  const credential = await createPasskeyCredential(started.publicKey);
  return passkeys.registration.finish({
    challengeId: started.challengeId,
    credential,
  });
};

export const signInWithPasskey = async () => {
  const started = await passkeys.authentication.start({});
  const credential = await getPasskeyCredential(started.publicKey);
  return passkeys.authentication.finish({
    challengeId: started.challengeId,
    credential,
  });
};

import {
  AuthOriginCheckMiddleware,
  AuthSchemaErrorMiddleware,
  passkeyAuthenticationFinishEndpoint,
  passkeyAuthenticationStartEndpoint,
  passkeyCredentialListEndpoint,
  passkeyCredentialRevokeEndpoint,
  passkeyRegistrationFinishEndpoint,
  passkeyRegistrationStartEndpoint,
} from "@effect-auth/core/HttpApi";
import { HttpApi, HttpApiGroup } from "effect/unstable/httpapi";

class AppPasskeyHttpApiGroup extends HttpApiGroup.make("passkey")
  .add(
    passkeyRegistrationStartEndpoint,
    passkeyRegistrationFinishEndpoint,
    passkeyAuthenticationStartEndpoint,
    passkeyAuthenticationFinishEndpoint,
    passkeyCredentialListEndpoint,
    passkeyCredentialRevokeEndpoint
  )
  .prefix("/auth/passkey")
  .middleware(AuthSchemaErrorMiddleware)
  .middleware(AuthOriginCheckMiddleware) {}

export class AppAuthApi extends HttpApi.make("AppAuthApi")
  .add(AppPasskeyHttpApiGroup) {}

import {
  PasskeyHttpOperations,
  PasskeyHttpOperationsLive,
} from "@effect-auth/core/HttpApi";
import { Effect, Layer } from "effect";
import { HttpApiBuilder } from "effect/unstable/httpapi";

export const AppPasskeyHttpApiGroupLive = HttpApiBuilder.group(
  AppAuthApi,
  "passkey",
  Effect.fn("app.auth.passkey")(function* (handlers) {
    const passkeys = yield* PasskeyHttpOperations;

    return handlers
      .handle("registerStart", passkeys.registerStart)
      .handle("registerFinish", passkeys.registerFinish)
      .handle("authenticateStart", passkeys.authenticateStart)
      .handle("authenticateFinish", passkeys.authenticateFinish)
      .handle("listCredentials", passkeys.listCredentials)
      .handle("revokeCredential", passkeys.revokeCredential);
  })
).pipe(Layer.provide(PasskeyHttpOperationsLive));

import { ChallengeId, UserId } from "@effect-auth/core/Identifiers";
import {
  PasskeyOptions,
  PasskeyVerification,
  type PasskeyClientCredentialJson,
} from "@effect-auth/core/Passkey";

const relyingPartyId = "app.example.com";
const expectedOrigin = "https://app.example.com";

export const startRegistration = (currentUser: {
  readonly id: UserId;
  readonly email: string;
}) =>
  PasskeyOptions.use((passkeys) =>
    passkeys.startRegistration({
      relyingParty: { id: relyingPartyId, name: "Example" },
      userId: currentUser.id,
      userName: currentUser.email,
      userDisplayName: currentUser.email,
      authenticatorSelection: {
        residentKey: "preferred",
        userVerification: "required",
      },
      attestation: "none",
      timeout: 60_000,
    })
  );

export const finishRegistration = (input: {
  readonly currentUserId: UserId;
  readonly challengeId: ChallengeId;
  readonly credential: PasskeyClientCredentialJson;
}) =>
  PasskeyVerification.use((passkeys) =>
    passkeys.finishRegistration({
      userId: input.currentUserId,
      challengeId: input.challengeId,
      response: input.credential,
      relyingPartyId,
      expectedOrigin,
      requireUserVerification: true,
    })
  );

import { createPasskeyCredential } from "@effect-auth/core/PasskeyBrowser";

const started = await api.startPasskeyRegistration();
const credential = await createPasskeyCredential(started.publicKey);

await api.finishPasskeyRegistration({
  challengeId: started.challengeId,
  credential,
});

import { passkeyEvidence } from "@effect-auth/core/Assurance";
import { AuthFlow } from "@effect-auth/core/AuthFlow";
import { ChallengeId, UnixMillis, UserId } from "@effect-auth/core/Identifiers";
import {
  PasskeyOptions,
  PasskeyVerification,
  type PasskeyClientCredentialJson,
} from "@effect-auth/core/Passkey";
import { Effect } from "effect";

const relyingPartyId = "app.example.com";
const expectedOrigin = "https://app.example.com";

export const startAuthentication = (userId?: UserId) =>
  PasskeyOptions.use((passkeys) =>
    passkeys.startAuthentication({
      relyingPartyId,
      userVerification: "required",
      timeout: 60_000,
      ...(userId === undefined ? {} : { userId }),
    })
  );

export const finishAuthentication = (input: {
  readonly userId?: UserId;
  readonly challengeId: ChallengeId;
  readonly credential: PasskeyClientCredentialJson;
}) =>
  Effect.gen(function* () {
    const verifiedAt = UnixMillis(Date.now());
    const finished = yield* PasskeyVerification.use((passkeys) =>
      passkeys.finishAuthentication({
        challengeId: input.challengeId,
        response: input.credential,
        relyingPartyId,
        expectedOrigin,
        requireUserVerification: true,
        now: verifiedAt,
        ...(input.userId === undefined ? {} : { userId: input.userId }),
      })
    );

    return yield* AuthFlow.use((flow) =>
      flow.completePrimaryFactor({
        userId: finished.userId,
        method: "passkey",
        evidence: [passkeyEvidence({
          credentialId: finished.credential.id,
          verifiedAt,
          userVerification: finished.userVerification,
          authenticatorAttachment: finished.authenticatorAttachment,
          backedUp: finished.backedUp,
          backupEligible: finished.backupEligible,
          signCount: finished.signCount,
          aaguid: finished.aaguid,
        })],
      })
    );
  });

import { UserId } from "@effect-auth/core/Identifiers";
import {
  PasskeyCredentialManagement,
  type PasskeyCredentialId,
} from "@effect-auth/core/Passkey";

export const listPasskeys = (currentUserId: UserId) =>
  PasskeyCredentialManagement.use((credentials) =>
    credentials.listForUser({ userId: currentUserId })
  );

export const revokePasskey = (
  currentUserId: UserId,
  credentialId: PasskeyCredentialId
) =>
  PasskeyCredentialManagement.use((credentials) =>
    credentials.revokeForUser({
      userId: currentUserId,
      credentialId,
      reason: "user_request",
    })
  );