auth-yes

tylerg/auth-yes

Fork 0

Commit Graph

Author	SHA1	Message	Date
google-labs-jules[bot]	e1555f14fc	feat: implement WebAuthn PRF extension for client-side HKDF key derivation * Added `prf_enabled` and `prf_salt` columns to the `passkeys` table. * Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt. * Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge. * Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string. * Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported. * Added corresponding unit tests to verify PRF flow and rejection logic. * Verified visual and functional changes for the optional username input on the login page via Playwright scripts. Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>	2026-08-24 07:46:22 +00:00
Tyler Gillispie	474cc177ce	chore: adopt dual licensing and import task history & scaffolding - Add LICENSE-MIT and LICENSE-APACHE for dual MIT / Apache-2.0 distribution - Update root LICENSE pointer, README.md, Deno workspace manifests, and Cargo.toml - Add deno.lock dependency lockfile - Format AGENTS.md system guidelines - Import task lifecycle scaffolding and historical story specifications (extract-auth-yes, setup-ts architecture, modular workspace)	2026-08-21 15:20:36 -07:00
Tyler Gillispie	ac89e4c8d0	feat: initial commit for auth-yes identity hub	2026-08-21 14:27:36 -07:00

Author

SHA1

Message

Date

google-labs-jules[bot]

e1555f14fc

feat: implement WebAuthn PRF extension for client-side HKDF key derivation

* Added `prf_enabled` and `prf_salt` columns to the `passkeys` table.
* Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt.
* Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge.
* Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string.
* Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported.
* Added corresponding unit tests to verify PRF flow and rejection logic.
* Verified visual and functional changes for the optional username input on the login page via Playwright scripts.

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>

2026-08-24 07:46:22 +00:00

Tyler Gillispie

474cc177ce

chore: adopt dual licensing and import task history & scaffolding

- Add LICENSE-MIT and LICENSE-APACHE for dual MIT / Apache-2.0 distribution
- Update root LICENSE pointer, README.md, Deno workspace manifests, and Cargo.toml
- Add deno.lock dependency lockfile
- Format AGENTS.md system guidelines
- Import task lifecycle scaffolding and historical story specifications (extract-auth-yes, setup-ts architecture, modular workspace)

2026-08-21 15:20:36 -07:00

Tyler Gillispie

ac89e4c8d0

feat: initial commit for auth-yes identity hub

2026-08-21 14:27:36 -07:00

3 Commits