jackmechem/server-dash
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NFC

Browse source
This commit is contained in:
Jack Mechem 2026-05-01 16:21:50 -07:00
parent c991fe7b6d
commit e6b5fed399
8 changed files with 6647 additions and 6623 deletions
Download patch file Download diff file Expand all files Collapse all files

3
app/api/auth/login/route.ts
View file

@ -13,7 +13,8 @@ export async function POST(req: NextRequest) {
}); });
if (!res.ok) { if (!res.ok) {
return NextResponse.json({ error: "Invalid credentials" }, { status: 401 }); const text = await res.text();
return NextResponse.json({ error: text }, { status: 401 });
} }
// Returns { session_id, challenge } — browser completes the WebAuthn step // Returns { session_id, challenge } — browser completes the WebAuthn step

5
app/api/auth/register/finish/route.ts
View file

@ -1,6 +1,11 @@
import { NextRequest, NextResponse } from "next/server"; import { NextRequest, NextResponse } from "next/server";
const ENROLLMENT_OPEN = process.env.ENROLLMENT_OPEN === "true";
export async function POST(req: NextRequest) { export async function POST(req: NextRequest) {
if (!ENROLLMENT_OPEN) {
return new NextResponse(null, { status: 404 });
}
const body = await req.json(); const body = await req.json();
const res = await fetch("http://localhost:3001/auth/register/finish", { const res = await fetch("http://localhost:3001/auth/register/finish", {

5
app/api/auth/register/start/route.ts
View file

@ -1,6 +1,11 @@
import { NextRequest, NextResponse } from "next/server"; import { NextRequest, NextResponse } from "next/server";
const ENROLLMENT_OPEN = process.env.ENROLLMENT_OPEN === "true";
export async function POST(req: NextRequest) { export async function POST(req: NextRequest) {
if (!ENROLLMENT_OPEN) {
return new NextResponse(null, { status: 404 });
}
const { username, password } = await req.json(); const { username, password } = await req.json();
const res = await fetch("http://localhost:3001/auth/register/start", { const res = await fetch("http://localhost:3001/auth/register/start", {

4
app/auth/page.tsx
View file

@ -69,11 +69,13 @@ export default function AuthPage() {
setStatus("waiting_yubikey"); setStatus("waiting_yubikey");
const opts = challenge.publicKey; const opts = challenge.publicKey;
opts.challenge = b64uToBuf(opts.challenge); opts.challenge = b64uToBuf(opts.challenge);
opts.userVerification = "discouraged";
if (opts.allowCredentials) { if (opts.allowCredentials) {
opts.allowCredentials = opts.allowCredentials.map( opts.allowCredentials = opts.allowCredentials.map(
(c: { id: string; type: string; transports?: string[] }) => ({ (c: { id: string; type: string; transports?: string[] }) => ({
...c, type: c.type,
id: b64uToBuf(c.id), id: b64uToBuf(c.id),
transports: ["usb", "nfc", "ble", "hybrid"],
}), }),
); );
} }

12
app/enroll/page.tsx
View file

@ -50,6 +50,14 @@ export default function EnrollPage() {
const opts = challenge.publicKey; const opts = challenge.publicKey;
opts.challenge = b64uToBuf(opts.challenge); opts.challenge = b64uToBuf(opts.challenge);
opts.user.id = b64uToBuf(opts.user.id); opts.user.id = b64uToBuf(opts.user.id);
// Force security key UI — residentKey/UV discouraged so Android
// Chrome doesn't suppress the NFC option in favour of biometrics
opts.authenticatorSelection = {
authenticatorAttachment: "cross-platform",
residentKey: "discouraged",
requireResidentKey: false,
userVerification: "discouraged",
};
if (opts.excludeCredentials) { if (opts.excludeCredentials) {
opts.excludeCredentials = opts.excludeCredentials.map( opts.excludeCredentials = opts.excludeCredentials.map(
(c: { id: string; type: string; transports?: string[] }) => ({ (c: { id: string; type: string; transports?: string[] }) => ({
@ -89,9 +97,7 @@ export default function EnrollPage() {
response: { response: {
attestationObject: bufToB64u(attestation.attestationObject), attestationObject: bufToB64u(attestation.attestationObject),
clientDataJSON: bufToB64u(attestation.clientDataJSON), clientDataJSON: bufToB64u(attestation.clientDataJSON),
transports: attestation.getTransports transports: ["usb", "nfc", "ble", "hybrid"],
? attestation.getTransports()
: [],
}, },
extensions: {}, extensions: {},
}, },

7
app/layout.tsx
View file

@ -29,7 +29,12 @@ export default function RootLayout({
lang="en" lang="en"
className={`${dmSans.variable} ${playfair.variable} h-full antialiased`} className={`${dmSans.variable} ${playfair.variable} h-full antialiased`}
> >
<body className="min-h-full h-full flex flex-col">{children}</body> <body className="min-h-full h-full flex flex-col">
{children}
<span className="fixed bottom-3 right-4 text-[10px] text-gray-300 select-none pointer-events-none">
v0.1.0
</span>
</body>
</html> </html>
); );
} }

20
proxy.ts → middleware.ts
View file

@ -1,16 +1,28 @@
import { NextResponse } from "next/server"; import { NextResponse } from "next/server";
import type { NextRequest } from "next/server"; import type { NextRequest } from "next/server";
export function proxy(req: NextRequest) { const ENROLLMENT_OPEN = process.env.ENROLLMENT_OPEN === "true";
const token = req.cookies.get("token")?.value;
export function middleware(req: NextRequest) {
const { pathname } = req.nextUrl; const { pathname } = req.nextUrl;
// always allow login page and auth api routes // Enrollment routes — only accessible when enrollment is open
if (
pathname.startsWith("/enroll") ||
pathname.startsWith("/api/auth/register")
) {
return ENROLLMENT_OPEN
? NextResponse.next()
: new NextResponse(null, { status: 404 });
}
// Always allow login page and auth api routes
if (pathname.startsWith("/auth") || pathname.startsWith("/api/auth")) { if (pathname.startsWith("/auth") || pathname.startsWith("/api/auth")) {
return NextResponse.next(); return NextResponse.next();
} }
// no token — redirect to login // No token — redirect to login
const token = req.cookies.get("token")?.value;
if (!token) { if (!token) {
const loginUrl = new URL("/auth", req.url); const loginUrl = new URL("/auth", req.url);
loginUrl.searchParams.set("callbackUrl", pathname); loginUrl.searchParams.set("callbackUrl", pathname);

13214
package-lock.json generated
View file

File diff suppressed because it is too large Load diff