Class: BaseSecretRouteSQL
Defined in: auth/src/routes/sql/BaseSecretRouteSQL.ts:11
Extends
Constructors
Constructor
new BaseSecretRouteSQL():
BaseSecretRouteSQL
Returns
BaseSecretRouteSQL
Inherited from
Properties
_objectFactory?
protectedoptional_objectFactory?:ObjectFactory
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:101
Inherited from
BaseSecretRoute._objectFactory
aclUtils?
protectedoptionalaclUtils?:ACLUtils
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:102
Inherited from
appPasswordEnabled
protectedappPasswordEnabled:boolean=true
Defined in: auth/src/routes/BaseSecretRoute.ts:121
Set to false to disable app passwords (see SecretType.APP_PASSWORD) deployment-wide. Turning
this off refuses creation of new app passwords (see validateAppPasswordCreate()) and stops any
existing app-password secret from authenticating (see BaseAuthBasicRoute) - it does not delete
any already-created app password, so re-enabling this restores them exactly as they were.
Inherited from
BaseSecretRoute.appPasswordEnabled
auditLogUtils?
protectedoptionalauditLogUtils?:AuditLogUtils
Defined in: auth/src/routes/BaseSecretRoute.ts:133
Inherited from
config?
protectedoptionalconfig?:any
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:104
The global application configuration.
Inherited from
defaultACLUid
protecteddefaultACLUid:string
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:106
The unique identifier of the default ACL for the model type.
Inherited from
fido2Config
protectedfido2Config:PasskeyConfig
Defined in: auth/src/routes/BaseSecretRoute.ts:88
The relying party configuration used for validating and generating FIDO2 hardware security key
(WebAuthn) registration data. Kept separate from passkeyConfig since a hardware key deployment
commonly wants a different authenticatorAttachment/residentKey policy — a hardware key is
typically registered as a "cross-platform", non-discoverable credential tied to a known
account, rather than a discoverable, possibly-synced passkey.
Inherited from
logger
protectedlogger:any
Defined in: auth/src/routes/BaseSecretRoute.ts:130
Inherited from
notificationUtils?
protectedoptionalnotificationUtils?:NotificationUtils
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:108
Inherited from
BaseSecretRoute.notificationUtils
passkeyConfig
protectedpasskeyConfig:PasskeyConfig
Defined in: auth/src/routes/BaseSecretRoute.ts:74
The relying party configuration used for validating and generating passkey (WebAuthn) registration data.
Inherited from
passwordConfig
protectedpasswordConfig:PasswordConfig
Defined in: auth/src/routes/BaseSecretRoute.ts:112
The minimum required length for a new password secret's plaintext value.
Inherited from
BaseSecretRoute.passwordConfig
regexSpecialChars
protectedregexSpecialChars:RegExp
Defined in: auth/src/routes/BaseSecretRoute.ts:68
Inherited from
BaseSecretRoute.regexSpecialChars
repoUtils?
protectedoptionalrepoUtils?:RepoUtils<SecretSQL>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:112
The repository utility class to use for common operations.
Inherited from
repoUtilsClass
protectedreadonlyrepoUtilsClass:any=RepoUtils
Defined in: auth/src/routes/BaseSecretRoute.ts:67
The class of the RepoUtils to use when instantiating the utility.
Inherited from
BaseSecretRoute.repoUtilsClass
systemSettingsClass
protectedsystemSettingsClass:any=SystemSettingsSQL
Defined in: auth/src/routes/sql/BaseSecretRouteSQL.ts:13
The SystemSettings model class (e.g. SystemSettingsMongo), used to read the allowMultiplePasswords policy.
Optional: a subclass that leaves it unset has no policy to consult, and so doesn't enforce one.
Overrides
BaseSecretRoute.systemSettingsClass
systemSettingsUtils?
protectedoptionalsystemSettingsUtils?:SystemSettingsUtils
Defined in: auth/src/routes/BaseSecretRoute.ts:149
Inherited from
BaseSecretRoute.systemSettingsUtils
totpConfig
protectedtotpConfig:TOTPConfig
Defined in: auth/src/routes/BaseSecretRoute.ts:100
The issuer configuration used for validating and generating TOTP (RFC 6238) registration data.
Inherited from
trackChanges
protectedtrackChanges:number
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:117
The number of previous document versions to store in the database. A negative value indicates storing all
versions, a value of 0 stores no versions.
Inherited from
trustedProxies
protectedtrustedProxies:string[] =[]
Defined in: auth/src/routes/BaseSecretRoute.ts:124
Inherited from
BaseSecretRoute.trustedProxies
trustedRoles
protectedtrustedRoles:string[]
Defined in: auth/src/routes/BaseSecretRoute.ts:127
Inherited from
userClass
protecteduserClass:any=UserSQL
Defined in: auth/src/routes/sql/BaseSecretRouteSQL.ts:12
The User model class (e.g. UserMongo), used to clear passwordChangeRequired once the account holder
changes their password. Optional: a subclass that leaves it unset simply never clears the flag.
Overrides
userRepo?
protectedoptionaluserRepo?:RepoUtils<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:141
Inherited from
Accessors
modelClass
Get Signature
get modelClass():
any
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:122
The class type of the model this route is associated with.
Returns
any
Inherited from
Methods
assertElevatedOrForcedPasswordChange()
protectedassertElevatedOrForcedPasswordChange(existing,obj,user):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:307
The elevation check @RequiresElevation(60) would make on update() — the caller's token must have been
elevated within the last 60 seconds — except that it's waived for an account holder changing their own
password while their account is flagged passwordChangeRequired.
That flag means they were just sent here to choose a new password, having signed in with a temporary one. Asking
them to prove the password they typed a moment ago again, to replace it, is an empty ceremony; and an elevated
sign-in token wouldn't fix it — elevation lapses after 60 seconds, which is easily less than the time it takes to
choose a password, and an elevated token also carries trusted roles (an administrator recovering their own
account would be handed an elevated admin token). Waiving the requirement for this one action has neither problem.
Nothing else about the caller is loosened: it applies only to their own password, only to a change of its data,
and only while the flag is set.
Parameters
existing
obj
UpdateObject<SecretSQL>
user
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.assertElevatedOrForcedPasswordChange
assertPasswordAllowed()
protectedassertPasswordAllowed(obj):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:274
Enforces the SystemSettings.allowMultiplePasswords policy on a new password: unless it's on, an account that
already has one can't be given another — by anyone, an administrator included, who changes the existing one
instead. Sign-in accepts any of an account's password secrets, so this is also what makes "the one password"
mean something: whoever controls it (see syncOwnerAccess()) controls signing in by password, and the holder
can't sidestep an administrator by adding a password of their own.
Not enforced by a route with no systemSettingsClass, which has no policy to consult.
Parameters
obj
Partial<T>
Returns
Promise<void>
Inherited from
BaseSecretRoute.assertPasswordAllowed
buildOwnerACL()
protectedbuildOwnerACL(obj,req,user?): {records:any[]; } |undefined
Defined in: auth/src/routes/BaseSecretRoute.ts:188
Builds the ACL to create a new secret with when a trusted user (e.g. an administrator) provisions a
password for another account and asks, via the allowUserChange=true query parameter, for the account
holder to be able to change it themselves.
Without this the new secret's ACL is empty: the creator is a trusted role, which is exempt from the usual
implicit creator grant, and the account holder — who is not the creator — has no rights on it at all, so their
own PUT /secrets/:id to change the password is refused. Only READ, EXISTS and UPDATE are granted;
removing a password remains an administrator's call.
Parameters
obj
req
HttpRequest
user?
JWTUser
Returns
{ records: any[]; } | undefined
The ACL to pass to doCreate(), or undefined when the caller didn't ask for it or isn't entitled to.
Inherited from
cleanData()
protectedcleanData(obj):void
Defined in: auth/src/routes/BaseSecretRoute.ts:375
Removes the data property from the secret(s) to protect sensitive information.
Parameters
obj
Returns
void
Inherited from
clearPasswordChangeRequired()
protectedclearPasswordChangeRequired(userUid):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:337
Clears the passwordChangeRequired flag on the given account, after its holder set a new password. A
failure is logged rather than thrown: the password change itself has already been persisted, and the worst
case is the account being asked to change it once more.
Parameters
userUid
string
Returns
Promise<void>
Inherited from
BaseSecretRoute.clearPasswordChangeRequired
count()
count(
params,query,res,user):Promise<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:390
Parameters
params
any
query
any
res
HttpResponse
user
JWTUser
Returns
Promise<any>
Inherited from
create()
Defined in: auth/src/routes/BaseSecretRoute.ts:793
Parameters
obj
req
HttpRequest
user
JWTUser
Returns
Promise<SecretSQL | SecretSQL[]>
Inherited from
delete()
delete(
id,version,purge,req,user):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:938
Parameters
id
string
version
string | undefined
purge
string | undefined
req
HttpRequest
user
JWTUser
Returns
Promise<void>
Inherited from
doBulkCreate()
protecteddoBulkCreate(objs,options):Promise<SecretSQL[]>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:151
Attempts to store a collection of objects provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
objs
Partial<SecretSQL>[]
The object(s) to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretSQL[]>
Inherited from
doBulkUpdate()
protecteddoBulkUpdate(objs,options):Promise<SecretSQL[]>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:203
Attempts to modify a collection of existing data model objects.
Parameters
objs
UpdateObject<SecretSQL>[]
The object(s) to bulk update in the database.
options
UpdateRequestOptions<SecretSQL>
The options to process the request using.
Returns
Promise<SecretSQL[]>
Inherited from
doCount()
protecteddoCount(options):Promise<HttpResponse>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:133
Attempts to retrieve the number of data model objects matching the given set of criteria as specified in the
request query. Any results that have been found are set to the content-length header of the res argument.
Parameters
options
FindRequestOptions
The options to process the request using.
Returns
Promise<HttpResponse>
Inherited from
doCreate()
protecteddoCreate(obj,options):Promise<SecretSQL|SecretSQL[]>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:160
Attempts to store one or more objects provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
obj
Partial<SecretSQL> | Partial<SecretSQL>[]
The object(s) to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretSQL | SecretSQL[]>
Inherited from
doCreateObject()
protecteddoCreateObject(obj,options):Promise<SecretSQL>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:142
Attempts to store an object provided in options.req.body into the datasource. Upon success, sets the newly persisted
object(s) to the result property of the options.res argument, otherwise sends a 400 BAD REQUEST response to the
client.
Parameters
obj
Partial<T>
The object to store in the database.
options
CreateRequestOptions
The options to process the request using.
Returns
Promise<SecretSQL>
Inherited from
BaseSecretRoute.doCreateObject
doDelete()
protecteddoDelete(id,options):Promise<void>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:168
Attempts to delete an existing data model object with a given unique identifier encoded by the URI parameter
id.
Parameters
id
string
The unique identifier of the object to delete.
options
DeleteRequestOptions
The options to process the request using.
Returns
Promise<void>
Inherited from
doExists()
protecteddoExists(id,options):Promise<any>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:175
Attempts to determine if an existing object with the given unique identifier exists.
Parameters
id
string
The unique identifier of the object to verify exists.
options
FindRequestOptions
The options to process the request using.
Returns
Promise<any>
Inherited from
doFind()
protecteddoFind(options):Promise<SecretSQL[]>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:183
Attempts to retrieve all data model objects matching the given set of criteria as specified in the request
query. Any results that have been found are set to the result property of the res argument. result is
never null.
Parameters
options
FindRequestOptions
The options to process the request using.
Returns
Promise<SecretSQL[]>
Inherited from
doFindById()
protecteddoFindById(id,options):Promise<SecretSQL|null>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:189
Attempts to retrieve a single data model object as identified by the id parameter in the URI.
Parameters
id
string
options
FindRequestOptions
The options to process the request using.
Returns
Promise<SecretSQL | null>
Inherited from
doTruncate()
protecteddoTruncate(options):Promise<void>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:196
Attempts to remove all entries of the data model type from the datasource matching the given parameters and query.
Parameters
options
TruncateRequestOptions
The options to process the request using.
Returns
Promise<void>
Inherited from
doUpdate()
protecteddoUpdate(id,obj,options):Promise<SecretSQL>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:210
Attempts to modify an existing data model object as identified by the id parameter in the URI.
Parameters
id
string
obj
UpdateObject<SecretSQL>
The object to update in the database
options
UpdateRequestOptions<SecretSQL>
The options to process the request using.
Returns
Promise<SecretSQL>
Inherited from
doUpdateProperty()
protecteddoUpdateProperty(id,propertyName,value,options):Promise<SecretSQL>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:221
Attempts to modify a single property of an existing data model object as identified by the id parameter in the URI.
Note that this effectively bypasses optimistic locking and can cause unexpected data overwrites. Use with care.
Parameters
id
string
The unique identifier of the object to update.
propertyName
string
The name of the property to update.
value
any
The value of the property to set.
options
UpdateRequestOptions<SecretSQL>
The options to process the request using.
Returns
Promise<SecretSQL>
Inherited from
BaseSecretRoute.doUpdateProperty
enforceOwnership()
protectedenforceOwnership(obj,user?):void
Defined in: auth/src/routes/BaseSecretRoute.ts:361
Ensures the userUid of a secret being created belongs to the authenticated caller, defaulting it to
their own uid when unset. Prevents any authenticated user from self-service registering a password,
passkey, FIDO2 key, or TOTP secret on another user's account. Callers with one of trustedRoles (e.g.
an administrator provisioning an account) are exempt.
Parameters
obj
Partial<T>
user?
JWTUser
Returns
void
Inherited from
BaseSecretRoute.enforceOwnership
exists()
exists(
id,query,res,user):Promise<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:1009
Parameters
id
string
query
any
res
HttpResponse
user
JWTUser
Returns
Promise<any>
Inherited from
fido2RegistrationOptions()
fido2RegistrationOptions(
req,user):Promise<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:774
Parameters
req
HttpRequest
user
JWTUser
Returns
Promise<any>
Inherited from
BaseSecretRoute.fido2RegistrationOptions
find()
find(
params,query,user):Promise<SecretSQL[]>
Defined in: auth/src/routes/BaseSecretRoute.ts:1034
Secret's class-level ACL intentionally does NOT grant LIST to .* — per-record ACL narrowing in
RepoUtils.find() falls back to the parent (class-level) ACL when a specific record has no direct
grant for the caller, so a class-level .*: LIST wildcard would make every record's per-record check
pass for every caller via that fallback, leaking every user's secrets to every other user. Instead,
self-service "list my own secrets" is handled here directly: scope the query to the caller's own
userUid (discarding any client-supplied userUid filter, which would otherwise let a caller probe
another user's secrets) and bypass ACL entirely with ignoreACL for that already-scoped lookup — the
same pattern already used internally by beginWebAuthnRegistration() above. A trusted role keeps the
normal, unscoped behavior.
Parameters
params
any
query
any
user
JWTUser
Returns
Promise<SecretSQL[]>
Inherited from
findById()
findById(
id,query,user):Promise<SecretSQL|null>
Defined in: auth/src/routes/BaseSecretRoute.ts:1057
Parameters
id
string
query
any
user
JWTUser
Returns
Promise<SecretSQL | null>
Inherited from
getPasswordConfig()
getPasswordConfig():
Promise<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:760
Returns
Promise<any>
Inherited from
BaseSecretRoute.getPasswordConfig
isPasswordChangeRequired()
protectedisPasswordChangeRequired(userUid):Promise<boolean>
Defined in: auth/src/routes/BaseSecretRoute.ts:327
Whether the given account is flagged passwordChangeRequired. false when there's no user repo to ask.
Parameters
userUid
string
Returns
Promise<boolean>
Inherited from
BaseSecretRoute.isPasswordChangeRequired
ownerAccessRequest()
protectedownerAccessRequest(type,userUid,req,user?):"revoke"|"grant"|undefined
Defined in: auth/src/routes/BaseSecretRoute.ts:202
What a trusted user is asking for, via the allowUserChange query parameter, about whether the account holder
can change a password secret they're provisioning or resetting for that account: "grant" for
allowUserChange=true, "revoke" for allowUserChange=false, and undefined when it isn't given (leave it as
it is) or the caller isn't entitled to ask. Never for another secret type, for a caller who isn't a trusted user,
or for one acting on their own secret (who has the ordinary creator grant already).
Parameters
type
userUid
string | undefined
req
HttpRequest
user?
JWTUser
Returns
"revoke" | "grant" | undefined
Inherited from
BaseSecretRoute.ownerAccessRequest
passkeyRegistrationOptions()
passkeyRegistrationOptions(
req,user):Promise<any>
Defined in: auth/src/routes/BaseSecretRoute.ts:748
Parameters
req
HttpRequest
user
JWTUser
Returns
Promise<any>
Inherited from
BaseSecretRoute.passkeyRegistrationOptions
syncOwnerAccess()
protectedsyncOwnerAccess(existing,req,user?):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:231
The update() counterpart of buildOwnerACL(): a secret that already exists has an ACL already, and what the
account holder can do with it depends on how it got there — a password an administrator created earlier gives
them nothing, one they set themselves gives them everything. So an administrator resetting it says which they
want, with allowUserChange:
trueaddsOWNER_PASSWORD_ACTIONSfor the holder (creating the ACL first if the record somehow has none), so a password they couldn't change becomes one they can;falseremoves the holder's record from it altogether, so a password they could change — including one they chose themselves — becomes one only an administrator can. That's how an administrator keeps control of it.
Parameters
existing
req
HttpRequest
user?
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.syncOwnerAccess
truncate()
truncate(
params,query,user):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:1071
Parameters
params
any
query
any
user
JWTUser
Returns
Promise<void>
Inherited from
update()
update(
id,obj,req,user):Promise<SecretSQL>
Defined in: auth/src/routes/BaseSecretRoute.ts:1144
Parameters
id
string
obj
UpdateObject<SecretSQL>
req
HttpRequest
user
JWTUser
Returns
Promise<SecretSQL>
Inherited from
validate()
validate(
objs,options?):Promise<void>
Defined in: auth/node_modules/@rapidrest/service-core/dist/types/routes/ModelRoute.d.ts:225
Calls repoUtils.validate() to validate the object(s) provided.
Parameters
objs
Partial<SecretSQL> | Partial<SecretSQL>[]
options?
CreateRequestOptions | UpdateRequestOptions<SecretSQL>
Returns
Promise<void>
Inherited from
validateAppPasswordCreate()
protectedvalidateAppPasswordCreate(obj,req):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:540
Validates a new app-password secret's hint and generates the credential itself, discarding any
client-supplied data entirely - like recovery codes, there's no legitimate reason for a caller to
bring their own value here; accepting one would let an attacker who can currently write to this
secret type plant a known credential for later use. A hint is required (not merely optional, as it
is for other secret types) since an account may accumulate several app passwords over time - the
label is the only way a user tells them apart again later, once the plaintext itself is gone.
Only the generated password's argon2 hash is persisted; the plaintext is stashed on req so
sanitizeSecretForResponse() can return it to the caller exactly once, in the create() response -
it can never be retrieved again after that, since it's never written to the datastore.
Parameters
obj
Partial<T>
The secret being created.
req
HttpRequest
The source HTTP request, used to stash the plaintext app password for the create()
response only.
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateAppPasswordCreate
validateCreate()
protectedvalidateCreate(obj,req,user?):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:399
Parameters
obj
Partial<T>
req
HttpRequest
user?
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateCreate
validateRecoveryCodesCreate()
protectedvalidateRecoveryCodesCreate(obj,req):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:689
Generates a fresh batch of MFA recovery/backup codes for the account, discarding any client-supplied
data entirely - unlike a TOTP secret, there's no legitimate reason for a caller to bring their own
codes here; accepting caller-chosen values would let an attacker who can currently write to this
secret pre-plant known codes for later use. Only each code's argon2 hash is persisted (see
RecoveryCodesSecret); the plaintext is stashed on req so sanitizeSecretForResponse() can return
it to the caller exactly once, in the create() response - it can never be retrieved again after
that, since it's never written to the datastore.
Parameters
obj
Partial<T>
The secret being created.
req
HttpRequest
The source HTTP request, used to stash the plaintext codes for the create() response only.
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateRecoveryCodesCreate
validateTOTPCreate()
protectedvalidateTOTPCreate(obj):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:650
Validates (or generates) the secret for a new totp secret per RFC 6238/RFC 4226.
The client may either bring their own Base32-encoded secret (e.g. one generated on a
different server for migration purposes) or, more commonly, omit data entirely and have one
generated here. Either way, the secret's token parameters (digits/period/algorithm) are
captured onto the stored TOTPSecret alongside it, rather than left to always defer to
totpConfig, so verification keeps working for this secret even if the configured defaults
change later.
Parameters
obj
Partial<T>
The secret being created. If data is a string, it's used as the caller-supplied
secret; otherwise a new one is generated.
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateTOTPCreate
validateUpdate()
protectedvalidateUpdate(obj,existing,user):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:1075
Parameters
obj
UpdateObject<SecretSQL>
existing
user
JWTUser
Returns
Promise<void>
Inherited from
BaseSecretRoute.validateUpdate
validateWebAuthnCreate()
protectedvalidateWebAuthnCreate(obj,req,config):Promise<void>
Defined in: auth/src/routes/BaseSecretRoute.ts:587
Verifies a client-submitted WebAuthn RegistrationResponseJSON (as produced by
navigator.credentials.create() using the options from generatePasskeyRegistrationOptions()) against
the challenge stored in the session, and replaces obj.data with the resulting StoredPasskeyCredential.
Shared by both passkey and fido2 secrets — the two differ only in relying party configuration
(see passkeyConfig/fido2Config) and which SecretType they're persisted under, not in the
underlying WebAuthn ceremony.
Per the WebAuthn registration ceremony (https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential),
the credential ID must be unique across all accounts known to this relying party. Rather than duplicate that
check here, the credential ID is used directly as this secret's own uid so that ModelRoute's existing
create-time identifier check rejects the request should the ID already be registered to any account. This
also lets a login ceremony, which only has the credential ID to go on, look the secret up directly by its
primary key (see BaseAuthPasskeyRoute/BaseAuthFIDO2Route's getCredentialById/updateCredentialCounter).
Parameters
obj
Partial<T>
The secret being created. Its data property must be a RegistrationResponseJSON.
req
HttpRequest
The source HTTP request, used to retrieve the challenge stored in the session by a prior call to
generatePasskeyRegistrationOptions().
config
The relying party configuration to verify the response against.
Returns
Promise<void>