feat: Dashboard WebAuthn support (#984)

* added support for webauthn user editing

* bumped version

* chore: update version and rebuild

---------

Co-authored-by: Victor Bojica <[email protected]>
Co-authored-by: Mihaly Lengyel <[email protected]>

Author: 3 people

CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
+## [22.0.1] - 2025-03-26
+
+-   Added Dashboard support for WebAuthn
+
 ## [22.0.0] - 2025-03-19
 
 ### Breaking changes

lib/build/recipe/dashboard/api/multitenancy/utils.js

@@ -66,6 +66,7 @@ function factorIdToRecipe(factorId) {
         "link-email": "Passwordless",
         "link-phone": "Passwordless",
         totp: "Totp",
+        webauthn: "WebAuthn",
     };
     return factorIdToRecipe[factorId];
 }

lib/build/recipe/dashboard/api/userdetails/userPut.js

@@ -9,10 +9,12 @@ exports.userPut = void 0;
 const error_1 = __importDefault(require("../../../../error"));
 const recipe_1 = __importDefault(require("../../../emailpassword/recipe"));
 const recipe_2 = __importDefault(require("../../../passwordless/recipe"));
+const recipe_3 = __importDefault(require("../../../webauthn/recipe"));
 const emailpassword_1 = __importDefault(require("../../../emailpassword"));
 const passwordless_1 = __importDefault(require("../../../passwordless"));
+const webauthn_1 = __importDefault(require("../../../webauthn"));
 const utils_1 = require("../../utils");
-const recipe_3 = __importDefault(require("../../../usermetadata/recipe"));
+const recipe_4 = __importDefault(require("../../../usermetadata/recipe"));
 const usermetadata_1 = __importDefault(require("../../../usermetadata"));
 const constants_1 = require("../../../emailpassword/constants");
 const utils_2 = require("../../../passwordless/utils");
@@ -99,6 +101,33 @@ const updateEmailForRecipeId = async (recipeId, recipeUserId, email, tenantId, u
             status: "OK",
         };
     }
+    if (recipeId === "webauthn") {
+        let validationError = await recipe_3.default
+            .getInstanceOrThrowError()
+            .config.validateEmailAddress(email, tenantId, userContext);
+        if (validationError !== undefined) {
+            return {
+                status: "INVALID_EMAIL_ERROR",
+                error: validationError,
+            };
+        }
+        const emailUpdateResponse = await webauthn_1.default.updateUserEmail({
+            email,
+            recipeUserId: recipeUserId.getAsString(),
+            tenantId,
+            userContext,
+        });
+        if (emailUpdateResponse.status === "EMAIL_ALREADY_EXISTS_ERROR") {
+            return {
+                status: "EMAIL_ALREADY_EXISTS_ERROR",
+            };
+        } else if (emailUpdateResponse.status === "UNKNOWN_USER_ID_ERROR") {
+            throw new Error("Should never come here");
+        }
+        return {
+            status: "OK",
+        };
+    }
     /**
      * If it comes here then the user is a third party user in which case the UI should not have allowed this
      */
@@ -211,7 +240,7 @@ const userPut = async (_, tenantId, options, userContext) => {
     if (firstName.trim() !== "" || lastName.trim() !== "") {
         let isRecipeInitialised = false;
         try {
-            recipe_3.default.getInstanceOrThrowError();
+            recipe_4.default.getInstanceOrThrowError();
             isRecipeInitialised = true;
         } catch (_) {
             // no op

lib/build/recipe/dashboard/types.d.ts

@@ -51,7 +51,7 @@ export declare type APIFunction = (
     options: APIOptions,
     userContext: UserContext
 ) => Promise<any>;
-export declare type RecipeIdForUser = "emailpassword" | "thirdparty" | "passwordless";
+export declare type RecipeIdForUser = "emailpassword" | "thirdparty" | "passwordless" | "webauthn";
 export declare type AuthMode = "api-key" | "email-password";
 export declare type UserWithFirstAndLastName = User & {
     firstName?: string;

lib/build/recipe/dashboard/utils.d.ts

@@ -12,7 +12,7 @@ export declare function getUserForRecipeId(
     userContext: UserContext
 ): Promise<{
     user: UserWithFirstAndLastName | undefined;
-    recipe: "emailpassword" | "thirdparty" | "passwordless" | undefined;
+    recipe: "emailpassword" | "thirdparty" | "passwordless" | "webauthn" | undefined;
 }>;
 export declare function validateApiKey(input: {
     req: BaseRequest;

lib/build/recipe/dashboard/utils.js

@@ -26,6 +26,7 @@ const recipe_1 = __importDefault(require("../accountlinking/recipe"));
 const recipe_2 = __importDefault(require("../emailpassword/recipe"));
 const recipe_3 = __importDefault(require("../thirdparty/recipe"));
 const recipe_4 = __importDefault(require("../passwordless/recipe"));
+const recipe_5 = __importDefault(require("../webauthn/recipe"));
 const logger_1 = require("../../logger");
 function validateAndNormaliseUserInput(config) {
     let override = Object.assign(
@@ -57,7 +58,12 @@ function sendUnauthorisedAccess(res) {
 }
 exports.sendUnauthorisedAccess = sendUnauthorisedAccess;
 function isValidRecipeId(recipeId) {
-    return recipeId === "emailpassword" || recipeId === "thirdparty" || recipeId === "passwordless";
+    return (
+        recipeId === "emailpassword" ||
+        recipeId === "thirdparty" ||
+        recipeId === "passwordless" ||
+        recipeId === "webauthn"
+    );
 }
 exports.isValidRecipeId = isValidRecipeId;
 async function getUserForRecipeId(recipeUserId, recipeId, userContext) {
@@ -115,6 +121,13 @@ async function _getUserForRecipeId(recipeUserId, recipeId, userContext) {
         } catch (e) {
             // No - op
         }
+    } else if (recipeId === recipe_5.default.RECIPE_ID) {
+        try {
+            recipe_5.default.getInstanceOrThrowError();
+            recipe = "webauthn";
+        } catch (e) {
+            // No - op
+        }
     }
     return {
         user,

lib/build/recipe/multitenancy/api/implementation.js

@@ -76,6 +76,9 @@ function getAPIInterface() {
                     enabled: validFirstFactors.includes("thirdparty"),
                     providers: finalProviderList,
                 },
+                webauthn: {
+                    enabled: validFirstFactors.includes("webauthn"),
+                },
                 passwordless: {
                     enabled:
                         validFirstFactors.includes("otp-email") ||

lib/build/recipe/webauthn/index.d.ts

@@ -223,9 +223,9 @@ export default class Wrapper {
         status:
             | "OK"
             | "UNKNOWN_USER_ID_ERROR"
-            | "INVALID_CREDENTIALS_ERROR"
             | "INVALID_OPTIONS_ERROR"
             | "OPTIONS_NOT_FOUND_ERROR"
+            | "INVALID_CREDENTIALS_ERROR"
             | "INVALID_AUTHENTICATOR_ERROR"
             | "CREDENTIAL_NOT_FOUND_ERROR";
     }>;