Add ESLint to all packages and reorganize CLI

ESLint: - Add @macalinao/eslint-config and eslint to all packages/apps - Add lint scripts to all package.json files - Create eslint.config.js for all apps - Add lint task to turbo.json - Add @macalinao/eslint-config and @types/bun to catalog Biome: - Exclude docs/ from biome checks CLI Reorganization: - Restructure CLI to use route maps with one command per file - Move commands to routes/ directory structure - Use func property instead of async loaders - Route maps in _command.ts files for each directory Environment: - Use Bun.env instead of process.env for env vars - Add DATABASE_URL and PORT to turbo.json globalEnv Lint Fixes: - Fix nullish coalescing operator usage - Update deprecated Zod API (z.email() instead of .string().email()) - Fix import sorting Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:01:41 +08:00
parent b687d9cd1d
commit 8f3f711af0
42 changed files with 3291 additions and 279 deletions
--- a/docs/initial-app.md
+++ b/docs/initial-app.md
--- a/docs/reference-webauthn.ts
+++ b/docs/reference-webauthn.ts
@@ -0,0 +1,300 @@
+import type {
+  AuthenticationResponseJSON,
+  PublicKeyCredentialCreationOptionsJSON,
+  PublicKeyCredentialRequestOptionsJSON,
+  RegistrationResponseJSON,
+} from "@simplewebauthn/types";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+} from "@simplewebauthn/server";
+import { TRPCError } from "@trpc/server";
+import { uniq } from "lodash-es";
+
+const KNOWN_AAGUIDS: Record<string, string> = {
+  "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4": "Google Password Manager",
+  "adce0002-35bc-c60a-648b-0b25f1f05503": "Chrome on Mac",
+  "08987058-cadc-4b81-b6e1-30de50dcbe96": "Windows Hello",
+  "9ddd1817-af5a-4672-a2b9-3e3dd95000a9": "Windows Hello",
+  "6028b017-b1d4-4c02-b4b3-afcdafc96bb2": "Windows Hello",
+  "dd4ec289-e01d-41c9-bb89-70fa845d4bf2": "iCloud Keychain (Managed)",
+  "531126d6-e717-415c-9320-3d9aa6981239": "Dashlane",
+  "bada5566-a7aa-401f-bd96-45619a55120d": "1Password",
+  "b84e4048-15dc-4dd0-8640-f4f60813c8af": "NordPass",
+  "0ea242b4-43c4-4a1b-8b17-dd6d0b6baec6": "Keeper",
+  "891494da-2c90-4d31-a9cd-4eab0aed1309": "Sésame",
+  "f3809540-7f14-49c1-a8b3-8f813b225541": "Enpass",
+  "b5397666-4885-aa6b-cebf-e52262a439a2": "Chromium Browser",
+  "771b48fd-d3d4-4f74-9232-fc157ab0507a": "Edge on Mac",
+  "39a5647e-1853-446c-a1f6-a79bae9f5bc7": "IDmelon",
+  "d548826e-79b4-db40-a3d8-11116f7e8349": "Bitwarden",
+  "fbfc3007-154e-4ecc-8c0b-6e020557d7bd": "iCloud Keychain",
+  "53414d53-554e-4700-0000-000000000000": "Samsung Pass",
+  "66a0ccb3-bd6a-191f-ee06-e375c50b9846": "Thales Bio iOS SDK",
+  "8836336a-f590-0921-301d-46427531eee6": "Thales Bio Android SDK",
+  "cd69adb5-3c7a-deb9-3177-6800ea6cb72a": "Thales PIN Android SDK",
+  "17290f1e-c212-34d0-1423-365d729f09d9": "Thales PIN iOS SDK",
+  "50726f74-6f6e-5061-7373-50726f746f6e": "Proton Pass",
+  "fdb141b2-5d84-443e-8a35-4698c205a502": "KeePassXC",
+  "cc45f64e-52a2-451b-831a-4edd8022a202": "ToothPic Passkey Provider",
+  "bfc748bb-3429-4faa-b9f9-7cfa9f3b76d0": "iPasswords",
+  "b35a26b2-8f6e-4697-ab1d-d44db4da28c6": "Zoho Vault",
+  "b78a0a55-6ef8-d246-a042-ba0f6d55050c": "LastPass",
+  "de503f9c-21a4-4f76-b4b7-558eb55c6f89": "Devolutions",
+};
+
+export const getRPInfo = (
+  ctx: APIContext,
+): {
+  rpName: string;
+  rpID: string;
+  origins: string[];
+} => {
+  // RP must always be the frontend URL.
+  const rpID = ctx.origin.includes("oval.ph")
+    ? "oval.ph"
+    : new URL(ctx.origin).hostname;
+  const origins = uniq(
+    ctx.env.ALLOWED_WEBAUTHN_ORIGINS.split(",").map((o) => new URL(o).origin),
+  );
+  return {
+    rpName: `Oval Business${rpID !== "oval.ph" ? ` (${rpID})` : ""}`,
+    rpID,
+    origins,
+  };
+};
+
+export const getUserPasskeys = async (ctx: APIContext, userId: string) => {
+  const userPasskeys = await fetchPasskeyQuery(ctx.db)
+    .where("passkeys.user_id", "=", userId)
+    .execute();
+  return userPasskeys.map(parsePasskey);
+};
+
+export const createRegistrationOptions = async (
+  ctx: ProtectedAPIContext,
+): Promise<{
+  options: PublicKeyCredentialCreationOptionsJSON;
+  challengeId: PublicId<"passkey_challenges">;
+}> => {
+  const { rpID, rpName } = getRPInfo(ctx);
+  const userPasskeys = await getUserPasskeys(ctx, ctx.user.id);
+  const options: PublicKeyCredentialCreationOptionsJSON =
+    await generateRegistrationOptions({
+      rpName,
+      rpID,
+      userName: ctx.user.display_name,
+      // Don't prompt users for additional information about the authenticator
+      // (Recommended for smoother UX)
+      attestationType: "direct",
+      // Prevent users from re-registering existing authenticators
+      excludeCredentials: userPasskeys.map((passkey) => ({
+        id: passkey.credentialId,
+        // Optional
+        transports: passkey.transports ?? undefined,
+      })),
+      // See "Guiding use of authenticators via authenticatorSelection" below
+      authenticatorSelection: {
+        // Defaults
+        residentKey: "preferred",
+        userVerification: "preferred",
+        // Optional
+        authenticatorAttachment: "platform",
+      },
+    });
+  const { public_id } = await ctx.db
+    .insertInto("passkey_challenges")
+    .values({
+      options: JSON.stringify(options),
+    })
+    .returning("public_id")
+    .executeTakeFirstOrThrow();
+  return {
+    options,
+    challengeId: public_id,
+  };
+};
+export const verifyRegistration = async (
+  ctx: ProtectedAPIContext,
+  {
+    challengeId,
+    response,
+  }: {
+    challengeId: PublicId<"passkey_challenges">;
+    response: RegistrationResponseJSON;
+  },
+): Promise<void> => {
+  const { rpID, origins } = getRPInfo(ctx);
+  const optionsRaw = await ctx.db
+    .selectFrom("passkey_challenges")
+    .where("public_id", "=", challengeId)
+    .select("options")
+    .executeTakeFirst();
+  if (!optionsRaw) {
+    throw new TRPCError({
+      code: "TIMEOUT",
+      message: "Registration timed out. Please try again.",
+    });
+  }
+  const options =
+    optionsRaw.options as unknown as PublicKeyCredentialCreationOptionsJSON;
+
+  let verification;
+  try {
+    verification = await verifyRegistrationResponse({
+      response,
+      expectedChallenge: options.challenge,
+      expectedOrigin: origins,
+      expectedRPID: rpID,
+    });
+  } catch (error) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: `Invalid registration response. Please try again. ${(error as { message?: string }).message ?? ""}`,
+    });
+  } finally {
+    await ctx.db
+      .deleteFrom("passkey_challenges")
+      .where("public_id", "=", challengeId)
+      .execute();
+  }
+
+  const { verified, registrationInfo } = verification;
+  if (!(verified && registrationInfo)) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Unable to verify your device.",
+    });
+  }
+
+  const { credential, credentialDeviceType, credentialBackedUp } =
+    registrationInfo;
+
+  const guidName = KNOWN_AAGUIDS[registrationInfo.aaguid];
+
+  const insert: PasskeyInsert = {
+    credentialId: credential.id,
+    webAuthnUserId: options.user.id,
+    counter: BigInt(credential.counter),
+    deviceType: credentialDeviceType,
+    backupStatus: credentialBackedUp,
+    transports: response.response.transports ?? null,
+    rpid: rpID,
+    name: `${guidName ?? "Key"} registered at ${formatDateTime(new Date())}`,
+    publicKey: credential.publicKey,
+  };
+
+  await ctx.db
+    .insertInto("passkeys")
+    .values(
+      passkeyToInsert(insert, {
+        rawUserId: ctx.user.id,
+      }),
+    )
+    .execute();
+};
+
+export const createAuthenticationOptions = async (
+  ctx: APIContext,
+  userId: string,
+): Promise<{
+  options: PublicKeyCredentialRequestOptionsJSON;
+  challengeId: PublicId<"passkey_challenges">;
+}> => {
+  const { rpID } = getRPInfo(ctx);
+  const userPasskeys = await getUserPasskeys(ctx, userId);
+  const options = await generateAuthenticationOptions({
+    rpID,
+    // Require users to use a previously-registered authenticator
+    allowCredentials: userPasskeys.map((passkey) => ({
+      id: passkey.credentialId,
+      transports: passkey.transports ?? undefined,
+    })),
+  });
+  const { public_id: challengeId } = await ctx.db
+    .insertInto("passkey_challenges")
+    .values({
+      options: JSON.stringify(options),
+    })
+    .returning("public_id")
+    .executeTakeFirstOrThrow();
+  return {
+    options,
+    challengeId: challengeId,
+  };
+};
+
+export const verifyAuthentication = async (
+  ctx: APIContext,
+  {
+    userId,
+    challengeId,
+    response,
+  }: {
+    userId: string;
+    challengeId: PublicId<"passkey_challenges">;
+    response: AuthenticationResponseJSON;
+  },
+): Promise<boolean> => {
+  const { rpID, origins } = getRPInfo(ctx);
+  const optionsRaw = await ctx.db
+    .selectFrom("passkey_challenges")
+    .where("public_id", "=", challengeId)
+    .select("options")
+    .executeTakeFirst();
+  if (!optionsRaw) {
+    throw new TRPCError({
+      code: "TIMEOUT",
+      message: "Registration timed out. Please try again.",
+    });
+  }
+  const options =
+    optionsRaw.options as unknown as PublicKeyCredentialRequestOptionsJSON;
+  try {
+    const userPasskeys = await getUserPasskeys(ctx, userId);
+    const passkey = userPasskeys.find(
+      (passkey) => passkey.credentialId === response.id,
+    );
+    if (!passkey) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: "Unknown passkey.",
+      });
+    }
+
+    const verification = await verifyAuthenticationResponse({
+      response,
+      expectedChallenge: options.challenge,
+      expectedOrigin: origins,
+      expectedRPID: rpID,
+      credential: {
+        id: passkey.credentialId,
+        publicKey: passkey.publicKey,
+        counter: Number.parseInt(passkey.counter.toString(), 10),
+        transports: passkey.transports ?? undefined,
+      },
+    });
+
+    if (!verification.verified) {
+      return false;
+    }
+
+    await ctx.db
+      .updateTable("passkeys")
+      .set((eb) => ({
+        counter: verification.authenticationInfo.newCounter.toString(),
+        last_used_at: eb.fn("NOW"),
+      }))
+      .where("passkeys.id", "=", passkey.id)
+      .execute();
+  } finally {
+    await ctx.db
+      .deleteFrom("passkey_challenges")
+      .where("public_id", "=", challengeId)
+      .execute();
+  }
+
+  return true;
+};