Using passkeys with wallets

// /api/register-passkey/begin
import {generateRegistrationOptions} from '@simplewebauthn/server';
import type {NextApiRequest, NextApiResponse} from 'next';
import {passkeyStorage} from '@/lib/passkey-storage';

// This would typically come from your database
const rpName = 'Your App Name';
const rpID = 'yourdomain.com';
const origin = 'https://yourdomain.com';

export default async function handler(req: NextApiRequest, res: NextApiResponse) {
  if (req.method !== 'POST') {
    return res.status(405).json({error: 'Method not allowed'});
  }

  try {
    const {userId} = req.body;

    if (!userId) {
      return res.status(400).json({error: 'userId is required'});
    }

    // Generate registration options
    const options = await generateRegistrationOptions({
      rpName,
      rpID,
      userID: Buffer.from(userId),
      userName: `user-${userId}`, // This would typically be the user's email or username
      attestationType: 'none', // For demo purposes, we don't need attestation
      authenticatorSelection: {
        residentKey: 'preferred',
        userVerification: 'preferred'
      },
      supportedAlgorithmIDs: [-7] // ES256
    });

    // Store the options temporarily (in production, store in database with expiration)
    passkeyStorage.set(userId, {options});

    // Clean up old entries (older than 5 minutes)
    // passkeyStorage.cleanup();

    return res.status(200).json(options);
  } catch (error) {
    console.error('Error generating registration options:', error);
    return res.status(500).json({error: 'Internal server error'});
  }
}

// /api/register-passkey/verify
import {verifyRegistrationResponse} from '@simplewebauthn/server';
import type {NextApiRequest, NextApiResponse} from 'next';
import {passkeyStorage} from '@/lib/passkey-storage';

const rpID = 'yourdomain.com';
const origin = 'https://yourdomain.com';

export default async function handler(req: NextApiRequest, res: NextApiResponse) {
  if (req.method !== 'POST') {
    return res.status(405).json({error: 'Method not allowed'});
  }

  try {
    const {userId, attestationResponse} = req.body;

    if (!userId || !attestationResponse) {
      return res.status(400).json({error: 'userId and attestationResponse are required'});
    }

    // Retrieve the stored registration options
    const storedData = passkeyStorage.get(userId);
    if (!storedData) {
      return res.status(400).json({error: 'Registration options not found or expired'});
    }

    const {options} = storedData;

    // Verify the registration response
    const verification = await verifyRegistrationResponse({
      response: attestationResponse,
      expectedRPID: rpID,
      expectedOrigin: origin,
      expectedChallenge: options.challenge,
      requireUserVerification: false // For demo purposes
    });

    if (verification.verified) {
      // Registration successful - store the passkey credentials
      // In production, you would store this in your database
      const {credentialID, credentialPublicKey} = verification.registrationInfo;

      // Clean up temporary storage
      passkeyStorage.delete(userId);

      return res.status(200).json({
        verified: true,
        credentialID: Buffer.from(credentialID).toString('base64'),
        publicKey: Buffer.from(credentialPublicKey).toString('base64')
      });
    } else {
      return res.status(400).json({error: 'Registration verification failed'});
    }
  } catch (error) {
    console.error('Error verifying registration:', error);
    return res.status(500).json({error: 'Internal server error'});
  }
}

// Client-side registration
async function registerPasskey(userId: string) {
  // Step 1: Get registration options from server
  const optionsResponse = await fetch('/api/register-passkey/begin', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({userId})
  });

  const options = await optionsResponse.json();

  // Step 2: Start the registration process in the browser
  const attestationResponse = await startRegistration(options);

  // Step 3: Send the response to your server for verification
  const verificationResponse = await fetch('/api/register-passkey/verify', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      userId,
      attestationResponse
    })
  });

  const verification = await verificationResponse.json();

  if (verification.verified) {
    // Passkey registration successful!
    return {
      credentialID: verification.credentialID,
      publicKey: verification.publicKey
    };
  } else {
    throw new Error('Passkey registration failed');
  }
}

const coseToJwk = require('cose-to-jwk');

async function convertCoseToPem(coseKey: Uint8Array): Promise<string> {
  // Convert COSE to JWK format
  const jwk = coseToJwk(coseKey);

  // Import the JWK using Web Crypto API
  const cryptoKey = await crypto.subtle.importKey(
    'jwk',
    jwk,
    {
      name: 'ECDSA',
      namedCurve: 'P-256'
    },
    true, // extractable
    ['verify'] // only need verify for public keys
  );

  // Export the key in SPKI format (DER-encoded)
  const spkiDer = await crypto.subtle.exportKey('spki', cryptoKey);

  // Convert to base64 and format as PEM
  const base64Key = Buffer.from(spkiDer).toString('base64');

  // Split into 64-character lines
  const lines = [];
  for (let i = 0; i < base64Key.length; i += 64) {
    lines.push(base64Key.slice(i, i + 64));
  }

  // Create PEM format
  const pemKey = `-----BEGIN PUBLIC KEY-----\n${lines.join('\n')}\n-----END PUBLIC KEY-----`;

  return pemKey;
}