Vendor Oslo dependencies

Author: Nicolapps

eslint.config.mjs

@@ -15,6 +15,8 @@ export default defineConfig([
       ".context/**",
       ".pnpm-store/**",
       "packages/argon2id-wasm/rust/pkg/**",
+      // Generated wasm-bindgen output.
+      "packages/argon2id/src/argon2-wasm/pkg/**",
       // Generated output in the docs package (Next.js build + Fumadocs MDX).
       "packages/docs/.next/**",
       "packages/docs/.source/**",

packages/core/package.json

@@ -53,8 +53,6 @@
   },
   "dependencies": {
     "@convex-dev/rate-limiter": "^0.3.2",
-    "@oslojs/crypto": "^1.0.1",
-    "@oslojs/webauthn": "^1.0.0",
     "argon2id-wasm": "0.0.0-alpha.1",
     "commander": "^14.0.2",
     "cookie": "1.1.1",

packages/core/src/components/passkey/authentication.ts

@@ -5,19 +5,19 @@ import {
   createAssertionSignatureMessage,
   parseAuthenticatorData,
   parseClientDataJSON,
-} from "@oslojs/webauthn";
+} from "../../vendor/oslo/webauthn";
 import {
   decodePKIXECDSASignature,
   decodeSEC1PublicKey,
   p256,
   verifyECDSASignature,
-} from "@oslojs/crypto/ecdsa";
+} from "../../vendor/oslo/crypto/ecdsa";
 import {
   decodePKCS1RSAPublicKey,
   sha256ObjectIdentifier,
   verifyRSASSAPKCS1v15Signature,
-} from "@oslojs/crypto/rsa";
-import { sha256 } from "@oslojs/crypto/sha2";
+} from "../../vendor/oslo/crypto/rsa";
+import { sha256 } from "../../vendor/oslo/crypto/sha2";
 import { finishAuthenticationUserError } from "./validation";
 import { consumeChallenge, randomChallenge } from "./helpers";
 

packages/core/src/components/passkey/helpers.ts

@@ -1,5 +1,5 @@
 import { MutationCtx } from "./_generated/server";
-import { constantTimeEqual } from "@oslojs/crypto/subtle";
+import { constantTimeEqual } from "../../vendor/oslo/crypto/subtle";
 
 // The time for which a stored challenge stays valid. A WebAuthn ceremony
 // completes in seconds. An older challenge shows a stale tab or a replay

packages/core/src/components/passkey/registration.ts

@@ -7,9 +7,9 @@ import {
   coseEllipticCurveP256,
   parseAttestationObject,
   parseClientDataJSON,
-} from "@oslojs/webauthn";
-import { ECDSAPublicKey, p256 } from "@oslojs/crypto/ecdsa";
-import { RSAPublicKey } from "@oslojs/crypto/rsa";
+} from "../../vendor/oslo/webauthn";
+import { ECDSAPublicKey, p256 } from "../../vendor/oslo/crypto/ecdsa";
+import { RSAPublicKey } from "../../vendor/oslo/crypto/rsa";
 import {
   finishRegistrationUserError,
   deletePasskeyUserError,

packages/core/src/vendor/oslo/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 pilcrowOnPaper
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/core/src/vendor/oslo/README.md

@@ -0,0 +1,40 @@
+# Vendored Oslo libraries
+
+This directory contains code vendored from the [Oslo
+project](https://oslojs.dev) by pilcrowOnPaper. The Oslo project is being
+deprecated, so the parts that the passkey component relies on live here
+instead of coming in as npm dependencies.
+
+All of the code is MIT-licensed, Copyright (c) 2024 pilcrowOnPaper (see the
+`LICENSE` file in this directory).
+
+## Sources
+
+Each directory mirrors one Oslo package, and the file layout follows the
+package's public import specifiers (for example `@oslojs/crypto/ecdsa`
+becomes `crypto/ecdsa.ts`).
+
+| Directory   | Source package     | Version | Commit    | Repository                               |
+| ----------- | ------------------ | ------- | --------- | ---------------------------------------- |
+| `webauthn/` | `@oslojs/webauthn` | 1.0.0   | `c18f664` | https://github.com/oslo-project/webauthn |
+| `crypto/`   | `@oslojs/crypto`   | 1.0.1   | `8b3910f` | https://github.com/oslo-project/crypto   |
+| `asn1/`     | `@oslojs/asn1`     | 1.0.0   | `65a9bbd` | https://github.com/oslo-project/asn1     |
+| `binary/`   | `@oslojs/binary`   | 1.0.0   | `9186bf7` | https://github.com/oslo-project/binary   |
+| `cbor/`     | `@oslojs/cbor`     | 1.0.0   | `0ec853c` | https://github.com/oslo-project/cbor     |
+| `encoding/` | `@oslojs/encoding` | 1.1.0   | `5b8b873` | https://github.com/oslo-project/encoding |
+
+## Modifications
+
+- Each package module is merged into a single file, and the pieces the
+  passkey component does not use are removed (for example other hash
+  functions, other elliptic curves, RSA-PSS, CBOR encoding, ASN.1 types that
+  never appear in WebAuthn payloads, and the COSE key types the component
+  rejects).
+- The tests are ported into `*.test.ts` files next to the sources so they run
+  with the repository's Vitest setup. Tests that used `node:crypto` were
+  rewritten against the WebCrypto API (the tests run in an edge-like runtime,
+  like Convex functions). The NIST signature- and hash-verification vectors
+  from the `@oslojs/crypto` repository are ported for the algorithms kept here
+  (SHA-256, ECDSA P-256, RSASSA-PKCS1-v1.5) in `crypto/nist-vectors.test.ts`.
+
+When changing this code, keep the changes minimal and covered by the tests.