1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
// Lock with a fingerprint or face: the padlock's "Protect this device?" offers
// a passkey instead of a password. The saved-wallets vault is then sealed
// under a secret only that passkey's PRF produces — nothing in this browser's
// storage opens it — and unlocking is the passkey's check, asked for as the
// locked screen opens. Turning it off returns to an unlocked vault. Chrome's
// virtual authenticator (CDP WebAuthn, with PRF) plays the phone.
// Run: bun tools/passkey-lock-test.js
import puppeteer from './puppeteer.js';
import { generateMnemonic } from '@scure/bip39';
import { wordlist } from '@scure/bip39/wordlists/english';
import { decryptVault } from '../src/wallet.js';
import { buildHtml } from '../build.js';
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
let ok = true;
const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + d : ''}`); if (!c) ok = false; };
const html = await buildHtml({ minify: true, pwa: false });
const server = Bun.serve({ port: 5314, fetch: (req) => {
const p = new URL(req.url).pathname;
if (p.endsWith('.js') && p !== '/') { const f = Bun.file('dist' + p); return f.size ? new Response(f, { headers: { 'content-type': 'text/javascript' } }) : new Response('', { status: 404 }); }
return new Response(html, { headers: { 'content-type': 'text/html' } });
} });
const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
const page = await browser.newPage();
const cdp = await page.createCDPSession();
await cdp.send('WebAuthn.enable');
const { authenticatorId } = await cdp.send('WebAuthn.addVirtualAuthenticator', { options: {
protocol: 'ctap2', ctap2Version: 'ctap2_1', transport: 'internal', hasResidentKey: true,
hasUserVerification: true, isUserVerified: true, hasPrf: true, automaticPresenceSimulation: true } });
await page.evaluateOnNewDocument(() => {
window.__gets = [];
const real = navigator.credentials.get.bind(navigator.credentials);
navigator.credentials.get = (o) => {
const r = { at: Date.now() }; window.__gets.push(r);
// the person cancels the next fingerprint dialog
if (localStorage.getItem('__refuseNext')) { localStorage.removeItem('__refuseNext'); r.err = 'refused'; return Promise.reject(new DOMException('The operation either timed out or was not allowed.', 'NotAllowedError')); }
return real(o).then((c) => { r.ok = true; return c; }, (e) => { r.err = e.name + ': ' + e.message; throw e; }); };
});
const errs = [];
page.on('pageerror', (e) => errs.push(String(e)));
const click = (sel, t) => page.evaluate((s, x) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(x.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, t);
const bodyText = () => page.evaluate(() => document.body.innerText);
const waitText = async (x, ms = 25000) => { for (let i = 0; i < ms / 250; i++) { if ((await bodyText()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; };
const vault = () => page.evaluate(() => JSON.parse(localStorage.getItem('btc-wallet-vault') || 'null'));
const opensBlank = (b) => { try { decryptVault(b, ''); return true; } catch { return false; } };
// the padlock on the wallet's settings page: "Unlock" when locked, "Lock wallet" when open
const padlockSays = async () => {
await page.evaluate(() => document.querySelector('.balance-gear')?.click());
await sleep(700);
const s = await page.evaluate(() => { const b = [...document.querySelectorAll('button')].find((e) => /^(unlock|lock wallet)$/i.test(e.getAttribute('aria-label') || '')); return b ? b.getAttribute('aria-label') : null; });
return s;
};
try {
await page.setViewport({ width: 390, height: 844 });
await page.goto('http://localhost:5314/', { waitUntil: 'domcontentloaded' });
await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
await page.reload({ waitUntil: 'domcontentloaded' });
await sleep(400);
const mn = generateMnemonic(wordlist);
await click('button', 'create a new wallet'); await sleep(500);
await click('button', 'Have an existing seed'); await sleep(400);
await page.waitForSelector('textarea');
await page.type('textarea', mn);
await click('button', 'Open wallet');
await waitText('receive', 20000);
await sleep(800);
check('the wallet saved itself, under no password', opensBlank(await vault()));
console.log('\n[the padlock offers a fingerprint]');
await page.evaluate(() => document.querySelector('.balance-gear')?.click());
await sleep(900);
await page.evaluate(() => { const b = [...document.querySelectorAll('button')].find((e) => /lock/i.test(e.getAttribute('aria-label') || '')); b && b.click(); });
await sleep(500);
check('"Protect this device?" offers fingerprint or face', await waitText('lock with fingerprint or face', 3000));
await click('button', 'lock with fingerprint or face');
let v = null;
for (let i = 0; i < 40; i++) { v = await vault(); if (v && v.passkey) break; await sleep(250); }
check('the vault names its passkey', !!(v && v.passkey), JSON.stringify(v && Object.keys(v)));
check('...and no longer opens without it', v && !opensBlank(v));
check('...and certainly not with the seed lying around in storage', !(await page.evaluate((m) => Object.keys(localStorage).some((k) => (localStorage.getItem(k) || '').includes(m)), mn)));
const creds = (await cdp.send('WebAuthn.getCredentials', { authenticatorId })).credentials;
check('one passkey made, marked as a lock (user handle)', creds.length === 1 && Buffer.from(creds[0].userHandle || '', 'base64').toString().startsWith('coinos-lock:'), JSON.stringify(creds.map((c) => c.isResidentCredential)));
await sleep(600);
check('the wallet is locked in place', /^unlock$/i.test(await padlockSays() || ''));
console.log('\n[a fresh start: the fingerprint opens it]');
// a new browser session: the tab's copy of the keys is gone. The first
// fingerprint check fails (as a cancel would) — the screen must wait.
await page.evaluate(() => { sessionStorage.clear(); localStorage.setItem('__refuseNext', '1'); });
await page.reload({ waitUntil: 'domcontentloaded' });
check('the app opens on the locked screen, which speaks of the fingerprint', await waitText('use your fingerprint or face', 8000));
await sleep(1500);
check('...with no password field, and still there after a refused check', /use your fingerprint or face/i.test(await bodyText()) && !(await page.$('input[type=password]')));
const before = (await cdp.send('WebAuthn.getCredentials', { authenticatorId })).credentials[0].signCount;
await click('button', 'unlock with fingerprint or face');
await sleep(1500);
check('the first ask came by itself, on opening', (await page.evaluate(() => window.__gets)).some((g) => g.err === 'refused'));
const after = (await cdp.send('WebAuthn.getCredentials', { authenticatorId })).credentials[0].signCount;
check('the button asks the passkey', after > before, before + ' → ' + after);
check('...and the wallet opens, spendable', /^lock wallet$/i.test(await padlockSays() || ''));
console.log('\n[turning it off]');
check('Security says it\'s on and offers to turn it off', await waitText('turn off fingerprint lock', 3000));
check('...and no "Change password" for a password that doesn\'t exist', !/change password/i.test(await bodyText()));
await click('button', 'turn off fingerprint lock');
for (let i = 0; i < 20; i++) { v = await vault(); if (v && !v.passkey) break; await sleep(250); }
check('the vault opens without a passkey again', v && !v.passkey && opensBlank(v));
check('Security offers the fingerprint lock again', await waitText('lock with fingerprint or face', 3000));
check('no page errors', errs.length === 0, errs.slice(0, 2).join(' | '));
} finally {
await browser.close(); server.stop(true);
}
console.log(ok ? '\n✅ fingerprint lock works' : '\n❌ failed');
process.exit(ok ? 0 : 1);
|
