import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
} from "@simplewebauthn/server";
 
// 1단계: 등록 옵션 생성
async function createRegistrationOptions(userId: string) {
  const user = await getUserById(userId);
  const existingCredentials = await getCredentialsByUserId(userId);
 
  const options = await generateRegistrationOptions({
    rpName: "My Service",
    rpID: "example.com",
    userName: user.email,
    userDisplayName: user.displayName,
    // 이미 등록된 인증기 제외
    excludeCredentials: existingCredentials.map((cred) => ({
      id: cred.credentialId,
      type: "public-key",
    })),
    authenticatorSelection: {
      // 플랫폼 인증기 우선 (패스키)
      authenticatorAttachment: "platform",
      // 사용자 검증 필수 (생체 인증 등)
      userVerification: "required",
      // Discoverable Credential 필수 (사용자 이름 없는 인증 가능)
      residentKey: "required",
    },
    attestationType: "none",
  });
 
  // challenge를 세션에 저장
  await storeChallenge(userId, options.challenge);
 
  return options;
}
 
// 2단계: 등록 응답 검증
async function verifyRegistration(
  userId: string,
  registrationResponse: RegistrationResponseJSON,
) {
  const expectedChallenge = await getStoredChallenge(userId);
 
  const verification = await verifyRegistrationResponse({
    response: registrationResponse,
    expectedChallenge,
    expectedOrigin: "https://example.com",
    expectedRPID: "example.com",
  });
 
  if (verification.verified && verification.registrationInfo) {
    // 공개키와 자격 증명 정보를 DB에 저장
    await saveCredential({
      userId,
      credentialId: verification.registrationInfo.credential.id,
      publicKey: verification.registrationInfo.credential.publicKey,
      counter: verification.registrationInfo.credential.counter,
      transports:
        registrationResponse.response.transports ?? [],
    });
  }
 
  return verification.verified;
}

import { startRegistration } from "@simplewebauthn/browser";
 
async function registerPasskey(): Promise<boolean> {
  try {
    // 서버에서 등록 옵션 가져오기
    const optionsResponse = await fetch("/api/auth/passkey/register/options", {
      method: "POST",
    });
    const options = await optionsResponse.json();
 
    // WebAuthn API 호출 (브라우저가 인증기와 통신)
    const registrationResponse = await startRegistration({
      optionsJSON: options,
    });
 
    // 서버에 결과 전송
    const verifyResponse = await fetch("/api/auth/passkey/register/verify", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(registrationResponse),
    });
 
    const result = await verifyResponse.json();
    return result.verified;
  } catch (error) {
    if (error instanceof Error && error.name === "NotAllowedError") {
      console.error("사용자가 인증을 취소했습니다.");
    }
    return false;
  }
}

import {
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
} from "@simplewebauthn/server";
 
// 인증 옵션 생성
async function createAuthenticationOptions() {
  const options = await generateAuthenticationOptions({
    rpID: "example.com",
    userVerification: "required",
    // allowCredentials를 비워두면 Discoverable Credential 사용
    // (사용자가 패스키 목록에서 선택)
  });
 
  await storeChallenge("auth", options.challenge);
  return options;
}
 
// 인증 응답 검증
async function verifyAuthentication(
  authResponse: AuthenticationResponseJSON,
) {
  const expectedChallenge = await getStoredChallenge("auth");
 
  // credentialId로 저장된 자격 증명 조회
  const credential = await getCredentialById(authResponse.id);
  if (!credential) {
    throw new Error("등록되지 않은 자격 증명입니다.");
  }
 
  const verification = await verifyAuthenticationResponse({
    response: authResponse,
    expectedChallenge,
    expectedOrigin: "https://example.com",
    expectedRPID: "example.com",
    credential: {
      id: credential.credentialId,
      publicKey: credential.publicKey,
      counter: credential.counter,
    },
  });
 
  if (verification.verified) {
    // 카운터 업데이트 (복제 감지)
    await updateCredentialCounter(
      credential.credentialId,
      verification.authenticationInfo.newCounter,
    );
  }
 
  return {
    verified: verification.verified,
    userId: credential.userId,
  };
}