webauthn

@noy-db/on-webauthn · pnpm add @noy-db/on-webauthn Hardware-key passkey unlock — Touch ID, Face ID, Windows Hello, YubiKey.

What it does

enrollWebAuthn(keyring, vault, options) creates a WebAuthn credential — requesting the PRF extension for deterministic key derivation, falling back to a rawId-derived key when PRF isn't available — and wraps the keyring summary under it. unlockWebAuthn(enrollment) triggers the assertion prompt and returns an UnlockedKeyring directly, so it plugs straight into createNoydb's getKeyring callback with no secret bridge required. It's the tier-2 method with no knowledge factor at all — the physical authenticator (and, optionally, the platform's user verification) is the whole proof.

Usage

import { createNoydb } from '@noy-db/hub'
import { unlockWebAuthn } from '@noy-db/on-webauthn'

const enrollment = await loadEnrollmentFromIDB() // your storage of choice

const db = await createNoydb({
  store,
  user: 'alice',
  getKeyring: (vault) => unlockWebAuthn(enrollment),
})

Enrolling, from an already-unlocked keyring:

import { enrollWebAuthn } from '@noy-db/on-webauthn'

const enrollment = await enrollWebAuthn(keyring, 'acme', { rp: { name: 'Acme Notes' } })

See also

• on-* family
• oidc
• magic-link