Implement end-user recovery

import crypto from 'crypto'

// Generate a recovery keypair
const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'prime256v1',
})

// Export keys
const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' })
const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' })

// Generate a random recovery password for the user
const recoveryPassword = crypto.randomBytes(16).toString('base64') // Or use a word-based format

// Derive an encryption key from the password
const salt = crypto.randomBytes(16)
const encryptionKey = crypto.pbkdf2Sync(recoveryPassword, salt, 100000, 32, 'sha256')

// Encrypt the private key
const iv = crypto.randomBytes(16)
const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, iv)

let encrypted = cipher.update(privateKeyPem, 'utf8', 'base64')
encrypted += cipher.final('base64')
const authTag = cipher.getAuthTag()

const encryptedPrivateKey = JSON.stringify({
  salt: salt.toString('base64'),
  iv: iv.toString('base64'),
  authTag: authTag.toString('base64'),
  data: encrypted,
})

// Keys must be alphabetically sorted, no spaces in JSON separators
const clientData = {
  challenge: registrationChallenge, // from Create (Delegated) Registration Challenge
  type: 'key.create',
}
const clientDataJson = JSON.stringify(clientData)
const clientDataBase64 = Buffer.from(clientDataJson).toString('base64url')

const recoveryCredential = {
  credentialKind: 'RecoveryKey',
  credentialInfo: {
    credId: generateCredentialId(),
    clientData: clientDataBase64,       // built above
    attestationData: attestationBase64, // contains the public key
  },
  encryptedPrivateKey, // encrypted blob only, password stays with user
}

const { temporaryAuthenticationToken, challenge, allowedRecoveryCredentials } =
  await dfnsClient.auth.createDelegatedRecoveryChallenge({
    body: { username, credentialId: recoveryCredentialId },
  })
// Send temporaryAuthenticationToken, challenge, and allowedRecoveryCredentials to the client.

// 1. Prompt user for their recovery password
const recoveryPassword = await promptUser('Enter your recovery password')

// 2. Get the encrypted recovery key from the allowedRecoveryCredentials returned above
const encryptedData = JSON.parse(allowedRecoveryCredentials[0].encryptedRecoveryKey)

// 3. Derive the encryption key from the user's password
const encryptionKey = crypto.pbkdf2Sync(
  recoveryPassword,
  Buffer.from(encryptedData.salt, 'base64'),
  100000,
  32,
  'sha256'
)

// 4. Decrypt the private key
const decipher = crypto.createDecipheriv(
  'aes-256-gcm',
  encryptionKey,
  Buffer.from(encryptedData.iv, 'base64')
)
decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'base64'))

let privateKeyPem = decipher.update(encryptedData.data, 'base64', 'utf8')
privateKeyPem += decipher.final('utf8')

// 5. Build the new credentials wrapper — this is what you send in the body
//    and what the recovery key commits to in the challenge.
const newCredentials = {
  firstFactorCredential: newCredential,      // WebAuthn / Fido2 attestation created above
  recoveryCredential: newRecoveryCredential, // strongly recommended — rotates the recovery key
}

// 6. Build the clientData for the recovery assertion.
//    type MUST be 'key.get'
//    challenge MUST be base64url(JSON.stringify(newCredentials)) — the whole wrapper
const clientData = JSON.stringify({
  type: 'key.get',
  challenge: Buffer.from(JSON.stringify(newCredentials)).toString('base64url'),
  origin: window.location.origin,
  crossOrigin: false,
})

// 7. Sign the clientData BYTES with the decrypted recovery private key.
//    You sign clientData, NOT newCredentials directly.
const recoveryKey = crypto.createPrivateKey(privateKeyPem)
const signature = crypto.sign(undefined, Buffer.from(clientData), recoveryKey)

// 8. Complete recovery — authenticate with the temporaryAuthenticationToken from the server
const userClient = new DfnsApiClient({
  authToken: temporaryAuthenticationToken,
  baseUrl: process.env.NEXT_PUBLIC_DFNS_BASE_URL,
})
await userClient.auth.recoverUser({
  body: {
    recovery: {
      kind: 'RecoveryKey',
      credentialAssertion: {
        credId: recoveryCredentialId,
        clientData: Buffer.from(clientData).toString('base64url'),
        signature: signature.toString('base64url'), // base64url, not standard base64
      },
    },
    newCredentials, // same wrapper committed to in step 6
  },
})