Implement password-protected keys

import crypto from 'crypto'

// Generate a signing keypair
const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'prime256v1',
})

// Export keys
const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' })
const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' })

// The user's password — collected in your UI, never sent to your server
const password = await promptUser('Choose a password to protect your key')

// Derive an encryption key from the password
const salt = crypto.randomBytes(16)
const encryptionKey = crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256')

// Encrypt the private key
const iv = crypto.randomBytes(16)
const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, iv)

let encrypted = cipher.update(privateKeyPem, 'utf8', 'base64')
encrypted += cipher.final('base64')
const authTag = cipher.getAuthTag()

const encryptedPrivateKey = JSON.stringify({
  salt: salt.toString('base64'),
  iv: iv.toString('base64'),
  authTag: authTag.toString('base64'),
  data: encrypted,
})

// Keys must be alphabetically sorted, no spaces in JSON separators
const clientData = {
  challenge: registrationChallenge, // from the registration init call
  type: 'key.create',
}
const clientDataJson = JSON.stringify(clientData)
const clientDataBase64 = Buffer.from(clientDataJson).toString('base64url')

const passwordProtectedKeyCredential = {
  credentialKind: 'PasswordProtectedKey',
  credentialInfo: {
    credId: generateCredentialId(),
    clientData: clientDataBase64,       // built above
    attestationData: attestationBase64, // contains the public key
  },
  encryptedPrivateKey, // encrypted blob only, password stays with user
}

// The client is unauthenticated at this point — no token yet.
// DFNS emails a one-time code to the user.
await dfnsClient.auth.sendLoginCode({ body: { username, orgId } })
const loginCode = await promptUser('Enter the login code we emailed you')

const challenge = await dfnsClient.auth.createLoginChallenge({
  body: { username, orgId, loginCode },
})

// The encrypted key is returned here, keyed by credential.
const { encryptedPrivateKey } = challenge.allowCredentials.passwordProtectedKey[0]

// Prompt for the password and decrypt the private key
const password = await promptUser('Enter your password')
const encryptedData = JSON.parse(encryptedPrivateKey)

const encryptionKey = crypto.pbkdf2Sync(
  password,
  Buffer.from(encryptedData.salt, 'base64'),
  100000,
  32,
  'sha256'
)

const decipher = crypto.createDecipheriv(
  'aes-256-gcm',
  encryptionKey,
  Buffer.from(encryptedData.iv, 'base64')
)
decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'base64'))

let privateKeyPem = decipher.update(encryptedData.data, 'base64', 'utf8')
privateKeyPem += decipher.final('utf8')

// Build the clientData — type MUST be 'key.get' for login, keys sorted, no spaces
const clientData = JSON.stringify({
  challenge: challenge.challenge, // already base64url — do not re-encode
  type: 'key.get',
})

// Sign the clientData BYTES with the decrypted private key
const signingKey = crypto.createPrivateKey(privateKeyPem)
const signature = crypto.sign(undefined, Buffer.from(clientData), signingKey)

// Complete login
const { token } = await dfnsClient.auth.login({
  body: {
    challengeIdentifier: challenge.challengeIdentifier,
    firstFactor: {
      kind: 'PasswordProtectedKey',
      credentialAssertion: {
        credId: challenge.allowCredentials.passwordProtectedKey[0].id,
        clientData: Buffer.from(clientData).toString('base64url'),
        signature: signature.toString('base64url'), // base64url, not standard base64
      },
    },
  },
})

const challenge = await dfnsClient.auth.createUserActionChallenge({
  body: { userActionPayload, userActionHttpMethod, userActionHttpPath },
})

// Decrypt the key and build the 'key.get' clientData exactly as in login,
// then submit the assertion:
const { userAction } = await dfnsClient.auth.createUserActionSignature({
  body: {
    challengeIdentifier: challenge.challengeIdentifier,
    firstFactor: {
      kind: 'PasswordProtectedKey',
      credentialAssertion: {
        credId: challenge.allowCredentials.passwordProtectedKey[0].id,
        clientData: clientDataBase64url,
        signature: signatureBase64url,
      },
    },
  },
})
// Pass userAction as the X-DFNS-USERACTION header on the original request.