| … | … | @@ -5,13 +5,17 @@ import { ANProto } from '../../anproto.js' |
| 5 | 5 | * WebIdentityProvider — Browser ANProto authentication |
| 6 | 6 | * |
| 7 | 7 | * Handles Ed25519 challenge-response auth for web clients. |
| 8 | | * Supports both signed (challenge-based) and legacy (unsigned) auth. |
| 8 | * |
| 9 | * Options: |
| 10 | * autoRegister: true — auto-create user on first auth (default, pear-git/hypernote behavior) |
| 11 | * autoRegister: false — reject unknown keys, require explicit registration |
| 9 | 12 | */ |
| 10 | 13 | export class WebIdentityProvider extends BaseProvider { |
| 11 | | constructor (identityRegistry, challengeManager) { |
| 14 | constructor (identityRegistry, challengeManager, opts = {}) { |
| 12 | 15 | super('web-identity') |
| 13 | 16 | this.registry = identityRegistry |
| 14 | 17 | this.challengeManager = challengeManager |
| 18 | this.autoRegister = opts.autoRegister !== false // default: true |
| 15 | 19 | } |
| 16 | 20 | |
| 17 | 21 | async extractCredentials (req) { |
| … | … | @@ -40,10 +44,14 @@ export class WebIdentityProvider extends BaseProvider { |
| 40 | 44 | await this.challengeManager.consume(challengeId) |
| 41 | 45 | } |
| 42 | 46 | |
| 43 | | // Look up or auto-register identity |
| 47 | // Look up identity |
| 44 | 48 | let identity = await this.registry.getIdentityByPublicKey(publicKey) |
| 45 | 49 | |
| 46 | 50 | if (!identity) { |
| 51 | if (!this.autoRegister) { |
| 52 | throw new Error('Unknown identity. Register first.') |
| 53 | } |
| 54 | |
| 47 | 55 | // Auto-register: creates user + identity atomically |
| 48 | 56 | // First user gets admin, subsequent get read-only |
| 49 | 57 | const result = await this.registry.autoRegister({ |