glasskey

WebAuthn/FIDO2 passkey bindings for Gleam, wrapping the browser’s navigator.credentials API for registration and authentication ceremonies.

Designed for use with glasslock on the server side, or any server that consumes JSON compatible with @simplewebauthn/browser.

Types

Algorithm

</>

COSE algorithm identifier for credential key pairs.

pub type Algorithm {
  Es256
  Ed25519
  Rs256
}

Constructors

```
Es256
```
ECDSA with P-256 and SHA-256 (COSE -7).
```
Ed25519
```
EdDSA with Ed25519 (COSE -8).
```
Rs256
```
RSASSA-PKCS1-v1_5 with SHA-256 (COSE -257).

AuthenticationOptions

</>

Parsed authentication ceremony options from the server.

Construct with authentication_options_decoder.

pub type AuthenticationOptions =
  @internal InternalAuthenticationOptions

AuthenticatorAttachment

</>

Authenticator attachment modality.

pub type AuthenticatorAttachment {
  Platform
  CrossPlatform
}

Constructors

```
Platform
```
Built-in authenticator (Touch ID, Windows Hello, etc.).
```
CrossPlatform
```
Removable authenticator (USB security key, Bluetooth, etc.).

ConditionalAuthentication

</>

Result of starting a conditional authentication ceremony.

Contains the promise that resolves when the user selects a passkey from the browser’s autofill UI, and an abort function to cancel the pending ceremony. After calling abort(), result resolves to Error(Aborted).

pub type ConditionalAuthentication {
  ConditionalAuthentication(
    result: promise.Promise(Result(json.Json, Error)),
    abort: fn() -> Nil,
  )
}

Constructors

ConditionalAuthentication(
  result: promise.Promise(Result(json.Json, Error)),
  abort: fn() -> Nil,
)

CredentialDescriptor

</>

A reference to a previously registered credential, with optional transport hints to help the browser route the ceremony to the right authenticator.

pub type CredentialDescriptor {
  CredentialDescriptor(id: BitArray, transports: List(Transport))
}

Constructors

CredentialDescriptor(id: BitArray, transports: List(Transport))

Error

</>

Errors returned by glasskey operations.

pub type Error {
  NotSupported
  NotAllowed
  Aborted
  SecurityError
  InvalidState
  UnknownError(String)
}

Constructors

```
NotSupported
```
The browser or authenticator does not support what was requested.
```
NotAllowed
```
The user cancelled the request or the operation timed out.
```
Aborted
```
The operation was aborted.
```
SecurityError
```
Security policy violation (e.g., non-HTTPS origin or invalid relying party ID for this origin).
```
InvalidState
```
The operation conflicted with the authenticator’s state. During registration this typically means a credential matched by excludeCredentials is already present; during authentication it can mean the credential has been invalidated on the authenticator.
```
UnknownError(String)
```
An unexpected error from the browser API.

RegistrationOptions

</>

Parsed registration ceremony options from the server.

Construct with registration_options_decoder.

pub type RegistrationOptions =
  @internal InternalRegistrationOptions

Requirement

</>

WebAuthn preference used for resident keys and user verification.

pub type Requirement {
  Required
  Preferred
  Discouraged
}

Constructors

```
Required
```
Require the authenticator to satisfy the request.
```
Preferred
```
Request the capability, but accept a response without it.
```
Discouraged
```
Ask the authenticator to omit the capability when possible. Common for resident_key; unusual for user_verification, where it permits presence-only authentication.

Transport

</>

Transport hints reported by the authenticator.

pub type Transport {
  TransportUsb
  TransportNfc
  TransportBle
  TransportSmartCard
  TransportHybrid
  TransportInternal
}

Constructors

```
TransportUsb
```
Removable USB authenticator.
```
TransportNfc
```
Near-field communication authenticator.
```
TransportBle
```
Bluetooth Low Energy authenticator.
```
TransportSmartCard
```
ISO/IEC 7816 smart card.
```
TransportHybrid
```
Cross-device authenticator (e.g. phone acting as a roaming key).
```
TransportInternal
```
Built-in platform authenticator (Touch ID, Windows Hello, etc.).

Values

authentication_options_decoder

</>

pub fn authentication_options_decoder() -> decode.Decoder(
  AuthenticationOptions,
)

Decoder for the PublicKeyCredentialRequestOptionsJSON shape produced by glasslock/authentication.build.

Use this when decoding the server’s envelope response so the options subtree comes out as a typed AuthenticationOptions ready to pass to start_authentication or start_conditional_authentication.

registration_options_decoder

</>

pub fn registration_options_decoder() -> decode.Decoder(
  RegistrationOptions,
)

Decoder for the PublicKeyCredentialCreationOptionsJSON shape produced by glasslock/registration.build.

Use this when decoding the server’s envelope response so the options subtree comes out as a typed RegistrationOptions ready to pass to start_registration.

start_authentication

</>

pub fn start_authentication(
  options: AuthenticationOptions,
) -> promise.Promise(Result(json.Json, Error))

Start the WebAuthn authentication ceremony.

Takes options parsed with authentication_options_decoder, then calls navigator.credentials.get. Returns a promise resolving to the assertion response as a Json value. Serialize and send to your server (e.g. as the body to glasslock/authentication.verify_json), or embed it in a larger envelope and decode it server-side with glasslock/authentication.response_decoder() before calling glasslock/authentication.verify.

start_conditional_authentication

</>

pub fn start_conditional_authentication(
  options: AuthenticationOptions,
) -> Result(ConditionalAuthentication, Error)

Start a conditional WebAuthn authentication ceremony (autofill UI).

Unlike start_authentication which shows a modal browser prompt, this surfaces passkey suggestions in the browser’s autofill dropdown. Requires an <input autocomplete="username webauthn"> element on the page.

Takes options parsed with authentication_options_decoder. Returns synchronously with the ceremony handle or an error. Call abort before starting a modal ceremony or when navigating away.

start_registration

</>

pub fn start_registration(
  options: RegistrationOptions,
) -> promise.Promise(Result(json.Json, Error))

Start the WebAuthn registration ceremony.

Takes options parsed with registration_options_decoder, then calls navigator.credentials.create. Returns a promise resolving to the credential response as a Json value. Serialize and send to your server (e.g. as the body to glasslock/registration.verify_json), or embed it in a larger envelope and decode it server-side with glasslock/registration.response_decoder() before calling glasslock/registration.verify.

supports_platform_authenticator

</>

pub fn supports_platform_authenticator() -> promise.Promise(Bool)

Check whether the browser supports a user-verifying platform authenticator (Touch ID, Windows Hello, etc.).

supports_webauthn

</>

pub fn supports_webauthn() -> Bool

Check whether the browser supports WebAuthn.

Returns True if both window.PublicKeyCredential and navigator.credentials are available.

supports_webauthn_autofill

</>

pub fn supports_webauthn_autofill() -> promise.Promise(Bool)

Check whether the browser supports WebAuthn autofill (conditional mediation).