パスワードを預からないログインへ — Rork Max アプリにパスキー認証を組み込む実装手順

// server/passkey.ts — 何を解決するか: 登録用チャレンジの発行と attestation の検証
import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
} from "@simplewebauthn/server";
 
const rpID = "example.com";          // RP ID = ドメイン。アプリ側と必ず一致させる
const origin = `https://${rpID}`;
 
export async function startRegistration(userId: string, userName: string) {
  const options = await generateRegistrationOptions({
    rpName: "Your App",
    rpID,
    userID: new TextEncoder().encode(userId),
    userName,
    attestationType: "none",
    authenticatorSelection: { residentKey: "required", userVerification: "required" },
  });
  await saveChallenge(userId, options.challenge); // 有効期限つきで保存
  return options;
}
 
export async function finishRegistration(userId: string, body: unknown) {
  const expectedChallenge = await loadChallenge(userId);
  const verification = await verifyRegistrationResponse({
    response: body as any,
    expectedChallenge,
    expectedOrigin: origin,
    expectedRPID: rpID,
  });
  if (!verification.verified || !verification.registrationInfo) {
    throw new Error("registration failed");
  }
  const { credential } = verification.registrationInfo;
  await savePublicKey(userId, credential.id, credential.publicKey, credential.counter);
  return { ok: true };
}

// PasskeyRegistration.swift — 何を解決するか: サーバーのチャレンジから資格情報を作成して返す
import AuthenticationServices
 
final class PasskeyRegistrar: NSObject, ASAuthorizationControllerDelegate,
                              ASAuthorizationControllerPresentationContextProviding {
    private let rpID = "example.com"
 
    func register(challenge: Data, userID: Data, userName: String) {
        let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(
            relyingPartyIdentifier: rpID)
        let request = provider.createCredentialRegistrationRequest(
            challenge: challenge, name: userName, userID: userID)
        let controller = ASAuthorizationController(authorizationRequests: [request])
        controller.delegate = self
        controller.presentationContextProvider = self
        controller.performRequests()
    }
 
    func authorizationController(controller: ASAuthorizationController,
                                 didCompleteWithAuthorization authorization: ASAuthorization) {
        guard let cred = authorization.credential
                as? ASAuthorizationPlatformPublicKeyCredentialRegistration else { return }
        // rawAttestationObject / rawClientDataJSON / credentialID をサーバーへ POST する
        sendToServer(attestation: cred.rawAttestationObject,
                     clientData: cred.rawClientDataJSON,
                     credentialID: cred.credentialID)
    }
 
    func authorizationController(controller: ASAuthorizationController,
                                 didCompleteWithError error: Error) {
        // エラー分類は後述。1004 はほぼ設定不一致
        print("passkey registration error: \(error)")
    }
 
    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
        ASPresentationAnchor()
    }
}

// PasskeySignIn.swift — 何を解決するか: 保存済みパスキーでの署名取得
func signIn(challenge: Data) {
    let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(
        relyingPartyIdentifier: "example.com")
    let request = provider.createCredentialAssertionRequest(challenge: challenge)
    let controller = ASAuthorizationController(authorizationRequests: [request])
    controller.delegate = self
    controller.presentationContextProvider = self
    controller.performRequests()
}