From 34af90c9510d5947aec9d76f76b831dd6bc63ace Mon Sep 17 00:00:00 2001 From: Ardis Lu Date: Sat, 22 Aug 2026 22:24:35 -0700 Subject: [PATCH] Provide `challenge` and `exp` in return object Being able to get these components easily without parsing `url` sets up the workflow to later expand so users can bring their own bridge. --- src/getPrf.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/getPrf.js b/src/getPrf.js index 94922c2..eaed3f7 100644 --- a/src/getPrf.js +++ b/src/getPrf.js @@ -44,6 +44,10 @@ export const WINDOW_EXPIRATION_DURATION = 2 * 60 * 1000; /** * @typedef {Object} GetPrfResult * @property {string} url URL on `localhost` to open to complete the passkey flow. + * @property {string} challenge Randomly generated challenge bytes, as a hex string. This string MUST be included + * in the bridge's POST request as the `Envpass-Challenge` header, or the server will reject the request. + * @property {number} exp The expiration datetime of this flow in milliseconds. After this datetime, the server will + * shut down and not receive any more requests. You can pass this number directly to the `Date` constructor. * @property {Promise} prf 32-byte value returned from the user passkey's pseudo random * function, or `null` if the flow was aborted or timed out before the PRF was executed. */ @@ -201,6 +205,8 @@ export async function getPrf(options = {}) { return { url: await urlPromise, + challenge, + exp: timeoutExp, prf: Promise.any([prfPromise, abortPromise]) }; } \ No newline at end of file -- 2.47.3