Passkey sign-in (start)

async function signInWithPasskey(programId) {
  const base = "https://api.next.orenda.finance";
  const headers = { "Content-Type": "application/json", "x-program-id": programId };

  // 1. Start
  const start = await fetch(`${base}/v1/auth/passkey/login`, {
    method: "POST", headers,
  }).then((r) => r.json());
  const { session_token, fido2options } = start.data;

  // 2. Device — unlock the passkey
  fido2options.challenge = fromB64url(fido2options.challenge);
  (fido2options.allowCredentials ?? []).forEach((c) => { c.id = fromB64url(c.id); });
  const cred = await navigator.credentials.get({ publicKey: fido2options });

  // 3. Finish
  const result = await fetch(`${base}/v1/auth/passkey/verify`, {
    method: "POST", headers,
    body: JSON.stringify({
      session_token,
      assertion: {
        credentialIdB64: toB64url(cred.rawId),
        userHandleB64: toB64url(cred.response.userHandle),
        clientDataJSON_B64: toB64url(cred.response.clientDataJSON),
        authenticatorDataB64: toB64url(cred.response.authenticatorData),
        signatureB64: toB64url(cred.response.signature),
      },
    }),
  }).then((r) => r.json());

  return result.data; // access_token, id_token, refresh_token, ...
}

suspend fun signInWithPasskey(programId: String): JSONObject {
  val base = "https://api.next.orenda.finance"
  val client = OkHttpClient()
  fun post(path: String, body: String): JSONObject {
    val req = Request.Builder().url("$base$path")
      .addHeader("x-program-id", programId)
      .post(body.toRequestBody("application/json".toMediaType())).build()
    return JSONObject(client.newCall(req).execute().body!!.string())
  }

  // 1. Start
  val data = post("/v1/auth/passkey/login", "{}").getJSONObject("data")
  val sessionToken = data.getString("session_token")
  val fido2options = data.getJSONObject("fido2options")

  // 2. Device — unlock the passkey with Android Credential Manager (see below)
  val cred = getPasskey(fido2options)

  // 3. Finish
  val assertion = JSONObject()
    .put("credentialIdB64", cred.credentialIdB64)
    .put("userHandleB64", cred.userHandleB64)
    .put("clientDataJSON_B64", cred.clientDataJsonB64)
    .put("authenticatorDataB64", cred.authenticatorDataB64)
    .put("signatureB64", cred.signatureB64)
  return post("/v1/auth/passkey/verify", JSONObject()
    .put("session_token", sessionToken).put("assertion", assertion).toString())
    .getJSONObject("data")
}

func signInWithPasskey(programId: String) async throws -> [String: Any] {
  let base = "https://api.next.orenda.finance"
  func post(_ path: String, _ body: [String: Any]) async throws -> [String: Any] {
    var req = URLRequest(url: URL(string: base + path)!)
    req.httpMethod = "POST"
    req.setValue("application/json", forHTTPHeaderField: "Content-Type")
    req.setValue(programId, forHTTPHeaderField: "x-program-id")
    req.httpBody = try JSONSerialization.data(withJSONObject: body)
    let (data, _) = try await URLSession.shared.data(for: req)
    return try JSONSerialization.jsonObject(with: data) as! [String: Any]
  }

  // 1. Start
  let start = try await post("/v1/auth/passkey/login", [:])["data"] as! [String: Any]
  let sessionToken = start["session_token"] as! String
  let fido2options = start["fido2options"] as! [String: Any]

  // 2. Device — unlock the passkey with AuthenticationServices (see below)
  let cred = try await getPasskey(fido2options)

  // 3. Finish
  let result = try await post("/v1/auth/passkey/verify", [
    "session_token": sessionToken,
    "assertion": [
      "credentialIdB64": cred.credentialIdB64,
      "userHandleB64": cred.userHandleB64,
      "clientDataJSON_B64": cred.clientDataJSONB64,
      "authenticatorDataB64": cred.authenticatorDataB64,
      "signatureB64": cred.signatureB64,
    ],
  ])
  return result["data"] as! [String: Any]
}

Future<Map<String, dynamic>> signInWithPasskey(String programId) async {
  const base = 'https://api.next.orenda.finance';
  final headers = {'Content-Type': 'application/json', 'x-program-id': programId};

  // 1. Start
  final start = jsonDecode((await http.post(
    Uri.parse('$base/v1/auth/passkey/login'), headers: headers,
  )).body)['data'];
  final sessionToken = start['session_token'];
  final fido2options = start['fido2options'];

  // 2. Device — unlock the passkey with a passkeys plugin (see below)
  final cred = await getPasskey(fido2options);

  // 3. Finish
  final result = jsonDecode((await http.post(
    Uri.parse('$base/v1/auth/passkey/verify'),
    headers: headers,
    body: jsonEncode({
      'session_token': sessionToken,
      'assertion': {
        'credentialIdB64': cred.credentialIdB64,
        'userHandleB64': cred.userHandleB64,
        'clientDataJSON_B64': cred.clientDataJsonB64,
        'authenticatorDataB64': cred.authenticatorDataB64,
        'signatureB64': cred.signatureB64,
      },
    }),
  )).body)['data'];

  return result; // access_token, id_token, refresh_token, ...
}