Editing Openai/691a9edc-b5b8-800a-99a3-c32d9abccf68 (section)

=== User: Ah, but there's even more. ===
Ah, but there's even more.

Q.exports(function (Q) {
    /**
     * Generates a public/private key pair and exports them as base64 strings.
     * Compatible with Q.Data.verify and Q.Data.sign using SubtleCrypto.
     *
     * @module Q
     * @class Q.Data
     */

    /**
     * @static
     * @method generateKey
     * @param {Object} [algo] optional algorithm override
     * @param {String} [algo.name="ECDSA"]
     * @param {String} [algo.namedCurve="P-256"]
     * @param {String} [algo.hash="SHA-256"]
     * @return {Q.Promise} Resolves with { publicKey, privateKey, algorithm },
     * where each key is a base64 string and algorithm is the resolved object.
     */
    return function Q_Data_generateKey(algo) {
        algo = Q.extend({
            name: 'ECDSA',
            namedCurve: 'P-256',
            hash: { name: "SHA-256" }
        }, algo);

        return crypto.subtle.generateKey(algo, true, ['sign', 'verify']).then(function (keyPair) {
            return Q.Promise.all([
                crypto.subtle.exportKey('raw', keyPair.publicKey),
                crypto.subtle.exportKey('pkcs8', keyPair.privateKey)
            ]).then(function ([pubKeyBuf, privKeyBuf]) {
                return {
                    publicKey: Q.Data.toBase64(pubKeyBuf),
                    privateKey: Q.Data.toBase64(privKeyBuf),
                    algorithm: algo
                };
            });
        });
    };
});

Q.exports(function (Users, priv) {

    /**
	 * Methods for user sessions
     * @module Users
	 * @class Users.Session
	 */
    /**
     * Get (or get again) the (non-extractable) cryptographic key from IndexedDB.
     * Saves this key also as Users.Session.key.loaded and then calls the callback.
     * @method getKey
     * @static
     * @param {Function} callback Receives (err, key)
     */
    return Q.getter(function Users_Session_getKey(callback) {
        var storeName = 'Q.Users.keys';
        Q.IndexedDB.open(Q.info.baseUrl, storeName, 'id', function (err, db) {
            if (err) {
                return Q.handle(callback, null, [err]);
            }
            const store = db.transaction(storeName, 'readwrite').objectStore(storeName);
            var request = store.get('Users.Session');
            request.onsuccess = function (event) {
                var key = Users.Session.key.loaded
                = event.target.result ? event.target.result.key : null;
                Q.handle(callback, null, [null, key]);
            };
            request.onerror = function (event) {
                var err = {
                    classname: "Users_Session_getKeyIndexedDB",
                    message: "Users.Session.getKey: could not get store in IndexedDB"
                }
                Q.handle(callback, null, [err]);
            };
        });
    });
});

<?php

/**
 * Registers a session public key and recovery key for the currently authenticated session.
 *
 * Called automatically by the client after generating a new non-extractable session keypair.
 * If the session key is ephemeral, it will only be stored in PHP session and not persisted.
 * If persistent, creates a recovery intent allowing the user to later restore their session
 * using the recovery key.
 *
 * @module Users
 * @class HTTP Users key
 * @method post
 * @param {array} [$params] Parameters that can come from the request
 *   @param {array} $params.info  Required. Information about the key algorithm:
 *     {
 *       "name": "ECDSA",
 *       "namedCurve": "P-256",
 *       "hash": "SHA-256"
 *     }
 *   @param {array} $params.publicKey  Required. JWK representation of the session public key.
 *   @param {array} $params.recoveryKey  Required. JWK representation of the recovery public key.
 *   @param {boolean} [$params.publicKeyIsEphemeral=false]  Optional. Whether the key is ephemeral.
 *   @param {array} $params.Q_Users_sig  Required. Signature object:
 *     {
 *       "signature": "...",
 *       "publicKey": "...",
 *       "fieldNames": ["info", "publicKey", "recoveryKey"]
 *     }
 * @throws {Q_Exception_WrongValue}
 * @throws {Q_Exception_AlreadyExists}
 * @throws {Q_Exception}
 * @return {array} Returns:
 *   {
 *     "saved": true,
 *     "recoveryToken": "..." (if persistent)
 *   }
 */
function Users_key_post()
{
	Q_Valid::requireOrigin(true);

	$sigField = Q_Config::get('Users', 'signatures', 'sigField', 'Q_Users_sig');

	// Require the expected top-level fields and signature structure
	$fieldNames = array(
		'info',
		'publicKey',
		'recoveryKey',
		array($sigField, 'signature'),
		array($sigField, 'publicKey'),
		array($sigField, 'fieldNames')
	);
	Q_Request::requireFields($fieldNames, true);

	$info         = $_REQUEST['info'];
	$publicKey    = $_REQUEST['publicKey'];
	$recoveryKey  = $_REQUEST['recoveryKey'];
	$sig          = $_REQUEST[$sigField];
	$publicKeyIsEphemeral = !empty($_REQUEST['publicKeyIsEphemeral']);

	// Ensure fieldNames covers all three data fields
	if (empty($sig['fieldNames']) || !is_array($sig['fieldNames'])) {
		throw new Q_Exception_WrongValue(array('field' => $sigField . '[fieldNames]'));
	}
	foreach (['info', 'publicKey', 'recoveryKey'] as $f) {
		if (!in_array($f, $sig['fieldNames'])) {
			throw new Q_Exception_WrongValue(array(
				'field' => $sigField . '[fieldNames]',
				'value' => "missing $f"
			));
		}
	}

	// Validate algorithm parameters
	if ($info['name'] !== 'ECDSA'
	or $info['namedCurve'] !== 'P-256'
	or $info['hash'] !== 'SHA-256') {
		throw new Q_Exception_WrongValue(array('field' => 'info'));
	}

	// Start PHP + DB session
	Q_Session::start();
	$sessionRow = Q_Session::row();
	if (!$sessionRow) {
		throw new Q_Exception("Could not start session");
	}
	$sessionId = session_id();

	// Prevent overwriting a persistent key
	if (!empty($_SESSION['Users']['publicKey']) && empty($_SESSION['Users']['publicKeyIsEphemeral'])) {
		throw new Q_Exception_AlreadyExists(array('source' => 'session key'));
	}

	// Store in PHP session
	$_SESSION['Users']['publicKey'] = $publicKey;
	$_SESSION['Users']['recoveryKey'] = $recoveryKey;
	$_SESSION['Users']['publicKeyIsEphemeral'] = $publicKeyIsEphemeral;

	// If persistent, create an intent for recovery
	if (!$publicKeyIsEphemeral) {
		$token = Q_Utils::signature(compact('recoveryKey'));

		$duration = isset($sessionRow->duration)
			? intval($sessionRow->duration)
			: intval(ini_get('session.gc_maxlifetime'));

		$intent = new Users_Intent(array(
			'token' => $token,
			'action' => 'Users/registerRecoveryKey',
			'instructions' => json_encode(array(
				'info' => $info,
				'publicKey' => $publicKey,
				'recoveryKey' => $recoveryKey
			)),
			'sessionId' => $sessionId,
			'startTime' => new Db_Expression('CURRENT_TIMESTAMP'),
			'endTime'   => new Db_Expression('CURRENT_TIMESTAMP + INTERVAL ' . intval($duration) . ' SECOND')
		));
		$intent->save();

		Q_Response::setSlot('recoveryToken', $token);
	}

	Q_Response::setSlot('saved', true);
}