fix: add wasm-unsafe-eval to CSP for cap-widget WebAssembly, handle passkey autofill without sessionToken

Author: ddrayko

routes/passkeys.js

@@ -225,17 +225,33 @@ router.post('/passkeys/login/complete', passkeyLoginLimiter, async (req, res) =>
     if (!response) {
       return res.status(400).json({ error: 'Response is required' });
     }
-    if (!sessionToken) {
-      return res.status(400).json({ error: 'Session token is required' });
-    }
 
-    const stored = challengeMap.get(`login:${sessionToken}`);
-    if (!stored) {
-      return res.status(400).json({ error: 'No login in progress. Please try again.' });
+    let stored;
+    if (sessionToken) {
+      stored = challengeMap.get(`login:${sessionToken}`);
+      if (!stored) {
+        return res.status(400).json({ error: 'No login in progress. Please try again.' });
+      }
+      challengeMap.delete(`login:${sessionToken}`);
+    } else {
+      // Autofill / conditional mediation flow: look up challenge from clientDataJSON
+      try {
+        const challengeFromResponse = JSON.parse(isoBase64URL.toUTF8String(response.response.clientDataJSON)).challenge;
+        for (const [key, entry] of challengeMap) {
+          if (key.startsWith('login:') && entry.challenge === challengeFromResponse) {
+            stored = entry;
+            challengeMap.delete(key);
+            break;
+          }
+        }
+      } catch {
+        return res.status(400).json({ error: 'No login in progress. Please try again.' });
+      }
+      if (!stored) {
+        return res.status(400).json({ error: 'No login in progress. Please try again.' });
+      }
     }
 
-    challengeMap.delete(`login:${sessionToken}`);
-
     const passkeys = await query(
       'SELECT id, credential_id, public_key, counter, transports, user_id FROM passkeys WHERE credential_id = ?',
       [response.id]

server.js

@@ -90,7 +90,7 @@ app.use(helmet({
   contentSecurityPolicy: {
     directives: {
       defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://unpkg.com", "https://static.cloudflareinsights.com"],
+      scriptSrc: ["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'", "https://cdn.jsdelivr.net", "https://unpkg.com", "https://static.cloudflareinsights.com"],
       scriptSrcAttr: ["'unsafe-inline'"],
       styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://cdn.jsdelivr.net"],
       fontSrc: ["'self'", "https://fonts.gstatic.com", "https://cdn.jsdelivr.net"],