When Passkeys Fail

import { Recover } from "@chipi-stack/chipi-react";
import { createShhhPasskey } from "@chipi-stack/chipi-passkey";
import { webauthnPubkeyFelts, type NewOwnerInput } from "@chipi-stack/backend";

// The guardian signs initiate_recovery; returns { opId, validAfter } (see the recovery page).
declare function startRecoveryWithGuardian(): Promise<{ opId: bigint; validAfter: number }>;
// Anyone submits finalize_recovery after 7 days.
declare function finalizeRecovery(): Promise<void>;

// 1. On the new device, the user registers a fresh passkey. This owner works only on a
//    wallet that already verifies WEBAUTHN_P256. A useCreateWallet({ usePasskey: true })
//    wallet verifies STARK: recover it onto a new STARK key instead (see below).
export async function newPasskeyOwner(userId: string, userName: string): Promise<NewOwnerInput> {
  const { publicKey } = await createShhhPasskey(userId, userName);
  return {
    kind: "WEBAUTHN_P256",
    pubkeyBytes: webauthnPubkeyFelts(publicKey),
    role: "OWNER",
    weight: 1,
    label: "new-device",
  };
}

// 2. A guardian starts the recovery; after 7 days anyone finalizes it.
export function RecoverWallet(props: { walletAddress: string; newOwner: NewOwnerInput }) {
  return (
    <Recover
      mode="guardian-recovery"
      walletAddress={props.walletAddress}
      newOwner={props.newOwner}
      onPropose={startRecoveryWithGuardian}
      onExecute={finalizeRecovery}
    />
  );
}

type Wallet = {
  publicKey: string;
  encryptedPrivateKey: string;       // passkey-derived key encrypts this
  encryptedPrivateKeyBackup: string; // PIN encrypts this
  authMethod: "passkey+pin";         // marker for the dual-key path
};

import { useCreateWallet, Chain } from "@chipi-stack/chipi-react";

const { createWalletAsync } = useCreateWallet();
const pin = await promptForPin();

await createWalletAsync({
  params: {
    externalUserId: userId,
    chain: Chain.STARKNET,
    usePasskey: true,  // creates the passkey; its key encrypts encryptedPrivateKey
    encryptKey: pin,   // becomes the backup: encrypts encryptedPrivateKeyBackup
  },
  bearerToken,
});
// authMethod === "passkey+pin"

import { isWebAuthnSupported } from "@chipi-stack/chipi-passkey";

function SignUpFlow() {
  if (isWebAuthnSupported()) {
    return <PasskeySignUp />;
  }
  // Old browser, very old Android, or a corporate-managed device that
  // disables WebAuthn. Fall back to PIN.
  return <PinSignUp />;
}