初次提交

server/utils/webauthn-config.ts

@@ -0,0 +1,40 @@
+import { H3Event, getRequestHeader, getRequestHost, getRequestProtocol, createError } from 'h3'
+
+function parseAllowedOrigins(): string[] {
+  const env = process.env.WEBAUTHN_ORIGIN
+  if (!env) return []
+  return env.split(',').map(o => o.trim()).filter(Boolean)
+}
+
+function isOriginAllowed(origin: string, allowedOrigins: string[]): boolean {
+  if (allowedOrigins.length === 0) return true
+  return allowedOrigins.includes(origin)
+}
+
+export function getWebAuthnConfig(event: H3Event) {
+  const host = getRequestHost(event)
+  const protocol = getRequestProtocol(event, { xForwardedProto: true })
+  const allowedOrigins = parseAllowedOrigins()
+  
+  let rpID = process.env.WEBAUTHN_RP_ID
+  
+  if (!rpID) {
+    rpID = host.split(':')[0]
+  }
+
+  let origin: string
+  const requestOrigin = getRequestHeader(event, 'origin') || `${protocol}://${host}`
+
+  if (process.env.WEBAUTHN_ORIGIN) {
+    if (isOriginAllowed(requestOrigin, allowedOrigins)) {
+      origin = requestOrigin
+    } else {
+      console.error(`WebAuthn origin 不在允许列表中: ${requestOrigin}`)
+      throw createError({ statusCode: 403, message: `不被允许的 Origin: ${requestOrigin}` })
+    }
+  } else {
+    origin = requestOrigin
+  }
+
+  return { rpID, origin, allowedOrigins }
+}