Changeset d43230f in Klonkt

Timestamp:

07/21/2026 01:17:03 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

6cbd014

Parents:

9e9e6f9

git-author:

Robin Genis <roboburr@…> (07/21/2026 01:17:02 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 01:17:03 AM)

Message:

Harden: lazy-load @simplewebauthn/server so a missing dep never crashes boot

A canary that autofollows main before npm ci has run (or if it fails) would otherwise crash on the static import. The paid flow now imports the lib on first use, so only that flow degrades until the dependency is installed.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/services/PasskeyService.js (modified) (3 diffs)

src/services/PasskeyService.js

@@ -7 +7 @@
 import crypto from 'crypto';
 import db from '../config/database.js';
-import { generateRegistrationOptions, verifyRegistrationResponse } from '@simplewebauthn/server';
+
+// Lazy so a not-yet-installed dependency can never crash app boot; only the
+// paid passkey flow fails until `npm ci` has run.
+let _lib = null;
+async function lib() { if (!_lib) _lib = await import('@simplewebauthn/server'); return _lib; }
 
 const DEFAULT_TTL_DAYS = 32;   // aligns with Patreon's monthly cycle; re-link after
@@ -21 +25 @@
 export async function registrationOptions(base, siteSlug) {
   const { rpID } = rpFor(base);
+  const { generateRegistrationOptions } = await lib();
   return generateRegistrationOptions({
     rpName: `Supporter of ${siteSlug}`,
@@ -39 +44 @@
   let v;
   try {
+    const { verifyRegistrationResponse } = await lib();
     v = await verifyRegistrationResponse({
       response,