kv-wasm: onboarding (setup codes, enrollment tickets, scan-to-join) for the web vault

Mirrors kv-ffi's docs/10 §5 API in WebCore and binds it under the names the web app codes
against: setupPayloadForKit, addDevicePayload, revokeEnrollmentTicket, loginWithSetup,
joinStart/joinPoll/joinCancel, joinApprove, joinSend, and the free function parseSetupPayload
(also callable through the worker client).

Unlike kv-ffi, the Secret Key is not persisted: every unlock on the web takes it, so it is
kept zeroized in the unlocked state and dropped on lock. loginWithSetup refuses a code for a
different server than the configured origin (the browser only talks to its own origin).

Tests: ticket enrollment and scan-to-join in both roles against kv-ffi via the kv-sync test
server, a swapped-approver rejection, a Chrome test (IndexedDB never holds the Secret Key,
JS shapes, error codes) and a Node smoke check of the built package.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

sami

2026-10-18 06:58:13 +09:00

co-authored by

Claude Opus 5.5

parent d70beef92c

commit 2e2c8cd26f

11 changed files with 779 additions and 14 deletions

Cargo.lock

Generated

View File

@@ -1490,6 +1490,7 @@ dependencies = [
 name = "kv-wasm"
 version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
  "getrandom 0.2.17",
  "js-sys",
  "kv-crypto",