PUSHPASSKEY_API_KEY=ここにAPIキーを記載してください
PUSHPASSKEY_TEST_MODE=true
PUSHPASSKEY_TEST_USER_KEY=pushpasskey_test_user
PUSHPASSKEY_REQUEST_TIMEOUT_MS=15000
SESSION_SECRET=十分に長いランダムな文字列へ変更してください
PORT=3000
NODE_ENV=development

'use strict';

require('dotenv').config();
const path = require('node:path');
const express = require('express');
const session = require('express-session');

const app = express();
const API_BASE = 'https://auth.jintec.com';
const COMPLETED_STATUSES = new Set([
  'success', 'failed', 'expired', 'cancelled'
]);

app.set('trust proxy', 1);
app.use(express.json({ limit: '32kb' }));
app.use(session({
  name: 'pushpasskey.sid',
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: 30 * 60 * 1000
  }
}));

app.get('/pushpasskey/test', (_req, res) => {
  res.sendFile(path.join(
    __dirname, '..', 'public', 'pushpasskey-test.html'
  ));
});

app.get('/pushpasskey/status', (req, res) => {
  res.json({
    ok: true,
    authenticated_user_key:
      req.session.pushpasskeyAuthenticatedUserKey || ''
  });
});

app.post(
  '/pushpasskey/endpoint',
  verifySameOrigin,
  async (req, res) => {
    try {
      const action = String(req.body.action || '').trim();

      switch (action) {
        case 'regist_start':
          return await registStart(req, res);
        case 'auth_start':
          return await authStart(req, res);
        case 'regist_result':
          return await registResult(req, res);
        case 'auth_result':
          return await authResult(req, res);
        default:
          return sendJson(res, 400, {
            ok: false,
            message: '処理の指定が正しくありません。'
          });
      }
    } catch (error) {
      console.error('[Push! Passkey]', error);
      return sendJson(res, 500, {
        ok: false,
        message: 'Push! Passkeyの処理を完了できませんでした。'
      });
    }
  }
);

// ============================================================
// 本番接続時に変更する箇所 1
// ログイン中のユーザーを一意に識別する文字列を返します。
// ============================================================
function getLoggedInUserKey(req) {
  // 例：既存のログインセッションを利用する場合
  // return String(req.session.userId || '').trim();

  if (process.env.PUSHPASSKEY_TEST_MODE === 'true') {
    return String(
      process.env.PUSHPASSKEY_TEST_USER_KEY || ''
    ).trim();
  }

  return '';
}

// ============================================================
// 本番接続時に変更する箇所 2
// パスキー登録成功後の処理です。
// ============================================================
async function afterRegistSuccess(req, _result) {
  req.session.passkeyMessage =
    'パスキーの登録が完了しました。';
  // 必要に応じて登録済み状態や登録日時をDBへ保存します。
}

// ============================================================
// 本番接続時に変更する箇所 3
// パスキー認証成功後のログイン処理です。
// ============================================================
async function afterAuthSuccess(req, result) {
  const userKey = String(result.user_key || '').trim();
  if (!userKey) {
    throw new Error('認証ユーザーを確認できません。');
  }

  // 実運用ではuserKeyに一致する有効なユーザーをDBから取得し、
  // regenerate後に自社サイトのログインセッションを発行します。
  await regenerateSession(req);
  req.session.pushpasskeyAuthenticatedUserKey = userKey;
  req.session.pushpasskeyAuthenticatedAt = Date.now();
}

async function registStart(req, res) {
  const userKey = getLoggedInUserKey(req);
  if (!userKey) {
    return sendJson(res, 401, {
      ok: false,
      message: 'ログイン状態を確認できません。'
    });
  }

  const result = await callPushPasskey('/regist_url', {
    api_key: apiKey(),
    user_key: userKey,
    return_page_url: returnPageUrl(req)
  });

  if (result.ok && result.request_id) {
    savePendingRequest(
      req, String(result.request_id), 'regist', userKey
    );
  }
  return res.json(result);
}

async function authStart(req, res) {
  const result = await callPushPasskey('/auth_url', {
    api_key: apiKey(),
    return_page_url: returnPageUrl(req)
  });

  if (result.ok && result.request_id) {
    savePendingRequest(req, String(result.request_id), 'auth');
  }
  return res.json(result);
}

async function registResult(req, res) {
  const requestId = requiredRequestId(req, res);
  if (!requestId) return;

  const pending = pendingRequest(req, res, requestId, 'regist');
  if (!pending) return;

  const result = await callPushPasskey('/regist_result', {
    api_key: apiKey(), request_id: requestId
  });

  if (result.is_success) {
    if (String(result.user_key) !== String(pending.userKey)) {
      throw new Error('登録ユーザーが一致しません。');
    }
    await afterRegistSuccess(req, result);
  }

  if (result.is_completed) clearPendingRequest(req, requestId);
  return res.json(result);
}

async function authResult(req, res) {
  const requestId = requiredRequestId(req, res);
  if (!requestId) return;

  if (!pendingRequest(req, res, requestId, 'auth')) return;

  const result = await callPushPasskey('/auth_result', {
    api_key: apiKey(), request_id: requestId
  });
  const status = String(result.status || '').trim().toLowerCase();
  const success = result.is_success || status === 'success';

  if (success) await afterAuthSuccess(req, result);

  const completed =
    result.is_completed || COMPLETED_STATUSES.has(status);
  if (completed) clearPendingRequest(req, requestId);

  return res.json(result);
}

async function callPushPasskey(apiPath, payload) {
  if (!apiKey()) {
    throw new Error('Push! Passkeyの設定を確認してください。');
  }

  const controller = new AbortController();
  const timeout = setTimeout(
    () => controller.abort(),
    Number(process.env.PUSHPASSKEY_REQUEST_TIMEOUT_MS || 15000)
  );

  try {
    const response = await fetch(`${API_BASE}${apiPath}`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Accept: 'application/json'
      },
      body: JSON.stringify(payload),
      signal: controller.signal,
      redirect: 'error'
    });

    const contentType = response.headers.get('content-type') || '';
    if (!contentType.includes('application/json')) {
      throw new Error(
        'Push! PasskeyからJSON以外の応答が返されました。'
      );
    }

    const result = await response.json();
    if (!response.ok) result.ok = false;
    return result;
  } finally {
    clearTimeout(timeout);
  }
}

function savePendingRequest(req, requestId, kind, userKey = '') {
  const requests = req.session.pushpasskeyRequests || {};
  requests[requestId] = {
    kind,
    userKey,
    createdAt: Date.now()
  };
  req.session.pushpasskeyRequests = requests;
}

function pendingRequest(req, res, requestId, kind) {
  const requests = req.session.pushpasskeyRequests || {};
  const data = requests[requestId];
  if (!data || data.kind !== kind) {
    sendJson(res, 400, {
      ok: false,
      message:
        '処理情報を確認できません。最初からやり直してください。'
    });
    return null;
  }
  return data;
}

function clearPendingRequest(req, requestId) {
  const requests = req.session.pushpasskeyRequests || {};
  delete requests[requestId];
  req.session.pushpasskeyRequests = requests;
}

function requiredRequestId(req, res) {
  const requestId = String(req.body.request_id || '').trim();
  if (!requestId) {
    sendJson(res, 400, {
      ok: false, message: '処理情報を確認できません。'
    });
    return '';
  }
  return requestId;
}

function returnPageUrl(req) {
  const value = String(req.body.return_page_url || '').trim();
  try {
    const url = new URL(value);
    return url.host === req.get('host') ? value : '';
  } catch {
    return '';
  }
}

function verifySameOrigin(req, res, next) {
  const origin = req.get('origin');
  if (!origin) return next();

  try {
    if (new URL(origin).host === req.get('host')) return next();
  } catch {
    // 不正なOriginは拒否します。
  }

  return sendJson(res, 403, {
    ok: false,
    message: 'このページからは処理を開始できません。'
  });
}

function regenerateSession(req) {
  return new Promise((resolve, reject) => {
    req.session.regenerate((error) => {
      if (error) reject(error);
      else resolve();
    });
  });
}

function apiKey() {
  return String(process.env.PUSHPASSKEY_API_KEY || '').trim();
}

function sendJson(res, status, data) {
  return res.status(status).json(data);
}

app.listen(Number(process.env.PORT || 3000), () => {
  console.log(`Server started on port ${process.env.PORT || 3000}`);
});

<!doctype html>
<html lang="ja">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title>Push! Passkey動作確認</title>
  <script src="https://auth.jintec.com/js/passkey.js" defer></script>
</head>
<body>
  <h1>Push! Passkey動作確認</h1>
  <p>最初にパスキー登録を行い、続いて認証してください。</p>

  <button type="button"
    data-pushpasskey="regist"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/pushpasskey/test">
    パスキーを登録する
  </button>

  <button type="button"
    data-pushpasskey="auth"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/pushpasskey/test">
    パスキーで認証する
  </button>

  <div id="resultMessage" role="alert" aria-live="polite"></div>
  <p id="sessionStatus">認証状態を確認しています。</p>

  <script>
  fetch('/pushpasskey/status', {
    credentials: 'same-origin'
  })
    .then((response) => response.json())
    .then((data) => {
      document.getElementById('sessionStatus').textContent =
        data.authenticated_user_key
          ? `認証したuser_key：${data.authenticated_user_key}`
          : '認証したuser_keyはまだありません。';
    })
    .catch(() => {
      document.getElementById('sessionStatus').textContent =
        '認証状態を取得できませんでした。';
    });
  </script>
</body>
</html>