3 files changed, 45 insertions, 1 deletions
diff --git a/packages/server/src/helpers/generateUserID.test.ts b/packages/server/src/helpers/generateUserID.test.ts
new file mode 100644
index 0000000..b15cab8
--- /dev/null
+++ b/packages/server/src/helpers/generateUserID.test.ts
@@ -0,0 +1,16 @@
+import { assert, assertNotEquals } from 'https://deno.land/std@0.198.0/assert/mod.ts';
+
+import { generateUserID } from './generateUserID.ts';
+
+Deno.test('should return a buffer of 32 bytes', async () => {
+  const userID = await generateUserID();
+
+  assert(userID.byteLength === 32);
+});
+
+Deno.test('should return random bytes on each execution', async () => {
+  const userID1 = await generateUserID();
+  const userID2 = await generateUserID();
+
+  assertNotEquals(userID1, userID2);
+});
diff --git a/packages/server/src/helpers/generateUserID.ts b/packages/server/src/helpers/generateUserID.ts
new file mode 100644
index 0000000..eaf9bb0
--- /dev/null
+++ b/packages/server/src/helpers/generateUserID.ts
@@ -0,0 +1,21 @@
+import { isoCrypto } from './iso/index.ts';
+
+/**
+ * Generate a suitably random value to be used as user ID
+ */
+export async function generateUserID(): Promise<Uint8Array> {
+  /**
+   * WebAuthn spec says user.id has a max length of 64 bytes. I prefer how 32 random bytes look
+   * after they're base64url-encoded so I'm choosing to go with that here.
+   */
+  const newUserID = new Uint8Array(32);
+
+  await isoCrypto.getRandomValues(newUserID);
+
+  return _generateUserIDInternals.stubThis(newUserID);
+}
+
+// Make it possible to stub the return value during testing
+export const _generateUserIDInternals = {
+  stubThis: (value: Uint8Array) => value,
+};
diff --git a/packages/server/src/helpers/index.ts b/packages/server/src/helpers/index.ts
index 30cf867..09b2f33 100644
--- a/packages/server/src/helpers/index.ts
+++ b/packages/server/src/helpers/index.ts
@@ -5,6 +5,7 @@ import { decodeAttestationObject } from './decodeAttestationObject.ts';
 import { decodeClientDataJSON } from './decodeClientDataJSON.ts';
 import { decodeCredentialPublicKey } from './decodeCredentialPublicKey.ts';
 import { generateChallenge } from './generateChallenge.ts';
+import { generateUserID } from './generateUserID.ts';
 import { getCertificateInfo } from './getCertificateInfo.ts';
 import { isCertRevoked } from './isCertRevoked.ts';
 import { parseAuthenticatorData } from './parseAuthenticatorData.ts';
@@ -23,6 +24,7 @@ export {
   decodeClientDataJSON,
   decodeCredentialPublicKey,
   generateChallenge,
+  generateUserID,
   getCertificateInfo,
   isCertRevoked,
   isoBase64URL,
@@ -42,7 +44,12 @@ import type {
 } from './decodeAttestationObject.ts';
 import type { CertificateInfo } from './getCertificateInfo.ts';
 import type { ClientDataJSON } from './decodeClientDataJSON.ts';
-import type { COSEPublicKey, COSEPublicKeyEC2, COSEPublicKeyOKP, COSEPublicKeyRSA } from './cose.ts';
+import type {
+  COSEPublicKey,
+  COSEPublicKeyEC2,
+  COSEPublicKeyOKP,
+  COSEPublicKeyRSA,
+} from './cose.ts';
 import type { ParsedAuthenticatorData } from './parseAuthenticatorData.ts';
 
 export type {