Lazily evaluate PQC support to prevent Node warnings on startup

packages/server/src/registration/generateRegistrationOptions.ts

@@ -28,19 +28,16 @@ const defaultAuthenticatorSelection: AuthenticatorSelectionCriteria = {
 };
 
 /**
- * Use the most commonly-supported algorithms
- * See the following:
- *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
- *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
+ * Generate the default array of public key algorithms to offer during registration. Defaults to
+ * the most commonly-supported algorithms of EdDSA, ES256, and RS256. When the runtime supports
+ * PQC algorithms, ML-DSA-44 is included as the most preferred algorithm.
  */
-export let defaultSupportedAlgorithmIDs: COSEALG[] = [
-  COSEALG.EdDSA,
-  COSEALG.ES256,
-  COSEALG.RS256,
-];
+export function getDefaultSupportedAlgorithmIDs(): COSEALG[] {
+  if (SettingsService.runtimeSupportsPQC()) {
+    return [COSEALG.ML_DSA_44, COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256];
+  }
 
-if (SettingsService.runtimeSupportsPQC()) {
-  defaultSupportedAlgorithmIDs = [COSEALG.ML_DSA_44, ...defaultSupportedAlgorithmIDs];
+  return [COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256];
 }
 
 /**
@@ -94,7 +91,7 @@ export async function generateRegistrationOptions(
     excludeCredentials = [],
     authenticatorSelection = defaultAuthenticatorSelection,
     extensions,
-    supportedAlgorithmIDs = defaultSupportedAlgorithmIDs,
+    supportedAlgorithmIDs = getDefaultSupportedAlgorithmIDs(),
     preferredAuthenticatorType,
   } = options;
 

packages/server/src/registration/verifyRegistrationResponse.ts

@@ -22,7 +22,7 @@ import { matchExpectedRPID } from '../helpers/matchExpectedRPID.ts';
 import { isoBase64URL } from '../helpers/iso/index.ts';
 import { SettingsService } from '../services/settingsService.ts';
 
-import { defaultSupportedAlgorithmIDs } from './generateRegistrationOptions.ts';
+import { getDefaultSupportedAlgorithmIDs } from './generateRegistrationOptions.ts';
 import { verifyAttestationFIDOU2F } from './verifications/verifyAttestationFIDOU2F.ts';
 import { verifyAttestationPacked } from './verifications/verifyAttestationPacked.ts';
 import { verifyAttestationAndroidSafetyNet } from './verifications/verifyAttestationAndroidSafetyNet.ts';
@@ -71,7 +71,7 @@ export async function verifyRegistrationResponse(
     expectedType,
     requireUserPresence = true,
     requireUserVerification = true,
-    supportedAlgorithmIDs = defaultSupportedAlgorithmIDs,
+    supportedAlgorithmIDs = getDefaultSupportedAlgorithmIDs(),
     attestationSafetyNetEnforceCTSCheck = true,
   } = options;
   const { id, rawId, type: credentialType, response: attestationResponse } = response;

packages/server/src/services/settingsService.ts

@@ -43,11 +43,10 @@ class BaseSettingsService implements SettingsService {
   // Certificates are stored as PEM-formatted strings
   private pemCertificates: Map<RootCertIdentifier, string[]>;
   // Track whether the runtime supports PQC algorithms
-  private _runtimeSupportsPQC = false;
+  private _runtimeSupportsPQC?: boolean;
 
   constructor() {
     this.pemCertificates = new Map();
-    this._runtimeSupportsPQC = runtimeSupportsWebCryptoKeyAlg('ML-DSA-44');
   }
 
   setRootCertificates(opts: {
@@ -74,6 +73,7 @@ class BaseSettingsService implements SettingsService {
   }
 
   runtimeSupportsPQC() {
+    this._runtimeSupportsPQC ??= runtimeSupportsWebCryptoKeyAlg('ML-DSA-44');
     return this._runtimeSupportsPQC;
   }
 }