Lazily evaluate PQC support to prevent Node warnings on startup (#809)

This PR updates PQC support detection to only check for PQC support when
a method that needs to know is actually invoked. Before, PQC support was
checked by `SettingsService` when it was initialized. This lead to noisy
warnings any time the Node process was started:

**issue-807-prefix.mjs**
```js
// @simplewebauthn/server@14.0.2
import { generateRegistrationOptions } from '@simplewebauthn/server';
```
```sh
$ node issue-807-prefix.mjs
(node:16420) ExperimentalWarning: The supports Web Crypto API method is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
(node:16420) ExperimentalWarning: The ML-DSA-44 Web Crypto API algorithm is an experimental feature and might change at any time
```

With these changes, a method needs to be actually invoked before the
warnings will be displayed (if the runtime emits them):

**issue-807-postfix-1.mjs**
```js
// @simplewebauthn/server@"probably 14.0.3"
import { generateRegistrationOptions } from '@simplewebauthn/server';
```
```sh
$ node issue-807-postfix-1.mjs
# No output
```

**issue-807-postfix-2.mjs**
```js
// @simplewebauthn/server@"probably 14.0.3"
import { generateRegistrationOptions } from '@simplewebauthn/server';

console.log('Calling generateRegistrationOptions()', await generateRegistrationOptions({}));
```
```
$ node issue-807-postfix-1.mjs
Calling generateRegistrationOptions() {
  # ...
}
(node:16489) ExperimentalWarning: The supports Web Crypto API method is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
(node:16489) ExperimentalWarning: The ML-DSA-44 Web Crypto API algorithm is an experimental feature and might change at any time
```

Fixes #807.

Author: MasterKale

packages/server/src/registration/generateRegistrationOptions.ts

@@ -28,19 +28,16 @@ const defaultAuthenticatorSelection: AuthenticatorSelectionCriteria = {
 };
 
 /**
- * Use the most commonly-supported algorithms
- * See the following:
- *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
- *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
+ * Generate the default array of public key algorithms to offer during registration. Defaults to
+ * the most commonly-supported algorithms of EdDSA, ES256, and RS256. When the runtime supports
+ * PQC algorithms, ML-DSA-44 is included as the most preferred algorithm.
  */
-export let defaultSupportedAlgorithmIDs: COSEALG[] = [
-  COSEALG.EdDSA,
-  COSEALG.ES256,
-  COSEALG.RS256,
-];
+export function getDefaultSupportedAlgorithmIDs(): COSEALG[] {
+  if (SettingsService.runtimeSupportsPQC()) {
+    return [COSEALG.ML_DSA_44, COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256];
+  }
 
-if (SettingsService.runtimeSupportsPQC()) {
-  defaultSupportedAlgorithmIDs = [COSEALG.ML_DSA_44, ...defaultSupportedAlgorithmIDs];
+  return [COSEALG.EdDSA, COSEALG.ES256, COSEALG.RS256];
 }
 
 /**
@@ -94,7 +91,7 @@ export async function generateRegistrationOptions(
     excludeCredentials = [],
     authenticatorSelection = defaultAuthenticatorSelection,
     extensions,
-    supportedAlgorithmIDs = defaultSupportedAlgorithmIDs,
+    supportedAlgorithmIDs = getDefaultSupportedAlgorithmIDs(),
     preferredAuthenticatorType,
   } = options;
 

packages/server/src/registration/verifyRegistrationResponse.ts

@@ -22,7 +22,7 @@ import { matchExpectedRPID } from '../helpers/matchExpectedRPID.ts';
 import { isoBase64URL } from '../helpers/iso/index.ts';
 import { SettingsService } from '../services/settingsService.ts';
 
-import { defaultSupportedAlgorithmIDs } from './generateRegistrationOptions.ts';
+import { getDefaultSupportedAlgorithmIDs } from './generateRegistrationOptions.ts';
 import { verifyAttestationFIDOU2F } from './verifications/verifyAttestationFIDOU2F.ts';
 import { verifyAttestationPacked } from './verifications/verifyAttestationPacked.ts';
 import { verifyAttestationAndroidSafetyNet } from './verifications/verifyAttestationAndroidSafetyNet.ts';
@@ -71,7 +71,7 @@ export async function verifyRegistrationResponse(
     expectedType,
     requireUserPresence = true,
     requireUserVerification = true,
-    supportedAlgorithmIDs = defaultSupportedAlgorithmIDs,
+    supportedAlgorithmIDs = getDefaultSupportedAlgorithmIDs(),
     attestationSafetyNetEnforceCTSCheck = true,
   } = options;
   const { id, rawId, type: credentialType, response: attestationResponse } = response;

packages/server/src/services/settingsService.ts

@@ -43,11 +43,10 @@ class BaseSettingsService implements SettingsService {
   // Certificates are stored as PEM-formatted strings
   private pemCertificates: Map<RootCertIdentifier, string[]>;
   // Track whether the runtime supports PQC algorithms
-  private _runtimeSupportsPQC = false;
+  private _runtimeSupportsPQC?: boolean;
 
   constructor() {
     this.pemCertificates = new Map();
-    this._runtimeSupportsPQC = runtimeSupportsWebCryptoKeyAlg('ML-DSA-44');
   }
 
   setRootCertificates(opts: {
@@ -74,6 +73,7 @@ class BaseSettingsService implements SettingsService {
   }
 
   runtimeSupportsPQC() {
+    this._runtimeSupportsPQC ??= runtimeSupportsWebCryptoKeyAlg('ML-DSA-44');
     return this._runtimeSupportsPQC;
   }
 }