Allow expectedChallenge to return a promise

[jordanbtucker]

Describe the issue

verifyAuthenticationResponse and verifyRegistrationResponse allow users to provide a function as the value of the expectedChallenge property of their options parameter. However, this function does not allow for returning a promise, even though both verifyAuthenticationResponse and verifyRegistrationResponse are async.

If these functions allowed expectedChallenge to return a promise, users could perform async validation of challenges (e.g. the challenge is asynchronously retrieved from the database, or the challenge included a signature that could be verified by crypto.subtle.verify in Deno). Currenlty, only sync validation is possible.

I recommend changing the signature for expectedChallenge in VerifyAuthenticationResponseOpts and VerifyRegistrationResponseOpts to be:

string | ((challenge: string) => boolean | Promise<boolean>)

Then verifyAuthenticationResponse and verifyRegistrationResponse can perform await expectedChallenge(challenge) if it's a function.

[jordanbtucker]

I do understand that the spec says that challenges should be randomly generated to prevent relay attacks and should "store the challenge temporarily". My use case would be to create a challenge that is a signed JWT that includes a user ID, expiration, and randomly generated nonce, effectively allowing it to be both randomly generated and temporarily stored without hitting the database.

[MasterKale]

@jordanbtucker This is now available in @simplewebauthn/server@8.1.0 ✌️