<[j=fddlmZddlZddlZddlmZmZmZmZddl m Z ddl m Z ddlmZddlmZdd lmZmZdd lmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)ej*e+Z,eee-gdfZ.ee/ge0fZ1d#dZ2d$dZ3 d%d&dZ4d'dZ5d(d Z6Gd!d"Z7dS))) annotationsN)AnyCallableMappingSequence)InvalidSignature) constant_time)CoseKey verify_rp_id)websafe_decodewebsafe_encode)AttestationConveyancePreferenceAttestationObjectAttestedCredentialDataAuthenticationResponseAuthenticatorAttachmentAuthenticatorDataAuthenticatorSelectionCriteriaCollectedClientDataCredentialCreationOptionsCredentialRequestOptions"PublicKeyCredentialCreationOptionsPublicKeyCredentialDescriptorPublicKeyCredentialParameters!PublicKeyCredentialRequestOptionsPublicKeyCredentialRpEntityPublicKeyCredentialTypePublicKeyCredentialUserEntityRegistrationResponseResidentKeyRequirementUserVerificationRequirementrp_idstrreturn VerifyOrigincfdS)Nc$t|SNr )or$s T/home/thesage/.hermes/hermes-agent/venv/lib/python3.11/site-packages/fido2/server.pyz'_verify_origin_for_rp..Gs\%++)r$s`r,_verify_origin_for_rpr0Fs + + + ++r. challenge bytes | Nonebytesc|tjd}nFt|tst dt |dkrt d|S)N z)Custom challenge must be of type 'bytes'.z&Custom challenge length must be >= 16.)osurandom isinstancer3 TypeErrorlen ValueError)r1s r,_validata_challenger=Js_JrNN )U++ IGHH H y>>B  EFF F r. credentialrrcDttj|j|S)aConverts an AttestedCredentialData to a PublicKeyCredentialDescriptor. :param credential: AttestedCredentialData containing the credential ID to use. :param transports: Optional list of AuthenticatorTransport strings to add to the descriptor. :return: A descriptor of the credential, for use with register_begin or authenticate_begin. :rtype: PublicKeyCredentialDescriptor )typeid transports)rr PUBLIC_KEY credential_id)r>rBs r, to_descriptorrEUs* ) $ /  #   r.credsGSequence[AttestedCredentialData | PublicKeyCredentialDescriptor] | None.Sequence[PublicKeyCredentialDescriptor] | Nonec"|dSd|DS)Nc~g|]:}t|trt|ntj|;Sr/)r9rrEr from_dict).0cs r, z%_wrap_credentials..msU    !344 .sA# # #  *,7S   # # # r.z Fido2Server initialized for RP: )rrKrWrAr0_verifytimeoutrrXr supported_algorithmsallowed_algorithmsrT_verify_attestationloggerdebug)selfrWrXrZr\s r,__init__zFido2Server.__init__s.7;;wz%%%$I(=dgj(I(I  :;GG# # 355 # # #  $6#L9L  AAABBBBBr.userr credentialsrGresident_key_requirementResidentKeyRequirement | Noneuser_verification"UserVerificationRequirement | Noneauthenticator_attachmentAuthenticatorAttachment | Noner1r2r&%tuple[CredentialCreationOptions, Any]c|jstdt|}t|}|||} t ddd|pgDztt|j tj |||j|j |t|||frt|||nd|j| | fS) avReturn a PublicKeyCredentialCreationOptions registration object and the internal state dictionary that needs to be passed as is to the corresponding `register_complete` call. :param user: The dict containing the user data. :param credentials: The list of previously registered credentials, these can be of type AttestedCredentialData, or PublicKeyCredentialDescriptor. :param resident_key_requirement: The desired RESIDENT_KEY_REQUIREMENT level. :param user_verification: The desired USER_VERIFICATION level. :param authenticator_attachment: The desired AUTHENTICATOR_ATTACHMENT or None to not provide a preference (and get both types). :param challenge: A custom challenge to sign and verify or None to use OS-specific random bytes. :return: Registration data, internal state.z!Server has no allowed algorithms.z1Starting new registration, existing credentials: , c3HK|]}|jVdSr*rAhexrLds r, z-Fido2Server.register_begin..s,>>q >>>>>>r.)rp resident_keyrnN) rWrjr1pub_key_cred_paramsrbexclude_credentialsauthenticator_selectionrX extensions public_key)rdr<r=rO_make_internal_staterfrgjoinrrrWr rKrbanyrrX) rhrjrkrlrnrpr1r descriptorsstates r,register_beginzFido2Server.register_begins94& B@AA A' 22 ' 44 )))5FGG ?ii>>K,=2>>>>> ?   &=w6@FF'(,(? L(3 8 8 1 "65M)A.?" $ 0)/   6 9  r.response(RegistrationResponse | Mapping[str, Any]rctj|}|jj}|jj}|jt jjkrtd| |j stdtj t|d|jstdtj |jjpd|jjstd|jstd|dt*jkr(|jstd |jd t2jfvr=t6d |j|||j|j}|j Jt6!d |j j"#z|S) a(Verify the correctness of the registration data received from the client. :param state: The state data returned by the corresponding `register_begin`. :param response: The registration response from the client. :return: The authenticator data &Incorrect type in CollectedClientData.&Invalid origin in CollectedClientData.r1Wrong challenge in response.r.Wrong RP ID hash in response.User Present flag not set.rnz;User verification required, but User Verified flag not set.NzVerifying attestation of type zNew credential registered: )$r!rKr client_datarPr@rTYPECREATEr<raoriginr bytes_eqrr1rWid_hash auth_data rp_id_hashis_user_presentr#REQUIREDis_user_verifiedrXrNONErfrgfmtrehashcredential_datainforDrw)rhrr registrationrrPrs r,register_completezFido2Server.register_completes,5h?? "+7 )2E  27> > >EFF F||K.// GEFF F% 5- . . 0E   =;<< <% GO "s$6$@$K   ><== =!+;;== ;9:: : % &*E*N N N&0AACC OM   D*I*N#O O O LLR:L:PRR S S S  $ $%79I J J J'0 (444 )'599;; <   r.$tuple[CredentialRequestOptions, Any]c t|}t|}|||}|tdn:tddd|Dzt t||j|j j ||||fS)aRReturn a PublicKeyCredentialRequestOptions assertion object and the internal state dictionary that needs to be passed as is to the corresponding `authenticate_complete` call. :param credentials: The list of previously registered credentials, these can be of type AttestedCredentialData, or PublicKeyCredentialDescriptor. :param user_verification: The desired USER_VERIFICATION level. :param challenge: A custom challenge to sign and verify or None to use OS-specific random bytes. :return: Assertion data, internal state.Nz/Starting new authentication without credentialsz.Starting new authentication, for credentials: rtc3HK|]}|jVdSr*rvrxs r,rzz1Fido2Server.authenticate_begin..3s,<<1ADHHJJ<<<<< "+5  27; ; ;EFF F||K.// GEFF F% 5- . . 0E   =;<< <%dgo&<i>RSS ><== =((** ;9:: : % &*E*N N N..00 OM    D!]22;O**9{7G+GSSSS(;;;$%9:::; N9J9J9L9LNNOOO 31222s /#FF-r3c&t||dS)Nr1rn)rrs r,rz Fido2Server._make_internal_statezs! ( 22!2   r.)NNN)rWrrXrYrZr[r\r])NNNNNN)rjr rkrGrlrmrnrorprqr1r2r&rr)rrr&r)NNNN)rkrGrnror1r2r&r)rkrrrr&r)r1r3rnro) __name__ __module__ __qualname____doc__rirrrr staticmethodrr/r.r,rVrV}s  ?C-17; CCCCC4 BF@DCG"&B B B B B H4444t @D"&* * * * * X43434343l   \   r.rV)r$r%r&r')r1r2r&r3r*)r>rr&r)rFrGr&rH)rPrrQr3r&rR)8 __future__rloggingr7typingrrrrcryptography.exceptionsrrcryptography.hazmat.primitivesr coser rpidr utilsrrwebauthnrrrrrrrrrrrrrrrrr r!r"r# getLoggerrrfr3VerifyAttestationr%boolr'r0r=rErOrTrVr/r.r,rsq8#""""" 333333333333IIIIII88888811111111.  8 $ $/7=>t $ ,,,,48&     D D D D D D D D D D r.