<[jԝ,ddlmZddlZddlZddlmZddlmZmZddl m Z m Z ddl m Z mZmZmZmZddlmZdd lmZdd lmZmZdd lmZmZmZdd lmZmZm Z dd l!m"Z"m#Z#m$Z$m%Z%ddl&m'Z'm(Z(ddl)m*Z*ddl+m,Z,ddl-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAejBeCZDGddeEZFeFfdZGGddeFZHdZIGddZJGddejKZLGddZMGdd ejKZNGd!d"eNZOd#ZPGd$d%ejKZQGd&d'eQZRGd(d)eJZSed6d.ZTed7d0ZTd1ZTGd2d3eQZUGd4d5eLZVdS)8) annotationsN)replace)IntEnumunique)EventTimer)AnyCallableMappingSequenceoverload)urlparse)ES256) CtapDevice CtapError)APDU ApduErrorCtap1)AssertionResponseCtap2Info)_DEFAULT_EXTENSIONS AuthenticationExtensionProcessorCtap2ExtensionRegistrationExtensionProcessor) ClientPin PinProtocol)STATUS) verify_rp_id)sha256)AaguidAttestationConveyancePreferenceAttestationObject%AuthenticationExtensionsClientOutputsAuthenticationResponseAuthenticatorAssertionResponseAuthenticatorAttachment AuthenticatorAttestationResponseAuthenticatorSelectionCriteriaCollectedClientData"PublicKeyCredentialCreationOptionsPublicKeyCredentialDescriptor!PublicKeyCredentialRequestOptionsPublicKeyCredentialTypeRegistrationResponseResidentKeyRequirementUserVerificationRequirement_as_cborcLeZdZdZeGddeZddZdZdS) ClientErrorzBase error raised by clients.c.eZdZdZdZdZdZdZdZd dZ dS) ClientError.ERRzError codes for ClientError.rNc"t||SN)r5)selfcauses ]/home/thesage/.hermes/hermes-agent/venv/lib/python3.11/site-packages/fido2/client/__init__.py__call__zClientError.ERR.__call__YstU++ +r=) __name__ __module__ __qualname____doc__ OTHER_ERROR BAD_REQUESTCONFIGURATION_UNSUPPORTEDDEVICE_INELIGIBLETIMEOUTrArBr@ERRr7OsI**  $%! , , , , , ,rBrMNcRt||_||_dSr=)r5rMcoder?)r>rOr?s r@__init__zClientError.__init__\s OOD))  rBcdd|j}|jr|d|jdz }|S)NzClient error: {0} - {0.name}z (cause: ))formatrOr?)r>rs r@__repr__zClientError.__repr__`s> * 1 1$) < < : + *TZ*** *ArBr=) rCrDrErFrrrMrPrUrLrBr@r5r5Lsq''  , , , , ,g , , V ,rBr5c|jtjjtjjfvrt jj}n|jtjjtjjtjj fvrt jj }nh|jtjj tjj tjj fvrt jj}n|jtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjfvrt jj}nt jj}|||Sr=) rOrrMCREDENTIAL_EXCLUDEDNO_CREDENTIALSr5rJKEEPALIVE_CANCELACTION_TIMEOUTUSER_ACTION_TIMEOUTrKUNSUPPORTED_ALGORITHMUNSUPPORTED_OPTIONKEY_STORE_FULLrIINVALID_COMMANDCBOR_UNEXPECTED_TYPE INVALID_CBORMISSING_PARAMETERINVALID_OPTION PUAT_REQUIRED PIN_INVALID PIN_BLOCKED PIN_NOT_SETPIN_POLICY_VIOLATIONPIN_TOKEN_EXPIREDPIN_AUTH_INVALIDPIN_AUTH_BLOCKEDREQUEST_TOO_LARGEOPERATION_DENIEDrHrG)eerr_clsces r@_ctap2client_errrqgsRv)-3Y]5QRRR _ .  & $ )   _ $  + ( $   _ 6  % * " ' $ # ! ! ! * ' & & ' &  "_ ( _ ( 72q>>rBc<eZdZdZejjdffd ZxZS)PinRequiredErrorz=Raised when a call cannot be completed without providing PIN.zPIN required but not providedcLt||dSr=)superrP)r>rOr? __class__s r@rPzPinRequiredError.__init__s% u%%%%%rB) rCrDrErFr5rMrHrP __classcell__rvs@r@rsrssPGG?.6U&&&&&&&&&&rBrsc|p t}|s ||i|S#t$rm}|jtjkr/|r|t jd}||ntj |Yd}~n$d}~wt$r}t|d}~wwxYw|tj r=)ris_setrrOrUSE_NOT_SATISFIEDrUPNEEDEDwaitr5rMrGrrqrK) poll_delayevent on_keepalivefuncargskwargsrns r@ _call_pollingrs  UWWEllnn & &4((( ( 5 5 5v///( L111#'L :&&&&!o11!444'&&&& & & &"1%% % &llnn & / ! ! # ##s!. CA#B  C-B<<Cc6eZdZdZifddZdd Zdd ZddZdS)AssertionSelectionzGetAssertion result holding one or more assertions. Since multiple assertions may be retured by Fido2Client.get_assertion, this result is returned which can be used to select a specific response to get. client_datar+ assertionsSequence[AssertionResponse]extension_resultsMapping[str, Any]c0||_||_||_dSr=) _client_data _assertions_extension_results)r>rrrs r@rPzAssertionSelection.__init__s" (%"3rBreturnc|jS)zIGet the raw AssertionResponses available to inspect before selecting one.)rr>s r@get_assertionsz!AssertionSelection.get_assertionss rB assertionrc|jSr=)r)r>rs r@_get_extension_resultsz)AssertionSelection._get_extension_resultss &&rBindexintr&c *|j|}t|jdt|j|j|j|jr |jdndtj t| |tj S)zGet a single response.idN)rauthenticator_data signature user_handleraw_idresponseauthenticator_attachmentclient_extension_resultstype)rr& credentialr'r auth_dataruserr(CROSS_PLATFORMr%rr/ PUBLIC_KEY)r>rrs r@ get_responsezAssertionSelection.get_responses$U+ %'-3 -#,#6#-4=NLIN400  &=%K%J++I66&&)3    rBN)rr+rrrr)rr)rrrr)rrrr&)rCrDrErFrPrrrrLrBr@rrsx02 44444    ''''      rBrc^eZdZdZej d dd Zej d dd ZdS)WebAuthnClientzMBase class for a WebAuthn client, supporting registration and authentication.Noptionsr,r Event | Nonerr0ct)Creates a credential. :param options: PublicKeyCredentialCreationOptions data. :param threading.Event event: (optional) Signal to abort the operation. NotImplementedErrorr>rrs r@make_credentialzWebAuthnClient.make_credential"###rBr.rct)Get an assertion. :param options: PublicKeyCredentialRequestOptions data. :param threading.Event event: (optional) Signal to abort the operation. rrs r@ get_assertionzWebAuthnClient.get_assertionrrBr=rr,rrrr0rr.rrrr)rCrDrErFabcabstractmethodrrrLrBr@rrstWW# $ $ $ $ $ # $ $ $ $ $ $ $rBrc*eZdZdZd dZdd Zdd Zd S)UserInteractionzProvides user interaction to the Client. Users of Fido2Client should subclass this to implement asking the user to perform specific actions, such as entering a PIN or touching theirrNonec:tddS)z@Called when the authenticator is awaiting a user presence check.zUser Presence check required.Nloggerinfors r@ prompt_upzUserInteraction.prompt_ups 344444rB permissionsClientPin.PERMISSIONrp_id str | Nonec:tddS)zkCalled when the client requires a PIN from the user. Should return a PIN, or None/Empty to cancel.z7PIN requested, but UserInteraction does not support it.Nrr>rrs r@ request_pinzUserInteraction.request_pins  MNNNtrBboolc:tddS)zxCalled when the client is about to request UV from the user. Should return True if allowed, or False to cancel.zUser Verification requested.Trrs r@ request_uvzUserInteraction.request_uvs  2333trBN)rr)rrrrrr)rrrrrr)rCrDrErFrrrrLrBr@rrs\BB 5555rBrc4eZdZdZejddZdS) ClientDataCollectorzProvides client data and logic to the Client. Users should subclass this to implement custom behavior for determining the origin, validating the RP ID, and providing client data for a request. rFPublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptionsrtuple[CollectedClientData, str]cdS)zCalled when the client is preparing a request. Should return a CollectedClientData object with the client data for the request, as well as the RP ID of the credential. NrLr>rs r@collect_client_dataz'ClientDataCollector.collect_client_datasrBN)rrrr)rCrDrErFrrrrLrBr@rrsB        rBrc<eZdZdZefddZdd Zdd ZddZdZdS)DefaultClientDataCollectorzDefault implementation of ClientDataProvider. This implementation uses a fixed origin, it can be subclassed to customize specific behavior. originstrverifyCallable[[str, str], bool]c"||_||_dSr=)_origin_verify)r>rrs r@rPz#DefaultClientDataCollector.__init__(s  rBrrrc4t|tr |jj}n,t|tr|j}nt d|Gt|}|jdks|j stj d|j S|S)z/Get the RP ID for the given options and origin.Invalid options type.Nhttpsz$RP ID required for non-https origin.) isinstancer,rprr.r ValueErrorrschemenetlocr5rMrH)r>rrrurls r@ get_rp_idz$DefaultClientDataCollector.get_rp_id,s gA B B 6JMEE !B C C 6MEE455 5 =6""CzW$$CJ$!o11:: LrBrrc |||rdSn#t$rYnwxYwtj)z&Verify the RP ID for the given origin.N)r Exceptionr5rMrH)r>rrs r@r z'DefaultClientDataCollector.verify_rp_idCs[ ||E6**      D o))+++s  ((ct|trtjjSt|t rtjjStd)z+Get the request type for the given options.r)rr,r+TYPECREATEr.GETrrs r@get_request_typez+DefaultClientDataCollector.get_request_typeLsO gA B B 6&+2 2 !B C C 6&+/ /455 5rBc|||j}|||jtj|||j|j|fS)N)rr challenge)rrr r+createrr)r>rrs r@rz.DefaultClientDataCollector.collect_client_dataUsqw 55 %... &**733|!+       rBN)rrrr)rrrrrr)rrrrrr)rr) rCrDrErFr rPrrrrLrBr@rr!s JV.,,,,6666     rBrcfd}|S)NcT|tjkrdSdSr=)rr|r)statususer_interactions r@rz%_user_keepalive..on_keepalivegs0 V_ $ $  & & ( ( ( ( ( % $rBrL)rrs` r@_user_keepaliverfs$))))) rBceZdZUded<ejddZejddZejddZdS)_ClientBackendrrrrrrctr=rr>rs r@ selectionz_ClientBackend.selectionqs!###rBrr,rr+rrenterprise_rpid_listSequence[str] | Nonerr0ctr=r)r>rrrrrs r@do_make_credentialz!_ClientBackend.do_make_credentialus"###rBr.rctr=r)r>rrrrs r@do_get_assertionz_ClientBackend.do_get_assertions"###rBNrrrr) rr,rr+rrrrrrrr0) rr.rr+rrrrrr) rCrDrE__annotations__rrrrrrLrBr@rrnsJJJ$$$$ $$$$ $$$$$$rBrc(eZdZd dZdZdZdZd S) _Ctap1ClientBackenddevicerrrct||_tdggtj|_d|_t||_dS)NU2F_V2)versions extensionsaaguidg?) rctap1rr"NONEr _poll_delayr _on_keepalive)r>rrs r@rPz_Ctap1ClientBackend.__init__sH6]] 8*FKPPP ,-=>>rBcLt|j|d|jjdddS)N )rrr registerrs r@rz_Ctap1ClientBackend.selections8     J         rBc  |j}|j}|jp t}|j} |j} | s=| t jks-tj d|Dvs|j tj krttjjt!|} d} |pgD]} | j} |j| | |dt*j#t.$re}|jt2jkrFt7|j||j|jj| | t*jYd}~d}~wwxYwtAj!| t7|j||j|jj|j"| }|j#j$}|JtK|j&tO||tPj)tUitVj,S)Ncg|] }|j SrL)alg).0ps r@ z:_Ctap1ClientBackend.do_make_credential..s&A&A&Aqu&A&A&ArBrTrattestation_objectr)-pub_key_cred_paramsexclude_credentialsauthenticator_selectionr*require_resident_keyuser_verificationr2REQUIREDr ALGORITHM attestationr# ENTERPRISErrMr]r!encoderr  authenticater5rGrrOrr{rrrrrJr$ from_ctap1hashrcredential_datar0 credential_idr)r(rr%r/r)r>rrrrr key_params exclude_listrrkr app_param dummy_paramcred key_handlernatt_objrs r@rz&_Ctap1ClientBackend.do_make_credentials,0 2 3W7U7W7W  +%7  > $?$HHH&A&Aj&A&A&AAA"&E&PPPIM<== =5<<>>**   &B > >DJ > '' Y DQQQ!o11333 > > >6T333!(* +## &/;;===43333 >$.   " #       &6 %%%#+5'G&=%K%J2%N%N(3    s;C;; E*AE%%E*c @|j}|j}|tjks|st tjjt|}|j }|D]} t|j ||j |j j||| j} t!j|t%| | g} t'|| cS#t($r%} | jt(jjkrYd} ~ d} ~ wwxYwt(jr=)allow_credentialsrr2r rrMr]r!r$r'rrrr r%rrr&r3rr5rOrKrJ) r>rrrr allow_listrr- client_paramr/ auth_resprrns r@rz$_Ctap1ClientBackend.do_get_assertions2. #5  ; D D DJ DIM<== =5<<>>** "'   D )$&J+ G &0HTNNIVV *+zBBBBB   6[_44454444 o//111s,A!C C?C::C?N)rrrr)rCrDrErPrrrrLrBr@rrsY????    @ @ @ D!2!2!2!2!2rBrc&eZdZd fd Zd ZxZS) _Ctap2ClientAssertionSelectionrr+rrr *Sequence[AuthenticationExtensionProcessor] pin_token bytes | Nonecht||||_||_dSr=)rurP _extensions _pin_token)r>rrr r:rvs r@rPz'_Ctap2ClientAssertionSelection.__init__s2 j111%#rBci} |jD]4}|||j}|r||5n1#t$r$}t j|d}~wwxYw|Sr=)r=prepare_outputsr>updaterr5rMrI)r>rextension_outputsextoutputrns r@rz5_Ctap2ClientAssertionSelection._get_extension_resultss ?' 5 5,,YHH5%,,V444 5 ? ? ?/;;A>> > ?  s.&s ( ( (AHQKK ( ( (rBrLrHs r@rIrI#s# t ( ( ( ( ((rBc@eZdZddZdZd Zd Zd Zd Zd Z dZ dS)_Ctap2ClientBackendrrrrr Sequence[Ctap2Extension]clt||_|jj|_||_||_dSr=)rctap2rr=r)r>rrr s r@rPz_Ctap2ClientBackend.__init__*s2 6]] JO % 0rBc l|j}|jrfd|D}d}|r|||} |j} nd} d} |jpd} |r|d| } |j||t| dddi| | || } t| dkr| dStdi| dj S#t$rS}|j xtj jkr | dkr| dz} n!tj jkr || d}n Yd}~nd}~wwxYw|dS) NcDg|]}t|jk|SrL)lenr)rcmax_lens r@rz5_Ctap2ClientBackend._filter_creds..>s+FFFqQTg1E1E1E1E1ErBrr8upFrrrrL)rRget_infomax_cred_id_lengthr%VERSIONmax_creds_in_listrrIrUr-rrrOrMrlrX)r>r cred_list pin_protocolr:rrrclient_data_hashpin_authversion max_credschunkrrnrWs @r@ _filter_credsz!_Ctap2ClientBackend._filter_creds5sz""$$)  GFFFFIFFFI%  #00ts .A C;C D/A D**D/c`d|jjjvr|j|dS |jddddddddd d gd | dS#t $rE}|jt jjt jj t jj fvrYd}~dSd}~wwxYw) NFIDO_2_1)rrz example.com)rnamesdummydummyz public-keyi)rrrB) pin_uv_paramr) rRrr rrrrOrMrgrerjr>rrns r@rz_Ctap2ClientBackend.selectionjs 1 1 1 J u - - - - -  **(-@@#W55*2667!$ +   6M-M-M2 FFFFF s*A B-(9B('B((B-ctfddD}tfddD}tjj|zdk}|tjjtjjzz}|t jks,|t jdfvr|sj dr#|stj ddS|r|rj dsdS|r|rdSd S) Nc3*K|] }|jvVdSr=)rrkrs r@ z5_Ctap2ClientBackend._should_use_uv..s*WW1 ,WWWWWWrB)uv clientPin bioEnrollc3LK|]}j|VdSr=)rgetrns r@rpz5_Ctap2ClientBackend._should_use_uv..sD  $%DL  Q        rBralwaysUvz*User verification not configured/supportedTmakeCredUvNotRqdF) anyr PERMISSIONMAKE_CREDENTIAL GET_ASSERTIONr2r  PREFERREDrrur5rMrI)r>rrr uv_supported uv_configuredmcadditional_permss ` r@_should_use_uvz"_Ctap2ClientBackend._should_use_uvsSWWWW6VWWWWW     )I      ! 1K ?1 D&  093G3U U*   !r client_pinrrrrallow_internal_uvallow_uvpins r@ _get_tokenz_Ctap2ClientBackend._get_tokens   ((.. +D11 (33KGG%22#UE<# (33KGG 4 <  K ( ( %'33KGGC I!//[%HHH"$$ $o77 .   rBc 2|j}d} d} ||||r`t|j|} |tjjtjjzzdk} ||| ||||| |} | sd} | | fS)NFrT)rRrZrrryrzr{r) r>r_rrrrrrrr: internal_uvrrs r@_get_auth_paramsz$_Ctap2ClientBackend._get_auth_paramssz""$$    t%6 D D #"4:|<used_extensionsrrs r@_do_makez8_Ctap2ClientBackend.do_make_credential.._do_makes#.>K By3AA   ! ! # # #% 3 3'' G\JJ3#**3///3?2K&*%:%:!&& "I{ $#11<y%    $  "  C*<!>J!<(// ;;;< C C C!o??BBB C\%%d++F'+A+JJ&*@*JJUv  &+ &&!)oGG8"&DJ&!%DJ +/  (  ( --i9IJJ (= (+ *$WWZE:::;;TNNz**0<FXl++,,$$,  +   !-    s1C66 D$DD$Fconnectrr)2rrrrr*rrrrRrZr"r#r#rrur PROTOCOLSr\pin_uv_protocolsrrrOrMrdr2 DISCOURAGEDr  UV_BLOCKEDgetattrrkcloser@rArr5rIr$rfmtratt_stmtr(r0r)r)r(rr%r/r)r>rrrrrprotordev reconnectedatt_respr:rnrrBrCrDr1rrrr+rr*rr_rrrrs```` ` @@@@@@@@@@@r@rz&_Ctap2ClientBackend.do_make_credentials|0 2 3W7U7W7W %7&t'<== z""$$"&  "A"L L L|%% /'3 44412../*(  E} 55538577 6 L@BZ Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z xj   &.hjj#)   Fim999)-H-TTT(C(L%HHHH6Y]555(5$HHHHH!#y$77Fim<<<='=IIKKKGIII"&KHHHH/ 4 ?& 5 5,,XyAA%%,,V444 5 ? ? ?/;;A>> > ?$* L(,h.?  &6 %%%#+5'G&=%K%J!&&)3    sC> D G6G G 4AG G  G2H H5H00H5c  jj jtj t jD]!}|jjj vr |n"dd  f d}j j }d} |S#t$r} | j tjjkr!t jkrt jYd} ~ Q| j tjjkr rd Yd} ~ tt)|dd} | j tjjkr)| r'|s%|| d}Yd} ~ Ȃd} ~ wwxYw)NTc ( tjj}g}jD]?}|j}|r||||jz}@|\}} r  |}nd}i} |D]/}| ||}|r| |0n1#t$r$}tj|d}~wwxYw|rddind} j} r |r|| jf} nd} r|st' djd}jj| |rt-|gnd|pd| g| Rd} t/| ||S)NrqTrr)rrrY)rryr{r=rrRrrrrerrArr5rMrIr'r%r\r-rrr3r8)rrrnrCr:r selected_credrinputsrr`rarr4rrrrrr_rr>rs r@_do_authz6_Ctap2ClientBackend.do_get_assertion.._do_authsd#.#A+!!! 32 -:D-(()) (D    )   J2Z) s2C C=C88C=Fr)rr3rrrrrr\rrrRrrrOrMrdr2rr rrrkr)r>rrrrrrrrrnrr4rrr_rs````` @@@@@r@rz$_Ctap2ClientBackend.do_get_assertions . #5&t'<== (  E} :::38577 ; LL L L L L L L L L L L L L L \j   xzz!   Fim999)-H-TTT(C(L%HHHH6Y]555(5$HHHHH!#y$77Fim<<<='=IIKKKGIII"&KHHHH/ s+ B E6E E 6AE  E  EN)rrrrr rP) rCrDrErPrerrrrrrrLrBr@rOrO)s 1 1 1 1333j.:    D$&$&$&L~ ~ ~ @AAAAArBrOcjeZdZdZeefdd Zedd ZdddZ dddZ dddZ dS) Fido2Clienta>WebAuthn-like client implementation. The client allows registration and authentication of WebAuthn credentials against an Authenticator using CTAP (1 or 2). :param device: CtapDevice to use. :param str origin: The origin to use. :param verify: Function to verify an RP ID for a given origin. rrclient_data_collectorrrrr rPc||_d|_ t||||_dS#tt f$rt |||_YdSwxYwr=)_client_data_collector_enterprise_rpid_listrO_backendrrr)r>rrrr s r@rPzFido2Client.__init__5sx'<#<@" J,?(*--DMMMI& J J J/8HIIDMMMM Js(&AArrc|jjSr=)rrrs r@rzFido2Client.infoHs }!!rBNrrrc~ |j|dS#t$r}t|d}~wwxYwr=)rrrrqrks r@rzFido2Client.selectionLsP & M # #E * * * * * & & &"1%% % &s <7<rr,r0c2tj|}|p t}|jr9t |jdz |j}d|_|nd}|j |\}}t d| |j ||||j||r|SS#t $r}t#|d}~wwxYw#|r|wwxYw)rTNz%Register a new credential for RP ID: )r, from_dictrtimeoutrsetdaemonstartrrrdebugrrrcancelrrqr>rrtimerrrrns r@rzFido2Client.make_credentialRs25>wGG  ? '/D0%)<u>>??? =11     & & &"1%% % &   s$"C C4 C//C44C77D)rrrrrrr rP)rrr=rrr) rCrDrErFrrrPpropertyrrrrrLrBr@rr*s-rs8#"""""  """"""""==============!!!!!!((((((((**********2222222222 /.......*  8 $ $)6!,$$$$N&&&&&{&&&$$$$) ) ) ) ) ) ) ) X$$$$$SW$$$<6     #'   &B B B B B !4B B B J$$$$$SW$$$:t2t2t2t2t2.t2t2t2n!!!!!%7!!!2 --- - ))) )))) ~~~~~.~~~Bqqqqq.qqqqqrB