
    Dj)t                       d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	m
Z
mZmZ ddlmZ ddlmZmZmZ dd	lmZmZmZmZmZmZmZ d
dlmZmZmZ d
dlm Z  d
dl!m"Z"m#Z#  G d dej$                  Z% G d de%          Z& G d de%          Z' G d dej$                  Z( edd           G d de                      Z) edd           G d de                      Z*d Z+ edd           G d de                      Z, edd           G d  d!e                      Z- edd           G d" d#e                      Z.d$ Z/d% Z0 G d& d'e(          Z1 edd           G d( d)e                      Z2 edd           G d* d+e                      Z3 G d, d-e(          Z4 G d. d/e(          Z5 G d0 d1e(          Z6 G d2 d3e(          Z7 G d4 d5e(          Z8 edd           G d6 d7e                      Z9 G d8 d9e(          Z: edd           G d: d;e                      Z; edd           G d< d=e                      Z< edd           G d> d?e                      Z= G d@ dAe(          Z> edd           G dB dCe                      Z? edd           G dD dEe                      Z@ edd           G dF dGe                      ZA edd           G dH dIe                      ZB edd           G dJ dKe                      ZC G dL dMe(          ZD e1             e4             e5             e6             e7             e:            gZEdS )N    )annotationsN)	dataclass)Enumunique)AnyMappingSequencecast   )cbor)_JsonDataObjectsha256websafe_encode)AttestationObjectAuthenticatorSelectionCriteria"PublicKeyCredentialCreationOptionsPublicKeyCredentialDescriptor!PublicKeyCredentialRequestOptionsResidentKeyRequirementUserVerificationRequirement   )AssertionResponseAttestationResponseCtap2)
LargeBlobs)	ClientPinPinProtocolc                  >    e Zd ZdZ ej        d          ddfd
d	ZdS )ExtensionProcessorzBase class for CTAP2 extension processing.

    See: :class:`RegistrationExtensionProcessor` and
    :class:`AuthenticationExtensionProcessor`.
    r   NpermissionsClientPin.PERMISSIONinputsdict[str, Any] | Noneoutputsc                0    || _         || _        || _        d S N)r    _inputs_outputs)selfr    r"   r$   s       Q/home/thesage/.hermes/venv/lib/python3.11/site-packages/fido2/ctap2/extensions.py__init__zExtensionProcessor.__init__:   s     '    )r    r!   r"   r#   r$   r#   )__name__
__module____qualname____doc__r   
PERMISSIONr+    r,   r*   r   r   3   sP          -AI,@,C,C(,)-	             r,   r   c                  "    e Zd ZdZddZdd	Zd
S )RegistrationExtensionProcessora  Processing state for a CTAP2 extension, for single use.

    The ExtensionProcessor holds state and logic for client processing of an extension,
    for a registration (MakeCredential) call.

    :param permissions: PinUvAuthToken permissions required by the extension.
    :param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
    :param outputs: Default client outputs, if prepare_outputs is not overridden.
    	pin_tokenbytes | Nonereturnr#   c                    | j         S zLPrepare authenticator extension inputs, to be passed to the Authenenticator.r'   r)   r5   s     r*   prepare_inputsz-RegistrationExtensionProcessor.prepare_inputsP   s
    |r,   responser   c                    | j         S z?Prepare client extension outputs, to be returned to the caller.r(   r)   r=   r5   s      r*   prepare_outputsz.RegistrationExtensionProcessor.prepare_outputsT        }r,   N)r5   r6   r7   r#   )r=   r   r5   r6   r7   r#   r-   r.   r/   r0   r<   rB   r2   r,   r*   r4   r4   E   sF                 r,   r4   c                  "    e Zd ZdZddZddZdS ) AuthenticationExtensionProcessora  Processing state for a CTAP2 extension, for single use.

    The ExtensionProcessor holds state and logic for client processing of an extension,
    for an authentication (GetAssertion) call.

    :param permissions: PinUvAuthToken permissions required by the extension.
    :param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
    :param outputs: Default client outputs, if prepare_outputs is not overridden.
    selected$PublicKeyCredentialDescriptor | Noner5   r6   r7   r#   c                    | j         S r9   r:   )r)   rG   r5   s      r*   r<   z/AuthenticationExtensionProcessor.prepare_inputsh   s     |r,   r=   r   c                    | j         S r?   r@   rA   s      r*   rB   z0AuthenticationExtensionProcessor.prepare_outputsp   rC   r,   N)rG   rH   r5   r6   r7   r#   )r=   r   r5   r6   r7   r#   rD   r2   r,   r*   rF   rF   ]   sF                 r,   rF   c                  D    e Zd ZdZej        dd            ZddZddZdS )Ctap2Extensiona'  Base class for CTAP2 extensions.

    As of python-fido2 1.2 these instances can be used for multiple requests and
    should be invoked via the make_credential and get_assertion methods.
    Subclasses are instantiated for a single request, if the Authenticator supports
    the extension.
    ctapr   r7   boolc                    dS )z?Whether or not the extension is supported by the authenticator.Nr2   r)   rM   s     r*   is_supportedzCtap2Extension.is_supported   s      r,   optionsr   pin_protocolPinProtocol | None%RegistrationExtensionProcessor | Nonec                    dS )z3Start client extension processing for registration.Nr2   r)   rM   rR   rS   s       r*   make_credentialzCtap2Extension.make_credential   	     tr,   r   'AuthenticationExtensionProcessor | Nonec                    dS )z5Start client extension processing for authentication.Nr2   rW   s       r*   get_assertionzCtap2Extension.get_assertion   rY   r,   N)rM   r   r7   rN   )rM   r   rR   r   rS   rT   r7   rU   )rM   r   rR   r   rS   rT   r7   rZ   )	r-   r.   r/   r0   abcabstractmethodrQ   rX   r\   r2   r,   r*   rL   rL   y   sn          	N N N N        r,   rL   FT)eqfrozenc                  ,    e Zd ZU dZded<   dZded<   dS )HMACGetSecretInputzClient inputs for hmac-secret.bytessalt1Nr6   salt2)r-   r.   r/   r0   __annotations__re   r2   r,   r*   rb   rb      s2         ((LLLEr,   rb   c                  ,    e Zd ZU dZded<   dZded<   dS )HMACGetSecretOutputzClient outputs for hmac-secret.rc   output1Nr6   output2)r-   r.   r/   r0   rf   rj   r2   r,   r*   rh   rh      s2         ))NNN G      r,   rh   c                &    t          d| z             S )Ns   WebAuthn PRF )r   )secrets    r*   	_prf_saltrm      s    #f,---r,   c                  ,    e Zd ZU dZded<   dZded<   dS ) AuthenticatorExtensionsPRFValueszSalt values for use with prf.rc   firstNr6   second)r-   r.   r/   r0   rf   rq   r2   r,   r*   ro   ro      s2         ''LLLFr,   ro   c                  0    e Zd ZU dZdZded<   dZded<   dS ) AuthenticatorExtensionsPRFInputszClient inputs for prf.N'AuthenticatorExtensionsPRFValues | Noneevalz5Mapping[str, AuthenticatorExtensionsPRFValues] | Noneeval_by_credential)r-   r.   r/   r0   ru   rf   rv   r2   r,   r*   rs   rs      s;           48D8888PTTTTTTTr,   rs   c                  0    e Zd ZU dZdZded<   dZded<   dS )!AuthenticatorExtensionsPRFOutputszClient outputs for prf.Nbool | Noneenabledrt   results)r-   r.   r/   r0   rz   rf   r{   r2   r,   r*   rx   rx      s:         !!G7;G;;;;;;r,   rx   c                @   |r|j         }|j        }|rc| st          d          d | D             }|                    |          st          d          |r t	          |j                  }||v r||         }|sd S t          |j                  |j        t          |j                  ndf}n|r|j	        |j
        pdf}nd S t          |d                   t          j        k    r+|d         r2t          |d                   t          j        k    st          d          |S )Nz+evalByCredentials requires allowCredentialsc                6    h | ]}t          |j                  S r2   r   id.0cs     r*   	<setcomp>z&_hmac_prepare_salts.<locals>.<setcomp>   s"    <<<A>!$''<<<r,   z&evalByCredentials contains invalid keyr,   r   r   zInvalid salt length)ru   rv   
ValueError
issupersetr   r   rm   rp   rq   rd   re   lenHmacSecretExtensionSALT_LEN)	
allow_listrG   prfhmacsecretsby_credsidskeysaltss	            r*   _hmac_prepare_saltsr      sO   
 () 
	, P !NOOO<<<<<C>>(++ K !IJJJ ,$X[11(??&smG 	F gm$$*1.*DYw~&&&#
 
 
DJ-#- 	E!H,555q 	6 q]].A.JJJ.///Lr,   c                    |r|d t           j                 nd }|r|t           j        d          nd }|r+t          | |rt          ||          nd           }|rd|ind S i }| | |d<   |rt	          ||          |d<   |pd S )N)rz   r{   r   hmacCreateSecrethmacGetSecret)r   r   rx   ro   rh   )rz   	decryptedr   ri   rj   resultr$   s          r*   _hmac_format_outputsr      s    ;DNi6-6677$G;DNi+46677$G
 2FMW0'BBBSW
 
 
 #)2vd2*1G&' 	M':7G'L'LGO$$r,   c                  8    e Zd ZdZdZdZdZddZd Zd Z	d	 Z
d
S )r   a  
    Implements the Pseudo-random function (prf) and the hmac-secret CTAP2 extensions.

    The hmac-secret extension is not directly available to clients by default, instead
    the prf extension is used.

    https://www.w3.org/TR/webauthn-3/#prf-extension

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-hmac-secret-extension

    :param allow_hmac_secret: Set to True to allow hmac-secret, in addition to prf.
    zhmac-secretzhmac-secret-mc    Fc                    || _         d S r&   )_allow_hmac_secret)r)   allow_hmac_secrets     r*   r+   zHmacSecretExtension.__init__  s    "3r,   c                (    | j         |j        j        v S r&   NAMEinfo
extensionsrP   s     r*   rQ   z HmacSecretExtension.is_supported      yDI000r,   c                   |j         pi }|                    d          d u| j        o|                    d          du }rz|                     |          rfs|rct          j        did | j        |j        j         v rt          	                    t          t          d z  |                    d                              }|rCt          	                    t          t          d z  |                    d                              nd }t          d d ||          }|r{t          |          }	|	                                \  }
                    |d         |d         z             }                    |          }|
||j        dt          j        <    G fdd	t&                    } |            S d S d S d S )
Nr   r   Tr   r   r   r   r         c                  (    e Zd Z fdZfdZdS )6HmacSecretExtension.make_credential.<locals>.Processorc                    S r&   r2   )r)   r5   r"   s     r*   r<   zEHmacSecretExtension.make_credential.<locals>.Processor.prepare_inputs8  s    !Mr,   c                    |j         j        pi }|                    t          j        d          }|                    t          j                  }|r	r                    	|          nd }t          ||          S )NF)	auth_datar   getr   r   MC_NAMEdecryptr   )
r)   r=   r5   r   rz   valuer   rS   r   shared_secrets
          r*   rB   zFHmacSecretExtension.make_credential.<locals>.Processor.prepare_outputs;  s    !)!3!>!D"J(nn-@-EuMMG&NN+>+FGGE !"%2",,]EBBB! 
 0CHHHr,   Nr-   r.   r/   r<   rB   )r"   rS   r   r   s   r*   	Processorr   7  sZ        " " " " "	I 	I 	I 	I 	I 	I 	I 	I 	Ir,   r   )r   r   r   rQ   r   r   r   r   rs   	from_dictr
   r   rb   r   r   _get_shared_secretencryptauthenticateVERSIONr4   )r)   rM   rR   rS   c_inputsr   	prf_salts
hmac_saltsr   
client_pinkey_agreementsalt_enc	salt_authr   r"   r   r   s      `          @@@r*   rX   z#HmacSecretExtension.make_credential  s.   %+ll5!!-&S8<<8J+K+Kt+S *	D--d33 *	 *	 *	&9&>%EF M|ty333<FF4e)<)<== 	 &00Wt^X\\/-J-JKK     ,D$	:NN 
!*4!>!>J3=3P3P3R3R0M=+33M58eTUhCVWWH , 9 9- R RI(#$'/	; ;F.67I I I I I I I I I I: I I I 9;;U*	 *	 *	 *	 *	 *	r,   c                  	
 j         pi }t                              t          t          d z  |                    d                              	| j        rCt                              t          t          d z  |                    d                              nd rd|                     |          rQ	srOt          |          }|
                                \  
 G 	
fddt                    } |            S d S d S d S )Nr   r   c                  2    e Zd Z fdZfdZdS )5HmacSecretExtension.get_assertion.<locals>.Processingc                    t          j        |
          }|sd S 	                    |d         |d         z             }	                    |          }t          j        ||	j        diS )Nr   r   r   )r   allow_credentialsr   r   r   r   r   )r)   rG   r5   r   r   r   r   r   rR   rS   r   r   s         r*   r<   zDHmacSecretExtension.get_assertion.<locals>.Processing.prepare_inputsZ  s    /18S$ E ! +33M58eTUhCVWWH , 9 9- R RI ,0,'(+3	3 3 r,   c                    |j         j        pi }|                    t          j                  }|r                    |          nd }t          d |          S r&   )r   r   r   r   r   r   r   )	r)   r=   r5   r   r   r   rS   r   r   s	         r*   rB   zEHmacSecretExtension.get_assertion.<locals>.Processing.prepare_outputsm  s_    !)!3!>!D"J&NN+>+CDDEFKU,,]EBBBQU  0iEEEr,   Nr   )r   r   rR   rS   r   r   s   r*   
Processingr   Y  ss                 &F F F F F F F F Fr,   r   )r   rs   r   r
   r   r   r   rb   rQ   r   r   rF   )r)   rM   rR   rS   r"   r   r   r   r   r   r   s     ``   @@@@r*   r\   z!HmacSecretExtension.get_assertionH  so   #)r.884E!2!233
 
 &((Wt^VZZ%@%@AA    	   	 D--d33  	   	   	 "466J+5+H+H+J+J(M=F F F F F F F F F F F F= F F F8 :<<A 	   	   	   	   	   	 r,   N)F)r-   r.   r/   r0   r   r   r   r+   rQ   rX   r\   r2   r,   r*   r   r      sq          DGH4 4 4 41 1 1. . .`-  -  -  -  - r,   r   c                  >    e Zd ZU dZdZded<   dZded<   dZded<   dS )	&AuthenticatorExtensionsLargeBlobInputszClient inputs for largeBlob.N
str | Nonesupportry   readr6   write)r-   r.   r/   r0   r   rf   r   r   r2   r,   r*   r   r   x  sK         &&GDEr,   r   c                  >    e Zd ZU dZdZded<   dZded<   dZded<   dS )'AuthenticatorExtensionsLargeBlobOutputszClient outputs for largeBlob.Nry   	supportedr6   blobwritten)r-   r.   r/   r0   r   rf   r   r   r2   r,   r*   r   r     sK         ''!I!!!!DGr,   r   c                  (    e Zd ZdZdZd Zd Zd ZdS )LargeBlobExtensionz
    Implements the Large Blob storage (largeBlob) WebAuthn extension.

    https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension
    largeBlobKeyc                h    | j         |j        j        v o|j        j                            dd          S )N
largeBlobsF)r   r   r   rR   r   rP   s     r*   rQ   zLargeBlobExtension.is_supported  s7    yDI00 
TY5F5J5J%6
 6
 	
r,   c                t   |j         pi }t                              t          t          d z  |                    d                              }|ri|j        s|j        rt          d          |j	        dk    r$| 
                    |          st          d           G d dt                    } |            S d S )N	largeBlobInvalid set of parametersrequired1Authenticator does not support large blob storagec                      e Zd Zd Zd ZdS )5LargeBlobExtension.make_credential.<locals>.Processorc                    t           j        diS NT)r   r   r;   s     r*   r<   zDLargeBlobExtension.make_credential.<locals>.Processor.prepare_inputs  s    .3T::r,   c                4    dt          |j        d u          iS )Nr   )r   )r   large_blob_keyrA   s      r*   rB   zELargeBlobExtension.make_credential.<locals>.Processor.prepare_outputs  s,    #%L&.&=T&I& & & r,   Nr   r2   r,   r*   r   r     s2        ; ; ;    r,   r   )r   r   r   r
   r   r   r   r   r   r   rQ   r4   )r)   rM   rR   rS   r"   datar   s          r*   rX   z"LargeBlobExtension.make_credential  s    #)r5??4K!8!899
 
  	y >DJ > !<===|z))$2C2CD2I2I) !TUUU	 	 	 	 	: 	 	 	 9;;#	 	r,   c                   |j         pi }t                              t          t          d z  |                    d                              rj        sj        rj        rt          d          | 
                              st          d           G fddt                    } |j        rt          j        j        nt          j        d          t          j        di          S d S )	Nr   r   r   c                      e Zd Z fdZdS )3LargeBlobExtension.get_assertion.<locals>.Processorc                *   J |j         }|rj        r6t                    }|                    |          }dt	          |          iS j        r@t          |          }|                    |j                   dt	          d          iS d S d S )Nr   )r   T)r   )r   r   r   get_blobr   r   put_blob)	r)   r=   r5   blob_keylarge_blobsr   rM   r   rS   s	         r*   rB   zCLargeBlobExtension.get_assertion.<locals>.Processor.prepare_outputs  s    +++'6H 9 *4T*:*:K#.#7#7#A#AD +-T)-." ." ."$ 
 "Z *4T<*S*SK'004:FFF +-T,0." ." ."$   r,   N)r-   r.   r/   rB   )rM   r   rS   s   r*   r   r     s8                r,   r   r   Tr"   )r   r   r   r
   r   r   r   r   r   r   rQ   rF   r   r1   LARGE_BLOB_WRITEr   r   r)   rM   rR   rS   r"   r   r   s    ` `  @r*   r\   z LargeBlobExtension.get_assertion  s3   #)r5??4K!8!899
 
  #	| >	 >dj > !<===$$T** V !TUUU        <   , 9 z1I(99"-a00*/6   9#	 #	r,   Nr-   r.   r/   r0   r   rQ   rX   r\   r2   r,   r*   r   r     sR          D
 
 

  0( ( ( ( (r,   r   c                  (    e Zd ZdZdZd Zd Zd ZdS )CredBlobExtensionz
    Implements the Credential Blob (credBlob) CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credBlob-extension
    credBlobc                (    | j         |j        j        v S r&   r   rP   s     r*   rQ   zCredBlobExtension.is_supported  r   r,   c                    |j         pi }|                     |          rY|                    d          }|j        j        J |r6t          |          |j        j        k    rt          | j        |i          S d S d S d S )Nr   r   )r   rQ   r   r   max_cred_blob_lengthr   r4   r   )r)   rM   rR   rS   r"   r   s         r*   rX   z!CredBlobExtension.make_credential  s    #)rT"" 	P::j))D91=== PD		TY%CCC5di=NOOOO		P 	PP PCCr,   c                    |j         pi }|                     |          r.|                    d          du rt          | j        di          S d S d S )NgetCredBlobTr   )r   rQ   r   rF   r   r)   rM   rR   rS   r"   s        r*   r\   zCredBlobExtension.get_assertion  sf    #)rT"" 	Nvzz-'@'@D'H'H3DIt;LMMMM	N 	N'H'Hr,   Nr   r2   r,   r*   r   r     sZ          D1 1 1P P PN N N N Nr,   r   c                  N    e Zd ZdZe G d de                      ZdZd Zd Z	dS )CredProtectExtensionz
    Implements the Credential Protection CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credProtect-extension
    c                  2    e Zd ZdZdZdZed
d            Zd	S )CredProtectExtension.POLICYuserVerificationOptional,userVerificationOptionalWithCredentialIDListuserVerificationRequiredpolicystrr7   intc                ^    t          |                                | |                    dz   S )Nr   )listindex)clsr   s     r*   str2intz#CredProtectExtension.POLICY.str2int  s'    99??33v;;//!33r,   N)r   r   r7   r   )r-   r.   r/   OPTIONALOPTIONAL_WITH_LISTREQUIREDclassmethodr  r2   r,   r*   POLICYr     sB        -K-		4 	4 	4 
	4 	4 	4r,   r
  credProtectc                (    | j         |j        j        v S r&   r   rP   s     r*   rQ   z!CredProtectExtension.is_supported  r   r,   c                6   |j         pi }|                    d          }|rxt          j                            |          }|                    dd          }|r*|                     |          s|dk    rt          d          t          | j        |i          S d S )NcredentialProtectionPolicy!enforceCredentialProtectionPolicyFr   z4Authenticator does not support Credential Protectionr   )	r   r   r   r
  r  rQ   r   r4   r   )r)   rM   rR   rS   r"   r   r  enforces           r*   rX   z$CredProtectExtension.make_credential  s    #)r899 	M(/77??Ejj!DeLLG Yt0066 Y5199 !WXXX1$)U9KLLLL	M 	Mr,   N)
r-   r.   r/   r0   r   r   r
  r   rQ   rX   r2   r,   r*   r   r     s~          4 4 4 4 4 4 4 V4 D1 1 1	M 	M 	M 	M 	Mr,   r   c                  "    e Zd ZdZdZd Zd ZdS )MinPinLengthExtensionz
    Implements the Minimum PIN Length (minPinLength) CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension
    minPinLengthc                    d|j         j        v S )NsetMinPINLength)r   rR   rP   s     r*   rQ   z"MinPinLengthExtension.is_supported   s     DI$555r,   c                    |j         pi }|                     |          r3|                    | j                  du rt	          | j        di          S d S d S NTr   r   rQ   r   r   r4   r   s        r*   rX   z%MinPinLengthExtension.make_credential$  h    #)rT"" 	Lvzz$)'<'<'D'D1$)T9JKKKK	L 	L'D'Dr,   Nr-   r.   r/   r0   r   rQ   rX   r2   r,   r*   r  r    sH          D6 6 6L L L L Lr,   r  c                  "    e Zd ZdZdZd Zd ZdS )PinComplexityPolicyExtensionz
    Implements the PIN Complexity Policy (pinComplexityPolicy) CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension
    pinComplexityPolicyc                (    | j         |j        j        v S r&   r   rP   s     r*   rQ   z)PinComplexityPolicyExtension.is_supported3  r   r,   c                    |j         pi }|                     |          r3|                    | j                  du rt	          | j        di          S d S d S r  r  r   s        r*   rX   z,PinComplexityPolicyExtension.make_credential6  r  r,   Nr  r2   r,   r*   r  r  *  sH          !D1 1 1L L L L Lr,   r  c                  "    e Zd ZU dZdZded<   dS )CredentialPropertiesOutputzClient outputs for credProps.Nry   rk)r-   r.   r/   r0   r"  rf   r2   r,   r*   r!  r!  <  s)         ''Br,   r!  c                  "    e Zd ZdZdZd Zd ZdS )CredPropsExtensionz
    Implements the Credential Properties (credProps) WebAuthn extension.

    https://www.w3.org/TR/webauthn-3/#sctn-authenticator-credential-properties-extension
    	credPropsc                    dS r   r2   rP   s     r*   rQ   zCredPropsExtension.is_supportedL  s    tr,   c                V   |j         pi }|                    | j                  du r|j        pt	                      }|j        t          j        k    p3|j        t          j        k    o|j	        j
                            d          }t          | j        t          |          i          S d S )NTr"  )r"  )r$   )r   r   r   authenticator_selectionr   resident_keyr   r  	PREFERREDr   rR   r4   r!  )r)   rM   rR   rS   r"   	selectionr"  s          r*   rX   z"CredPropsExtension.make_credentialP  s    #)r::di  D((/S3Q3S3S  '+A+JJ &*@*JJ 0I%))$// 
 2$>"$E$E$EF    )(r,   Nr  r2   r,   r*   r$  r$  C  sC          D      r,   r$  c                  $    e Zd ZU ded<   ded<   dS )PaymentCurrencyAmountr   currencyr   Nr-   r.   r/   rf   r2   r,   r*   r-  r-  `  s"         MMMJJJJJr,   r-  c                  2    e Zd ZU ded<   ded<   dZded<   dS )PaymentCredentialInstrumentr   display_nameiconTrN   icon_must_be_shownN)r-   r.   r/   rf   r4  r2   r,   r*   r1  r1  f  s9         III#######r,   r1  c                  v    e Zd ZU dZdZded<   dZded<   dZded<   dZded<   dZ	ded	<   dZ
d
ed<   dZded<   dS )%AuthenticationExtensionsPaymentInputszClient inputs for payment.Nry   
is_paymentr   rp_id
top_origin
payee_namepayee_originzPaymentCurrencyAmount | Nonetotalz"PaymentCredentialInstrument | None
instrument)r-   r.   r/   r0   r7  rf   r8  r9  r:  r;  r<  r=  r2   r,   r*   r6  r6  m  s         $$"J""""E!J!!!!!J!!!!#L####*.E....59J999999r,   r6  c                  (    e Zd ZdZdZd Zd Zd ZdS )ThirdPartyPaymentExtensiona]  
    Implements the Third Party Payment (thirdPartyPayment) CTAP2.2 extension.

    https://fidoalliance.org/specs/fido-v2.2-ps-20250228/fido-client-to-authenticator-protocol-v2.2-ps-20250228.html#sctn-thirdPartyPayment-extension

    Note that most of the processing for the WebAuthn extension needs to be done by the
    client, see:
    https://www.w3.org/TR/secure-payment-confirmation/#sctn-collectedclientpaymentdata-dictionary

    As such, this extension is not included in the default extensions list, and should
    not be used without a client that supports the WebAuthn payment extension.
    thirdPartyPaymentc                (    | j         |j        j        v S r&   r   rP   s     r*   rQ   z'ThirdPartyPaymentExtension.is_supported  r   r,   c                   |j         pi }t                              t          t          d z  |                    d                              }|                     |          r |r |j        rt          | j	        di          S d S d S d S NpaymentTr   )
r   r6  r   r
   r   r   rQ   r7  r4   r   r)   rM   rR   rS   r"   r   s         r*   rX   z*ThirdPartyPaymentExtension.make_credential  s    #)r4>>4I!6!677
 
 T"" 	Lt 	L 	L1$)T9JKKKK	L 	L 	L 	L 	L 	Lr,   c                   |j         pi }t                              t          t          d z  |                    d                              }|                     |          r |r |j        rt          | j	        di          S d S d S d S rC  )
r   r6  r   r
   r   r   rQ   r7  rF   r   rE  s         r*   r\   z(ThirdPartyPaymentExtension.get_assertion  s    #)r4>>4I!6!677
 
 T"" 	Nt 	N 	N3DIt;LMMMM	N 	N 	N 	N 	N 	Nr,   Nr   r2   r,   r*   r?  r?  z  sZ          D1 1 1L L LN N N N Nr,   r?  c                      e Zd ZU ded<   dS )_SignGenerateKeyInputszSequence[int]
algorithmsNr/  r2   r,   r*   rH  rH    s         r,   rH  c                  2    e Zd ZU ded<   ded<   dZded<   dS )_SignSignInputsrc   
key_handletbsNr6   additional_args)r-   r.   r/   rf   rN  r2   r,   r*   rK  rK    s8         JJJ$(O((((((r,   rK  c                  ,    e Zd ZU dZded<   dZded<   dS )_SignInputsNz_SignGenerateKeyInputs | Nonegenerate_keyz$Mapping[str, _SignSignInputs] | Nonesign_by_credential)r-   r.   r/   rQ  rf   rR  r2   r,   r*   rP  rP    s5         26L6666?CCCCCCCr,   rP  c                  8    e Zd ZU ded<   ded<   ded<   ded<   dS )	_SignGeneratedKeyrc   rL  
public_keyr   	algorithmr   attestation_objectNr/  r2   r,   r*   rT  rT    s?         NNN))))))r,   rT  c                  ,    e Zd ZU dZded<   dZded<   dS )_SignOutputsNz_SignGeneratedKey | Nonegenerated_keyr6   	signature)r-   r.   r/   rZ  rf   r[  r2   r,   r*   rY  rY    s4         .2M2222"I""""""r,   rY  c                  (    e Zd ZdZdZd Zd Zd ZdS )PreviewSignExtensiona  
    WARNING: This extension is currently in DRAFT.
    It is to be considered experimental, and NOT part of the stable API of this library.

    Implements version 4-SNAPSHOT-2025-08-21T15:00 of the sign CTAP2 extension.

    https://github.com/yubicolabs/webauthn-sign-extension
    previewSignc                (    | j         |j        j        v S r&   r   rP   s     r*   rQ   z!PreviewSignExtension.is_supported  r   r,   c                (   j         pi }t                              |                    | j                            r|                     |          sd S j        sj        st          d           G fddt                    } |            S )NInvalid inputsc                  "    e Zd Z fdZd ZdS )7PreviewSignExtension.make_credential.<locals>.Processorc                    j         }j        pt                      }|j        t          j        k    rdnd}|j        |d}t          j        |iS )N   r   )r   r   )	rQ  r(  r   user_verificationr   r  rI  r]  r   )r)   r5   gkr+  flagsr$   r   rR   s         r*   r<   zFPreviewSignExtension.make_credential.<locals>.Processor.prepare_inputs  sl    & 3W7U7W7W 
 !22;< < E 	  !m66,17;;r,   c           
     2   |j         j        pi }|                    t          j                  }|sd S |j        t          j                 d         }t          j        t          t          t          j        |                              }t          j        |j        |j         |j                  }|j         j        }|J t          j        t#          t%          |j        t          j        |j                  |                    d          |                    iS )N   r   )rL  rU  rV  rW  )rZ  )r   r   r   r]  r   unsigned_extension_outputsr   r   r
   r   r   decoder   createfmtatt_stmtcredential_datarY  rT  credential_idencoderU  )	r)   r=   r5   r   r   att_obj_bytesatt_respatt_obj	cred_datas	            r*   rB   zGPreviewSignExtension.make_credential.<locals>.Processor.prepare_outputs  s   %/:@b
!~~&:&?@@  4 ( C(-!! /8$+m"<"<==  ,2L("4h6G  $-=	 ,,, )-|&7'0'>'+{93G'H'H&*hhqkk/6	' ' '0 0 0	 	r,   Nr   r   rR   s   r*   r   rc    sB        < < < < < <     r,   r   )
r   rP  r   r   r   rQ   rR  rQ  r   r4   r   s     `   @r*   rX   z$PreviewSignExtension.make_credential  s    #)r$$VZZ	%:%:;; 	4,,T22 	F" 	/$*; 	/-...+	 +	 +	 +	 +	 +	 +	 +	6 +	 +	 +	Z y{{r,   c                (   j         pi }t                              |                    | j                            r|                     |          sd S j        rj        rt          d           G fddt                    } |            S )Nra  c                  "    e Zd Z fdZd ZdS )5PreviewSignExtension.get_assertion.<locals>.Processorc                6   j         }	j        }|r|st          d          d |D             }|                    |          rt          d          |t	          |j                           }|j        |j        d}|j        r
|j        |d<   t          j
        |iS )Nzsign requires allowCredentialsc                6    h | ]}t          |j                  S r2   r~   r   s     r*   r   zWPreviewSignExtension.get_assertion.<locals>.Processor.prepare_inputs.<locals>.<setcomp>  s"    @@@~ad++@@@r,   z"keyHandleByCredential is not valid)r      rj  )rR  r   r   
differencer   r   rL  rM  rN  r]  r   )
r)   rG   r5   r   r   r   cred_inputsauthenticator_inputr   rR   s
           r*   r<   zDPreviewSignExtension.get_assertion.<locals>.Processor.prepare_inputs  s    2 %6
! G G$%EFFF@@Z@@@>>(++ K$%IJJJ&~hk'B'BC #-"' '# . I-8-H'*,13FGGr,   c                    |j         j        pi }|                    t          j                  }|r"t          j        t          |d                   iS d S )Nr}  )r[  )r   r   r   r]  r   rY  )r)   r=   r5   r   r   s        r*   rB   zEPreviewSignExtension.get_assertion.<locals>.Processor.prepare_outputs$  sZ    %/:@b
!~~&:&?@@ X05|dSTg7V7V7VWWX Xr,   Nr   rw  s   r*   r   rz    sM        H H H H H H*X X X X Xr,   r   )
r   rP  r   r   r   rQ   rR  rQ  r   rF   r   s     `   @r*   r\   z"PreviewSignExtension.get_assertion  s    #)r$$VZZ	%:%:;; 	4,,T22 	F& 	/$*; 	/-...	X 	X 	X 	X 	X 	X 	X 	X8 	X 	X 	X8 y{{r,   Nr   r2   r,   r*   r]  r]    sS          D1 1 16 6 6p% % % % %r,   r]  )F
__future__r   r]   dataclassesr   enumr   r   typingr   r   r	   r
    r   utilsr   r   r   webauthnr   r   r   r   r   r   r   baser   r   r   r   r   pinr   r   ABCr   r4   rF   rL   rb   rh   rm   ro   rs   rx   r   r   r   r   r   r   r   r   r  r  r!  r$  r-  r1  r6  r?  rH  rK  rP  rT  rY  r]  _DEFAULT_EXTENSIONSr2   r,   r*   <module>r     s  8 # " " " " " 



 ! ! ! ! ! !         / / / / / / / / / / / /       ; ; ; ; ; ; ; ; ; ;                  @ ? ? ? ? ? ? ? ? ?       ' ' ' ' ' ' ' '               $    %7   0    '9   8    SW   @ eD!!!       "! eD!!!! ! ! ! !/ ! ! "!!. . . eD!!!              "!  eD!!!U U U U U U U "!U eD!!!< < < < < < < "!<" " "J  ,u  u  u  u  u . u  u  u p eD!!!    _   "! eD!!!         o     "! N N N N N N N NbN N N N N N N N4M M M M M> M M MDL L L L LN L L L&L L L L L> L L L$ eD!!!       "!       : eD!!!    O   "!
 eD!!!$ $ $ $ $/ $ $ "!$ eD!!!	: 	: 	: 	: 	:O 	: 	: "!	:!N !N !N !N !N !N !N !NH eD!!!    _   "! eD!!!) ) ) ) )o ) ) "!) eD!!!D D D D D/ D D "!D
 eD!!!* * * * * * * "!* eD!!!# # # # #? # # "!#
l l l l l> l l l`    r,   