o
    l>jZ                     @  s~  d dl mZ d dlZd dlZd dlmZmZ d dlmZm	Z	m
Z
mZ d dlmZmZmZmZ ddlmZ ddlmZmZ dd	lmZmZmZmZmZ 	 G d
d deZede_edddG dd deZedddG dd deZ edddG dd deZ!G dd de	Z"G dd de#ee"dZ$edddG dd deZ%eG dd de$Z&eG dd  d e$Z'eG d!d" d"e$Z(eG d#d$ d$e$Z)eG d%d& d&e$Z*eG d'd( d(e$Z+eG d)d* d*e$Z,dNd/d0Z-edddd1G d2d3 d3eZ.edddd1G d4d5 d5eZ/edddd1G d6d7 d7eZ0edddd1G d8d9 d9eZ1edddd1G d:d; d;eZ2edddd1G d<d= d=eZ3edddd1G d>d? d?eZ4edddd1G d@dA dAeZ5edddd1G dBdC dCeZ6G dDdE dEee#ef Z7edddd1G dFdG dGeZ8edddd1G dHdI dIeZ9edddd1G dJdK dKeZ:edddd1G dLdM dMeZ;dS )O    )annotationsN)	dataclassfield)EnumEnumMetaIntFlagunique)AnyMappingSequencecast   )cbor)ES256CoseKey)
ByteBuffer_JsonDataObjectsha256websafe_decodewebsafe_encodec                   @  sF   e Zd ZU dddZdd Zdd Zd	d
 ZedddZd e	d< dS )Aaguiddatabytesc                 C  s   t | dkr
tdd S )N   zAAGUID must be 16 bytes)len
ValueError)selfr    r   C/home/thesage/.local/lib/python3.10/site-packages/fido2/webauthn.py__init__A   s   zAaguid.__init__c                 C  s
   | t jkS N)r   NONEr   r   r   r   __bool__E      
zAaguid.__bool__c                 C  sP   |   }|d d  d|dd  d|dd  d|dd  d|dd   	S )N   -   r      )hex)r   hr   r   r   __str__H   s   HzAaguid.__str__c                 C  s   dt |  dS )NzAAGUID())strr"   r   r   r   __repr__L   s   zAaguid.__repr__valuer-   returnc                 C  s   |  |ddS )Nr&    )fromhexreplaceclsr/   r   r   r   parseO      zAaguid.parser!   N)r   r   )r/   r-   r0   r   )
__name__
__module____qualname__r   r#   r+   r.   classmethodr6   __annotations__r   r   r   r   r   @   s   
 
r   s                   FT)initfrozenc                      sx   e Zd ZU ded< ded< ded< d fdd	Zd
d ZedddZedddZ	edddZ
edddZ  ZS )AttestedCredentialDatar   aaguidr   credential_idr   
public_key_c                   s^   t    t| }t| d|d  t| d|d  t| d|d  |d r-tdd S )	Nr@   r   rA   r   rB         Wrong length)superr   r?   _parseobject__setattr__r   )r   rC   parsed	__class__r   r   r   `   s   

zAttestedCredentialData.__init__c                 C     t | S r    reprr"   r   r   r   r+   j      zAttestedCredentialData.__str__r   r0   #tuple[bytes, bytes, CoseKey, bytes]c                 C  sJ   t | }t|d}||d}t| \}}||t||fS )zParse the components of an AttestedCredentialData from a binary
        string, and return them.

        :param data: A binary string containing an attested credential data.
        :return: AAGUID, credential ID, public key, and remaining data.
        r   >H)r   r   readunpackr   decode_fromr   r6   )r   readerr@   cred_idpub_keyrestr   r   r   rH   m   s
   zAttestedCredentialData._parsec                 C  s&   | |t dt| | t| S )a%  Create an AttestedCredentialData by providing its components.

        :param aaguid: The AAGUID of the authenticator.
        :param credential_id: The binary ID of the credential.
        :param public_key: A COSE formatted public key.
        :return: The attested credential data.
        rS   )structpackr   r   encode)r5   r@   rA   rB   r   r   r   create{   s   zAttestedCredentialData.create$tuple[AttestedCredentialData, bytes]c                 C  s$   |  |\}}}}| ||||fS )a  Unpack an AttestedCredentialData from a byte string, returning it and
        any remaining data.

        :param data: A binary string containing an attested credential data.
        :return: The parsed AttestedCredentialData, and any remaining data from
            the input.
        )rH   r^   )r5   r   r@   rX   rY   rZ   r   r   r   unpack_from   s   	z"AttestedCredentialData.unpack_from
key_handlec                 C  s   |  tj|t|S )ap  Create an AttestatedCredentialData from a CTAP1 RegistrationData instance.

        :param key_handle: The CTAP1 credential key_handle.
        :type key_handle: bytes
        :param public_key: The CTAP1 65 byte public key.
        :type public_key: bytes
        :return: The credential data, using an all-zero AAGUID.
        :rtype: AttestedCredentialData
        )r^   r   r!   r   
from_ctap1)r5   ra   rB   r   r   r   rb      s   z!AttestedCredentialData.from_ctap1rC   r   )r   r   r0   rR   )r@   r   rA   r   rB   r   r0   r?   )r   r   r0   r_   )ra   r   rB   r   r0   r?   )r8   r9   r:   r<   r   r+   staticmethodrH   r;   r^   r`   rb   __classcell__r   r   rL   r   r?   Z   s   
 
r?   c                      s   e Zd ZU dZG dd deZded< ded< ded	< d
ed< ded< d% fddZdd Ze			d&d'ddZ
d(ddZd(ddZd(ddZd(dd Zd(d!d"Zd(d#d$Z  ZS ))AuthenticatorDataa  Binary encoding of the authenticator data.

    :param _: The binary representation of the authenticator data.
    :ivar rp_id_hash: SHA256 hash of the RP ID.
    :ivar flags: The flags of the authenticator data, see
        AuthenticatorData.FLAG.
    :ivar counter: The signature counter of the authenticator.
    :ivar credential_data: Attested credential data, if available.
    :ivar extensions: Authenticator extensions, if available.
    c                   @  s@   e Zd ZdZdZdZdZdZdZdZ	dZ
dZdZdZdZdZdS )	AuthenticatorData.FLAGzqAuthenticator data flags

        See https://www.w3.org/TR/webauthn/#sec-authenticator-data for details
        r      r%   r   @      N)r8   r9   r:   __doc__UPUVBEBSATEDUSER_PRESENTUSER_VERIFIEDBACKUP_ELIGIBILITYBACKUP_STATEATTESTEDEXTENSION_DATAr   r   r   r   FLAG   s    rx   r   
rp_id_hashrg   flagsintcounterzAttestedCredentialData | Nonecredential_dataMapping | None
extensionsrC   c                   s   t    t| }t| d|d t| d|d t| d|d | }| jtj	j
@ r:t|\}}nd }t| d| | jtj	j@ rRt|\}}nd }t| d| |ratd	d S )
Nry       rz   Br|   z>Ir}   r   rF   )rG   r   r   rI   rJ   rT   rU   rz   rf   rx   rp   r?   r`   rq   r   rV   r   )r   rC   rW   rZ   r}   r   rL   r   r   r      s"   
zAuthenticatorData.__init__c                 C  rN   r    rO   r"   r   r   r   r+      rQ   zAuthenticatorData.__str__    Nc                 C  s4   | |t d|| | |durt| S d S )a  Create an AuthenticatorData instance.

        :param rp_id_hash: SHA256 hash of the RP ID.
        :param flags: Flags of the AuthenticatorData.
        :param counter: Signature counter of the authenticator data.
        :param credential_data: Authenticated credential data (only if attested
            credential data flag is set).
        :param extensions: Authenticator extensions (only if ED flag is set).
        :return: The authenticator data.
        z>BINr   )r[   r\   r   r]   )r5   ry   rz   r|   r}   r   r   r   r   r^      s   zAuthenticatorData.creater0   boolc                 C     t | jtjj@ S )z,Return true if the User Present flag is set.)r   rz   rf   rx   rl   r"   r   r   r   is_user_present  r7   z!AuthenticatorData.is_user_presentc                 C  r   )z-Return true if the User Verified flag is set.)r   rz   rf   rx   rm   r"   r   r   r   is_user_verified	  r7   z"AuthenticatorData.is_user_verifiedc                 C  r   )z2Return true if the Backup Eligibility flag is set.)r   rz   rf   rx   rn   r"   r   r   r   is_backup_eligible  r7   z$AuthenticatorData.is_backup_eligiblec                 C  r   )z,Return true if the Backup State flag is set.)r   rz   rf   rx   ro   r"   r   r   r   is_backed_up  r7   zAuthenticatorData.is_backed_upc                 C  r   )z8Return true if the Attested credential data flag is set.)r   rz   rf   rx   rp   r"   r   r   r   is_attested  r7   zAuthenticatorData.is_attestedc                 C  r   )z/Return true if the Extenstion data flag is set.)r   rz   rf   rx   rq   r"   r   r   r   has_extension_data  r7   z$AuthenticatorData.has_extension_datarc   )r   N)
ry   r   rz   rg   r|   r{   r}   r   r   r~   )r0   r   )r8   r9   r:   rk   r   rx   r<   r   r+   r;   r^   r   r   r   r   r   r   re   r   r   rL   r   rf      s(   
 




rf   c                      s`   e Zd ZU dZded< ded< ded< d fd
dZdd ZedddZedddZ	  Z
S )AttestationObjecta  Binary CBOR encoded attestation object.

    :param _: The binary representation of the attestation object.
    :ivar fmt: The type of attestation used.
    :ivar auth_data: The attested authenticator data.
    :ivar att_statement: The attestation statement.
    r-   fmtrf   	auth_dataMapping[str, Any]att_stmtrC   r   c                   sd   t    ttttf tt| }t	
| d|d  t	
| dt|d  t	
| d|d  d S )Nr   r   authDatar   attStmt)rG   r   r   r
   r-   r	   r   decoder   rI   rJ   rf   )r   rC   r   rL   r   r   r   ,  s
   
zAttestationObject.__init__c                 C  rN   r    rO   r"   r   r   r   r+   4  rQ   zAttestationObject.__str__r0   c                 C  s   | t |||dS )N)r   r   r   )r   r]   )r5   r   r   r   r   r   r   r^   7  s   zAttestationObject.create	app_paramc                 C  s>   |  dt |tjjtjjB dt|j|j|j	g|j
dS )a  Create an AttestationObject from a CTAP1 RegistrationData instance.

        :param app_param: SHA256 hash of the RP ID used for the CTAP1 request.
        :type app_param: bytes
        :param registration: The CTAP1 registration data.
        :type registration: RegistrationData
        :return: The attestation object, using the "fido-u2f" format.
        :rtype: AttestationObject
        zfido-u2fr   )x5csig)r^   rf   rx   rp   rl   r?   rb   ra   rB   certificate	signature)r5   r   registrationr   r   r   rb   ?  s   zAttestationObject.from_ctap1rc   )r   r-   r   rf   r   r   r0   r   )r   r   r0   r   )r8   r9   r:   rk   r<   r   r+   r;   r^   rb   re   r   r   rL   r   r     s   
 r   c                      s$   e Zd Zdd Z fddZ  ZS )_StringEnumMetac                 C  s   d S r    r   r4   r   r   r   
_get_valueY  s   z_StringEnumMeta._get_valuec                   s:   zt  j|g|R i |W S  ty   | | Y S w r    )rG   __call__r   r   )r5   r/   argskwargsrL   r   r   r   \  s
   z_StringEnumMeta.__call__)r8   r9   r:   r   r   re   r   r   rL   r   r   X  s    r   c                   @  s   e Zd ZdZdd ZdS )_StringEnumzYEnum of strings for WebAuthn types.

    Unrecognized values are treated as missing.
    c                 C  s   | j S r    )r/   r"   r   r   r   r+   m  s   z_StringEnum.__str__N)r8   r9   r:   rk   r+   r   r   r   r   r   f  s    r   )	metaclassc                      s   e Zd ZU eG dd deZded< ded< ded< ded	< d
Zded< d fddZe		
ddddZ
dd ZedddZedddZ  ZS )CollectedClientDatac                   @     e Zd ZdZdZdS )zCollectedClientData.TYPEzwebauthn.createzwebauthn.getN)r8   r9   r:   CREATEGETr   r   r   r   TYPEs      r   r   _datar-   typer   	challengeoriginFr   cross_originrC   c                   s~   t    t| dt|   t| d| jd  t| dt| jd  t| d| jd  t| d| j	dd d S )Nr   r   r   r   r   crossOriginF)
rG   r   rI   rJ   jsonloadsr   r   r   get)r   rC   rL   r   r   r   ~  s   
zCollectedClientData.__init__bytes | strr0   c                 K  s<   t |tr
t|}n|}| tj||||d|dd S )N)r   r   r   r   ),:)
separators)
isinstancer   r   r   dumpsr]   )r5   r   r   r   r   r   encoded_challenger   r   r   r^     s    
	
	zCollectedClientData.createc                 C  rN   r    rO   r"   r   r   r   r+     rQ   zCollectedClientData.__str__c                 C  rN   r    )r   r"   r   r   r   b64     zCollectedClientData.b64c                 C  rN   r    )r   r"   r   r   r   hash  r   zCollectedClientData.hashrc   )F)
r   r-   r   r   r   r-   r   r   r0   r   )r0   r-   )r0   r   )r8   r9   r:   r   r   r   r<   r   r   r;   r^   r+   propertyr   r   re   r   r   rL   r   r   q  s"   
 	r   c                   @  s   e Zd ZdZdZdZdZdS )AttestationConveyancePreferencenoneindirectdirect
enterpriseN)r8   r9   r:   r!   INDIRECTDIRECT
ENTERPRISEr   r   r   r   r     s
    r   c                   @     e Zd ZdZdZdZdS )UserVerificationRequirementrequired	preferreddiscouragedNr8   r9   r:   REQUIRED	PREFERREDDISCOURAGEDr   r   r   r   r         r   c                   @  r   )ResidentKeyRequirementr   r   r   Nr   r   r   r   r   r     r   r   c                   @  r   )AuthenticatorAttachmentplatformzcross-platformN)r8   r9   r:   PLATFORMCROSS_PLATFORMr   r   r   r   r     r   r   c                   @  s    e Zd ZdZdZdZdZdZdS )AuthenticatorTransportusbnfcblehybridinternalN)r8   r9   r:   USBNFCBLEHYBRIDINTERNALr   r   r   r   r     s    r   c                   @  s   e Zd ZdZdS )PublicKeyCredentialTypez
public-keyN)r8   r9   r:   
PUBLIC_KEYr   r   r   r   r     s    r   c                   @  r   )PublicKeyCredentialHintzsecurity-keyzclient-devicer   N)r8   r9   r:   SECURITY_KEYCLIENT_DEVICEr   r   r   r   r   r     r   r   r   r   r0   r   c                   s    fdd D S )Nc                   s   i | ]}|t t |qS r   )rG   r   __getitem__).0kr   r   r   
<dictcomp>      z_as_cbor.<locals>.<dictcomp>r   r   r   r   r   _as_cbor  s   r   )eqr>   kw_onlyc                   @  s0   e Zd ZU ded< dZded< ed
dd	ZdS )PublicKeyCredentialRpEntityr-   nameN
str | Noneidr0   bytes | Nonec                 C  s   | j rt| j dS dS )z%Return SHA256 hash of the identifier.utf8N)r   r   r]   r"   r   r   r   id_hash  s   z#PublicKeyCredentialRpEntity.id_hash)r0   r   )r8   r9   r:   r<   r   r   r   r   r   r   r   r     s
   
 r   c                   @  s.   e Zd ZU dZded< ded< dZded< dS )PublicKeyCredentialUserEntityNr   r   r   r   display_name)r8   r9   r:   r   r<   r   r   r   r   r   r     s   
 r   c                   @  s   e Zd ZU ded< ded< dS )PublicKeyCredentialParametersr   r   r{   algNr8   r9   r:   r<   r   r   r   r   r     s   
 r   c                   @  s*   e Zd ZU ded< ded< dZded< dS )PublicKeyCredentialDescriptorr   r   r   r   Nz'Sequence[AuthenticatorTransport] | None
transports)r8   r9   r:   r<   r   r   r   r   r   r     s   
 r   c                      sN   e Zd ZU dZded< dZded< dZded< dZd	ed
<  fddZ  Z	S )AuthenticatorSelectionCriteriaNAuthenticatorAttachment | Noneauthenticator_attachmentzResidentKeyRequirement | Noneresident_key"UserVerificationRequirement | Noneuser_verificationFzbool | Nonerequire_resident_keyc                   sJ   t    | jd u rt| d| jrtjntj t| d| jtjk d S )Nr   r   )	rG   __post_init__r   rI   rJ   r   r   r   r   r"   rL   r   r   r     s   

	
z,AuthenticatorSelectionCriteria.__post_init__)
r8   r9   r:   r   r<   r   r   r   r   re   r   r   rL   r   r     s   
 r   c                   @  s   e Zd ZU ded< ded< ded< ded< d	Zd
ed< d	Zded< d	Zded< d	Zded< d	Zded< d	Z	ded< d	Z
ded< d	S )"PublicKeyCredentialCreationOptionsr   rpr   userr   r   z'Sequence[PublicKeyCredentialParameters]pub_key_cred_paramsN
int | Nonetimeout.Sequence[PublicKeyCredentialDescriptor] | Noneexclude_credentialsz%AuthenticatorSelectionCriteria | Noneauthenticator_selection(Sequence[PublicKeyCredentialHint] | Nonehintsz&AttestationConveyancePreference | NoneattestationzSequence[str] | Noneattestation_formatsMapping[str, Any] | Noner   )r8   r9   r:   r<   r  r  r  r
  r  r  r   r   r   r   r   r     s   
 r   c                   @  s^   e Zd ZU ded< dZded< dZded< dZded	< dZd
ed< dZded< dZ	ded< dS )!PublicKeyCredentialRequestOptionsr   r   Nr  r  r   rp_idr  allow_credentialsr   r   r	  r
  r  r   )
r8   r9   r:   r<   r  r  r  r   r
  r   r   r   r   r   r  .  s   
 r  c                   @  s.   e Zd ZU eedddZded< ded< dS )	 AuthenticatorAttestationResponseclientDataJSONr   metadatar   client_datar   attestation_objectN)r8   r9   r:   r   dictr  r<   r   r   r   r   r  9  s   
 r  c                   @  sB   e Zd ZU eedddZded< ded< ded	< d
Zded< d
S )AuthenticatorAssertionResponser  r  r  r   r  rf   authenticator_datar   r   Nr   user_handle)r8   r9   r:   r   r  r  r<   r  r   r   r   r   r  ?  s
   
 r  c                   @  sF   e Zd ZdZi fdddZdd Zdd	 Zd
d Zdd Zdd Z	dS )%AuthenticationExtensionsClientOutputsa  Holds extension output from a call to MakeCredential or GetAssertion.

    When accessed as a dict, all bytes values will be serialized to base64url encoding,
    capable of being serialized to JSON.

    When accessed using attributes, richer types will instead be returned.
    outputsr   c                 C  s   dd |  D | _d S )Nc                 S  s   i | ]\}}|d ur||qS r    r   )r   r   vr   r   r   r   Q  r   zBAuthenticationExtensionsClientOutputs.__init__.<locals>.<dictcomp>)items_members)r   r  r   r   r   r   P  s   z.AuthenticationExtensionsClientOutputs.__init__c                 C  
   t | jS r    )iterr   r"   r   r   r   __iter__S  r$   z.AuthenticationExtensionsClientOutputs.__iter__c                 C  r!  r    )r   r   r"   r   r   r   __len__V  r$   z-AuthenticationExtensionsClientOutputs.__len__c                 C  s<   | j | }t|trt|S t|trt|tst|S |S r    )r   r   r   r   r
   r  )r   keyr/   r   r   r   r   Y  s   

z1AuthenticationExtensionsClientOutputs.__getitem__c                 C  s:   | d}|d ddd |dd  D  }| j|S )NrC   r   r1   c                 s  s    | ]}|  V  qd S r    )title)r   pr   r   r   	<genexpr>c  s    zDAuthenticationExtensionsClientOutputs.__getattr__.<locals>.<genexpr>r   )splitjoinr   r   )r   r%  partsr   r   r   r   __getattr__a  s   
$z1AuthenticationExtensionsClientOutputs.__getattr__c                 C  s   t t| S r    )rP   r  r"   r   r   r   r.   f  s   z.AuthenticationExtensionsClientOutputs.__repr__N)r  r   )
r8   r9   r:   rk   r   r#  r$  r   r,  r.   r   r   r   r   r  G  s    r  c                         e Zd ZU dZeddZded< ded< ded	< d
Zded< eedZ	ded< e
jZded<  fddZe fddZe fddZ  ZS )RegistrationResponsea1  
    Represents the RegistrationResponse structure from the WebAuthn specification,
    with fields modeled after the JSON serialization.

    Serializing this object to JSON can be done by using json.dumps(dict(response)).

    See: https://www.w3.org/TR/webauthn-3/#dictdef-registrationresponsejson
    Fr=   r-   r   r   raw_idr  responseNr   r   default_factoryr  client_extension_resultsr   r   c                   "   t | dt| j t   d S Nr   rI   rJ   r   r0  rG   r   r"   rL   r   r   r   ~     z"RegistrationResponse.__post_init__c                   &   |t ttf d B kr|S t ||S r    r
   r-   r	   rG   _parse_valuer5   tr/   rL   r   r   r;       z!RegistrationResponse._parse_valuec                   :   d|v rt |}|d}||d krtdt |S Nr   rawIdzid does not match rawIdr  popr   rG   _parse_from_dictr5   r   rA   rL   r   r   rD    s   
z%RegistrationResponse._parse_from_dictr8   r9   r:   rk   r   r   r<   r   r  r4  r   r   r   r   r;   r;  rD  re   r   r   rL   r   r.  j     
 	r.  c                      r-  )AuthenticationResponsea5  
    Represents the AuthenticationResponse structure from the WebAuthn specification,
    with fields modeled after the JSON serialization.

    Serializing this object to JSON can be done by using json.dumps(dict(response)).

    See: https://www.w3.org/TR/webauthn-3/#dictdef-authenticationresponsejson
    Fr/  r-   r   r   r0  r  r1  Nr   r   r2  r  r4  r   r   c                   r5  r6  r7  r"   rL   r   r   r     r8  z$AuthenticationResponse.__post_init__c                   r9  r    r:  r<  rL   r   r   r;    r>  z#AuthenticationResponse._parse_valuec                   r?  r@  rB  rE  rL   r   r   rD    s   
z'AuthenticationResponse._parse_from_dictrF  r   r   rL   r   rH    rG  rH  c                   @     e Zd ZU ded< dS )CredentialCreationOptionsr   rB   Nr   r   r   r   r   rJ       
 rJ  c                   @  rI  )CredentialRequestOptionsr  rB   Nr   r   r   r   r   rL    rK  rL  )r   r   r0   r   )<
__future__r   r   r[   dataclassesr   r   enumr   r   r   r   typingr	   r
   r   r   r1   r   coser   r   utilsr   r   r   r   r   r   r   r!   r?   rf   r   r   r-   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r.  rH  rJ  rL  r   r   r   r   <module>   s   


L
v9
<

#)(