o
    shצ                     @  s  d dl mZ ddlmZ ddlmZmZ ddlmZm	Z	m
Z
 ddlmZmZmZ ddlmZmZ ddlmZmZ dd	lmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$ dd
l%m&Z& ddl'm(Z( ddl)m*Z* d dl+m,Z,m-Z- d dl.m/Z/ d dl0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z= d dl>Z>d dl?Z?d dl@Z@d dlAZAeABeCZDG dd deEZFeFfddZGG dd deFZHdd ZIG dd dZJG dd dZKG dd  d e>jLZMd?d#d$ZNG d%d& d&ZOd'd( ZPG d)d* d*e>jLZQG d+d, d,eQZRG d-d. d.eKZSe=d@d2d3ZTe=dAd5d3ZTd6d3 ZTG d7d8 d8eQZUG d9d: d:eMeJZVe?W X d;krRzdd<lYmZZZm[Z[m\Z\m]Z]m^Z^ W n
 eEyQ   Y nw G d=d> d>eMeJZ_dS )B    )annotations   )STATUS)
CtapDevice	CtapError)Ctap1APDU	ApduError)Ctap2AssertionResponseInfo)	ClientPinPinProtocol)Ctap2Extension AuthenticationExtensionProcessor)AaguidAttestationObjectCollectedClientDataPublicKeyCredentialRpEntityPublicKeyCredentialDescriptor"PublicKeyCredentialCreationOptions!PublicKeyCredentialRequestOptions%AuthenticationExtensionsClientOutputsAuthenticatorSelectionCriteriaUserVerificationRequirement AuthenticatorAttestationResponseAuthenticatorAssertionResponseAttestationConveyancePreferenceResidentKeyRequirement_as_cbor)ES256)verify_rp_id)sha256)IntEnumunique)replace)urlparse)TimerEvent)TypeAnyCallableOptionalMappingSequenceTupleoverloadNc                   @  s6   e Zd ZdZeG dd deZd	ddZdd ZdS )
ClientErrorzBase error raised by clients.c                   @  s.   e Zd ZdZdZdZdZdZdZd
dd	Z	dS )zClientError.ERRzError codes for ClientError.r               Nc                 C  s
   t | |S N)r1   )selfcause r9   G/var/www/html/env_mimamsha/lib/python3.10/site-packages/fido2/client.py__call___   s   
zClientError.ERR.__call__r6   )
__name__
__module____qualname____doc__OTHER_ERRORBAD_REQUESTCONFIGURATION_UNSUPPORTEDDEVICE_INELIGIBLETIMEOUTr;   r9   r9   r9   r:   ERRU   s    rE   Nc                 C  s   t || _|| _d S r6   )r1   rE   coder8   r7   rF   r8   r9   r9   r:   __init__b   s   
zClientError.__init__c                 C  s(   d | j}| jr|d| j d7 }|S )NzClient error: {0} - {0.name}z	 (cause: ))formatrF   r8   )r7   rr9   r9   r:   __repr__f   s   zClientError.__repr__r6   )	r<   r=   r>   r?   r$   r#   rE   rH   rL   r9   r9   r9   r:   r1   R   s    
r1   c                 C  s   | j tjjtjjfv rtjj}na| j tjjtjjtjj	fv r#tjj
}nN| j tjjtjjtjjfv r6tjj}n;| j tjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjtjjfv rmtjj}ntjj}||| S r6   ) rF   r   rE   CREDENTIAL_EXCLUDEDNO_CREDENTIALSr1   rC   KEEPALIVE_CANCELACTION_TIMEOUTUSER_ACTION_TIMEOUTrD   UNSUPPORTED_ALGORITHMUNSUPPORTED_OPTIONKEY_STORE_FULLrB   INVALID_COMMANDCBOR_UNEXPECTED_TYPEINVALID_CBORMISSING_PARAMETERINVALID_OPTIONPUAT_REQUIREDPIN_INVALIDPIN_BLOCKEDPIN_NOT_SETPIN_POLICY_VIOLATIONPIN_TOKEN_EXPIREDPIN_AUTH_INVALIDPIN_AUTH_BLOCKEDREQUEST_TOO_LARGEOPERATION_DENIEDrA   r@   )eerr_clscer9   r9   r:   _ctap2client_errm   sD   




rg   c                      s*   e Zd ZdZejjdf fdd	Z  ZS )PinRequiredErrorz=Raised when a call cannot be completed without providing PIN.zPIN required but not providedc                   s   t  || d S r6   )superrH   rG   	__class__r9   r:   rH      s   zPinRequiredError.__init__)	r<   r=   r>   r?   r1   rE   rA   rH   __classcell__r9   r9   rj   r:   rh      s    rh   c              
   O  s   |pt  }| sRz||i |W S  ty> } z!|jtjkr.|r(|tj d }||  nt	j
|W Y d }~nd }~w tyM } zt|d }~ww | r	t	j
 r6   )r(   is_setr	   rF   r   USE_NOT_SATISFIEDr   UPNEEDEDwaitr1   rE   r@   r   rg   rD   )
poll_delayeventon_keepalivefuncargskwargsrd   r9   r9   r:   _call_polling   s&   


rw   c                   @  s&   e Zd ZdddZdd Zd	d
 ZdS )_BaseClientoriginstrverifyCallable[[str, str], bool]c                 C  s   || _ || _d S r6   )ry   _verify)r7   ry   r{   r9   r9   r:   rH      s   
z_BaseClient.__init__c                 C  s6   z|  || jrW d S W n	 ty   Y nw tj r6   )r}   ry   	Exceptionr1   rE   rA   )r7   rp_idr9   r9   r:   _verify_rp_id   s   
z_BaseClient._verify_rp_idc                 C  s   t j|| j|dS )N)typery   	challenge)r   createry   )r7   typr   r9   r9   r:   _build_client_data   s
   z_BaseClient._build_client_dataNry   rz   r{   r|   )r<   r=   r>   rH   r   r   r9   r9   r9   r:   rx      s    
rx   c                   @  s<   e Zd ZdZ	ddddZdd
dZdddZdddZdS )AssertionSelectionzGetAssertion result holding one or more assertions.

    Since multiple assertions may be retured by Fido2Client.get_assertion, this result
    is returned which can be used to select a specific response to get.
    Nclient_datar   
assertionsSequence[AssertionResponse]c                 C  s   || _ || _|| _d S r6   )_client_data_assertions_extension_results)r7   r   r   extension_resultsr9   r9   r:   rH      s   
zAssertionSelection.__init__returnc                 C     | j S )zIGet the raw AssertionResponses available to inspect before selecting one.)r   r7   r9   r9   r:   get_assertions      z!AssertionSelection.get_assertions	assertionr   Optional[Mapping[str, Any]]c                 C  r   r6   )r   )r7   r   r9   r9   r:   _get_extension_results   s   z)AssertionSelection._get_extension_resultsindexintr   c              	   C  sH   | j | }t| j|j|j|jr|jd nd|jr|jd nd| |S )zGet a single response.idN)r   r   r   	auth_data	signatureuser
credentialr   )r7   r   r   r9   r9   r:   get_response   s   
zAssertionSelection.get_responser6   )r   r   r   r   )r   r   )r   r   r   r   )r   r   r   r   )r<   r=   r>   r?   rH   r   r   r   r9   r9   r9   r:   r      s    



r   c                   @  s8   e Zd ZdZej	ddd	d
Zej	ddddZdS )WebAuthnClientzMBase class for a WebAuthn client, supporting registration and authentication.Noptionsr   rr   Optional[Event]r   r   c                 C     t  )Creates a credential.

        :param options: PublicKeyCredentialCreationOptions data.
        :param threading.Event event: (optional) Signal to abort the operation.
        NotImplementedErrorr7   r   rr   r9   r9   r:   make_credential      zWebAuthnClient.make_credentialr   r   c                 C  r   )Get an assertion.

        :param options: PublicKeyCredentialRequestOptions data.
        :param threading.Event event: (optional) Signal to abort the operation.
        r   r   r9   r9   r:   get_assertion   r   zWebAuthnClient.get_assertionr6   r   r   rr   r   r   r   r   r   rr   r   r   r   )r<   r=   r>   r?   abcabstractmethodr   r   r9   r9   r9   r:   r      s    r   r   Sequence[Type[Ctap2Extension]]c                   C  s   dd t  D S )Nc                 S  s   g | ]	}t |s|qS r9   )inspect
isabstract).0clsr9   r9   r:   
<listcomp>  s
    
z'_default_extensions.<locals>.<listcomp>)r   __subclasses__r9   r9   r9   r:   _default_extensions
  s   r   c                   @  s.   e Zd ZdZdddZdd
dZdddZdS )UserInteractionzProvides user interaction to the Client.

    Users of Fido2Client should subclass this to implement asking the user to perform
    specific actions, such as entering a PIN or touching theirr   Nonec                 C     t d dS )z@Called when the authenticator is awaiting a user presence check.zUser Presence check required.Nloggerinfor   r9   r9   r:   	prompt_up  s   zUserInteraction.prompt_uppermissionsClientPin.PERMISSIONr   Optional[str]c                 C  r   )zkCalled when the client requires a PIN from the user.

        Should return a PIN, or None/Empty to cancel.z7PIN requested, but UserInteraction does not support it.Nr   r7   r   r   r9   r9   r:   request_pin     
zUserInteraction.request_pinboolc                 C  r   )zxCalled when the client is about to request UV from the user.

        Should return True if allowed, or False to cancel.zUser Verification requested.Tr   r   r9   r9   r:   
request_uv#  r   zUserInteraction.request_uvN)r   r   )r   r   r   r   r   r   )r   r   r   r   r   r   )r<   r=   r>   r?   r   r   r   r9   r9   r9   r:   r     s
    

	r   c                   s    fdd}|S )Nc                   s   | t jkr   d S d S r6   )r   ro   r   )statususer_interactionr9   r:   rs   .  s   
z%_user_keepalive.<locals>.on_keepaliver9   )r   rs   r9   r   r:   _user_keepalive-  s   r   c                   @  sF   e Zd ZU ded< ejdddZejdddZejdddZdS )_ClientBackendr   r   rr   r   r   r   c                 C  r   r6   r   r7   rr   r9   r9   r:   	selection8  r   z_ClientBackend.selectionr   r   r   r   rpr   r   rz   enterprise_rpid_listOptional[Sequence[str]]r(   r   c                 C  r   r6   r   )r7   r   r   r   r   r   rr   r9   r9   r:   do_make_credential<  s   
z!_ClientBackend.do_make_credentialr   r   c                 C  r   r6   r   )r7   r   r   r   rr   r9   r9   r:   do_get_assertionH  s   z_ClientBackend.do_get_assertionNrr   r   r   r   )r   r   r   r   r   r   r   rz   r   r   rr   r(   r   r   )
r   r   r   r   r   rz   rr   r(   r   r   )	r<   r=   r>   __annotations__r   r   r   r   r   r9   r9   r9   r:   r   5  s   
 r   c                   @  s.   e Zd ZdddZdd Zd	d
 Zdd ZdS )_Ctap1ClientBackenddevicer   r   r   c                 C  s2   t || _tdgg tjd| _d| _t|| _d S )NU2F_V2versions
extensionsaaguidg      ?)	r   ctap1r   r   NONEr   _poll_delayr   _on_keepalive)r7   r   r   r9   r9   r:   rH   T  s   
z_Ctap1ClientBackend.__init__c                 C  s   t | j|d | jjdd d S )N                                    )rw   r   r   registerr   r9   r9   r:   r   Z  s   z_Ctap1ClientBackend.selectionc                 C  s6  |j }|j}|jpt }	|	j}
|	j}|
s)|tjks)tj	dd |D vs)|j
tjkr/ttjjt| }d}|p:g D ]=}|j}z| j|||d tj  tyx } z|jtjkrnt| j|| j| jj|| tj W Y d }~q;d }~ww t !|t| j|| j| jj|j"|}t#|t $|j%|j&|j't(i S )Nc                 S  s   g | ]}|j qS r9   )alg)r   pr9   r9   r:   r   v  s    z:_Ctap1ClientBackend.do_make_credential.<locals>.<listcomp>r   T))pub_key_cred_paramsexclude_credentialsauthenticator_selectionr   require_resident_keyuser_verificationr   REQUIREDr    	ALGORITHMattestationr   
ENTERPRISEr   rE   rS   r"   encoder   r   authenticater1   r@   r	   rF   r   rn   rw   r   r   r   rC   r   
from_ctap1hashr   r   fmtr   att_stmtr   )r7   r   r   r   r   r   rr   
key_paramsexclude_listr   rkr   	app_paramdummy_paramcred
key_handlerd   att_objr9   r9   r:   r   d  s`   	


z&_Ctap1ClientBackend.do_make_credentialc                 C  s   |j }|j}|tjks|sttjjt| }|j	}|D ];}	zt
| j|| j| jj|||	j}
t||	|
g}t||W   S  tyY } z|jtjjkrO W Y d }~qd }~ww tj r6   )allow_credentialsr   r   r   r   rE   rS   r"   r   r   rw   r   r   r   r   r   r   r   r   r1   rF   rD   rC   )r7   r   r   r   rr   
allow_listr   r   client_paramr   	auth_respr   rd   r9   r9   r:   r     s4   	
z$_Ctap1ClientBackend.do_get_assertionN)r   r   r   r   )r<   r=   r>   rH   r   r   r   r9   r9   r9   r:   r   S  s
    

<r   c                      s&   e Zd Zd fd	d
Zdd Z  ZS )_Ctap2ClientAssertionSelectionr   r   r   r   r   *Sequence[AuthenticationExtensionProcessor]	pin_tokenOptional[bytes]c                   s   t  || || _|| _d S r6   )ri   rH   _extensions
_pin_token)r7   r   r   r   r   rj   r9   r:   rH     s   
z'_Ctap2ClientAssertionSelection.__init__c              
   C  s\   i }z| j D ]}||| j}|r|| qW t|S  ty- } ztj|d }~ww r6   )	r  prepare_outputsr  update
ValueErrorr1   rE   rB   r   )r7   r   extension_outputsextoutputrd   r9   r9   r:   r     s   

z5_Ctap2ClientAssertionSelection._get_extension_results)r   r   r   r   r   r   r   r  )r<   r=   r>   rH   r   rl   r9   r9   rj   r:   r     s    r   valuesr.   listc                 C     d S r6   r9   r
  r9   r9   r:   
_cbor_list     r  r   c                 C  r  r6   r9   r  r9   r9   r:   r    r  c                 C  s   | sd S dd | D S )Nc                 S  s   g | ]}t |qS r9   )r   )r   vr9   r9   r:   r     s    z_cbor_list.<locals>.<listcomp>r9   r  r9   r9   r:   r    s   c                   @  sX   e Zd Zdd	d
ZdddZdd Zdd Zdd Zdd Zdd Z	dd Z
dd ZdS )_Ctap2ClientBackendr   r   r   r   extension_typesr   r   Sequence[Ctap2Extension]c                 C  s*   t || _| jj| _|| _|| _|| _d S r6   )r
   ctap2r   _extension_typesr  r   )r7   r   r   r  r   r9   r9   r:   rH     s
   


z_Ctap2ClientBackend.__init__r   c                   s     j r j S  fdd jD S )Nc                   s   g | ]}| j qS r9   )r  )r   r  r   r9   r:   r     s    z7_Ctap2ClientBackend._get_extensions.<locals>.<listcomp>)r  r  r   r9   r   r:   _get_extensions  s   z#_Ctap2ClientBackend._get_extensionsc                   s
  | j jrfdd D  | j jpd fddtdt D }d}|r3|||}	|j}
nd }	d }
|D ]I}z-| jj||t	|d ddi|	|
||d		}t|dkr\|d W   S t
d
i |d jW   S  ty } z|jtjjkr}W Y d }~q9 d }~ww d S )Nc                   s   g | ]}t |j kr|qS r9   )lenr   )r   c)max_lenr9   r:   r     s    z5_Ctap2ClientBackend._filter_creds.<locals>.<listcomp>r   c                   s   g | ]
} ||  qS r9   r9   )r   i)	cred_list	max_credsr9   r:   r     s    r   r   upFrr   rs   r9   )r   max_cred_id_lengthmax_creds_in_listranger  r   VERSIONr  r   r  r   r   r   rF   rE   rN   )r7   r   r  pin_protocolr   rr   rs   chunksclient_data_hashpin_authversionchunkr   rd   r9   )r  r  r  r:   _filter_creds  sH   z!_Ctap2ClientBackend._filter_credsc              
   C  s   d| j jv r| jj|d d S z| jjddddddddd	d
gd|d W d S  tyJ } z|jtjjtjj	tjj
fv rEW Y d }~d S  d }~ww )NFIDO_2_1)rr   r   zexample.com)r   names   dummydummyz
public-keyi)r   r       )pin_uv_paramrr   )r   r   r  r   r   r   rF   rE   r]   r[   r`   r7   rr   rd   r9   r9   r:   r   ,  s*   
z_Ctap2ClientBackend.selectionc                   s   t  fdddD }t  fdddD }tjj|@ dk}|tjjtjjB  @ }|tjks<|tjkr5|s< jj	
drF|sDtjddS |rS|rS jj	
d	sSdS |rY|rYdS d
S )Nc                 3  s    | ]	}| j jv V  qd S r6   )r   r   r   kr   r9   r:   	<genexpr>D  s    
z5_Ctap2ClientBackend._should_use_uv.<locals>.<genexpr>)uv	clientPin	bioEnrollc                 3  s    | ]
} j j|V  qd S r6   )r   r   getr0  r   r9   r:   r2  G  s    
r   alwaysUvz*User verification not configured/supportedTmakeCredUvNotRqdF)anyr   
PERMISSIONMAKE_CREDENTIALGET_ASSERTIONr   r   	PREFERREDr   r   r6  r1   rE   rB   )r7   r   r   uv_supporteduv_configuredmcadditional_permsr9   r   r:   _should_use_uvC  s4   

z"_Ctap2ClientBackend._should_use_uvc                 C  s   | j jdr(t| j r| j||r|||||S n|r(| j||r(d S | j jdrB| j||}|r?|	|||S t
 tjd)Nr3  r4  z User verification not configured)r   r   r6  r   is_token_supportedr   r   get_uv_tokenr   get_pin_tokenrh   r1   rE   rB   )r7   
client_pinr   r   rr   rs   allow_internal_uvpinr9   r9   r:   
_get_tokenb  s$   z_Ctap2ClientBackend._get_tokenc                 C  sj   | j  | _d }d}| ||r1t| j |}	|tjjtjjB  @ dk}
| |	|||||
}|s1d}||fS )NFr   T)	r  get_infor   rB  r   r:  r;  r<  rI  )r7   r#  r   r   r   rr   rs   r   internal_uvrF  rG  r9   r9   r:   _get_auth_params|  s(   z$_Ctap2ClientBackend._get_auth_paramsc                   s   |j |j|j|jpt 

jtjd |jt	j
kr3jjdr3|d ur1	|v r0dndtjD ]}|jjjv rD|  nq6d tjjrStjjO g  D ]}|j|}	|	ro|	 |	jO qY 	
fdd}
jj}d}	 z|
 \}}W nB ty } z6|jtjjkrtj krtj!W Y d }~qt"|dd }|jtjj#kr|r|s|$  |  d}W Y d }~q d }~ww i }zD ]}	|	%||}|d ur|&| qW n t'y } zt(j)|d }~ww t* t+,|j-|j.|j/t0|S )	Nepr2   r   c               
     sf   	\} }r	| }nd }i }zD ]}|| }|r.|| q W n tyB } ztj|d }~ww jj	
d}
jtjkpW
jtjkoW|}|s_|s_d }	ni }	|ro|sktjdd|	d< |rud|	d<  j}
r| r| |
jf}nd}jj|
tt	dtt|rt|gnd |pd |	g|R d| fS )Nr   zResident key not supportedTr3  NN)r   r  )rL  r)  prepare_inputsr  r  r1   rE   rB   r   r   r6  resident_keyr   r   r=  r   r   r"  r  r   r   r%   r  )r   rK  exclude_credextension_inputsr  
auth_inputrd   can_rkr   r   r%  r&  r   enterprise_attestationrr   r   r   rs   r   r#  r   r   r   r7   used_extensionsr   r   r9   r:   _do_make  sv   


	
z8_Ctap2ClientBackend.do_make_credential.<locals>._do_makeFTconnect)1r   r   r   r   r   r   r   r   r   r   r   r   r   r6  r   	PROTOCOLSr"  pin_uv_protocolsr:  r;  r<  r  r   r  appendr   r   r   rF   rE   rZ   r   DISCOURAGEDr   getattrra   closer  r  r  r1   rB   r   r   r   r   r   r   r   )r7   r   r   r   r   r   rr   protord   r  rX  devreconnectedr   r   rY  r  r	  r9   rU  r:   r     s   	



(H


z&_Ctap2ClientBackend.do_make_credentialc              
     s@  |j |j |j	tjtjD ]}|jjj	v r|  nqd tj
jg  D ]}|j|}|rB| |jO q, 	f
dd}jj}	d}
	 z| W S  ty } z6|jtjjkrz	tjkrztj	W Y d }~qXt|	dd }|jtjjkr|r|
s|	  |  d}
W Y d }~qX d }~ww )Nc               
     s   	\} } r | }nd }i }zD ]}||| }|r/|| q W n tyC } ztj|d }~ww |rJddind }j}r]| r]	| |j
f}	nd}	 rk|skt d jd}jj||rwt|gnd |p{d |g|	R d}
t|
| S )Nr3  TrN  r       r  )rL  r)  rO  r  r  r1   rE   rB   r   r   r"  r   r   r  r   r   r   )r   rK  selected_credrR  r  inputsrd   r   r%  r&  r   
r   r   rr   rs   r   r#  r   r7   rW  r   r9   r:   _do_authZ  sX   

z6_Ctap2ClientBackend.do_get_assertion.<locals>._do_authFTrY  )r   r   r   r   r   r   rZ  r"  r   r[  r:  r<  r  r   r  r\  r   r   r   rF   rE   rZ   r   r]  r   r^  ra   r_  )r7   r   r   r   rr   r`  rd   r  rg  ra  rb  rY  r9   rf  r:   r   :  sT   



;
z$_Ctap2ClientBackend.do_get_assertionN)r   r   r   r   r  r   r   r  )r   r  )r<   r=   r>   rH   r  r)  r   rB  rI  rL  r   r   r9   r9   r9   r:   r    s    

0 'r  c                      sp   e Zd ZdZee e g fd' fddZed(ddZ	d)d*ddZ
d+ddZ	d)d,d!d"Z	d)d-d%d&Z  ZS ).Fido2Clienta>  WebAuthn-like client implementation.

    The client allows registration and authentication of WebAuthn credentials against
    an Authenticator using CTAP (1 or 2).

    :param device: CtapDevice to use.
    :param str origin: The origin to use.
    :param verify: Function to verify an RP ID for a given origin.
    r   r   ry   rz   r{   r|   r  r   r   r   r   r  c              	     sP   t  || d | _zt||||| _W d S  ttfy'   t||| _Y d S w r6   )ri   rH   _enterprise_rpid_listr  _backendr  r   r   )r7   r   ry   r{   r  r   r   rj   r9   r:   rH     s   
zFido2Client.__init__r   r   c                 C  s   | j jS r6   )rj  r   r   r9   r9   r:   r     s   zFido2Client.infoNrr   r   r   c              
   C  s4   z	| j | W d S  ty } zt|d }~ww r6   )rj  r   r   rg   r/  r9   r9   r:   r     s   zFido2Client.selectionr   r   c                 C  s8   |d u rt | j}|jdks|jstjd|jS |S )Nhttpsz$RP ID required for non-https origin.)r&   ry   schemenetlocr1   rE   rA   )r7   r   urlr9   r9   r:   
_get_rp_id  s   
zFido2Client._get_rp_idr   r   r   c              
   C  s   t |}|p	t }|jrt|jd |j}d|_|  |j}| 	|j
}td|  | | | tjj|j}z'z| j||||| j|W W |jrS|  S S  tyc } zt|d}~ww |jrl|  w w )r     T%Register a new credential for RP ID: N)r   	from_dictr(   timeoutr'   setdaemonstartr   ro  r   r   debugr   r   r   TYPECREATEr   rj  r   ri  cancelr   rg   )r7   r   rr   timerr   r   r   rd   r9   r9   r:   r     s@   





zFido2Client.make_credentialr   r   c              
   C  s   t |}|p	t }|jrt|jd |j}d|_|  | |j	}t
d|  | | | tjj|j}z$z| j||||W W |jrM|  S S  ty] } zt|d}~ww |jrf|  w w )r   rp  TAssert a credential for RP ID: N)r   rr  r(   rs  r'   rt  ru  rv  ro  r   r   rw  r   r   r   rx  GETr   rj  r   rz  r   rg   )r7   r   rr   r{  r   r   rd   r9   r9   r:   r     s:   



	

zFido2Client.get_assertion)r   r   ry   rz   r{   r|   r  r   r   r   r   r  )r   r   r6   r   )r   r   r   rz   r   r   )r<   r=   r>   r?   r!   r   r   rH   propertyr   r   ro  r   r   rl   r9   r9   rj   r:   rh    s    
.rh  windows)WinAPIWebAuthNAuthenticatorAttachment#WebAuthNUserVerificationRequirement'WebAuthNAttestationConveyancePreferenceWebAuthNEnterpriseAttestationc                      sL   e Zd ZdZeddfd fdd	ZedddZdddZdddZ	  Z
S )WindowsClientan  Fido2Client-like class using the Windows WebAuthn API.

    Note: This class only works on Windows 10 19H1 or later. This is also when Windows
    started restricting access to FIDO devices, causing the standard client classes to
    require admin priveleges to run (unlike this one).

    The make_credential and get_assertion methods are intended to work as a drop-in
    replacement for the Fido2Client methods of the same name.

    :param str origin: The origin to use.
    :param verify: Function to verify an RP ID for a given origin.
    :param ctypes.wintypes.HWND handle: (optional) Window reference to use.
    NFry   rz   r{   r|   c                   s>   t  || t|d|d| _tddgg tjd| _d | _d S )NT)return_extensionsallow_hmac_secretr   FIDO_2_0r   )	ri   rH   r  apir   r   r   r   ri  )r7   ry   r{   handler  rj   r9   r:   rH   U  s   
zWindowsClient.__init__r   r   c                   C  s   t   dkotjdkS )Nr  r   )platformsystemlowerr  r'  r9   r9   r9   r:   is_availableg  s   zWindowsClient.is_availablec           
      C  s>  t |}td|jj  | |jj | tj	j
|j}|jp$t }tj}|jtjkrLtj}| jjdrK| jdurH|jj| jv rGtj}ntj}nt|jpRd}z+| j|j|j|j||j pcd|j!t"|j#pkdt$|j%prd||j&|j'||\}}W n t(y }	 zt)j*+|	d}	~	ww td t,||t-|S )	zCreate a credential using Windows WebAuthN APIs.

        :param options: PublicKeyCredentialCreationOptions data.
        :param threading.Event event: (optional) Signal to abort the operation.
        rq  rM  Nnoner   r9  discouragedzNew credential registered).r   rr  r   rw  r   r   r   r   r   rx  ry  r   r   r   r  r   r   r   r   r  ANYr   r   r6  ri  PLATFORM_MANAGEDVENDOR_FACILITATEDfrom_stringr  r   r   r   rs  rP  r  authenticator_attachmentr  r   r   r   OSErrorr1   rE   r@   r   r   )
r7   r   rr   r   r   rV  r   r   r   rd   r9   r9   r:   r   k  sd   




zWindowsClient.make_credentialc              
   C  s   t |}td|j  | |j | tjj	|j
}z!| j|j||jp(dtjt|jp0d|j|j|\}}}}}W n tyP }	 ztj|	d}	~	ww |rWd|ind}
t|t||||
dgt|S )zGet assertion using Windows WebAuthN APIs.

        :param options: PublicKeyCredentialRequestOptions data.
        :param threading.Event event: (optional) Signal to abort the operation.
        r|  r   r  Nr   )r   r   r   r   )r   rr  r   rw  r   r   r   r   rx  r}  r   r  r   rs  r  r  r  r  r   r   r   r  r1   rE   r@   r   r   r   )r7   r   rr   r   r   r   r   user_idr   rd   r   r9   r9   r:   r     sH   

zWindowsClient.get_assertionr   )r   r   r6   )r<   r=   r>   r?   r!   rH   staticmethodr  r   r   rl   r9   r9   rj   r:   r  F  s    
Br  )r   r   )r
  r.   r   r  )r
  r   r   r   )`
__future__r   hidr   ctapr   r   r   r   r   r	   r  r
   r   r   	ctap2.pinr   r   ctap2.extensionsr   r   webauthnr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   coser    rpidr!   utilsr"   enumr#   r$   dataclassesr%   urllib.parser&   	threadingr'   r(   typingr)   r*   r+   r,   r-   r.   r/   r0   r   r  r   logging	getLoggerr<   r   r~   r1   rg   rh   rw   rx   r   ABCr   r   r   r   r   r   r   r  r  rh  r  r  win_apir  r  r  r  r  r  r9   r9   r9   r:   <module>   sh   D(
'	(
o   J 
 