o
    sh~                     @  sD  d dl mZ ddlmZmZmZ ddlmZmZ ddl	m
Z
 ddlmZmZmZ ddlmZmZmZmZmZ d d	lmZmZ d d
lmZ d dlmZmZmZmZmZ d dl Z d dl!Z!G dd de j"Z#G dd de#Z$G dd de#Z%G dd de j"Z&edddG dd deZ'edddG dd deZ(dd Z)edddG dd deZ*edddG d d! d!eZ+edddG d"d# d#eZ,G d$d% d%e&Z-edddG d&d' d'eZ.edddG d(d) d)eZ/G d*d+ d+e&Z0G d,d- d-e&Z1G d.d/ d/e&Z2G d0d1 d1e&Z3edddG d2d3 d3eZ4G d4d5 d5e&Z5dS )6    )annotations   )AttestationResponseAssertionResponseCtap2)	ClientPinPinProtocol)
LargeBlobs   )sha256websafe_encode_JsonDataObject)PublicKeyCredentialDescriptor"PublicKeyCredentialCreationOptions!PublicKeyCredentialRequestOptionsAuthenticatorSelectionCriteriaResidentKeyRequirement)Enumunique)	dataclass)DictTupleAnyOptionalMappingNc                   @  s(   e Zd ZdZedddfdd	d
ZdS )ExtensionProcessorzBase class for CTAP2 extension processing.

    See: :class:`RegistrationExtensionProcessor` and
    :class:`AuthenticationExtensionProcessor`.
    r   NpermissionsClientPin.PERMISSIONinputsOptional[Dict[str, Any]]outputsc                 C  s   || _ || _|| _d S N)r   _inputs_outputs)selfr   r   r     r%   Q/var/www/html/env_mimamsha/lib/python3.10/site-packages/fido2/ctap2/extensions.py__init__7   s   
zExtensionProcessor.__init__)r   r   r   r   r    r   )__name__
__module____qualname____doc__r   
PERMISSIONr'   r%   r%   r%   r&   r   0   s    r   c                   @  s$   e Zd ZdZdddZdd
dZdS )RegistrationExtensionProcessora  Processing state for a CTAP2 extension, for single use.

    The ExtensionProcessor holds state and logic for client processing of an extension,
    for a registration (MakeCredential) call.

    :param permissions: PinUvAuthToken permissions required by the extension.
    :param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
    :param outputs: Default client outputs, if prepare_outputs is not overridden.
    	pin_tokenOptional[bytes]returnr   c                 C     | j S zLPrepare authenticator extension inputs, to be passed to the Authenenticator.r"   r$   r.   r%   r%   r&   prepare_inputsM   s   z-RegistrationExtensionProcessor.prepare_inputsresponser   c                 C  r1   z?Prepare client extension outputs, to be returned to the caller.r#   r$   r6   r.   r%   r%   r&   prepare_outputsQ      z.RegistrationExtensionProcessor.prepare_outputsN)r.   r/   r0   r   )r6   r   r.   r/   r0   r   r(   r)   r*   r+   r5   r:   r%   r%   r%   r&   r-   B   s    

r-   c                   @  s$   e Zd ZdZddd	ZdddZdS ) AuthenticationExtensionProcessora  Processing state for a CTAP2 extension, for single use.

    The ExtensionProcessor holds state and logic for client processing of an extension,
    for an authentication (GetAssertion) call.

    :param permissions: PinUvAuthToken permissions required by the extension.
    :param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
    :param outputs: Default client outputs, if prepare_outputs is not overridden.
    selected'Optional[PublicKeyCredentialDescriptor]r.   r/   r0   r   c                 C  r1   r2   r3   )r$   r>   r.   r%   r%   r&   r5   e   r;   z/AuthenticationExtensionProcessor.prepare_inputsr6   r   c                 C  r1   r7   r8   r9   r%   r%   r&   r:   m   r;   z0AuthenticationExtensionProcessor.prepare_outputsN)r>   r?   r.   r/   r0   r   )r6   r   r.   r/   r0   r   r<   r%   r%   r%   r&   r=   Z   s    

r=   c                   @  s   e Zd ZU dZdZded< d7d8ddZed9ddZd7d:ddZ	d;ddZ
d<ddZd=ddZd>d!d"Zd?d$d%Zd@d+d,Zd=d-d.Zd>d/d0Zd?d1d2ZdAd5d6ZdS )BCtap2ExtensionaQ  Base class for CTAP2 extensions.

    As of python-fido2 1.2 these instances can be used for multiple requests and
    should be invoked via the make_credential and get_assertion methods.
    Subclasses are instantiated for a single request, if the Authenticator supports
    the extension.

    From python-fido2 2.0 the following methods will be fully removed:
        get_create_permissions, process_create_input, process_create_output,
        process_create_input_with_permissions,
        get_get_permissions, process_get_input, process_get_output,
        process_get_input_with_permissions.

    The following changes will also be made:
        :func:`__init__` will no longer allow passing a ctap2 instance.
        :func:`is_supported` will require a ctap2 instance to be passed.
        :attr:`NAME` and :attr:`ctap` will be removed.
    NstrNAMEctapOptional[Ctap2]c                 C  s   |rt dt || _d S )Nz5Calling __init__ with a Ctap2 instance is deprecated.)warningswarnDeprecationWarning_ctapr$   rC   r%   r%   r&   r'      s   
zCtap2Extension.__init__r0   r   c                 C  s   | j }|s	td|S )NzDAccessed self.ctap when no ctap instance has been passed to __init__)rH   
ValueErrorrI   r%   r%   r&   rC      s   zCtap2Extension.ctapboolc                 C  s4   |st dt |p| j}|std| j|jjv S )z?Whether or not the extension is supported by the authenticator.z<Calling is_supported without a Ctap2 instance is deprecated.No Ctap2 instance available)rE   rF   rG   rH   rJ   rB   info
extensionsrI   r%   r%   r&   is_supported   s   
zCtap2Extension.is_supportedoptionsr   pin_protocolOptional[PinProtocol](Optional[RegistrationExtensionProcessor]c                   J   t dt t|jpi || _|  G  fdddt}|| S )z3Start client extension processing for registration.zFThis extension does not override make_credential, which is deprecated.c                      s(   e Zd Z fddZ fddZdS )z1Ctap2Extension.make_credential.<locals>.Processorc                   s(     }|d u| _| jr j|iS d S r!   )process_create_input
_has_inputrB   )r$   r.   	processedextr   r%   r&   r5         

z@Ctap2Extension.make_credential.<locals>.Processor.prepare_inputsc                   s   | j r ||}|S d S r!   )rV   process_create_output)r$   r6   r.   rW   rY   rQ   r%   r&   r:      s   zACtap2Extension.make_credential.<locals>.Processor.prepare_outputsNr(   r)   r*   r5   r:   r%   rY   r   rQ   r%   r&   	Processor   s    r_   )rE   rF   rG   dictrN   rH   r-   get_create_permissionsr$   rC   rP   rQ   r_   r%   r^   r&   make_credential   s   
zCtap2Extension.make_credentialr   *Optional[AuthenticationExtensionProcessor]c                   rT   )z5Start client extension processing for authentication.zDThis extension does not override get_assertion, which is deprecated.c                      s2   e Zd ZU ded<  fddZ fddZdS )z/Ctap2Extension.get_assertion.<locals>.ProcessorrK   rV   c                   s(     }|d u| _| jr j|iS d S r!   )process_get_inputrV   rB   )r$   r>   r.   rW   rX   r%   r&   r5      rZ   z>Ctap2Extension.get_assertion.<locals>.Processor.prepare_inputsc                   s   | j r
 ||S d S r!   )rV   process_get_outputr9   r\   r%   r&   r:      s   z?Ctap2Extension.get_assertion.<locals>.Processor.prepare_outputsN)r(   r)   r*   __annotations__r5   r:   r%   r^   r%   r&   r_      s   
 r_   )rE   rF   rG   r`   rN   rH   r=   get_get_permissionsrb   r%   r^   r&   get_assertion   s   
zCtap2Extension.get_assertionr   Dict[str, Any]r   c                 C  
   t dS )zGet PinUvAuthToken permissions required for Registration.

        .. deprecated:: 1.2.0
           Implement :func:`make_credential` instead.
        r   r   r,   r$   r   r%   r%   r&   ra      s   
z%Ctap2Extension.get_create_permissionsr   c                 C     dS )zReturns a value to include in the authenticator extension input,
        or None.

        .. deprecated:: 1.2.0
           Implement :func:`make_credential` instead.
        Nr%   rm   r%   r%   r&   rU         z#Ctap2Extension.process_create_input Tuple[Any, ClientPin.PERMISSION]c                 C      t dt | || |fS )z^

        .. deprecated:: 1.2.0
           Implement :func:`make_credential` instead.
        z1This method is deprecated, use make_credential().)rE   rF   rG   rU   ra   rm   r%   r%   r&   %process_create_input_with_permissions   s   z4Ctap2Extension.process_create_input_with_permissionsattestation_responser   tokenr/   r   c                 C  rn   )zReturn client extension output given attestation_response, or None.

        .. deprecated:: 1.2.0
           Implement :func:`make_credential` instead.
        Nr%   )r$   rs   rt   rQ   r%   r%   r&   r[        z$Ctap2Extension.process_create_outputc                 C  rk   )[
        .. deprecated:: 1.2.0
           Implement :func:`get_assertion` instead.
        r   rl   rm   r%   r%   r&   rh     s   
z"Ctap2Extension.get_get_permissionsc                 C  rn   )zReturns a value to include in the authenticator extension input,
        or None.

        .. deprecated:: 1.2.0
           Implement :func:`get_assertion` instead.
        Nr%   rm   r%   r%   r&   re      ro   z Ctap2Extension.process_get_inputc                 C  rq   )rv   z/This method is deprecated, use get_assertion().)rE   rF   rG   re   rh   rm   r%   r%   r&   "process_get_input_with_permissions)  s   z1Ctap2Extension.process_get_input_with_permissionsassertion_responser   c                 C  rn   )zReturn client extension output given assertion_response, or None.

        .. deprecated:: 1.2.0
           Implement :func:`get_assertion` instead.
        Nr%   )r$   rx   rt   rQ   r%   r%   r&   rf   5  ru   z!Ctap2Extension.process_get_outputr!   )rC   rD   )r0   r   )rC   rD   r0   rK   )rC   r   rP   r   rQ   rR   r0   rS   )rC   r   rP   r   rQ   rR   r0   rd   )r   rj   r0   r   )r   rj   r0   r   )r   rj   r0   rp   )rs   r   rt   r/   rQ   rR   r0   r   )rx   r   rt   r/   rQ   rR   r0   r   )r(   r)   r*   r+   rB   rg   r'   propertyrC   rO   rc   ri   ra   rU   rr   r[   rh   re   rw   rf   r%   r%   r%   r&   r@   w   s"   
 	

!
!

	



	r@   FT)eqfrozenc                   @  &   e Zd ZU dZded< dZded< dS )HMACGetSecretInputzClient inputs for hmac-secret.bytessalt1Nr/   salt2)r(   r)   r*   r+   rg   r   r%   r%   r%   r&   r}   C     
 r}   c                   @  r|   )HMACGetSecretOutputzClient outputs for hmac-secret.r~   output1Nr/   output2)r(   r)   r*   r+   rg   r   r%   r%   r%   r&   r   K  r   r   c                 C  s   t d|  S )Ns   WebAuthn PRF )r   )secretr%   r%   r&   	_prf_saltS  s   r   c                   @  r|   ) AuthenticatorExtensionsPRFValueszSalt values for use with prf.r~   firstNr/   second)r(   r)   r*   r+   rg   r   r%   r%   r%   r&   r   W  r   r   c                   @  *   e Zd ZU dZdZded< dZded< dS ) AuthenticatorExtensionsPRFInputszClient inputs for prf.N*Optional[AuthenticatorExtensionsPRFValues]evalz8Optional[Mapping[str, AuthenticatorExtensionsPRFValues]]eval_by_credential)r(   r)   r*   r+   r   rg   r   r%   r%   r%   r&   r   _     
 r   c                   @  r   )!AuthenticatorExtensionsPRFOutputszClient outputs for prf.NOptional[bool]enabledr   results)r(   r)   r*   r+   r   rg   r   r%   r%   r%   r&   r   g  r   r   c                      sZ   e Zd ZdZdZdZd fdd	Zdd	 Zd
d Zdd Z	dd Z
dd Zdd Z  ZS )HmacSecretExtensiona  
    Implements the Pseudo-random function (prf) and the hmac-secret CTAP2 extensions.

    The hmac-secret extension is not directly available to clients by default, instead
    the prf extension is used.

    https://www.w3.org/TR/webauthn-3/#prf-extension

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-hmac-secret-extension

    :param allow_hmac_secret: Set to True to allow hmac-secret, in addition to prf.
    zhmac-secret    NFc                   s,   t  | |rtdt || _|| _d S )Nz_Initializing HmacSecretExtension with pin_protocol is deprecated, pin_protocol will be ignored.)superr'   rE   rF   rG   rQ   _allow_hmac_secret)r$   rC   rQ   allow_hmac_secret	__class__r%   r&   r'     s   
zHmacSecretExtension.__init__c                   s`   |j pi }|dd u | jo|ddu }| |r, s|r.G  fdddt}| S d S d S )NprfhmacCreateSecretTc                      s    e Zd Zdd Z fddZdS )z6HmacSecretExtension.make_credential.<locals>.Processorc                 S  
   t jdiS NT)r   rB   r4   r%   r%   r&   r5        
zEHmacSecretExtension.make_credential.<locals>.Processor.prepare_inputsc                   s4   |j jpi }|tjd} rdt|diS d|iS )NFr   )r   r   )	auth_datarN   getr   rB   r   )r$   r6   r.   rN   r   r   r%   r&   r:     s   
zFHmacSecretExtension.make_credential.<locals>.Processor.prepare_outputsNr]   r%   r   r%   r&   r_     s    r_   )rN   r   r   rO   r-   )r$   rC   rP   rQ   r   hmacr_   r%   r   r&   rc     s   
z#HmacSecretExtension.make_credentialc                   s   j pi }t|d| jrt|dnd rC| |rEs%rGt|   \G  fdddt	}| S d S d S d S )Nr   hmacGetSecretc                      s2   e Zd ZfddZ fddZdS )z5HmacSecretExtension.get_assertion.<locals>.Processingc                   s  rHj }j}|r2j}|stddd |D }||s#td|r2t|j}||v r2|| }|s6d S t|j|j	d urDt|j	ndf}n d usNJ  j
 jpTdf}t|d tjkrl|d rpt|d tjksptd|d |d  }	|	}
tj|	|
jd	iS )
Nz+evalByCredentials requires allowCredentialsc                 S  s   h | ]}t |jqS r%   )r   id).0cr%   r%   r&   	<setcomp>  s    zWHmacSecretExtension.get_assertion.<locals>.Processing.prepare_inputs.<locals>.<setcomp>z&evalByCredentials contains invalid key    r   r   Invalid salt lengthr   r
         )r   r   allow_credentialsrJ   
issupersetr   r   r   r   r   r   r   lenr   SALT_LENencryptauthenticaterB   VERSION)r$   r>   r.   secretsby_creds
allow_listidskeysaltssalt_enc	salt_auth)r   key_agreementrP   rQ   r   shared_secretr%   r&   r5     sR   



	zDHmacSecretExtension.get_assertion.<locals>.Processing.prepare_inputsc                   sv   |j jpi }|tj}|r& j|}|d tj }|tjd  p$d }nd S r4dtt	||diS dt
||iS )Nr   )r   r   )r   rN   r   r   rB   protocoldecryptr   r   r   r   )r$   r6   r.   rN   value	decryptedr   r   )
client_pinr   r   r%   r&   r:     s   zEHmacSecretExtension.get_assertion.<locals>.Processing.prepare_outputsNr]   r%   r   r   r   rP   rQ   r   r   r%   r&   
Processing  s    9r   )
rN   r   	from_dictr   r   r}   rO   r   _get_shared_secretr=   )r$   rC   rP   rQ   r   r   r%   r   r&   ri     s   

 Pz!HmacSecretExtension.get_assertionc                 C  "   |   r|ddu rdS d S d S )Nr   TrO   r   rm   r%   r%   r&   rU        z(HmacSecretExtension.process_create_inputc                 O  s   |j j| jd}d|iS )NFr   )r   rN   r   rB   )r$   rs   argskwargsr   r%   r%   r&   r[     s   z)HmacSecretExtension.process_create_outputc                 C  s   |   sd S t|d}|sd S |j|jpdf}t|d tjkr0|d r4t|d tjks4t	d| j
s;t	dt| j
| j}| \}| _| jd u rR|j| _| j| j|d |d  }| j| j|}|||| jjdS )Nr   r   r   r   r   rL   r   )rO   r}   r   r   r   r   r   r   r   rJ   rH   r   rQ   r   r   r   r   r   r   )r$   r   
get_secretr   r   r   r   r   r%   r%   r&   re   	  s0   
z%HmacSecretExtension.process_get_inputc                 O  s\   |j j| j}| jd usJ | j| j|}|d tj }|tjd  p&d }dt	||iS )Nr   )
r   rN   r   rB   rQ   r   r   r   r   r   )r$   rx   r   r   r   r   r   r   r%   r%   r&   rf   )  s   z&HmacSecretExtension.process_get_output)NNF)r(   r)   r*   r+   rB   r   r'   rc   ri   rU   r[   re   rf   __classcell__r%   r%   r   r&   r   o  s    ` r   c                   @  s6   e Zd ZU dZdZded< dZded< dZded< dS )	&AuthenticatorExtensionsLargeBlobInputszClient inputs for largeBlob.NzOptional[str]supportr   readr/   write)r(   r)   r*   r+   r   rg   r   r   r%   r%   r%   r&   r   3  
   
 r   c                   @  s6   e Zd ZU dZdZded< dZded< dZded< dS )'AuthenticatorExtensionsLargeBlobOutputszClient outputs for largeBlob.Nr   	supportedr/   blobwritten)r(   r)   r*   r+   r   rg   r   r   r%   r%   r%   r&   r   <  r   r   c                      s^   e Zd ZdZdZd fdd	Zdd Zdd	 Zd
d Zdd Z	dd Z
dd Zdd Z  ZS )LargeBlobExtensionz
    Implements the Large Blob storage (largeBlob) WebAuthn extension.

    https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension
    largeBlobKeyNc                   s2   |p| j }|d usJ t |o|jjddS )N
largeBlobsF)rH   r   rO   rM   rP   r   rI   r   r%   r&   rO   N  s   
zLargeBlobExtension.is_supportedc                 C  sh   |j pi }t|d}|r2|js|jrtd|jdkr'| |s'tdG dd dt	}| S d S )N	largeBlobInvalid set of parametersrequired1Authenticator does not support large blob storagec                   @  s   e Zd Zdd Zdd ZdS )z5LargeBlobExtension.make_credential.<locals>.Processorc                 S  r   r   )r   rB   r4   r%   r%   r&   r5   ]  r   zDLargeBlobExtension.make_credential.<locals>.Processor.prepare_inputsc                 S     dt |jd udiS Nr   )r   r   large_blob_keyr9   r%   r%   r&   r:   `     zELargeBlobExtension.make_credential.<locals>.Processor.prepare_outputsNr]   r%   r%   r%   r&   r_   \  s    r_   )
rN   r   r   r   r   r   rJ   r   rO   r-   )r$   rC   rP   rQ   r   datar_   r%   r%   r&   rc   S  s   
z"LargeBlobExtension.make_credentialc                   s   |j pi }t|drDjsjrjrtd|  s%tdG  fdddt	}|jr9t
jjnt
dtjdidS d S )	Nr   r   r   c                      s   e Zd Z fddZdS )z3LargeBlobExtension.get_assertion.<locals>.Processorc                   sf   |j }|r/jrt }||}dt|diS jr1t |}||j dtddiS d S d S )Nr   r   Tr   )r   r   r	   get_blobr   r   put_blob)r$   r6   r.   blob_keylarge_blobsr   rC   r   rQ   r%   r&   r:   s  s$   
	zCLargeBlobExtension.get_assertion.<locals>.Processor.prepare_outputsN)r(   r)   r*   r:   r%   r   r%   r&   r_   r  s    r_   r   Tr   )rN   r   r   r   r   r   r   rJ   rO   r=   r   r,   LARGE_BLOB_WRITEr   rB   )r$   rC   rP   rQ   r   r_   r%   r   r&   ri   i  s   


z LargeBlobExtension.get_assertionc                 C  sJ   t |d}|r#|js|jrtd|jdkr!|  s!tddS d S )Nr   r   r   r   T)r   r   r   r   r   rJ   r   rO   r$   r   r   r%   r%   r&   rU     s   z'LargeBlobExtension.process_create_inputc                 O  r   r   r   )r$   rs   r   r   r%   r%   r&   r[     r   z(LargeBlobExtension.process_create_outputc                 C  s,   t |d}|r|jrtjjS tdS )Nr   r   )r   r   r   r   r   r,   r   r   r%   r%   r&   rh     s   

z&LargeBlobExtension.get_get_permissionsc                 C  s^   t |d}|r-|js|jr|jrtd|  std|jr'd| _dS |j| _dS d S )Nr   r   r   T)	r   r   r   r   r   r   rJ   rO   _actionr   r%   r%   r&   re     s   z$LargeBlobExtension.process_get_inputc                 C  sn   |j }|r3| jdu rt| j}||}dt|diS | jr5t| j||}||| j dtddiS d S d S )NTr   r   r   )r   r   r	   rC   r   r   r   )r$   rx   rt   rQ   r   r   r   r%   r%   r&   rf     s   



z%LargeBlobExtension.process_get_outputr!   )r(   r)   r*   r+   rB   rO   rc   ri   rU   r[   rh   re   rf   r   r%   r%   r   r&   r   E  s    (	r   c                   @  s4   e Zd ZdZdZdd Zdd Zdd Zd	d
 ZdS )CredBlobExtensionz
    Implements the Credential Blob (credBlob) CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credBlob-extension
    credBlobc                 C  s\   |j pi }|  r(|d}|jjd usJ |r*t||jjkr,t| j|idS d S d S d S )Nr   r   )rN   rO   r   rM   max_cred_blob_lengthr   r-   rB   )r$   rC   rP   rQ   r   r   r%   r%   r&   rc     s   

z!CredBlobExtension.make_credentialc                 C  s:   |j pi }| |r|ddu rt| jdidS d S d S )NgetCredBlobTr   )rN   rO   r   r=   rB   r$   rC   rP   rQ   r   r%   r%   r&   ri     s   
zCredBlobExtension.get_assertionc                 C  sJ   |   r|d}| jjjd usJ |r!t|| jjjkr#|S d S d S d S )Nr   )rO   r   rC   rM   r   r   )r$   r   r   r%   r%   r&   rU     s   
z&CredBlobExtension.process_create_inputc                 C  r   )Nr   Tr   rm   r%   r%   r&   re     r   z#CredBlobExtension.process_get_inputN)	r(   r)   r*   r+   rB   rc   ri   rU   re   r%   r%   r%   r&   r     s    r   c                   @  s8   e Zd ZdZeG dd deZdZdd Zdd Z	d	S )
CredProtectExtensionz
    Implements the Credential Protection CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credProtect-extension
    c                   @  s   e Zd ZdZdZdZdS )zCredProtectExtension.POLICYuserVerificationOptional,userVerificationOptionalWithCredentialIDListuserVerificationRequiredN)r(   r)   r*   OPTIONALOPTIONAL_WITH_LISTREQUIREDr%   r%   r%   r&   POLICY  s    r   credProtectc                 C  sp   |j pi }|d}|r6ttjt|}|dd}|r,| |s,|dkr,tdt| j	|d idS d S )NcredentialProtectionPolicy!enforceCredentialProtectionPolicyFr   4Authenticator does not support Credential Protectionr   r   )
rN   r   listr   r   indexrO   rJ   r-   rB   )r$   rC   rP   rQ   r   policyr  enforcer%   r%   r&   rc     s   


z$CredProtectExtension.make_credentialc                 C  sX   | d}|r*ttjt|}| dd}|r&|  s&|dkr&td|d S d S )Nr   r   Fr   r   r   )r   r  r   r   r  rO   rJ   )r$   r   r  r  r  r%   r%   r&   rU     s   

z)CredProtectExtension.process_create_inputN)
r(   r)   r*   r+   r   r   r   rB   rc   rU   r%   r%   r%   r&   r     s    r   c                   @  s.   e Zd ZdZdZd
ddZdd Zdd	 ZdS )MinPinLengthExtensionz
    Implements the Minimum PIN Length (minPinLength) CTAP2 extension.

    https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension
    minPinLengthNc                 C  s"   |p| j }|d usJ d|jjv S )NsetMinPINLength)rH   rM   rP   rI   r%   r%   r&   rO     s   
z"MinPinLengthExtension.is_supportedc                 C  s<   |j pi }| |r|| jdu rt| jdidS d S d S )NTr   )rN   rO   r   rB   r-   r   r%   r%   r&   rc     s   
z%MinPinLengthExtension.make_credentialc                 C  s$   |   r|| jdu rdS d S d S r   )rO   r   rB   rm   r%   r%   r&   rU   $  s   z*MinPinLengthExtension.process_create_inputr!   )r(   r)   r*   r+   rB   rO   rc   rU   r%   r%   r%   r&   r    s    
r  c                   @  s   e Zd ZU dZdZded< dS )CredentialPropertiesOutputzClient outputs for credProps.Nr   rk)r(   r)   r*   r+   r	  rg   r%   r%   r%   r&   r  )  s   
 r  c                   @  s&   e Zd ZdZdZdddZdd ZdS )	CredPropsExtensionz
    Implements the Credential Properties (credProps) WebAuthn extension.

    https://www.w3.org/TR/webauthn-3/#sctn-authenticator-credential-properties-extension
    	credPropsNc                 C  rn   r   r%   rI   r%   r%   r&   rO   9  s   zCredPropsExtension.is_supportedc                 C  sf   |j pi }|| jdu r1|jpt }|jtjkp%|jtjko%|j	j
d}t| jt|didS d S )NTr	  )r	  )r    )rN   r   rB   authenticator_selectionr   resident_keyr   r   	PREFERREDrM   rP   r-   r  )r$   rC   rP   rQ   r   	selectionr	  r%   r%   r&   rc   <  s   

z"CredPropsExtension.make_credentialr!   )r(   r)   r*   r+   rB   rO   rc   r%   r%   r%   r&   r
  0  s
    
r
  )6
__future__r   baser   r   r   pinr   r   r   r	   utilsr   r   r   webauthnr   r   r   r   r   enumr   r   dataclassesr   typingr   r   r   r   r   abcrE   ABCr   r-   r=   r@   r}   r   r   r   r   r   r   r   r   r   r   r   r  r  r
  r%   r%   r%   r&   <module>   sP    
M



 
E
~#)
