webauthn-slim 3.4.3

data/lib/webauthn/fake_client.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+require "webauthn/authenticator_data"
+require "webauthn/encoder"
+require "webauthn/fake_authenticator"
+
+module WebAuthn
+  class FakeClient
+    TYPES = { create: "webauthn.create", get: "webauthn.get" }.freeze
+
+    attr_reader :origin, :cross_origin, :top_origin, :token_binding, :encoding
+
+    def initialize(
+      origin = fake_origin,
+      cross_origin: nil,
+      top_origin: nil,
+      token_binding: nil,
+      authenticator: WebAuthn::FakeAuthenticator.new,
+      encoding: WebAuthn.configuration.encoding
+    )
+      @origin = origin
+      @cross_origin = cross_origin
+      @top_origin = top_origin
+      @token_binding = token_binding
+      @authenticator = authenticator
+      @encoding = encoding
+    end
+
+    def create(
+      challenge: fake_challenge,
+      rp_id: nil,
+      user_present: true,
+      user_verified: false,
+      backup_eligibility: false,
+      backup_state: false,
+      attested_credential_data: true,
+      credential_algorithm: nil,
+      extensions: nil
+    )
+      rp_id ||= URI.parse(origin).host
+
+      client_data_json = data_json_for(:create, encoder.decode(challenge))
+      client_data_hash = hashed(client_data_json)
+
+      attestation_object = authenticator.make_credential(
+        rp_id: rp_id,
+        client_data_hash: client_data_hash,
+        user_present: user_present,
+        user_verified: user_verified,
+        backup_eligibility: backup_eligibility,
+        backup_state: backup_state,
+        attested_credential_data: attested_credential_data,
+        algorithm: credential_algorithm,
+        extensions: extensions
+      )
+
+      id =
+        if attested_credential_data
+          WebAuthn::AuthenticatorData
+            .deserialize(CBOR.decode(attestation_object)["authData"])
+            .attested_credential_data
+            .id
+        else
+          "id-for-pk-without-attested-credential-data"
+        end
+
+      {
+        "type" => "public-key",
+        "id" => internal_encoder.encode(id),
+        "rawId" => encoder.encode(id),
+        "authenticatorAttachment" => 'platform',
+        "clientExtensionResults" => extensions,
+        "response" => {
+          "attestationObject" => encoder.encode(attestation_object),
+          "clientDataJSON" => encoder.encode(client_data_json),
+          "transports" => ["internal"],
+        }
+      }
+    end
+
+    def get(challenge: fake_challenge,
+            rp_id: nil,
+            user_present: true,
+            user_verified: false,
+            backup_eligibility: false,
+            backup_state: true,
+            sign_count: nil,
+            extensions: nil,
+            user_handle: nil,
+            allow_credentials: nil)
+      rp_id ||= URI.parse(origin).host
+
+      client_data_json = data_json_for(:get, encoder.decode(challenge))
+      client_data_hash = hashed(client_data_json)
+
+      if allow_credentials
+        allow_credentials = allow_credentials.map { |credential| encoder.decode(credential) }
+      end
+
+      assertion = authenticator.get_assertion(
+        rp_id: rp_id,
+        client_data_hash: client_data_hash,
+        user_present: user_present,
+        user_verified: user_verified,
+        backup_eligibility: backup_eligibility,
+        backup_state: backup_state,
+        sign_count: sign_count,
+        extensions: extensions,
+        allow_credentials: allow_credentials
+      )
+
+      {
+        "type" => "public-key",
+        "id" => internal_encoder.encode(assertion[:credential_id]),
+        "rawId" => encoder.encode(assertion[:credential_id]),
+        "clientExtensionResults" => extensions,
+        "authenticatorAttachment" => 'platform',
+        "response" => {
+          "clientDataJSON" => encoder.encode(client_data_json),
+          "authenticatorData" => encoder.encode(assertion[:authenticator_data]),
+          "signature" => encoder.encode(assertion[:signature]),
+          "userHandle" => user_handle ? encoder.encode(user_handle) : nil
+        }
+      }
+    end
+
+    private
+
+    attr_reader :authenticator
+
+    def data_json_for(method, challenge)
+      data = {
+        type: type_for(method),
+        challenge: internal_encoder.encode(challenge),
+        origin: origin
+      }
+
+      if token_binding
+        data[:tokenBinding] = token_binding
+      end
+
+      if cross_origin
+        data[:crossOrigin] = cross_origin
+      end
+
+      if top_origin
+        data[:topOrigin] = top_origin
+      end
+
+      data.to_json
+    end
+
+    def encoder
+      @encoder ||= WebAuthn::Encoder.new(encoding)
+    end
+
+    def internal_encoder
+      WebAuthn.standard_encoder
+    end
+
+    def hashed(data)
+      OpenSSL::Digest::SHA256.digest(data)
+    end
+
+    def fake_challenge
+      encoder.encode(SecureRandom.random_bytes(32))
+    end
+
+    def fake_origin
+      "http://localhost#{rand(1000)}.test"
+    end
+
+    def type_for(method)
+      TYPES[method]
+    end
+  end
+end

data/lib/webauthn/json_serializer.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module WebAuthn
+  module JSONSerializer
+    # Argument wildcard for Ruby on Rails controller automatic object JSON serialization
+    def as_json(*)
+      deep_camelize_keys(to_hash)
+    end
+
+    private
+
+    def to_hash
+      attributes.each_with_object({}) do |attribute_name, hash|
+        value = send(attribute_name)
+
+        if value.respond_to?(:as_json)
+          value = value.as_json
+        end
+
+        if value
+          hash[attribute_name] = value
+        end
+      end
+    end
+
+    def deep_camelize_keys(object)
+      case object
+      when Hash
+        object.each_with_object({}) do |(key, value), result|
+          result[camelize(key)] = deep_camelize_keys(value)
+        end
+      when Array
+        object.map { |element| deep_camelize_keys(element) }
+      else
+        object
+      end
+    end
+
+    def camelize(term)
+      first_term, *rest = term.to_s.split('_')
+
+      [first_term, *rest.map(&:capitalize)].join.to_sym
+    end
+  end
+end

data/lib/webauthn/public_key.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "webauthn/attestation_statement/fido_u2f/public_key"
+
+module WebAuthn
+  class PublicKey
+    class UnsupportedAlgorithm < Error; end
+
+    def self.deserialize(public_key)
+      cose_key =
+        if WebAuthn::AttestationStatement::FidoU2f::PublicKey.uncompressed_point?(public_key)
+          # Gem version v1.11.0 and lower, used to behave so that Credential#public_key
+          # returned an EC P-256 uncompressed point.
+          #
+          # Because of https://github.com/cedarcode/webauthn-ruby/issues/137 this was changed
+          # and Credential#public_key started returning the unchanged COSE_Key formatted
+          # credentialPublicKey (as in https://www.w3.org/TR/webauthn/#credentialpublickey).
+          #
+          # Given that the credential public key is expected to be stored long-term by the gem
+          # user and later be passed as the public_key argument in the
+          # AuthenticatorAssertionResponse.verify call, we then need to support the two formats.
+          COSE::Key::EC2.new(
+            alg: COSE::Algorithm.by_name("ES256").id,
+            crv: 1,
+            x: public_key[1..32],
+            y: public_key[33..-1]
+          )
+        else
+          COSE::Key.deserialize(public_key)
+        end
+
+      new(cose_key: cose_key)
+    end
+
+    attr_reader :cose_key
+
+    def initialize(cose_key:)
+      @cose_key = cose_key
+    end
+
+    def pkey
+      @cose_key.to_pkey
+    end
+
+    def alg
+      @cose_key.alg
+    end
+
+    def verify(signature, verification_data)
+      cose_algorithm.verify(pkey, signature, verification_data)
+    rescue COSE::Error
+      false
+    end
+
+    private
+
+    def cose_algorithm
+      @cose_algorithm ||= COSE::Algorithm.find(alg) || raise(
+        UnsupportedAlgorithm,
+        "The public key algorithm #{alg} is not among the available COSE algorithms"
+      )
+    end
+  end
+end

data/lib/webauthn/public_key_credential/creation_options.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "webauthn/public_key_credential/options"
+require "webauthn/public_key_credential/rp_entity"
+require "webauthn/public_key_credential/user_entity"
+
+module WebAuthn
+  class PublicKeyCredential
+    class CreationOptions < Options
+      attr_accessor(
+        :attestation,
+        :authenticator_selection,
+        :exclude,
+        :algs,
+        :rp,
+        :user
+      )
+
+      def initialize(
+        attestation: nil,
+        authenticator_selection: nil,
+        exclude_credentials: nil,
+        exclude: nil,
+        pub_key_cred_params: nil,
+        algs: nil,
+        rp: {},
+        user:,
+        **keyword_arguments
+      )
+        super(**keyword_arguments)
+
+        @attestation = attestation
+        @authenticator_selection = authenticator_selection
+        @exclude_credentials = exclude_credentials
+        @exclude = exclude
+        @pub_key_cred_params = pub_key_cred_params
+        @algs = algs
+
+        @rp =
+          if rp.is_a?(Hash)
+            rp = rp.dup
+            rp[:name] ||= relying_party.name
+            rp[:id] ||= relying_party.id
+
+            RPEntity.new(**rp)
+          else
+            rp
+          end
+
+        @user =
+          if user.is_a?(Hash)
+            UserEntity.new(**user)
+          else
+            user
+          end
+      end
+
+      def exclude_credentials
+        @exclude_credentials || exclude_credentials_from_exclude
+      end
+
+      def pub_key_cred_params
+        @pub_key_cred_params || pub_key_cred_params_from_algs
+      end
+
+      private
+
+      def attributes
+        super.concat([:rp, :user, :pub_key_cred_params, :attestation, :authenticator_selection, :exclude_credentials])
+      end
+
+      def exclude_credentials_from_exclude
+        if exclude
+          as_public_key_descriptors(exclude)
+        end
+      end
+
+      def pub_key_cred_params_from_algs
+        Array(algs || relying_party.algorithms).map do |alg|
+          alg_id =
+            if alg.is_a?(String) || alg.is_a?(Symbol)
+              COSE::Algorithm.by_name(alg.to_s).id
+            else
+              alg
+            end
+
+          { type: TYPE_PUBLIC_KEY, alg: alg_id }
+        end
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential/entity.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module WebAuthn
+  class PublicKeyCredential
+    class Entity
+      include JSONSerializer
+
+      attr_reader :name
+
+      def initialize(name:)
+        @name = name
+      end
+
+      private
+
+      def attributes
+        [:name]
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential/options.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module WebAuthn
+  class PublicKeyCredential
+    class Options
+      include JSONSerializer
+
+      CHALLENGE_LENGTH = 32
+
+      attr_reader :timeout, :extensions, :relying_party
+
+      def initialize(timeout: nil, extensions: nil, relying_party: WebAuthn.configuration.relying_party)
+        @relying_party = relying_party
+        @timeout = timeout || default_timeout
+        @extensions = default_extensions.merge(extensions || {})
+      end
+
+      def challenge
+        encoder.encode(raw_challenge)
+      end
+
+      private
+
+      def attributes
+        [:challenge, :timeout, :extensions]
+      end
+
+      def encoder
+        relying_party.encoder
+      end
+
+      def raw_challenge
+        @raw_challenge ||= SecureRandom.random_bytes(CHALLENGE_LENGTH)
+      end
+
+      def default_timeout
+        relying_party.credential_options_timeout
+      end
+
+      def default_extensions
+        {}
+      end
+
+      def as_public_key_descriptors(ids)
+        Array(ids).map { |id| { type: TYPE_PUBLIC_KEY, id: id } }
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential/request_options.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "webauthn/public_key_credential/options"
+
+module WebAuthn
+  class PublicKeyCredential
+    class RequestOptions < Options
+      attr_accessor :rp_id, :allow, :user_verification
+
+      def initialize(rp_id: nil, allow_credentials: nil, allow: nil, user_verification: nil, **keyword_arguments)
+        super(**keyword_arguments)
+
+        @rp_id = rp_id || relying_party.id
+        @allow_credentials = allow_credentials
+        @allow = allow
+        @user_verification = user_verification
+      end
+
+      def allow_credentials
+        @allow_credentials || allow_credentials_from_allow || []
+      end
+
+      private
+
+      def attributes
+        super.concat([:allow_credentials, :rp_id, :user_verification])
+      end
+
+      def default_extensions
+        extensions = super || {}
+
+        if relying_party.legacy_u2f_appid
+          extensions.merge!(appid: relying_party.legacy_u2f_appid)
+        end
+
+        extensions
+      end
+
+      def allow_credentials_from_allow
+        if allow
+          as_public_key_descriptors(allow)
+        end
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential/rp_entity.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "webauthn/public_key_credential/entity"
+
+module WebAuthn
+  class PublicKeyCredential
+    class RPEntity < Entity
+      attr_reader :id
+
+      def initialize(id: nil, **keyword_arguments)
+        super(**keyword_arguments)
+
+        @id = id
+      end
+
+      private
+
+      def attributes
+        super.concat([:id])
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential/user_entity.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "webauthn/public_key_credential/entity"
+
+module WebAuthn
+  class PublicKeyCredential
+    class UserEntity < Entity
+      attr_reader :id, :display_name
+
+      def initialize(id:, display_name: nil, **keyword_arguments)
+        super(**keyword_arguments)
+
+        @id = id
+        @display_name = display_name || name
+      end
+
+      private
+
+      def attributes
+        super.concat([:id, :display_name])
+      end
+    end
+  end
+end

data/lib/webauthn/public_key_credential.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require "webauthn/encoder"
+
+module WebAuthn
+  class PublicKeyCredential
+    class InvalidChallengeError < Error; end
+
+    attr_reader :type, :id, :raw_id, :client_extension_outputs, :authenticator_attachment, :response
+
+    def self.from_client(credential, relying_party: WebAuthn.configuration.relying_party)
+      new(
+        type: credential["type"],
+        id: credential["id"],
+        raw_id: relying_party.encoder.decode(credential["rawId"]),
+        client_extension_outputs: credential["clientExtensionResults"],
+        authenticator_attachment: credential["authenticatorAttachment"],
+        response: response_class.from_client(credential["response"], relying_party: relying_party),
+        relying_party: relying_party
+      )
+    end
+
+    def initialize(
+      type:,
+      id:,
+      raw_id:,
+      response:,
+      authenticator_attachment: nil,
+      client_extension_outputs: {},
+      relying_party: WebAuthn.configuration.relying_party
+    )
+      @type = type
+      @id = id
+      @raw_id = raw_id
+      @client_extension_outputs = client_extension_outputs
+      @authenticator_attachment = authenticator_attachment
+      @response = response
+      @relying_party = relying_party
+    end
+
+    def verify(challenge, *_args)
+      unless valid_class?(challenge)
+        msg = "challenge must be a String. input challenge class: #{challenge.class}"
+
+        raise(InvalidChallengeError, msg)
+      end
+
+      valid_type? || raise("invalid type")
+      valid_id? || raise("invalid id")
+
+      true
+    end
+
+    def sign_count
+      authenticator_data&.sign_count
+    end
+
+    def authenticator_extension_outputs
+      authenticator_data.extension_data if authenticator_data&.extension_data_included?
+    end
+
+    def backup_eligible?
+      authenticator_data&.credential_backup_eligible?
+    end
+
+    def backed_up?
+      authenticator_data&.credential_backed_up?
+    end
+
+    private
+
+    attr_reader :relying_party
+
+    def valid_type?
+      type == TYPE_PUBLIC_KEY
+    end
+
+    def valid_id?
+      raw_id && id && raw_id == WebAuthn.standard_encoder.decode(id)
+    end
+
+    def valid_class?(challenge)
+      challenge.is_a?(String)
+    end
+
+    def authenticator_data
+      response&.authenticator_data
+    end
+
+    def encoder
+      relying_party.encoder
+    end
+  end
+end

data/lib/webauthn/public_key_credential_with_assertion.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "webauthn/authenticator_assertion_response"
+require "webauthn/public_key_credential"
+
+module WebAuthn
+  class PublicKeyCredentialWithAssertion < PublicKeyCredential
+    def self.response_class
+      WebAuthn::AuthenticatorAssertionResponse
+    end
+
+    def verify(challenge, public_key:, sign_count:, user_presence: nil, user_verification: nil)
+      super
+
+      response.verify(
+        encoder.decode(challenge),
+        public_key: encoder.decode(public_key),
+        sign_count: sign_count,
+        user_presence: user_presence,
+        user_verification: user_verification,
+        rp_id: appid_extension_output ? appid : nil
+      )
+
+      true
+    end
+
+    def user_handle
+      if raw_user_handle
+        encoder.encode(raw_user_handle)
+      end
+    end
+
+    def raw_user_handle
+      response.user_handle
+    end
+
+    private
+
+    def appid_extension_output
+      return if client_extension_outputs.nil?
+
+      client_extension_outputs['appid']
+    end
+
+    def appid
+      URI.parse(relying_party.legacy_u2f_appid || raise("Unspecified legacy U2F AppID")).to_s
+    end
+  end
+end