webauthn-slim 3.4.3

data/lib/webauthn/public_key_credential_with_attestation.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "webauthn/authenticator_attestation_response"
+require "webauthn/public_key_credential"
+
+module WebAuthn
+  class PublicKeyCredentialWithAttestation < PublicKeyCredential
+    def self.response_class
+      WebAuthn::AuthenticatorAttestationResponse
+    end
+
+    def verify(challenge, user_presence: nil, user_verification: nil)
+      super
+
+      response.verify(encoder.decode(challenge), user_presence: user_presence, user_verification: user_verification)
+
+      true
+    end
+
+    def public_key
+      if raw_public_key
+        encoder.encode(raw_public_key)
+      end
+    end
+
+    def raw_public_key
+      response&.authenticator_data&.credential&.public_key
+    end
+  end
+end

data/lib/webauthn/relying_party.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "webauthn/credential"
+require "webauthn/encoder"
+require "webauthn/error"
+
+module WebAuthn
+  class RootCertificateFinderNotSupportedError < Error; end
+
+  class RelyingParty
+    DEFAULT_ALGORITHMS = ["ES256", "PS256", "RS256"].freeze
+
+    def initialize(
+      algorithms: DEFAULT_ALGORITHMS.dup,
+      encoding: WebAuthn::Encoder::STANDARD_ENCODING,
+      allowed_origins: nil,
+      allowed_top_origins: nil,
+      origin: nil,
+      id: nil,
+      name: nil,
+      verify_attestation_statement: true,
+      verify_cross_origin: false,
+      credential_options_timeout: 120000,
+      silent_authentication: false,
+      acceptable_attestation_types: ['None', 'Self', 'Basic', 'AttCA', 'Basic_or_AttCA', 'AnonCA'],
+      attestation_root_certificates_finders: [],
+      legacy_u2f_appid: nil
+    )
+      @algorithms = algorithms
+      @encoding = encoding
+      @allowed_origins = allowed_origins
+      @allowed_top_origins = allowed_top_origins
+      @id = id
+      @name = name
+      @verify_attestation_statement = verify_attestation_statement
+      @verify_cross_origin = verify_cross_origin
+      @credential_options_timeout = credential_options_timeout
+      @silent_authentication = silent_authentication
+      @acceptable_attestation_types = acceptable_attestation_types
+      @legacy_u2f_appid = legacy_u2f_appid
+      self.origin = origin
+      self.attestation_root_certificates_finders = attestation_root_certificates_finders
+    end
+
+    attr_accessor :algorithms,
+                  :encoding,
+                  :allowed_origins,
+                  :allowed_top_origins,
+                  :id,
+                  :name,
+                  :verify_attestation_statement,
+                  :verify_cross_origin,
+                  :credential_options_timeout,
+                  :silent_authentication,
+                  :acceptable_attestation_types,
+                  :legacy_u2f_appid
+
+    attr_reader :attestation_root_certificates_finders
+
+    # This is the user-data encoder.
+    # Used to decode user input and to encode data provided to the user.
+    def encoder
+      @encoder ||= WebAuthn::Encoder.new(encoding)
+    end
+
+    def attestation_root_certificates_finders=(finders)
+      if !finders.respond_to?(:each)
+        finders = [finders]
+      end
+
+      finders.each do |finder|
+        unless finder.respond_to?(:find)
+          raise RootCertificateFinderNotSupportedError, "Finder must implement `find` method"
+        end
+      end
+
+      @attestation_root_certificates_finders = finders
+    end
+
+    def options_for_registration(**keyword_arguments)
+      WebAuthn::Credential.options_for_create(
+        **keyword_arguments,
+        relying_party: self
+      )
+    end
+
+    def verify_registration(raw_credential, challenge, user_presence: nil, user_verification: nil)
+      webauthn_credential = WebAuthn::Credential.from_create(raw_credential, relying_party: self)
+
+      if webauthn_credential.verify(challenge, user_presence: user_presence, user_verification: user_verification)
+        webauthn_credential
+      end
+    end
+
+    def options_for_authentication(**keyword_arguments)
+      WebAuthn::Credential.options_for_get(
+        **keyword_arguments,
+        relying_party: self
+      )
+    end
+
+    def verify_authentication(
+      raw_credential,
+      challenge,
+      user_presence: nil,
+      user_verification: nil,
+      public_key: nil,
+      sign_count: nil
+    )
+      webauthn_credential = WebAuthn::Credential.from_get(raw_credential, relying_party: self)
+
+      stored_credential = yield(webauthn_credential) if block_given?
+
+      if webauthn_credential.verify(
+        challenge,
+        public_key: public_key || stored_credential.public_key,
+        sign_count: sign_count || stored_credential.sign_count,
+        user_presence: user_presence,
+        user_verification: user_verification
+      )
+        block_given? ? [webauthn_credential, stored_credential] : webauthn_credential
+      end
+    end
+
+    # DEPRECATED: This method will be removed in future.
+    def origin
+      warn(
+        "DEPRECATION WARNING: `WebAuthn.origin` is deprecated and returns `nil` " \
+        "when `WebAuthn.allowed_origins` contains more than one origin. " \
+        "It will be removed in future. Please use `WebAuthn.allowed_origins` instead."
+      )
+
+      allowed_origins.first if allowed_origins&.size == 1
+    end
+
+    # DEPRECATED: This method will be removed in future.
+    def origin=(new_origin)
+      return if new_origin.nil?
+
+      warn(
+        "DEPRECATION WARNING: `WebAuthn.origin=` is deprecated and will be removed in future. "\
+        "Please use `WebAuthn.allowed_origins=` instead "\
+        "that also allows configuring multiple origins per Relying Party"
+      )
+
+      @allowed_origins ||= Array(new_origin) # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+  end
+end

data/lib/webauthn/u2f_migrator.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require 'webauthn/fake_client'
+require 'webauthn/attestation_statement/fido_u2f'
+
+module WebAuthn
+  class U2fMigrator
+    def initialize(app_id:, certificate:, key_handle:, public_key:, counter:)
+      @app_id = app_id
+      @certificate = certificate
+      @key_handle = key_handle
+      @public_key = public_key
+      @counter = counter
+    end
+
+    def authenticator_data
+      @authenticator_data ||= WebAuthn::FakeAuthenticator::AuthenticatorData.new(
+        rp_id_hash: OpenSSL::Digest::SHA256.digest(@app_id.to_s),
+        credential: {
+          id: credential_id,
+          public_key: credential_cose_key
+        },
+        sign_count: @counter,
+        user_present: true,
+        user_verified: false,
+        aaguid: WebAuthn::AuthenticatorData::AttestedCredentialData::ZEROED_AAGUID
+      )
+    end
+
+    def credential
+      @credential ||=
+        begin
+          hash = authenticator_data.send(:credential)
+          WebAuthn::AuthenticatorData::AttestedCredentialData::Credential.new(
+            id: hash[:id],
+            public_key: hash[:public_key].serialize
+          )
+        end
+    end
+
+    def attestation_type
+      WebAuthn::AttestationStatement::ATTESTATION_TYPE_BASIC_OR_ATTCA
+    end
+
+    def attestation_trust_path
+      @attestation_trust_path ||= [
+        OpenSSL::X509::Certificate.new(WebAuthn::Encoders::Base64Encoder.decode(@certificate))
+      ]
+    end
+
+    private
+
+    # https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#u2f-authenticatorMakeCredential-interoperability
+    # Let credentialId be a credentialIdLength byte array initialized with CTAP1/U2F response key handle bytes.
+    def credential_id
+      WebAuthn::Encoders::Base64UrlEncoder.decode(@key_handle)
+    end
+
+    # Let x9encodedUserPublicKey be the user public key returned in the U2F registration response message [U2FRawMsgs].
+    # Let coseEncodedCredentialPublicKey be the result of converting x9encodedUserPublicKey’s value from ANS X9.62 /
+    # Sec-1 v2 uncompressed curve point representation [SEC1V2] to COSE_Key representation ([RFC8152] Section 7).
+    def credential_cose_key
+      decoded_public_key = WebAuthn::Encoders::Base64Encoder.decode(@public_key)
+      if WebAuthn::AttestationStatement::FidoU2f::PublicKey.uncompressed_point?(decoded_public_key)
+        COSE::Key::EC2.new(
+          alg: COSE::Algorithm.by_name("ES256").id,
+          crv: 1,
+          x: decoded_public_key[1..32],
+          y: decoded_public_key[33..-1]
+        )
+      else
+        raise "expected U2F public key to be in uncompressed point format"
+      end
+    end
+  end
+end

data/lib/webauthn/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module WebAuthn
+  VERSION = "3.4.3"
+end

data/lib/webauthn.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "webauthn/json_serializer"
+require "webauthn/configuration"
+require "webauthn/credential"
+require "webauthn/credential_creation_options"
+require "webauthn/credential_request_options"
+require "webauthn/version"
+
+module WebAuthn
+  TYPE_PUBLIC_KEY = "public-key"
+
+  class << self
+    def generate_user_id
+      configuration.encoder.encode(SecureRandom.random_bytes(64))
+    end
+    alias_method :generate_user_handle, :generate_user_id
+  end
+end

data/webauthn.gemspec

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+lib = File.expand_path('lib', __dir__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "webauthn/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "webauthn-slim"
+  spec.version       = WebAuthn::VERSION
+  spec.authors       = ["Gonzalo Rodriguez", "Braulio Martinez"]
+  spec.email         = ["gonzalo@cedarcode.com", "braulio@cedarcode.com"]
+
+  spec.summary       = "WebAuthn ruby server library"
+  spec.description   = 'WebAuthn ruby server library ― Make your application a W3C Web Authentication conformant'
+  spec.homepage      = "https://github.com/npezza93/webauthn-slim"
+  spec.license       = "MIT"
+
+  spec.metadata = {
+    "bug_tracker_uri" => "https://github.com/npezza93/webauthn-slim/issues",
+    "changelog_uri" => "https://github.com/npezza93/webauthn-slim/blob/master/CHANGELOG.md",
+    "source_code_uri" => "https://github.com/npezza93/webauthn-slim"
+  }
+
+  spec.files =
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{^(test|spec|features|assets)/})
+    end
+
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.required_ruby_version = ">= 4.0"
+
+  spec.add_dependency "openssl", ">= 2.2"
+
+  spec.add_development_dependency "bundler", "~> 4.0"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rspec", "~> 3.8"
+  spec.add_development_dependency "rubocop", "~> 1"
+  spec.add_development_dependency "rubocop-rake", "~> 0.5"
+  spec.add_development_dependency "rubocop-rspec", ">= 2.2", "< 4.0"
+end

metadata

@@ -0,0 +1,218 @@
+--- !ruby/object:Gem::Specification
+name: webauthn-slim
+version: !ruby/object:Gem::Version
+  version: 3.4.3
+platform: ruby
+authors:
+- Gonzalo Rodriguez
+- Braulio Martinez
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: openssl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+description: WebAuthn ruby server library ― Make your application a W3C Web Authentication
+  conformant
+email:
+- gonzalo@cedarcode.com
+- braulio@cedarcode.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".github/FUNDING.yml"
+- ".github/actions/install-openssl/action.yml"
+- ".github/actions/install-ruby/action.yml"
+- ".github/dependabot.yml"
+- ".github/workflows/build.yml"
+- ".github/workflows/git.yml"
+- ".github/workflows/release.yml"
+- ".gitignore"
+- ".rspec"
+- ".rubocop.yml"
+- CHANGELOG.md
+- CONTRIBUTING.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- SECURITY.md
+- bin/console
+- bin/setup
+- docs/advanced_configuration.md
+- docs/u2f_migration.md
+- lib/webauthn.rb
+- lib/webauthn/attestation_object.rb
+- lib/webauthn/attestation_statement.rb
+- lib/webauthn/attestation_statement/apple.rb
+- lib/webauthn/attestation_statement/base.rb
+- lib/webauthn/attestation_statement/fido_u2f.rb
+- lib/webauthn/attestation_statement/fido_u2f/public_key.rb
+- lib/webauthn/attestation_statement/none.rb
+- lib/webauthn/attestation_statement/packed.rb
+- lib/webauthn/authenticator_assertion_response.rb
+- lib/webauthn/authenticator_attestation_response.rb
+- lib/webauthn/authenticator_data.rb
+- lib/webauthn/authenticator_data/attested_credential_data.rb
+- lib/webauthn/authenticator_response.rb
+- lib/webauthn/cbor.rb
+- lib/webauthn/client_data.rb
+- lib/webauthn/configuration.rb
+- lib/webauthn/cose.rb
+- lib/webauthn/credential.rb
+- lib/webauthn/credential_creation_options.rb
+- lib/webauthn/credential_entity.rb
+- lib/webauthn/credential_options.rb
+- lib/webauthn/credential_request_options.rb
+- lib/webauthn/credential_rp_entity.rb
+- lib/webauthn/credential_user_entity.rb
+- lib/webauthn/encoder.rb
+- lib/webauthn/encoders.rb
+- lib/webauthn/error.rb
+- lib/webauthn/fake_authenticator.rb
+- lib/webauthn/fake_authenticator/attestation_object.rb
+- lib/webauthn/fake_authenticator/authenticator_data.rb
+- lib/webauthn/fake_client.rb
+- lib/webauthn/json_serializer.rb
+- lib/webauthn/public_key.rb
+- lib/webauthn/public_key_credential.rb
+- lib/webauthn/public_key_credential/creation_options.rb
+- lib/webauthn/public_key_credential/entity.rb
+- lib/webauthn/public_key_credential/options.rb
+- lib/webauthn/public_key_credential/request_options.rb
+- lib/webauthn/public_key_credential/rp_entity.rb
+- lib/webauthn/public_key_credential/user_entity.rb
+- lib/webauthn/public_key_credential_with_assertion.rb
+- lib/webauthn/public_key_credential_with_attestation.rb
+- lib/webauthn/relying_party.rb
+- lib/webauthn/u2f_migrator.rb
+- lib/webauthn/version.rb
+- webauthn.gemspec
+homepage: https://github.com/npezza93/webauthn-slim
+licenses:
+- MIT
+metadata:
+  bug_tracker_uri: https://github.com/npezza93/webauthn-slim/issues
+  changelog_uri: https://github.com/npezza93/webauthn-slim/blob/master/CHANGELOG.md
+  source_code_uri: https://github.com/npezza93/webauthn-slim
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '4.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.20
+specification_version: 4
+summary: WebAuthn ruby server library
+test_files: []