pybiss 0.2.0__tar.gz → 0.3.2__tar.gz

{pybiss-0.2.0 → pybiss-0.3.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: pybiss
-Version: 0.2.0
+Version: 0.3.2
 Summary: Unofficial BISS implementation in Python. Fast, modern, self contained
 Project-URL: Homepage, https://github.com/h5rdly/pybiss
-Requires-Python: >=3.13
+Requires-Python: >=3.14
 Description-Content-Type: text/markdown

{pybiss-0.2.0 → pybiss-0.3.2}/pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "pybiss"
-version = "0.2.0"
+version = "0.3.2"
 description = "Unofficial BISS implementation in Python. Fast, modern, self contained"
 readme = "Readme.md"
-requires-python = ">=3.13"
+requires-python = ">=3.14"
 dependencies = [] 
 
 [project.urls]

{pybiss-0.2.0 → pybiss-0.3.2}/src/app.py

@@ -1,6 +1,6 @@
 import base64, functools, hashlib, os, sys
 
-from . import detector, hardware, service, jws, transport, backends
+from . import detector, hardware, service, jws, transport, backends, card_service, card_access
 from .cards import BTrustDriver
 from .cert_parser import pem_to_der
 from .config import config
@@ -95,11 +95,8 @@ def set_pin(req, payload):
     if not old_pin or not new_pin:
         return {'status': 'error', 'reasonCode': 401, 'reasonText': 'PIN entry canceled'}
 
-    lib_path = detector.auto_detect_library()
     try:
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        hardware.change_card_pin(funcs, slots[0], old_pin, new_pin)
+        card_service.change_pin(old_pin, new_pin)
         return {'confirm': '0', 'status': 'ok', 'reasonCode': 200, 'reasonText': 'PIN successfully changed'}
     except Exception as e:
         return {'status': 'error', 'reasonCode': 500, 'reasonText': str(e)}
@@ -115,11 +112,8 @@ def set_puk(req, payload):
     if not old_puk or not new_puk:
         return {'status': 'error', 'reasonCode': 401, 'reasonText': 'PUK entry canceled'}
 
-    lib_path = detector.auto_detect_library()
     try:
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        hardware.change_card_puk(funcs, slots[0], old_puk, new_puk)
+        card_service.change_puk(old_puk, new_puk)
         return {'confirm': '0', 'status': 'ok', 'reasonCode': 200, 'reasonText': 'PUK successfully changed'}
     except Exception as e:
         return {'status': 'error', 'reasonCode': 500, 'reasonText': str(e)}
@@ -135,11 +129,8 @@ def unblock_pin(req, payload):
     if not puk or not new_pin:
         return {'status': 'error', 'reasonCode': 401, 'reasonText': 'PUK entry canceled'}
 
-    lib_path = detector.auto_detect_library()
     try:
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        hardware.unblock_card_pin(funcs, slots[0], puk, new_pin)
+        card_service.unblock_pin(puk, new_pin)
         return {'confirm': '0', 'status': 'ok', 'reasonCode': 200, 'reasonText': 'PIN successfully unblocked'}
     except Exception as e:
         return {'status': 'error', 'reasonCode': 403, 'reasonText': str(e)}
@@ -177,7 +168,7 @@ def gen_spkac(req, payload):
 
     try:
         key_size = int(payload.get('keySize') or 2048)
-    except (TypeError, ValueError):
+    except TypeError, ValueError:
         return {'status': 'error', 'reasonCode': 400, 'reasonText': reason('error.request.bad-type')}
 
     key_id = (payload.get('serialNum') or 'btrust-renewal').encode('utf-8')[:16]
@@ -188,7 +179,7 @@ def gen_spkac(req, payload):
         return {'status': 'error', 'reasonCode': 401, 'reasonText': reason('error.user-canceled')}
 
     try:
-        funcs = _load_pkcs11()
+        funcs = card_access._load_pkcs11()
     except backends.BackendUnavailable:
         return {'status': 'error', 'reasonCode': 400, 'reasonText': reason('error.no-card-found')}
 
@@ -240,11 +231,8 @@ def write_cert_sc(req, payload):
     if not pin:
         return {'confirm': None, 'status': 'error', 'reasonCode': 401, 'reasonText': reason('error.user-canceled')}
 
-    lib_path = detector.auto_detect_library()
     try:
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        hardware.write_certificate(funcs, slots[0], pin, cert_der)
+        card_service.import_certificate(cert_der, pin)
         return {'confirm': '0', 'status': 'ok', 'reasonCode': 200, 'reasonText': reason('response.success')}
     except Exception as e:
         return {'status': 'error', 'reasonCode': 500, 'reasonText': str(e)}
@@ -255,17 +243,8 @@ def write_cert_sc(req, payload):
 def get_info(req, payload):
     ''' Full token spec sheet, in the daemon's flat response shape '''
 
-    lib_path = detector.auto_detect_library()
-    if not lib_path:
-        return {'status': 'error', 'reasonCode': 400, 'reasonText': reason('error.no-card-found')}
-
     try:
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        if not slots:
-            return {'status': 'error', 'reasonCode': 404, 'reasonText': reason('error.token-not-found')}
-
-        info = hardware.get_token_info_extended(funcs, slots[0])
+        info = card_service.token_info()
         provider = next((p for p in map(detector.identify_provider, detector.get_connected_atrs()) if p), '')
         # Flatten to the official C0030ai field names
         return {
@@ -281,6 +260,8 @@ def get_info(req, payload):
             'cardData': [],
             'status': 'ok', 'reasonCode': 200, 'reasonText': reason('response.success'),
         }
+    except backends.BackendUnavailable:
+        return {'status': 'error', 'reasonCode': 404, 'reasonText': reason('error.token-not-found')}
     except Exception as e:
         return {'status': 'error', 'reasonCode': 500, 'reasonText': str(e)}
 
@@ -293,7 +274,7 @@ def gen_rsa_pair(req, payload):
     key_id = (payload.get('serNum') or payload.get('keyId') or 'btrust-key').encode('utf-8')[:16]
     try:
         key_size = int(payload.get('keySize') or 2048)
-    except (TypeError, ValueError):
+    except TypeError, ValueError:
         return {'status': 'error', 'reasonCode': 400, 'reasonText': reason('error.request.bad-type')}
 
     ui_provider = get_ui_provider()
@@ -326,7 +307,7 @@ def renew_cert(req, payload):
 
     try:
         key_size = int(payload.get('keySize') or 2048)
-    except (TypeError, ValueError):
+    except TypeError, ValueError:
         return {'status': 'error', 'reasonCode': 400, 'reasonText': reason('error.request.bad-type')}
     key_id = (payload.get('serNum') or payload.get('keyId') or 'RENEWAL').encode('utf-8')[:16]
 
@@ -405,16 +386,6 @@ def del_cert(req, payload):
         return {'status': 'error', 'reasonCode': 500, 'reasonText': str(e)}
 
 
-def _detected_atr() -> str:
-    ''' First connected card ATR (upper hex), or '' - used to pick a backend '''
-
-    try:
-        atrs = detector.get_connected_atrs(ccid_fallback=True)
-        return atrs[0].upper() if atrs else ''
-    except Exception:
-        return ''
-
-
 def _aia_resolver():
     ''' Fetches missing issuer certs over AIA, caching into the user config dir. '''
 
@@ -449,17 +420,8 @@ def _getsigner_cng(selector, show_valid_certs, ui_provider):
             mscapi.free_windows_certificate(c['windows_ctx'])
 
 
-def _load_pkcs11():
-    ''' Test seam: resolve the vendor library and return its PKCS#11 function table '''
-
-    lib_path = detector.auto_detect_library()
-    if not lib_path:
-        raise backends.BackendUnavailable('No PKCS#11 library for the detected card')
-    return hardware.load_pkcs11(lib_path)
-
-
 def _getsigner_pkcs11(selector, show_valid_certs, ui_provider):
-    funcs = _load_pkcs11()
+    funcs = card_access._load_pkcs11()
     slots = hardware.get_slots(funcs, token_present=True)
     if not slots:
         raise backends.BackendUnavailable('No token present')
@@ -482,59 +444,13 @@ def _getsigner_pkcs11(selector, show_valid_certs, ui_provider):
     return _select_and_build_chain(filtered, [c['der'] for c in all_certs], ui_provider)
 
 
-def _pcsc_factory():
-    from .sc_ffi import SmartCardConnection
-    return SmartCardConnection()
-
-
-def _ccid_factory():
-    from .ccid import CcidConnection
-    return CcidConnection()
-
-
-class CardUnreachable(Exception):
-    ''' Neither PC/SC nor direct CCID could reach a card; carries both reasons '''
-
-    def __init__(self, pcsc_error, ccid_error):
-        self.pcsc_error, self.ccid_error = pcsc_error, ccid_error
-        super().__init__(f'PC/SC: {pcsc_error} | direct CCID: {ccid_error}')
-
-
-class _CardConnection:
-    ''' Open the card over PC/SC, falling back to direct USB CCID '''
-
-    def __init__(self, pcsc_factory=_pcsc_factory, ccid_factory=_ccid_factory):
-        self._pcsc_factory, self._ccid_factory = pcsc_factory, ccid_factory
-        self._inner = None
-
-    def __enter__(self):
-        try:
-            inner = self._pcsc_factory()
-            conn = inner.__enter__()
-        except Exception as pcsc_error:
-            try:
-                inner = self._ccid_factory()
-                conn = inner.__enter__()
-            except Exception as ccid_error:
-                raise CardUnreachable(pcsc_error, ccid_error) from ccid_error
-        self._inner = inner
-        return conn
-
-    def __exit__(self, *exc):
-        return self._inner.__exit__(*exc) if self._inner is not None else False
-
-
-def _open_card():
-    return _CardConnection()
-
-
 def _getsigner_apdu(selector, show_valid_certs, ui_provider):
     ''' Read-only certificate discovery over raw APDU (no PIN, safe) '''
 
     from .cards import BTrustDriver
 
     try:
-        conn_cm = _open_card()
+        conn_cm = card_access._open_card()
         conn = conn_cm.__enter__()
     except Exception as e:
         raise backends.BackendUnavailable(f'No card reachable over PC/SC or direct CCID: {e}')
@@ -559,7 +475,7 @@ def get_signer(req):
     show_valid_certs = data.get('showValidCerts', True)
     ui_provider = get_ui_provider()
 
-    order = backends.resolve(backends.OP_READ, atr=_detected_atr(), config=config)
+    order = backends.resolve(backends.OP_READ, atr=card_access._detected_atr(), config=config)
     for name in order:
         try:
             return _GETSIGNER[name](selector, show_valid_certs, ui_provider)
@@ -640,7 +556,7 @@ def sign(req):
          return {'signatures': [], 'status': 'error', 'reasonCode': 400, 'reasonText': 'Invalid signer certificate encoding'}
 
     # Route to a signing backend per the resolver, falling through on unavailability
-    order = backends.resolve(backends.OP_SIGN, atr=_detected_atr(), config=config)
+    order = backends.resolve(backends.OP_SIGN, atr=card_access._detected_atr(), config=config)
     for name in order:
         try:
             return _SIGN[name](contents, hash_algorithm, signer_cert_der, ui_provider)
@@ -678,7 +594,7 @@ def _sign_cng(contents, hash_algorithm, signer_cert_der, ui_provider):
 
 def _sign_pkcs11(contents, hash_algorithm, signer_cert_der, ui_provider):
     try:
-        funcs = _load_pkcs11()
+        funcs = card_access._load_pkcs11()
     except backends.BackendUnavailable:
         raise
     except Exception as e:
@@ -732,7 +648,7 @@ def _sign_apdu(contents, hash_algorithm, signer_cert_der, ui_provider):
     hash_name, algo_ref = _APDU_HASH[algo]
 
     try:
-        conn_cm = _open_card()
+        conn_cm = card_access._open_card()
         conn = conn_cm.__enter__()
     except Exception as e:
         raise backends.BackendUnavailable(f'No card reachable over PC/SC or direct CCID: {e}')

pybiss-0.3.2/src/card_access.py

@@ -0,0 +1,66 @@
+from . import backends, detector, hardware
+
+
+def _detected_atr() -> str:
+    ''' First connected card ATR (upper hex), or '' - used to pick a backend '''
+
+    try:
+        atrs = detector.get_connected_atrs(ccid_fallback=True)
+        return atrs[0].upper() if atrs else ''
+    except Exception:
+        return ''
+
+
+def _load_pkcs11():
+    ''' Resolve the vendor library and return its PKCS#11 function table. '''
+
+    lib_path = detector.auto_detect_library()
+    if not lib_path:
+        raise backends.BackendUnavailable('No PKCS#11 library for the detected card')
+    return hardware.load_pkcs11(lib_path)
+
+
+def _pcsc_factory():
+    from .sc_ffi import SmartCardConnection
+    return SmartCardConnection()
+
+
+def _ccid_factory():
+    from .ccid import CcidConnection
+    return CcidConnection()
+
+
+class CardUnreachable(Exception):
+    ''' Neither PC/SC nor direct CCID could reach a card; carries both reasons '''
+
+    def __init__(self, pcsc_error, ccid_error):
+        self.pcsc_error, self.ccid_error = pcsc_error, ccid_error
+        super().__init__(f'PC/SC: {pcsc_error} | direct CCID: {ccid_error}')
+
+
+class _CardConnection:
+    ''' Open the card over PC/SC, falling back to direct USB CCID '''
+
+    def __init__(self, pcsc_factory=_pcsc_factory, ccid_factory=_ccid_factory):
+        self._pcsc_factory, self._ccid_factory = pcsc_factory, ccid_factory
+        self._inner = None
+
+    def __enter__(self):
+        try:
+            inner = self._pcsc_factory()
+            conn = inner.__enter__()
+        except Exception as pcsc_error:
+            try:
+                inner = self._ccid_factory()
+                conn = inner.__enter__()
+            except Exception as ccid_error:
+                raise CardUnreachable(pcsc_error, ccid_error) from ccid_error
+        self._inner = inner
+        return conn
+
+    def __exit__(self, *exc):
+        return self._inner.__exit__(*exc) if self._inner is not None else False
+
+
+def _open_card():
+    return _CardConnection()

pybiss-0.3.2/src/card_service.py

@@ -0,0 +1,158 @@
+''' card-management API for the GUI / daemon '''
+
+
+from . import backends, detector, hardware
+from .config import config as _config
+from .card_access import _open_card, _detected_atr
+
+
+# --- engine plumbing --------------------------------------------------------
+
+def _pkcs11_session(cfg):
+    ''' (funcs, slot_id) for the detected token; BackendUnavailable if none. '''
+
+    lib = ((cfg or _config).get('pkcs11Path') or '') or detector.auto_detect_library()
+    if not lib:
+        raise backends.BackendUnavailable('No PKCS#11 library for the detected card')
+    funcs = hardware.load_pkcs11(lib)
+    slots = hardware.get_slots(funcs, token_present=True)
+    if not slots:
+        raise backends.BackendUnavailable('No token present in the reader')
+    return funcs, slots[0]
+
+
+def _with_apdu_driver(fn):
+    ''' Open a PC/SC (or direct-CCID) card, run fn(driver), guarantee cleanup. '''
+
+    from .cards import BTrustDriver
+    try:
+        cm = _open_card()
+        conn = cm.__enter__()
+    except Exception as e:
+        raise backends.BackendUnavailable(f'No card reachable over PC/SC or CCID: {e}')
+    try:
+        with conn.transaction():
+            return fn(BTrustDriver.create(conn))
+    finally:
+        cm.__exit__(None, None, None)
+
+
+def _dispatch(order, impls, what):
+    ''' Try each resolved backend in order '''
+
+    if not order:
+        raise backends.BackendUnavailable(f'no backend can {what} for this card')
+    last = None
+    for name in order:
+        impl = impls.get(name)
+        if impl is None:
+            continue                       # engine can't do this op (capability filtered)
+        try:
+            return impl()
+        except backends.BackendUnavailable as e:
+            last = e                        # engine unusable - safe to try the next
+            continue
+    raise last or backends.BackendUnavailable(f'no usable backend to {what}')
+
+
+def _order(op, atr, cfg):
+    return backends.resolve(op, atr=(atr or _detected_atr()), config=(cfg or _config))
+
+
+# --- public API -------------------------------------------------------------
+
+def change_pin(old_pin, new_pin, atr=None, cfg=None):
+    ''' Change the user PIN via whichever engine the card resolves to. '''
+
+    return _dispatch(_order(backends.OP_PIN, atr, cfg), {
+        'apdu':   lambda: _with_apdu_driver(lambda d: d.change_pin(old_pin, new_pin)),
+        'pkcs11': lambda: _pkcs11_change_pin(old_pin, new_pin, cfg),
+    }, 'change the PIN')
+
+
+def unblock_pin(puk, new_pin, atr=None, cfg=None):
+    ''' Unblock the PIN with the PUK via the resolved engine. '''
+
+    return _dispatch(_order(backends.OP_PIN, atr, cfg), {
+        'apdu':   lambda: _with_apdu_driver(lambda d: d.unblock_pin(puk, new_pin)),
+        'pkcs11': lambda: _pkcs11_unblock(puk, new_pin, cfg),
+    }, 'unblock the PIN')
+
+
+def change_puk(old_puk, new_puk, atr=None, cfg=None):
+    ''' Change the PUK. PKCS#11 only - the raw-APDU driver has no PUK-change
+        (it lacks the 'apdu' impl, so _dispatch routes straight to PKCS#11). '''
+
+    return _dispatch(_order(backends.OP_PIN, atr, cfg), {
+        'pkcs11': lambda: _pkcs11_change_puk(old_puk, new_puk, cfg),
+    }, 'change the PUK')
+
+
+def read_certificates(pin=None, atr=None, cfg=None):
+    ''' List certificates. APDU discovers public certs (no PIN); PKCS#11 logs in. '''
+
+    return _dispatch(_order(backends.OP_READ, atr, cfg), {
+        'apdu':   lambda: _with_apdu_driver(lambda d: d.discover_certificates()),
+        'pkcs11': lambda: _pkcs11_certs(pin, cfg),
+    }, 'read certificates')
+
+
+def import_certificate(cert_der, pin, atr=None, cfg=None):
+    ''' Write a certificate to the card. Only PKCS#11 advertises OP_MANAGE. '''
+
+    return _dispatch(_order(backends.OP_MANAGE, atr, cfg), {
+        'pkcs11': lambda: _pkcs11_write_cert(cert_der, pin, cfg),
+    }, 'import a certificate')
+
+
+def token_info(atr=None, cfg=None):
+    '''
+    A dict of token facts. Informational, so it prefers the richer PKCS#11
+    source and falls back to the APDU basics - it is not a security operation.
+    '''
+
+    resolved = set(_order(backends.OP_READ, atr, cfg))
+    order = [b for b in ('pkcs11', 'apdu') if b in resolved]
+    return _dispatch(order, {
+        'pkcs11': lambda: _pkcs11_token_info(cfg),
+        'apdu':   lambda: _apdu_token_info(atr),
+    }, 'read token info')
+
+
+# --- per-engine implementations ---------------------------------------------
+
+def _pkcs11_change_pin(old, new, cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    hardware.change_card_pin(funcs, slot_id=slot, old_pin=old, new_pin=new)
+
+
+def _pkcs11_unblock(puk, new, cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    hardware.unblock_card_pin(funcs, slot_id=slot, puk=puk, new_pin=new)
+
+
+def _pkcs11_change_puk(old, new, cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    hardware.change_card_puk(funcs, slot_id=slot, old_puk=old, new_puk=new)
+
+
+def _pkcs11_certs(pin, cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    return hardware.get_certificates(funcs, slot_id=slot, pin=pin)
+
+
+def _pkcs11_write_cert(cert_der, pin, cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    hardware.write_certificate(funcs, slot_id=slot, pin=pin, cert_der=cert_der)
+
+
+def _pkcs11_token_info(cfg):
+    funcs, slot = _pkcs11_session(cfg)
+    info = dict(hardware.get_token_info_extended(funcs, slot_id=slot))
+    info.setdefault('serial', hardware.get_token_serial_number(funcs, slot_id=slot))
+    return info
+
+
+def _apdu_token_info(atr):
+    return {'atr': (atr or _detected_atr()), 'engine': 'apdu',
+            'note': 'raw-APDU path: detailed token info needs PKCS#11'}

{pybiss-0.2.0 → pybiss-0.3.2}/src/ccid.py

@@ -189,7 +189,7 @@ def _find_usbfs() -> list[dict]:
             info['vid'] = _read_text(dev / 'idVendor') or '????'
             info['pid'] = _read_text(dev / 'idProduct') or '????'
             info['backend'] = 'usbfs'
-        except (OSError, ValueError):
+        except OSError, ValueError:
             continue
         out.append(info)
     return out

{pybiss-0.2.0 → pybiss-0.3.2}/src/chain_fetch.py

@@ -28,7 +28,7 @@ def ca_issuer_urls(cert_der: bytes) -> list[str]:
             tag, location = ad.read_tlv()           # accessLocation GeneralName
             if method == _CA_ISSUERS_METHOD and tag == _URI_TAG:
                 urls.append(location.decode('latin1'))
-    except (ValueError, IndexError):
+    except ValueError, IndexError:
         pass
     return urls
 
@@ -42,7 +42,7 @@ def _http_get(url: str, timeout: float) -> bytes | None:
     try:
         with urllib.request.urlopen(req, timeout=timeout) as resp:
             return resp.read(1 << 20)               # a CA cert is a few KB; cap at 1 MiB
-    except (urllib.error.URLError, OSError, ValueError):
+    except urllib.error.URLError, OSError, ValueError:
         return None
 
 

{pybiss-0.2.0 → pybiss-0.3.2}/src/dashboard.py

@@ -1,7 +1,7 @@
 import os, sys, logging, subprocess, tkinter as tk, base64, threading, queue
-from tkinter import filedialog, font as tkfont
+from tkinter import font as tkfont
 
-from . import detector, hardware, transport
+from . import detector, hardware, transport, card_service
 from .app import CERTS_DIR
 from .config import config
 from .i18n import _
@@ -9,7 +9,7 @@ from .app import app as api_server
 
 from .tkinter_mods import (
     Theme, Window, Button, Frame, Scrollbar, MessageBox, Toggle, Label,
-    set_dark_titlebar, Toplevel, Textbox, Listbox, Entry, Font
+    set_dark_titlebar, Toplevel, Textbox, Listbox, Entry, Font, FileDialog
 )
 from .ui_bridge import ui_task_queue, set_gui_active
 
@@ -446,7 +446,7 @@ class DesktopDashboard(Window):
             self.diag('[-] Run diagnostics first.')
             return
 
-        target = filedialog.askdirectory(title='Save diagnostics into...')
+        target = FileDialog.ask_directory(self, title='Save diagnostics into...')
         if not target:
             return
 
@@ -463,17 +463,6 @@ class DesktopDashboard(Window):
             self.diag('    Drop it in tests/fixtures/ for hardware-free replay tests.')
 
 
-    def _load_card(self):
-        ''' Loads the PKCS#11 library and returns (funcs, first_slot_id) '''
-
-        lib_path = config.get('pkcs11Path') or hardware.LIBCVP11_PATH
-        funcs = hardware.load_pkcs11(lib_path)
-        slots = hardware.get_slots(funcs, token_present=True)
-        if not slots:
-            raise Exception('No token present in the reader')
-        return funcs, slots[0]
-
-
     def _ui_change_pin(self):
 
         # ModalRenderer runs on the Tk main thread; get_ui_provider()'s proxy
@@ -484,8 +473,7 @@ class DesktopDashboard(Window):
         if not new_pin: return
 
         try:
-            funcs, slot = self._load_card()
-            hardware.change_card_pin(funcs, slot_id=slot, old_pin=old_pin, new_pin=new_pin)
+            card_service.change_pin(old_pin, new_pin)
             MessageBox.showinfo("Success", "PIN successfully changed.")
         except Exception as e:
             MessageBox.showinfo("Error", f"Failed to change PIN: {e}")
@@ -499,8 +487,7 @@ class DesktopDashboard(Window):
         if not new_pin: return
 
         try:
-            funcs, slot = self._load_card()
-            hardware.unblock_card_pin(funcs, slot_id=slot, puk=puk, new_pin=new_pin)
+            card_service.unblock_pin(puk, new_pin)
             MessageBox.showinfo("Success", "Card unblocked successfully.")
         except Exception as e:
             MessageBox.showinfo("Error", f"Failed to unblock card: {e}")
@@ -508,10 +495,10 @@ class DesktopDashboard(Window):
 
     def _ui_import_cert(self):
         
-        # Native OS File Dialog
-        filepath = filedialog.askopenfilename(
-            title="Select Certificate", 
-            filetypes=(("DER Certificates", "*.cer *.der *.crt"), ("All Files", "*.*"))
+        filepath = FileDialog.ask_open(
+            self,
+            title="Select Certificate",
+            filetypes=(("DER Certificates", ("*.cer", "*.der", "*.crt")), ("All files", ("*",)))
         )
         if not filepath: return
         
@@ -527,8 +514,7 @@ class DesktopDashboard(Window):
                 from .cert_parser import pem_to_der
                 cert_data = pem_to_der(cert_data)[0]
 
-            funcs, slot = self._load_card()
-            hardware.write_certificate(funcs, slot_id=slot, pin=pin, cert_der=cert_data)
+            card_service.import_certificate(cert_data, pin)
             MessageBox.showinfo("Success", "Certificate imported to smart card.")
         except Exception as e:
             MessageBox.showinfo("Error", f"Import failed: {e}")
@@ -945,8 +931,7 @@ class DesktopDashboard(Window):
             self.log_to_dashboard(f'    - {r}')
             
         try:
-            funcs, slot = self._load_card()
-            serial = hardware.get_token_serial_number(funcs, slot_id=slot)
+            serial = card_service.token_info().get('serial', 'n/a')
             self.log_to_dashboard(f'[+] Card Serial Number: {serial}')
             self.status_var.set(_('status_connected'))
         except Exception as e:
@@ -965,8 +950,7 @@ class DesktopDashboard(Window):
             return
 
         try:
-            funcs, slot = self._load_card()
-            certs = hardware.get_certificates(funcs, slot_id=slot, pin=pin)
+            certs = card_service.read_certificates(pin)
             if not certs:
                 self.log_to_dashboard('[-] No certificates found on card.')
                 return