tba-profile-fido2-server 0.4.0.dev2__tar.gz

tba_profile_fido2_server-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,21 @@
+Metadata-Version: 2.4
+Name: tba-profile-fido2-server
+Version: 0.4.0.dev2
+Summary: Versioned FIDO2 server requirement and capability profile.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-protocol-webauthn (==0.4.0.dev2)
+Description-Content-Type: text/markdown
+
+# tba-profile-fido2-server
+
+Aggregates versioned WebAuthn, authenticator, algorithm, attestation, metadata,
+and certification requirements. It does not implement CTAP transports.
+

tba_profile_fido2_server-0.4.0.dev2/README.md

@@ -0,0 +1,4 @@
+# tba-profile-fido2-server
+
+Aggregates versioned WebAuthn, authenticator, algorithm, attestation, metadata,
+and certification requirements. It does not implement CTAP transports.

tba_profile_fido2_server-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,15 @@
+[project]
+name = "tba-profile-fido2-server"
+version = "0.4.0.dev2"
+description = "Versioned FIDO2 server requirement and capability profile."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = ["tba-protocol-webauthn==0.4.0.dev2", "tba-contracts-identity==0.4.0.dev2"]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_profile_fido2_server", from = "src" }]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/__init__.py

@@ -0,0 +1,44 @@
+from .algorithm_profile import (
+    RECOMMENDED_ALGORITHMS,
+    REQUIRED_ALGORITHMS,
+    algorithm_is_profiled,
+)
+from .attestation_profile import (
+    BASELINE_ATTESTATION_FORMATS,
+    CERTIFICATION_ATTESTATION_FORMATS,
+)
+from .bindings import CAPABILITY_REQUIREMENTS
+from .certification import CertificationEvidence, certification_claimable
+from .claims import CLAIM_NAMES
+from .compatibility import compatible_revisions
+from .errors import Fido2ServerProfileError
+from .features import SERVER_FEATURES
+from .metadata_profile import DEFAULT_METADATA_PROFILE, MetadataProfile
+from .migrations import migration_path
+from .requirements import DEFAULT_REQUIREMENTS, Fido2ServerRequirements
+from .schemas import Fido2ServerProfile
+from .versions import CURRENT_VERSION, FIDO2_SERVER_1_0, Fido2ServerRevision
+
+__all__ = [
+    "BASELINE_ATTESTATION_FORMATS",
+    "CAPABILITY_REQUIREMENTS",
+    "CERTIFICATION_ATTESTATION_FORMATS",
+    "CURRENT_VERSION",
+    "CertificationEvidence",
+    "CLAIM_NAMES",
+    "DEFAULT_METADATA_PROFILE",
+    "DEFAULT_REQUIREMENTS",
+    "FIDO2_SERVER_1_0",
+    "Fido2ServerProfile",
+    "Fido2ServerProfileError",
+    "Fido2ServerRequirements",
+    "Fido2ServerRevision",
+    "MetadataProfile",
+    "RECOMMENDED_ALGORITHMS",
+    "REQUIRED_ALGORITHMS",
+    "SERVER_FEATURES",
+    "algorithm_is_profiled",
+    "certification_claimable",
+    "compatible_revisions",
+    "migration_path",
+]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/algorithm_profile.py

@@ -0,0 +1,9 @@
+REQUIRED_ALGORITHMS = (-7,)
+RECOMMENDED_ALGORITHMS = (-7, -8, -257)
+
+
+def algorithm_is_profiled(algorithm: int) -> bool:
+    return algorithm in RECOMMENDED_ALGORITHMS
+
+
+__all__ = ["RECOMMENDED_ALGORITHMS", "REQUIRED_ALGORITHMS", "algorithm_is_profiled"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/attestation_profile.py

@@ -0,0 +1,9 @@
+BASELINE_ATTESTATION_FORMATS = ("none", "packed", "fido-u2f")
+CERTIFICATION_ATTESTATION_FORMATS = BASELINE_ATTESTATION_FORMATS + (
+    "tpm",
+    "android-key",
+    "android-safetynet",
+    "apple",
+)
+
+__all__ = ["BASELINE_ATTESTATION_FORMATS", "CERTIFICATION_ATTESTATION_FORMATS"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/bindings.py

@@ -0,0 +1,3 @@
+from .capability_map import CAPABILITY_REQUIREMENTS
+
+__all__ = ["CAPABILITY_REQUIREMENTS"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/capability_map.py

@@ -0,0 +1,36 @@
+from tba_contracts_identity.capabilities import ProtocolCapabilityRequirement
+
+from .versions import CURRENT_VERSION
+
+CAPABILITY_REQUIREMENTS = (
+    ProtocolCapabilityRequirement(
+        "fido2-server",
+        CURRENT_VERSION.identifier,
+        "registration",
+        "WebAuthn registration",
+        "credential.public-key.registration",
+        "complete_public_key_registration",
+        "verified-public-key-registration",
+    ),
+    ProtocolCapabilityRequirement(
+        "fido2-server",
+        CURRENT_VERSION.identifier,
+        "authentication",
+        "WebAuthn assertion",
+        "credential.public-key.authentication",
+        "complete_public_key_authentication",
+        "verified-public-key-assertion",
+    ),
+    ProtocolCapabilityRequirement(
+        "fido2-server",
+        CURRENT_VERSION.identifier,
+        "metadata",
+        "AAGUID metadata",
+        "authenticator.attestation",
+        "resolve_authenticator_metadata",
+        "authenticator-metadata",
+        required=False,
+    ),
+)
+
+__all__ = ["CAPABILITY_REQUIREMENTS"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/certification.py

@@ -0,0 +1,16 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class CertificationEvidence:
+    conformance_suite: str
+    version: str
+    passed: bool
+    evidence_uri: str | None = None
+
+
+def certification_claimable(evidence: CertificationEvidence | None) -> bool:
+    return bool(evidence and evidence.passed and evidence.evidence_uri)
+
+
+__all__ = ["CertificationEvidence", "certification_claimable"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/claims.py

@@ -0,0 +1,5 @@
+"""FIDO2 server requirements do not define identity claims."""
+
+CLAIM_NAMES: tuple[str, ...] = ()
+
+__all__ = ["CLAIM_NAMES"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/compatibility.py

@@ -0,0 +1,10 @@
+from .versions import CURRENT_VERSION, Fido2ServerRevision
+
+
+def compatible_revisions(
+    source: Fido2ServerRevision, target: Fido2ServerRevision = CURRENT_VERSION
+) -> bool:
+    return source.webauthn_revision == target.webauthn_revision
+
+
+__all__ = ["compatible_revisions"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/errors.py

@@ -0,0 +1,5 @@
+class Fido2ServerProfileError(ValueError):
+    pass
+
+
+__all__ = ["Fido2ServerProfileError"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/features.py

@@ -0,0 +1,14 @@
+SERVER_FEATURES = frozenset(
+    {
+        "registration",
+        "authentication",
+        "discoverable-credentials",
+        "user-verification",
+        "backup-state",
+        "attestation-policy",
+        "metadata-status",
+        "credential-management",
+    }
+)
+
+__all__ = ["SERVER_FEATURES"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/metadata_profile.py

@@ -0,0 +1,14 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class MetadataProfile:
+    service_identifier: str = "fido-mds"
+    signed_blob_required: bool = True
+    reject_compromised_authenticators: bool = True
+    cache_until_next_update: bool = True
+
+
+DEFAULT_METADATA_PROFILE = MetadataProfile()
+
+__all__ = ["DEFAULT_METADATA_PROFILE", "MetadataProfile"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/migrations.py

@@ -0,0 +1,9 @@
+def migration_path(source: str, target: str) -> tuple[str, ...]:
+    if source == target:
+        return ()
+    raise ValueError(
+        f"unsupported FIDO2 server profile migration: {source} -> {target}"
+    )
+
+
+__all__ = ["migration_path"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/py.typed

@@ -0,0 +1 @@
+

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/requirements.py

@@ -0,0 +1,19 @@
+from dataclasses import dataclass
+
+from .algorithm_profile import REQUIRED_ALGORITHMS
+from .attestation_profile import BASELINE_ATTESTATION_FORMATS
+from .versions import CURRENT_VERSION
+
+
+@dataclass(frozen=True, slots=True)
+class Fido2ServerRequirements:
+    revision: str = CURRENT_VERSION.identifier
+    webauthn_revision: str = CURRENT_VERSION.webauthn_revision
+    required_algorithms: tuple[int, ...] = REQUIRED_ALGORITHMS
+    attestation_formats: tuple[str, ...] = BASELINE_ATTESTATION_FORMATS
+    direct_ctap_transport: bool = False
+
+
+DEFAULT_REQUIREMENTS = Fido2ServerRequirements()
+
+__all__ = ["DEFAULT_REQUIREMENTS", "Fido2ServerRequirements"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/schemas.py

@@ -0,0 +1,13 @@
+from dataclasses import dataclass
+
+from .requirements import Fido2ServerRequirements
+
+
+@dataclass(frozen=True, slots=True)
+class Fido2ServerProfile:
+    requirements: Fido2ServerRequirements = Fido2ServerRequirements()
+    metadata_enabled: bool = False
+    certification_evidence_uri: str | None = None
+
+
+__all__ = ["Fido2ServerProfile"]

tba_profile_fido2_server-0.4.0.dev2/src/tba_profile_fido2_server/versions.py

@@ -0,0 +1,22 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class Fido2ServerRevision:
+    identifier: str
+    webauthn_revision: str
+    ctap_authenticator_revisions: tuple[str, ...]
+    status: str
+    specification_uri: str
+
+
+FIDO2_SERVER_1_0 = Fido2ServerRevision(
+    "fido2-server-1.0",
+    "level-2",
+    ("CTAP 2.0", "CTAP 2.1"),
+    "implementation profile",
+    "https://fidoalliance.org/specifications/",
+)
+CURRENT_VERSION = FIDO2_SERVER_1_0
+
+__all__ = ["CURRENT_VERSION", "FIDO2_SERVER_1_0", "Fido2ServerRevision"]