tba-protocol-webauthn 0.4.0.dev2__py3-none-any.whl

tba_protocol_webauthn/extensions/registry.py

@@ -0,0 +1,68 @@
+"""Typed validation registry for WebAuthn extension inputs and outputs."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+
+ExtensionValidator = Callable[[object], object]
+
+
+def validate_appid(value: object) -> str:
+    if not isinstance(value, str) or not value.startswith("https://"):
+        raise ValueError("appid must be an HTTPS URL")
+    return value
+
+
+def validate_cred_props(value: object) -> bool:
+    if not isinstance(value, bool):
+        raise ValueError("credProps.rk must be boolean")
+    return value
+
+
+def validate_credential_protection(value: object) -> int:
+    if not isinstance(value, int) or value not in {1, 2, 3}:
+        raise ValueError("credentialProtectionPolicy is invalid")
+    return value
+
+
+def validate_large_blob(value: object) -> Mapping[str, object]:
+    if not isinstance(value, Mapping):
+        raise ValueError("largeBlob extension value must be an object")
+    if "supported" in value and not isinstance(value["supported"], bool):
+        raise ValueError("largeBlob.supported must be boolean")
+    return value
+
+
+def validate_payment(value: object) -> Mapping[str, object]:
+    if not isinstance(value, Mapping):
+        raise ValueError("payment extension value must be an object")
+    return value
+
+
+class ExtensionRegistry:
+    def __init__(self) -> None:
+        self._validators: dict[str, ExtensionValidator] = {
+            "appid": validate_appid,
+            "credProps": validate_cred_props,
+            "credentialProtectionPolicy": validate_credential_protection,
+            "largeBlob": validate_large_blob,
+            "payment": validate_payment,
+        }
+
+    def validate(
+        self, values: Mapping[str, object], *, allowed: frozenset[str]
+    ) -> dict[str, object]:
+        unknown = set(values).difference(allowed)
+        if unknown:
+            raise ValueError(f"WebAuthn extensions are not enabled: {sorted(unknown)}")
+        return {name: self._validators[name](value) for name, value in values.items()}
+
+
+__all__ = [
+    "ExtensionRegistry",
+    "validate_appid",
+    "validate_cred_props",
+    "validate_credential_protection",
+    "validate_large_blob",
+    "validate_payment",
+]

tba_protocol_webauthn/features.py

@@ -0,0 +1,41 @@
+from .versions import WebAuthnVersion
+
+
+class WebAuthnFeature:
+    """Feature-name constants used by versioned protocol configuration."""
+
+    REGISTRATION = "registration"
+    AUTHENTICATION = "authentication"
+    DISCOVERABLE_CREDENTIALS = "discoverable-credentials"
+    USER_VERIFICATION = "user-verification"
+    ATTESTATION = "attestation"
+    BACKUP_STATE = "backup-state"
+    JSON_SERIALIZATION = "json-serialization"
+    CONDITIONAL_MEDIATION = "conditional-mediation"
+    RELATED_ORIGINS = "related-origins"
+
+
+BASE_FEATURES = frozenset(
+    {
+        WebAuthnFeature.REGISTRATION,
+        WebAuthnFeature.AUTHENTICATION,
+        WebAuthnFeature.DISCOVERABLE_CREDENTIALS,
+        WebAuthnFeature.USER_VERIFICATION,
+        WebAuthnFeature.ATTESTATION,
+        WebAuthnFeature.BACKUP_STATE,
+    }
+)
+LEVEL_3_FEATURES = BASE_FEATURES | {
+    WebAuthnFeature.JSON_SERIALIZATION,
+    WebAuthnFeature.CONDITIONAL_MEDIATION,
+    WebAuthnFeature.RELATED_ORIGINS,
+}
+
+
+def features_for(version: str) -> frozenset[str]:
+    if version not in {WebAuthnVersion.LEVEL_2, WebAuthnVersion.LEVEL_3}:
+        raise ValueError(f"unsupported WebAuthn version: {version}")
+    return LEVEL_3_FEATURES if version == WebAuthnVersion.LEVEL_3 else BASE_FEATURES
+
+
+__all__ = ["BASE_FEATURES", "LEVEL_3_FEATURES", "WebAuthnFeature", "features_for"]

tba_protocol_webauthn/migrations.py

@@ -0,0 +1,23 @@
+from .versions import WebAuthnVersion, resolve_revision
+
+
+def migration_path(source: str, target: str) -> tuple[str, ...]:
+    source_version = resolve_revision(source).identifier
+    target_version = resolve_revision(target).identifier
+    if source_version == target_version:
+        return ()
+    if (
+        source_version == WebAuthnVersion.LEVEL_2
+        and target_version == WebAuthnVersion.LEVEL_3
+    ):
+        return (
+            "enable-level-3-json-serialization",
+            "enable-conditional-mediation-when-client-capable",
+            "configure-related-origin-policy-explicitly",
+        )
+    raise ValueError(
+        f"unsupported WebAuthn migration: {source_version} -> {target_version}"
+    )
+
+
+__all__ = ["migration_path"]

tba_protocol_webauthn/protocol.py

@@ -0,0 +1,40 @@
+"""Reportable WebAuthn protocol surface."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from tba_capability_public_key_authentication import (
+    PublicKeyAuthenticationCapability,
+)
+from tba_capability_public_key_registration import PublicKeyRegistrationCapability
+
+from .bindings import CAPABILITY_REQUIREMENTS
+from .configuration import WebAuthnConfiguration
+from .features import features_for
+from .versions import CURRENT_VERSION
+
+
+@dataclass(frozen=True, slots=True)
+class WebAuthnProtocol:
+    registration: PublicKeyRegistrationCapability
+    authentication: PublicKeyAuthenticationCapability
+    configuration: WebAuthnConfiguration = WebAuthnConfiguration()
+
+    def capability_report(self) -> dict[str, object]:
+        return {
+            "protocol": "webauthn",
+            "revision": CURRENT_VERSION.identifier,
+            "supported_features": tuple(
+                sorted(features_for(self.configuration.version))
+            ),
+            "enabled_features": tuple(sorted(self.configuration.enabled_features)),
+            "requirements": CAPABILITY_REQUIREMENTS,
+            "capabilities": {
+                "registration": self.registration.capability_report(),
+                "authentication": self.authentication.capability_report(),
+            },
+        }
+
+
+__all__ = ["WebAuthnProtocol"]

tba_protocol_webauthn/related_origins.py

@@ -0,0 +1,21 @@
+"""Explicit Level 3 related-origin policy."""
+
+from urllib.parse import urlsplit
+
+
+def origin_is_allowed(
+    origin: str, expected_origin: str, related_origins: tuple[str, ...] = ()
+) -> bool:
+    def normalized(value: str) -> str:
+        parsed = urlsplit(value)
+        if parsed.scheme != "https" or not parsed.hostname:
+            raise ValueError("related origins must be HTTPS origins")
+        return f"https://{parsed.netloc}"
+
+    supplied = normalized(origin)
+    return supplied == normalized(expected_origin) or supplied in {
+        normalized(value) for value in related_origins
+    }
+
+
+__all__ = ["origin_is_allowed"]

tba_protocol_webauthn/schemas.py

@@ -0,0 +1,29 @@
+"""Public versioned WebAuthn schema surface."""
+
+from .wire_schemas.common import (
+    AuthenticatorAssertionResponse,
+    AuthenticatorAttestationResponse,
+    AuthenticatorSelectionCriteria,
+    CollectedClientData,
+    PublicKeyCredential,
+    PublicKeyCredentialCreationOptions,
+    PublicKeyCredentialDescriptor,
+    PublicKeyCredentialParameters,
+    PublicKeyCredentialRequestOptions,
+    PublicKeyCredentialRpEntity,
+    PublicKeyCredentialUserEntity,
+)
+
+__all__ = [
+    "AuthenticatorAssertionResponse",
+    "AuthenticatorAttestationResponse",
+    "AuthenticatorSelectionCriteria",
+    "CollectedClientData",
+    "PublicKeyCredential",
+    "PublicKeyCredentialCreationOptions",
+    "PublicKeyCredentialDescriptor",
+    "PublicKeyCredentialParameters",
+    "PublicKeyCredentialRequestOptions",
+    "PublicKeyCredentialRpEntity",
+    "PublicKeyCredentialUserEntity",
+]

tba_protocol_webauthn/versions.py

@@ -0,0 +1,54 @@
+from dataclasses import dataclass
+
+
+class WebAuthnVersion:
+    """String constants; version history remains owned by this protocol package."""
+
+    LEVEL_2 = "level-2"
+    LEVEL_3 = "level-3"
+
+
+@dataclass(frozen=True, slots=True)
+class WebAuthnRevision:
+    version: str
+    publication_date: str
+    status: str
+    specification_uri: str
+
+    @property
+    def identifier(self) -> str:
+        return self.version
+
+
+WEB_AUTHN_REVISIONS = {
+    WebAuthnVersion.LEVEL_2: WebAuthnRevision(
+        WebAuthnVersion.LEVEL_2,
+        "2021-04-08",
+        "W3C Recommendation",
+        "https://www.w3.org/TR/webauthn-2/",
+    ),
+    WebAuthnVersion.LEVEL_3: WebAuthnRevision(
+        WebAuthnVersion.LEVEL_3,
+        "2026-05-26",
+        "W3C Candidate Recommendation Snapshot",
+        "https://www.w3.org/TR/webauthn-3/",
+    ),
+}
+
+CURRENT_VERSION = WEB_AUTHN_REVISIONS[WebAuthnVersion.LEVEL_2]
+
+
+def resolve_revision(value: str) -> WebAuthnRevision:
+    try:
+        return WEB_AUTHN_REVISIONS[value]
+    except KeyError as exc:
+        raise ValueError(f"unsupported WebAuthn version: {value}") from exc
+
+
+__all__ = [
+    "CURRENT_VERSION",
+    "WEB_AUTHN_REVISIONS",
+    "WebAuthnRevision",
+    "WebAuthnVersion",
+    "resolve_revision",
+]

tba_protocol_webauthn/wire_schemas/__init__.py

@@ -0,0 +1,27 @@
+from .common import (
+    AuthenticatorAssertionResponse,
+    AuthenticatorAttestationResponse,
+    AuthenticatorSelectionCriteria,
+    CollectedClientData,
+    PublicKeyCredential,
+    PublicKeyCredentialCreationOptions,
+    PublicKeyCredentialDescriptor,
+    PublicKeyCredentialParameters,
+    PublicKeyCredentialRequestOptions,
+    PublicKeyCredentialRpEntity,
+    PublicKeyCredentialUserEntity,
+)
+
+__all__ = [
+    "AuthenticatorAssertionResponse",
+    "AuthenticatorAttestationResponse",
+    "AuthenticatorSelectionCriteria",
+    "CollectedClientData",
+    "PublicKeyCredential",
+    "PublicKeyCredentialCreationOptions",
+    "PublicKeyCredentialDescriptor",
+    "PublicKeyCredentialParameters",
+    "PublicKeyCredentialRequestOptions",
+    "PublicKeyCredentialRpEntity",
+    "PublicKeyCredentialUserEntity",
+]

tba_protocol_webauthn/wire_schemas/common.py

@@ -0,0 +1,113 @@
+"""W3C WebAuthn wire structures represented with byte-preserving values."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialRpEntity:
+    id: str
+    name: str
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialUserEntity:
+    id: bytes
+    name: str
+    display_name: str
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialParameters:
+    alg: int
+    type: str = "public-key"
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialDescriptor:
+    id: bytes
+    type: str = "public-key"
+    transports: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class AuthenticatorSelectionCriteria:
+    authenticator_attachment: str | None = None
+    resident_key: str = "preferred"
+    require_resident_key: bool = False
+    user_verification: str = "preferred"
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialCreationOptions:
+    challenge: bytes
+    rp: PublicKeyCredentialRpEntity
+    user: PublicKeyCredentialUserEntity
+    pub_key_cred_params: tuple[PublicKeyCredentialParameters, ...]
+    timeout: int | None = None
+    exclude_credentials: tuple[PublicKeyCredentialDescriptor, ...] = ()
+    authenticator_selection: AuthenticatorSelectionCriteria | None = None
+    attestation: str = "none"
+    extensions: Mapping[str, object] = field(default_factory=dict)
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredentialRequestOptions:
+    challenge: bytes
+    timeout: int | None = None
+    rp_id: str | None = None
+    allow_credentials: tuple[PublicKeyCredentialDescriptor, ...] = ()
+    user_verification: str = "preferred"
+    extensions: Mapping[str, object] = field(default_factory=dict)
+    hints: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class CollectedClientData:
+    type: str
+    challenge: str
+    origin: str
+    cross_origin: bool = False
+    top_origin: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class AuthenticatorAttestationResponse:
+    client_data_json: bytes
+    attestation_object: bytes
+    transports: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class AuthenticatorAssertionResponse:
+    client_data_json: bytes
+    authenticator_data: bytes
+    signature: bytes
+    user_handle: bytes | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class PublicKeyCredential:
+    id: str
+    raw_id: bytes
+    response: AuthenticatorAttestationResponse | AuthenticatorAssertionResponse
+    type: str = "public-key"
+    authenticator_attachment: str | None = None
+    client_extension_results: Mapping[str, object] = field(default_factory=dict)
+
+
+__all__ = [
+    "AuthenticatorAssertionResponse",
+    "AuthenticatorAttestationResponse",
+    "AuthenticatorSelectionCriteria",
+    "CollectedClientData",
+    "PublicKeyCredential",
+    "PublicKeyCredentialCreationOptions",
+    "PublicKeyCredentialDescriptor",
+    "PublicKeyCredentialParameters",
+    "PublicKeyCredentialRequestOptions",
+    "PublicKeyCredentialRpEntity",
+    "PublicKeyCredentialUserEntity",
+]

tba_protocol_webauthn/wire_schemas/level2.py

@@ -0,0 +1,29 @@
+"""WebAuthn Level 2 schema surface."""
+
+from .common import (
+    AuthenticatorAssertionResponse,
+    AuthenticatorAttestationResponse,
+    AuthenticatorSelectionCriteria,
+    CollectedClientData,
+    PublicKeyCredential,
+    PublicKeyCredentialCreationOptions,
+    PublicKeyCredentialDescriptor,
+    PublicKeyCredentialParameters,
+    PublicKeyCredentialRequestOptions,
+    PublicKeyCredentialRpEntity,
+    PublicKeyCredentialUserEntity,
+)
+
+__all__ = [
+    "AuthenticatorAssertionResponse",
+    "AuthenticatorAttestationResponse",
+    "AuthenticatorSelectionCriteria",
+    "CollectedClientData",
+    "PublicKeyCredential",
+    "PublicKeyCredentialCreationOptions",
+    "PublicKeyCredentialDescriptor",
+    "PublicKeyCredentialParameters",
+    "PublicKeyCredentialRequestOptions",
+    "PublicKeyCredentialRpEntity",
+    "PublicKeyCredentialUserEntity",
+]

tba_protocol_webauthn/wire_schemas/level3.py

@@ -0,0 +1,29 @@
+"""WebAuthn Level 3 schema surface; additional behavior is feature-gated."""
+
+from .level2 import (
+    AuthenticatorAssertionResponse,
+    AuthenticatorAttestationResponse,
+    AuthenticatorSelectionCriteria,
+    CollectedClientData,
+    PublicKeyCredential,
+    PublicKeyCredentialCreationOptions,
+    PublicKeyCredentialDescriptor,
+    PublicKeyCredentialParameters,
+    PublicKeyCredentialRequestOptions,
+    PublicKeyCredentialRpEntity,
+    PublicKeyCredentialUserEntity,
+)
+
+__all__ = [
+    "AuthenticatorAssertionResponse",
+    "AuthenticatorAttestationResponse",
+    "AuthenticatorSelectionCriteria",
+    "CollectedClientData",
+    "PublicKeyCredential",
+    "PublicKeyCredentialCreationOptions",
+    "PublicKeyCredentialDescriptor",
+    "PublicKeyCredentialParameters",
+    "PublicKeyCredentialRequestOptions",
+    "PublicKeyCredentialRpEntity",
+    "PublicKeyCredentialUserEntity",
+]

tba_protocol_webauthn-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,27 @@
+Metadata-Version: 2.4
+Name: tba-protocol-webauthn
+Version: 0.4.0.dev2
+Summary: Versioned W3C Web Authentication relying-party protocol implementation.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: cbor2 (==6.1.3)
+Requires-Dist: tba-capability-public-key-authentication (==0.4.0.dev2)
+Requires-Dist: tba-capability-public-key-registration (==0.4.0.dev2)
+Requires-Dist: tba-concrete-cose (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
+Requires-Dist: tba-provider-cose-cryptography (==0.4.0.dev2)
+Description-Content-Type: text/markdown
+
+# tba-protocol-webauthn
+
+Versioned W3C WebAuthn relying-party schemas, codecs, registration verification, authentication verification, feature selection, and capability bindings.
+
+This package does not implement CTAP transports or durable storage.
+

tba_protocol_webauthn-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,33 @@
+tba_protocol_webauthn/__init__.py,sha256=nYDWfgjqsFK10COJ3k3kN6kp_erTjBOHYBma2soKPmM,3722
+tba_protocol_webauthn/attestation/__init__.py,sha256=-yDXKkd41PuwvN5EjITsnVb0bRxkQvNKJX_TYxDkhHY,249
+tba_protocol_webauthn/attestation/adapters.py,sha256=FSY8g2vw8BgLDb8i88vvNiQG7NCu5fLbip7h_Q8pzIM,1596
+tba_protocol_webauthn/attestation/registry.py,sha256=GgvGYPVZyumLO4WVs0KoPJmccoZlBvuWJL-W-z8s7O0,1883
+tba_protocol_webauthn/bindings.py,sha256=N2gRryTBOcrj83j8gwNEG1hATiz35yP2Ppw7YIlQELo,1535
+tba_protocol_webauthn/ceremonies/__init__.py,sha256=yf1tXHjovfo5eiJMtNVdS5w4BnYLyRQaTL5u9RvybNY,519
+tba_protocol_webauthn/ceremonies/authentication.py,sha256=6FatOwG-wJGZVMumn-vgpwNJuTkSFohE3tUdmDEV2Mw,6056
+tba_protocol_webauthn/ceremonies/registration.py,sha256=h8v3_cDkFBuO7WztrD6OQZ4W0aj_mWdmXt-GbgzirGI,8410
+tba_protocol_webauthn/claims.py,sha256=2jMEjSZ4RiMaUW9TR6udTS6P198w_p7WMpV4xsiB43c,145
+tba_protocol_webauthn/codecs/__init__.py,sha256=adQ3NI9Xrin8xJopRrJtZBz82sPYpOuICec89SuxYdw,674
+tba_protocol_webauthn/codecs/attestation_object.py,sha256=VwITXFxeH0aqnIycdifNNL9nZ7aK6t1cTfAwcjr7g0U,1772
+tba_protocol_webauthn/codecs/authenticator_data.py,sha256=DHF1x5l_V8VAZsYKFEJrg6oDsOpuzwOAtSW84WiC9nI,3873
+tba_protocol_webauthn/codecs/client_data.py,sha256=hnCI9O1Vp0dRTo_VsWMx_HJHvEECKxiAJ6v4oTHkmcc,3590
+tba_protocol_webauthn/codecs/credential_public_key.py,sha256=JXkUj2xxP8D8_Fxi6cKtqwx85LTQnCjWMjk2_G5_rb8,224
+tba_protocol_webauthn/compatibility.py,sha256=ZvQT6YJkGT3zSA1_wU8lVoWw4SWp8pDDCa_0u-2WiGE,284
+tba_protocol_webauthn/configuration.py,sha256=M5nxrDF1lja-ArjO17rnaisOi3mTkuNW1kV2zYqSdXc,1135
+tba_protocol_webauthn/errors.py,sha256=CyQXnWZRiupEdFMLETv_ly0-aT8sjcMpSO7zSUBCn2s,631
+tba_protocol_webauthn/extensions/__init__.py,sha256=31N9MOqbbZcLCcsvN6UzxKGihiethGR4Jm12HBtpq34,355
+tba_protocol_webauthn/extensions/registry.py,sha256=E5BX463p-VcTcMGBfKzJ_DXTRFEq1xdkBtPIFxS-awU,2194
+tba_protocol_webauthn/features.py,sha256=O3mJ8TyJRskrqdzSTvanszcASqfok14HtlVBIMZrr4M,1330
+tba_protocol_webauthn/migrations.py,sha256=RulW7sNxuep_mSulHtj_fGn8YQxXXyZmJmgI3x7WnsA,753
+tba_protocol_webauthn/protocol.py,sha256=2B_4hA9FbV64FWLF3Afp-EeYjZ9_8dPb2N4-7P-4e4E,1349
+tba_protocol_webauthn/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_protocol_webauthn/related_origins.py,sha256=QDs9E3QGEcEb2MXJI8SFZe2was7VLYNYm0IG0mx8OLM,636
+tba_protocol_webauthn/schemas.py,sha256=vWIcfx6oxqE0HY2zEJlqXCFk2dc-2XxeI974MKNYOoI,877
+tba_protocol_webauthn/versions.py,sha256=WTe4lJDrEU9g4AStll6Bvs7zr4grEIf-uiqIzy4qPEE,1243
+tba_protocol_webauthn/wire_schemas/__init__.py,sha256=pTcT6YUn2GRcWJsIj54uCpBtVoKmAu7aAoYk9TQrRvo,815
+tba_protocol_webauthn/wire_schemas/common.py,sha256=NkhH_HMnoYck0QYNrI7DC4924cYzC02zxwaKLwI8va4,3097
+tba_protocol_webauthn/wire_schemas/level2.py,sha256=lXIzQtZtjijhK93aJJXSGBey4xP25Jb9ctAQZWR83wE,855
+tba_protocol_webauthn/wire_schemas/level3.py,sha256=V69uaDDPXn1bDYFspKZT3f_-hvO42wurxmjiQ437nSc,893
+tba_protocol_webauthn-0.4.0.dev2.dist-info/METADATA,sha256=OC7vHYTSzT33DVv9fUn72rSQ3jxzBaPlNYOUBQVejIw,1192
+tba_protocol_webauthn-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_protocol_webauthn-0.4.0.dev2.dist-info/RECORD,,

tba_protocol_webauthn-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any