tba-router-webauthn 0.4.0.dev2__tar.gz

tba_router_webauthn-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.4
+Name: tba-router-webauthn
+Version: 0.4.0.dev2
+Summary: HTTPS carrier binding for WebAuthn ceremonies.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: pydantic (>=2.0)
+Requires-Dist: tba-protocol-webauthn (==0.4.0.dev2)
+Requires-Dist: tigrbl (==0.4.5.dev8)
+Description-Content-Type: text/markdown
+
+# tba-router-webauthn
+
+Application HTTPS carrier mapping for WebAuthn. Cryptographic and ceremony
+verification remain owned by the versioned layer-50 protocol package.
+

tba_router_webauthn-0.4.0.dev2/README.md

@@ -0,0 +1,4 @@
+# tba-router-webauthn
+
+Application HTTPS carrier mapping for WebAuthn. Cryptographic and ceremony
+verification remain owned by the versioned layer-50 protocol package.

tba_router_webauthn-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,19 @@
+[project]
+name = "tba-router-webauthn"
+version = "0.4.0.dev2"
+description = "HTTPS carrier binding for WebAuthn ceremonies."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "pydantic>=2.0",
+    "tigrbl==0.4.5.dev8",
+    "tba-protocol-webauthn==0.4.0.dev2",
+]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_router_webauthn", from = "src" }]

tba_router_webauthn-0.4.0.dev2/src/tba_router_webauthn/__init__.py

@@ -0,0 +1,5 @@
+from .binding import *
+from .schemas import *
+from .serialization import *
+
+__all__ = [name for name in globals() if not name.startswith("_")]

tba_router_webauthn-0.4.0.dev2/src/tba_router_webauthn/binding.py

@@ -0,0 +1,134 @@
+"""Tigrbl route binding for WebAuthn semantic operations."""
+
+from __future__ import annotations
+
+import inspect
+from collections.abc import Callable
+
+from tigrbl import Request, TigrblApp, TigrblRouter
+
+from .schemas import (
+    AuthenticationOptionsIn,
+    PublicKeyCredentialIn,
+    RegistrationOptionsIn,
+    RenameCredentialIn,
+)
+from .serialization import parse_public_key_credential, to_json_value
+
+
+async def _call(target: Callable[..., object], **kwargs: object) -> object:
+    value = target(**kwargs)
+    return await value if inspect.isawaitable(value) else value
+
+
+def build_webauthn_router(
+    *,
+    begin_public_key_registration: Callable[..., object],
+    complete_public_key_registration: Callable[..., object],
+    begin_public_key_authentication: Callable[..., object],
+    complete_public_key_authentication: Callable[..., object],
+    list_public_key_credentials: Callable[..., object] | None = None,
+    rename_public_key_credential: Callable[..., object] | None = None,
+    revoke_public_key_credential: Callable[..., object] | None = None,
+) -> TigrblRouter:
+    router = TigrblRouter()
+
+    @router.route("/webauthn/registration/options", methods=["POST"])
+    async def registration_options(
+        request: Request, body: RegistrationOptionsIn | None = None
+    ):
+        body = body or RegistrationOptionsIn.model_validate(await request.json() or {})
+        result = await _call(
+            begin_public_key_registration,
+            request=request,
+            user_name=body.user_name,
+            display_name=body.display_name,
+        )
+        return to_json_value(result)
+
+    @router.route("/webauthn/registration/complete", methods=["POST"])
+    async def registration_complete(
+        request: Request, body: PublicKeyCredentialIn | None = None
+    ):
+        body = body or PublicKeyCredentialIn.model_validate(await request.json() or {})
+        result = await _call(
+            complete_public_key_registration,
+            request=request,
+            credential=parse_public_key_credential(body),
+        )
+        return to_json_value(result)
+
+    @router.route("/webauthn/authentication/options", methods=["POST"])
+    async def authentication_options(
+        request: Request, body: AuthenticationOptionsIn | None = None
+    ):
+        body = body or AuthenticationOptionsIn.model_validate(
+            await request.json() or {}
+        )
+        result = await _call(
+            begin_public_key_authentication,
+            request=request,
+            user_name=body.user_name,
+            conditional=body.conditional,
+        )
+        return to_json_value(result)
+
+    @router.route("/webauthn/authentication/complete", methods=["POST"])
+    async def authentication_complete(
+        request: Request, body: PublicKeyCredentialIn | None = None
+    ):
+        body = body or PublicKeyCredentialIn.model_validate(await request.json() or {})
+        result = await _call(
+            complete_public_key_authentication,
+            request=request,
+            credential=parse_public_key_credential(body),
+        )
+        return to_json_value(result)
+
+    if list_public_key_credentials is not None:
+
+        @router.route("/webauthn/credentials", methods=["GET"])
+        async def credential_list(request: Request):
+            return to_json_value(
+                await _call(list_public_key_credentials, request=request)
+            )
+
+    if rename_public_key_credential is not None:
+
+        @router.route("/webauthn/credentials/{credential_id}", methods=["PATCH"])
+        async def credential_rename(
+            request: Request, credential_id: str, body: RenameCredentialIn | None = None
+        ):
+            body = body or RenameCredentialIn.model_validate(await request.json() or {})
+            return to_json_value(
+                await _call(
+                    rename_public_key_credential,
+                    request=request,
+                    credential_id=credential_id,
+                    display_name=body.display_name,
+                )
+            )
+
+    if revoke_public_key_credential is not None:
+
+        @router.route("/webauthn/credentials/{credential_id}", methods=["DELETE"])
+        async def credential_revoke(request: Request, credential_id: str):
+            return to_json_value(
+                await _call(
+                    revoke_public_key_credential,
+                    request=request,
+                    credential_id=credential_id,
+                )
+            )
+
+    return router
+
+
+def include_webauthn_endpoints(
+    app: TigrblApp, router: TigrblRouter, *, enabled: bool = True
+) -> None:
+    if enabled:
+        app.include_router(router)
+
+
+__all__ = ["build_webauthn_router", "include_webauthn_endpoints"]

tba_router_webauthn-0.4.0.dev2/src/tba_router_webauthn/py.typed

@@ -0,0 +1 @@
+

tba_router_webauthn-0.4.0.dev2/src/tba_router_webauthn/schemas.py

@@ -0,0 +1,52 @@
+"""WebAuthn application/JSON carrier envelopes."""
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class RegistrationOptionsIn(BaseModel):
+    user_name: str = Field(min_length=1, max_length=320)
+    display_name: str = Field(min_length=1, max_length=320)
+
+
+class AuthenticationOptionsIn(BaseModel):
+    user_name: str | None = Field(default=None, max_length=320)
+    conditional: bool = False
+
+
+class CredentialResponseIn(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    client_data_json: str = Field(alias="clientDataJSON")
+    attestation_object: str | None = Field(default=None, alias="attestationObject")
+    authenticator_data: str | None = Field(default=None, alias="authenticatorData")
+    signature: str | None = None
+    user_handle: str | None = Field(default=None, alias="userHandle")
+    transports: tuple[str, ...] = ()
+
+
+class PublicKeyCredentialIn(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    id: str
+    raw_id: str = Field(alias="rawId")
+    type: str = "public-key"
+    response: CredentialResponseIn
+    authenticator_attachment: str | None = Field(
+        default=None, alias="authenticatorAttachment"
+    )
+    client_extension_results: dict[str, object] = Field(
+        default_factory=dict, alias="clientExtensionResults"
+    )
+
+
+class RenameCredentialIn(BaseModel):
+    display_name: str = Field(min_length=1, max_length=120)
+
+
+__all__ = [
+    "AuthenticationOptionsIn",
+    "CredentialResponseIn",
+    "PublicKeyCredentialIn",
+    "RegistrationOptionsIn",
+    "RenameCredentialIn",
+]

tba_router_webauthn-0.4.0.dev2/src/tba_router_webauthn/serialization.py

@@ -0,0 +1,105 @@
+"""Byte-preserving application/JSON conversion for WebAuthn values."""
+
+from __future__ import annotations
+
+import base64
+import re
+from dataclasses import fields, is_dataclass
+from enum import Enum
+
+from tba_protocol_webauthn import (
+    AuthenticatorAssertionResponse,
+    AuthenticatorAttestationResponse,
+    PublicKeyCredential,
+)
+
+from .schemas import PublicKeyCredentialIn
+
+
+def encode_base64url(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")
+
+
+def decode_base64url(value: str) -> bytes:
+    if not isinstance(value, str) or not value:
+        raise ValueError("a non-empty base64url value is required")
+    if not re.fullmatch(r"[A-Za-z0-9_-]+", value):
+        raise ValueError("invalid base64url value")
+    try:
+        return base64.b64decode(
+            value + "=" * (-len(value) % 4), altchars=b"-_", validate=True
+        )
+    except Exception as exc:
+        raise ValueError("invalid base64url value") from exc
+
+
+def to_json_value(value: object) -> object:
+    if isinstance(value, bytes):
+        return encode_base64url(value)
+    if isinstance(value, Enum):
+        return value.value
+    if is_dataclass(value):
+        output: dict[str, object] = {}
+        for item in fields(value):
+            key = {
+                "raw_id": "rawId",
+                "rp_id": "rpId",
+                "pub_key_cred_params": "pubKeyCredParams",
+                "exclude_credentials": "excludeCredentials",
+                "allow_credentials": "allowCredentials",
+                "authenticator_selection": "authenticatorSelection",
+                "authenticator_attachment": "authenticatorAttachment",
+                "resident_key": "residentKey",
+                "require_resident_key": "requireResidentKey",
+                "user_verification": "userVerification",
+                "display_name": "displayName",
+            }.get(item.name, item.name)
+            item_value = getattr(value, item.name)
+            if item_value is not None and item_value not in ((), {}):
+                output[key] = to_json_value(item_value)
+        return output
+    if isinstance(value, dict):
+        return {str(key): to_json_value(item) for key, item in value.items()}
+    if isinstance(value, (tuple, list)):
+        return [to_json_value(item) for item in value]
+    return value
+
+
+def parse_public_key_credential(value: PublicKeyCredentialIn) -> PublicKeyCredential:
+    raw_id = decode_base64url(value.raw_id)
+    body = value.response
+    if body.attestation_object is not None:
+        response = AuthenticatorAttestationResponse(
+            client_data_json=decode_base64url(body.client_data_json),
+            attestation_object=decode_base64url(body.attestation_object),
+            transports=body.transports,
+        )
+    elif body.authenticator_data is not None and body.signature is not None:
+        response = AuthenticatorAssertionResponse(
+            client_data_json=decode_base64url(body.client_data_json),
+            authenticator_data=decode_base64url(body.authenticator_data),
+            signature=decode_base64url(body.signature),
+            user_handle=decode_base64url(body.user_handle)
+            if body.user_handle
+            else None,
+        )
+    else:
+        raise ValueError(
+            "credential response is neither attestation nor assertion data"
+        )
+    return PublicKeyCredential(
+        id=value.id,
+        raw_id=raw_id,
+        response=response,
+        type=value.type,
+        authenticator_attachment=value.authenticator_attachment,
+        client_extension_results=value.client_extension_results,
+    )
+
+
+__all__ = [
+    "decode_base64url",
+    "encode_base64url",
+    "parse_public_key_credential",
+    "to_json_value",
+]