tba-storage-webauthn 0.4.0.dev2__py3-none-any.whl

tba_storage_webauthn/__init__.py

@@ -0,0 +1,7 @@
+"""Standalone identity storage component."""
+
+from .manifest import MANIFEST, load_manifest
+from .tables import *  # noqa: F401,F403
+from .tables import TABLE_MODEL_BY_NAME, TABLE_MODEL_BY_TABLENAME, TABLE_MODELS
+
+__all__ = ["MANIFEST", "load_manifest", "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME"] + [model.__name__ for model in TABLE_MODELS]

tba_storage_webauthn/component.toml

@@ -0,0 +1,35 @@
+manifest_version = "1.0.0"
+
+[component]
+id = "tigrbl.identity.storage.webauthn"
+distribution = "tba-storage-webauthn"
+import_root = "tba_storage_webauthn"
+
+[schema]
+contract = "1.0.0"
+migration_head = "35709893-1208-54c2-ab00-dca4b2e67065"
+migrations_package = "tba_storage_webauthn.migrations.versions"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:credential_webauthn_passkeys"
+kind = "table"
+physical_name = "authn.credential_webauthn_passkeys"
+model = "tba_storage_webauthn.tables:CredentialWebAuthnPasskey"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_attestation_records"
+kind = "table"
+physical_name = "authn.webauthn_attestation_records"
+model = "tba_storage_webauthn.tables:WebAuthnAttestationRecord"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_ceremonies"
+kind = "table"
+physical_name = "authn.webauthn_ceremonies"
+model = "tba_storage_webauthn.tables:WebAuthnCeremony"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_relying_parties"
+kind = "table"
+physical_name = "authn.webauthn_relying_parties"
+model = "tba_storage_webauthn.tables:WebAuthnRelyingParty"

tba_storage_webauthn/manifest.py

@@ -0,0 +1,9 @@
+"""Installed component manifest access."""
+from importlib.resources import as_file, files
+from tigrbl_migrations import StorageManifest
+
+def load_manifest() -> StorageManifest:
+    with as_file(files(__package__).joinpath("component.toml")) as path:
+        return StorageManifest.from_toml(path)
+
+MANIFEST = load_manifest()

tba_storage_webauthn/migrations/versions/35709893_1208_54c2_ab00_dca4b2e67065_initial_schema.py

@@ -0,0 +1,23 @@
+"""Initial owned schema for tigrbl.identity.storage.webauthn."""
+from tigrbl_migrations import Migration
+from tba_storage_webauthn.tables import TABLE_MODELS
+
+REVISION = "35709893-1208-54c2-ab00-dca4b2e67065"
+
+def upgrade(connection):
+    for model in TABLE_MODELS:
+        model.__table__.create(bind=connection, checkfirst=True)
+
+def downgrade(connection):
+    for model in reversed(TABLE_MODELS):
+        model.__table__.drop(bind=connection, checkfirst=True)
+
+MIGRATION = Migration(
+    component="tigrbl.identity.storage.webauthn",
+    revision=REVISION,
+    parents=(),
+    kind="standard",
+    reversible=True,
+    upgrade=upgrade,
+    downgrade=downgrade,
+)

tba_storage_webauthn/tables/__init__.py

@@ -0,0 +1,18 @@
+"""Owned mapped-table inventory."""
+
+from .credential_webauthn_passkey import CredentialWebAuthnPasskey
+from .webauthn_attestation_record import WebAuthnAttestationRecord
+from .webauthn_ceremony import WebAuthnCeremony
+from .webauthn_relying_party import WebAuthnRelyingParty
+
+TABLE_MODELS = (
+    CredentialWebAuthnPasskey,
+    WebAuthnAttestationRecord,
+    WebAuthnCeremony,
+    WebAuthnRelyingParty,
+)
+TABLE_MODEL_BY_NAME = {model.__name__: model for model in TABLE_MODELS}
+TABLE_MODEL_BY_TABLENAME = {model.__tablename__: model for model in TABLE_MODELS}
+__all__ = [model.__name__ for model in TABLE_MODELS] + [
+    "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME",
+]

tba_storage_webauthn/tables/credential_webauthn_passkey/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_webauthn/tables/credential_webauthn_passkey/_table.py

@@ -0,0 +1,42 @@
+"""Durable WebAuthn passkey credential records."""
+
+from __future__ import annotations
+
+
+import datetime as dt
+
+from tba_primitives_identity.orm import Boolean, GUIDPk, Integer, JSON, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialWebAuthnPasskey(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_webauthn_passkeys"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    webauthn_credential_id: Mapped[str] = acol(storage=S(String(1000), nullable=False, unique=True, index=True))
+    public_key: Mapped[str] = acol(storage=S(String(4000), nullable=False))
+    rp_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    algorithm: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    sign_count: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0))
+    transports: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    passkey_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    credential_external_id: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, unique=True, index=True))
+    credential_public_key_cose: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True))
+    user_handle: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    cose_algorithm: Mapped[int | None] = acol(storage=S(Integer, nullable=True))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    attestation_format: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_type: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_trust_status: Mapped[str | None] = acol(storage=S(String(32), nullable=True, index=True))
+    discoverable: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_eligible: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_state: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    last_used_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    revoked_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    display_name: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+
+__all__ = ["CredentialWebAuthnPasskey"]

tba_storage_webauthn/tables/webauthn_attestation_record/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnAttestationRecord
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_webauthn/tables/webauthn_attestation_record/_table.py

@@ -0,0 +1,28 @@
+"""Durable result of authenticator attestation appraisal."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_primitives_identity.orm import GUIDPk, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+class WebAuthnAttestationRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_attestation_records"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    attestation_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    type: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    statement_digest: Mapped[bytes] = acol(storage=S(LargeBinary, nullable=False))
+    certificate_chain_artifact_ref: Mapped[str | None] = acol(storage=S(String(1024), nullable=True))
+    trust_anchor_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    metadata_statement_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    verification_status: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    verified_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    valid_until: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_webauthn/tables/webauthn_ceremony/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnCeremony
+
+__all__ = ["WebAuthnCeremony"]

tba_storage_webauthn/tables/webauthn_ceremony/_table.py

@@ -0,0 +1,43 @@
+"""Durable WebAuthn registration and authentication ceremony state."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    LargeBinary,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class WebAuthnCeremony(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_ceremonies"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    ceremony_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    ceremony_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    rp_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    expected_origin: Mapped[str] = acol(storage=S(String(2048), nullable=False))
+    challenge_digest: Mapped[bytes] = acol(storage=S(LargeBinary, nullable=False))
+    options_digest: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True))
+    user_verification_requirement: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    resident_key_requirement: Mapped[str | None] = acol(storage=S(String(32), nullable=True))
+    attestation_preference: Mapped[str | None] = acol(storage=S(String(32), nullable=True))
+    state: Mapped[str] = acol(storage=S(String(32), nullable=False, default="pending", index=True))
+    issued_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    consumed_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    bound_credential_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    failure_code: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+
+__all__ = ["WebAuthnCeremony"]

tba_storage_webauthn/tables/webauthn_relying_party/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnRelyingParty
+
+__all__ = ["WebAuthnRelyingParty"]

tba_storage_webauthn/tables/webauthn_relying_party/_table.py

@@ -0,0 +1,24 @@
+"""Tenant-scoped WebAuthn relying-party configuration."""
+
+from tba_primitives_identity.orm import Boolean, GUIDPk, JSON, Mapped, RestOltpTable, S, String, Timestamped, acol
+
+
+class WebAuthnRelyingParty(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_relying_parties"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    rp_config_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    rp_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    display_name: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    allowed_origins: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    allowed_algorithms: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    user_verification_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    resident_key_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    attestation_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="none"))
+    allowed_attestation_formats: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    related_origins: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    enabled: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+
+
+__all__ = ["WebAuthnRelyingParty"]

tba_storage_webauthn-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,22 @@
+Metadata-Version: 2.4
+Name: tba-storage-webauthn
+Version: 0.4.0.dev2
+Summary: Owned webauthn identity database tables and migrations.
+License: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-primitives-identity[storage] (>=0.4.0.dev2)
+Requires-Dist: tigrbl (>=0.4.4.dev1,<0.5)
+Requires-Dist: tigrbl-migrations (>=0.4.5.dev4)
+Description-Content-Type: text/markdown
+
+# tba-storage-webauthn
+
+Owns the `tigrbl.identity.storage.webauthn` schema component.
+

tba_storage_webauthn-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,19 @@
+tba_storage_webauthn/__init__.py,sha256=HoJ8HOyxQOG9vvo4LEJPfEUW3IDGqZF6ZIgJQ59tK6Q,366
+tba_storage_webauthn/component.toml,sha256=Bi3Qt4JhPZcmTB2I6AGlyGdEfQ8bDGnqaHkF48W6Q2A,1172
+tba_storage_webauthn/manifest.py,sha256=bYZmb6ItB8bRxtuCspB1us5eTvB1RqlTedISJZbws_w,325
+tba_storage_webauthn/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_storage_webauthn/migrations/versions/35709893_1208_54c2_ab00_dca4b2e67065_initial_schema.py,sha256=w40a7CjPAipWcjKYfeE9Fp-kJIRzB3Xl2naHZJM70BI,666
+tba_storage_webauthn/migrations/versions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_storage_webauthn/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_storage_webauthn/tables/__init__.py,sha256=IVinAQ16X-m2FRRHus1Kgo6auafzTPiaLh8wVmDrKFQ,690
+tba_storage_webauthn/tables/credential_webauthn_passkey/__init__.py,sha256=IwChVBciSBL8Hb5BIIxsotAa84PK6hC6qmoqW5rTydc,224
+tba_storage_webauthn/tables/credential_webauthn_passkey/_table.py,sha256=IVX_Vdiuoc8rb68F33YQMtQ-QrZkz0AJ3dDILsA5PM4,2736
+tba_storage_webauthn/tables/webauthn_attestation_record/__init__.py,sha256=sLOPWAmx_KaW34M_R0TCbKzTvv1h-KE-cmz529nvmwU,87
+tba_storage_webauthn/tables/webauthn_attestation_record/_table.py,sha256=ZU9lsexgQDM-LXJBePvv74qJ9T_uMem1PgqdIC-Jh00,1596
+tba_storage_webauthn/tables/webauthn_ceremony/__init__.py,sha256=Eb1zPQEzbucFxYl5ecUmmoqrDmt3Eja0ws5GQXtx3xI,69
+tba_storage_webauthn/tables/webauthn_ceremony/_table.py,sha256=VhshPDNfQD67eTdo020Y4X5-bp-wnj2OcfN4jKZPP5M,2078
+tba_storage_webauthn/tables/webauthn_relying_party/__init__.py,sha256=jFGOSTtOWl7wKc4hgPR1P4X5dBfVv4CdwwOcE1BO0Cc,77
+tba_storage_webauthn/tables/webauthn_relying_party/_table.py,sha256=20iSlNeqtTLxeXKSrrdPeVfy_9qmgKVVUjWAVVQa_VE,1495
+tba_storage_webauthn-0.4.0.dev2.dist-info/METADATA,sha256=XHEILpM4Xbx8AQv5JNUXccSKD5P567qmECCOYv5YtpU,831
+tba_storage_webauthn-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_storage_webauthn-0.4.0.dev2.dist-info/RECORD,,

tba_storage_webauthn-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any