tba-storage-webauthn 0.4.0.dev2__tar.gz

tba_storage_webauthn-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.4
+Name: tba-storage-webauthn
+Version: 0.4.0.dev2
+Summary: Owned webauthn identity database tables and migrations.
+License: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-primitives-identity[storage] (>=0.4.0.dev2)
+Requires-Dist: tigrbl (>=0.4.4.dev1,<0.5)
+Requires-Dist: tigrbl-migrations (>=0.4.5.dev4)
+Description-Content-Type: text/markdown
+
+# tba-storage-webauthn
+
+Owns the `tigrbl.identity.storage.webauthn` schema component.
+

tba_storage_webauthn-0.4.0.dev2/README.md

@@ -0,0 +1,3 @@
+# tba-storage-webauthn
+
+Owns the `tigrbl.identity.storage.webauthn` schema component.

tba_storage_webauthn-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,20 @@
+[project]
+name = "tba-storage-webauthn"
+version = "0.4.0.dev2"
+description = "Owned webauthn identity database tables and migrations."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = { text = "Apache-2.0" }
+dependencies = [
+    "tigrbl>=0.4.4.dev1,<0.5",
+    "tigrbl-migrations>=0.4.5.dev4",
+    "tba-primitives-identity[storage]>=0.4.0.dev2",
+]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_storage_webauthn", from = "src" }]
+include = ["src/tba_storage_webauthn/component.toml"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/__init__.py

@@ -0,0 +1,7 @@
+"""Standalone identity storage component."""
+
+from .manifest import MANIFEST, load_manifest
+from .tables import *  # noqa: F401,F403
+from .tables import TABLE_MODEL_BY_NAME, TABLE_MODEL_BY_TABLENAME, TABLE_MODELS
+
+__all__ = ["MANIFEST", "load_manifest", "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME"] + [model.__name__ for model in TABLE_MODELS]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/component.toml

@@ -0,0 +1,35 @@
+manifest_version = "1.0.0"
+
+[component]
+id = "tigrbl.identity.storage.webauthn"
+distribution = "tba-storage-webauthn"
+import_root = "tba_storage_webauthn"
+
+[schema]
+contract = "1.0.0"
+migration_head = "35709893-1208-54c2-ab00-dca4b2e67065"
+migrations_package = "tba_storage_webauthn.migrations.versions"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:credential_webauthn_passkeys"
+kind = "table"
+physical_name = "authn.credential_webauthn_passkeys"
+model = "tba_storage_webauthn.tables:CredentialWebAuthnPasskey"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_attestation_records"
+kind = "table"
+physical_name = "authn.webauthn_attestation_records"
+model = "tba_storage_webauthn.tables:WebAuthnAttestationRecord"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_ceremonies"
+kind = "table"
+physical_name = "authn.webauthn_ceremonies"
+model = "tba_storage_webauthn.tables:WebAuthnCeremony"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.webauthn:table:webauthn_relying_parties"
+kind = "table"
+physical_name = "authn.webauthn_relying_parties"
+model = "tba_storage_webauthn.tables:WebAuthnRelyingParty"

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/manifest.py

@@ -0,0 +1,9 @@
+"""Installed component manifest access."""
+from importlib.resources import as_file, files
+from tigrbl_migrations import StorageManifest
+
+def load_manifest() -> StorageManifest:
+    with as_file(files(__package__).joinpath("component.toml")) as path:
+        return StorageManifest.from_toml(path)
+
+MANIFEST = load_manifest()

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/migrations/versions/35709893_1208_54c2_ab00_dca4b2e67065_initial_schema.py

@@ -0,0 +1,23 @@
+"""Initial owned schema for tigrbl.identity.storage.webauthn."""
+from tigrbl_migrations import Migration
+from tba_storage_webauthn.tables import TABLE_MODELS
+
+REVISION = "35709893-1208-54c2-ab00-dca4b2e67065"
+
+def upgrade(connection):
+    for model in TABLE_MODELS:
+        model.__table__.create(bind=connection, checkfirst=True)
+
+def downgrade(connection):
+    for model in reversed(TABLE_MODELS):
+        model.__table__.drop(bind=connection, checkfirst=True)
+
+MIGRATION = Migration(
+    component="tigrbl.identity.storage.webauthn",
+    revision=REVISION,
+    parents=(),
+    kind="standard",
+    reversible=True,
+    upgrade=upgrade,
+    downgrade=downgrade,
+)

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/__init__.py

@@ -0,0 +1,18 @@
+"""Owned mapped-table inventory."""
+
+from .credential_webauthn_passkey import CredentialWebAuthnPasskey
+from .webauthn_attestation_record import WebAuthnAttestationRecord
+from .webauthn_ceremony import WebAuthnCeremony
+from .webauthn_relying_party import WebAuthnRelyingParty
+
+TABLE_MODELS = (
+    CredentialWebAuthnPasskey,
+    WebAuthnAttestationRecord,
+    WebAuthnCeremony,
+    WebAuthnRelyingParty,
+)
+TABLE_MODEL_BY_NAME = {model.__name__: model for model in TABLE_MODELS}
+TABLE_MODEL_BY_TABLENAME = {model.__tablename__: model for model in TABLE_MODELS}
+__all__ = [model.__name__ for model in TABLE_MODELS] + [
+    "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME",
+]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/credential_webauthn_passkey/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/credential_webauthn_passkey/_table.py

@@ -0,0 +1,42 @@
+"""Durable WebAuthn passkey credential records."""
+
+from __future__ import annotations
+
+
+import datetime as dt
+
+from tba_primitives_identity.orm import Boolean, GUIDPk, Integer, JSON, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialWebAuthnPasskey(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_webauthn_passkeys"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    webauthn_credential_id: Mapped[str] = acol(storage=S(String(1000), nullable=False, unique=True, index=True))
+    public_key: Mapped[str] = acol(storage=S(String(4000), nullable=False))
+    rp_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    algorithm: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    sign_count: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0))
+    transports: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    passkey_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    credential_external_id: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, unique=True, index=True))
+    credential_public_key_cose: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True))
+    user_handle: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    cose_algorithm: Mapped[int | None] = acol(storage=S(Integer, nullable=True))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    attestation_format: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_type: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_trust_status: Mapped[str | None] = acol(storage=S(String(32), nullable=True, index=True))
+    discoverable: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_eligible: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_state: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    last_used_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    revoked_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    display_name: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+
+__all__ = ["CredentialWebAuthnPasskey"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_attestation_record/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnAttestationRecord
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_attestation_record/_table.py

@@ -0,0 +1,28 @@
+"""Durable result of authenticator attestation appraisal."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_primitives_identity.orm import GUIDPk, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+class WebAuthnAttestationRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_attestation_records"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    attestation_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    type: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    statement_digest: Mapped[bytes] = acol(storage=S(LargeBinary, nullable=False))
+    certificate_chain_artifact_ref: Mapped[str | None] = acol(storage=S(String(1024), nullable=True))
+    trust_anchor_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    metadata_statement_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    verification_status: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    verified_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    valid_until: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_ceremony/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnCeremony
+
+__all__ = ["WebAuthnCeremony"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_ceremony/_table.py

@@ -0,0 +1,43 @@
+"""Durable WebAuthn registration and authentication ceremony state."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    LargeBinary,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class WebAuthnCeremony(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_ceremonies"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    ceremony_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    ceremony_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    rp_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    expected_origin: Mapped[str] = acol(storage=S(String(2048), nullable=False))
+    challenge_digest: Mapped[bytes] = acol(storage=S(LargeBinary, nullable=False))
+    options_digest: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True))
+    user_verification_requirement: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    resident_key_requirement: Mapped[str | None] = acol(storage=S(String(32), nullable=True))
+    attestation_preference: Mapped[str | None] = acol(storage=S(String(32), nullable=True))
+    state: Mapped[str] = acol(storage=S(String(32), nullable=False, default="pending", index=True))
+    issued_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    consumed_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    bound_credential_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    failure_code: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+
+__all__ = ["WebAuthnCeremony"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_relying_party/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnRelyingParty
+
+__all__ = ["WebAuthnRelyingParty"]

tba_storage_webauthn-0.4.0.dev2/src/tba_storage_webauthn/tables/webauthn_relying_party/_table.py

@@ -0,0 +1,24 @@
+"""Tenant-scoped WebAuthn relying-party configuration."""
+
+from tba_primitives_identity.orm import Boolean, GUIDPk, JSON, Mapped, RestOltpTable, S, String, Timestamped, acol
+
+
+class WebAuthnRelyingParty(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_relying_parties"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    rp_config_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    rp_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    display_name: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    allowed_origins: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    allowed_algorithms: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    user_verification_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    resident_key_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="preferred"))
+    attestation_policy: Mapped[str] = acol(storage=S(String(32), nullable=False, default="none"))
+    allowed_attestation_formats: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    related_origins: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    enabled: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+
+
+__all__ = ["WebAuthnRelyingParty"]