o
    g*                  
   @   s  d Z ddlmZmZmZmZ ddlmZmZ ddl	m	Z	 ddlm
Z
 er*ddlmZ zdd	lmZ dd
lmZmZ ddlmZ ddlmZ W n eyX Z zededZ[ww z
ddlmZ dZW n eyn   dZY nw dZG dd deZG dd de
Z dS )zWebAuthn Authentication Plugin.    )TYPE_CHECKINGAnyCallableOptional   )errorsutils)logger   )MySQLAuthPlugin)MySQLSocket)
dump_bytes)Fido2ClientUserInteraction)CtapHidDevice)!PublicKeyCredentialRequestOptionszxModule fido2 is required for WebAuthn authentication mechanism but was not found. Unable to authenticate with the serverN)CtapPcscDeviceTFMySQLWebAuthnAuthPluginc                   @   s.   e Zd ZdZd	dee fddZd
ddZdS )ClientInteractionz(Provides user interaction to the Client.Ncallbackc                 C   s   || _ d| _d S )NzTPlease insert FIDO device and perform gesture action for authentication to complete.)r   msg)selfr    r   p/var/www/html/api-tag/env/lib/python3.10/site-packages/mysql/connector/plugins/authentication_webauthn_client.py__init__B   s   zClientInteraction.__init__returnc                 C   s(   | j du rt| j dS |  | j dS )z=Prompt message for the user interaction with the FIDO device.N)r   printr   r   r   r   r   	prompt_upI   s   
zClientInteraction.prompt_upN)r   N)__name__
__module____qualname____doc__r   r   r   r   r   r   r   r   r   ?   s    r   c                   @   s   e Zd ZU dZdZee ed< dZee	 ed< ddg dZ
eed< edefdd	Zedefd
dZ	ddee defddZdededee fddZdddededefddZdddededefddZdS )r   z<Class implementing the MySQL WebAuthn authentication plugin.Nclientr   )rpId	challengeallowCredentialsoptionsr   c                 C      dS )zPlugin official name.authentication_webauthn_clientr   r   r   r   r   nameX      zMySQLWebAuthnAuthPlugin.namec                 C   r)   )z'Signals whether or not SSL is required.Fr   r   r   r   r   requires_ssl]   r,   z$MySQLWebAuthnAuthPlugin.requires_sslcredential_idc           
      C   s   | j du r
td|dur|ddg| jd< | j t| j}t| }d}t	
d}|t	
|7 }t|D ],}||}t|j}|j}	|t	
t|7 }||7 }|t	
t|	7 }||	7 }|j}q9|t	
t|7 }||7 }td| |S )	zGet assertion from authenticator and return the response.

        Args:
            credential_id (Optional[bytearray]): The credential ID.

        Returns:
            bytearray: The response packet with the data from the assertion.
        NzNo WebAuthn client foundz
public-key)idtyper'       r   z&WebAuthn - payload response packet: %s)r$   r   InterfaceErrorr(   get_assertionr   	from_dictlenget_assertionsr   lc_intrangeget_responsecbor_dump_bytesauthenticator_data	signatureclient_datar	   debug)
r   r.   	assertionnumber_of_assertionsclient_data_jsonpacketiassertion_responser;   r<   r   r   r   get_assertion_responseb   s6   






z.MySQLWebAuthnAuthPlugin.get_assertion_response	auth_datakwargsc           	   
   K   s$  z5t |d\}}t |\}}|| jd< | | jd< td| td| jd  td| jd  W n tyG } zt	d|d}~ww t
t d}|durYtd	 n	trbt
t d}|du rkt	d
t|d| jd  t| jd| _| jjjdstd dS td dS )aE  Find authenticator device and check if supports resident keys.

        It also creates a Fido2Client using the relying party ID from the server.

        Raises:
            InterfaceError: When the FIDO device is not found.

        Returns:
            bytes: 2 if the authenticator supports resident keys else 1.
        r
   r&   r%   zWebAuthn - capability: %dzWebAuthn - challenge: %szWebAuthn - relying party id: %sz2Unable to parse MySQL WebAuthn authentication dataNzWebAuthn - Use USB HID channelzNo FIDO device foundzhttps://)user_interactionrkz6WebAuthn - Authenticator doesn't support resident keys   1z<WebAuthn - Authenticator with support for resident key found   2)r   read_intread_lc_string_listr(   decoder	   r>   
ValueErrorr   r2   nextr   list_devicesCTAP_PCSC_DEVICE_AVAILABLEr   r   r   r   r$   infoget)	r   rF   rG   packets
capabilityr&   rp_iderrdevicer   r   r   auth_response   sB   



z%MySQLWebAuthnAuthPlugin.auth_responsesockr   c                 K   sP   t |\}}| |}td|t| || t| }td| |S )aE  Handles server's `auth more data` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Authentication method data (from a packet representing
                       an `auth more data` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        WebAuthn - request: %s size: %s%WebAuthn - server response packet: %s)	r   read_lc_stringrE   r	   r>   r5   sendbytesrecv)r   r[   rF   rG   _r.   responsepktr   r   r   auth_more_response   s   

z*MySQLWebAuthnAuthPlugin.auth_more_responsec                 K   s   | dp	| d}t|trt|n|| _| |}d}|dkr7td |	t
t| t| S | |}td|t| |	| t| }td| |S )aS  Handles server's `auth switch request` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Plugin provided data (extracted from a packet
                       representing an `auth switch request` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        webauthn_callbackfido_callbackNrJ   z WebAuthn - request credential_idr\   r]   )rT   
isinstancestrr   import_objectr   rZ   r	   r>   r_   r7   intr`   ra   rE   r5   )r   r[   rF   rG   webauth_callbackrc   r.   rd   r   r   r   auth_switch_response   s&   



z,MySQLWebAuthnAuthPlugin.auth_switch_responser   )r    r!   r"   r#   r$   r   r   __annotations__r   r   r(   dictpropertyri   r+   boolr-   	bytearrayr`   rE   r   rZ   re   rm   r   r   r   r   r   Q   sD   
 
F0
)!r#   typingr   r   r   r    r   r   r	   r   networkr   
fido2.cborr   r:   fido2.clientr   r   	fido2.hidr   fido2.webauthnr   ImportError
import_errProgrammingError
fido2.pcscr   rR   ModuleNotFoundErrorAUTHENTICATION_PLUGIN_CLASSr   r   r   r   r   r   <module>   s:   