mirror of
https://github.com/sonr-io/sonr.git
synced 2026-08-03 18:01:39 +00:00
feature/migrate models (#16)
* feat: add new supported attestation formats to genesis * feat: refactor keyType to keytype enum * refactor: remove unused imports and code * refactor: update main.go to use src package * refactor: move web-related structs from to * refactor: move client middleware package to root * refactor: remove unused IndexedDB dependency * feat: update worker implementation to use * feat: add Caddyfile and Caddy configuration for vault service * refactor(config): move keyshare and address to Motr config * fix: validate service origin in AllocateVault * chore: remove IndexedDB configuration * feat: add support for IPNS-based vault access
This commit is contained in:
Prad Nukala
@@ -1,226 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
|
||||
"github.com/go-webauthn/webauthn/protocol"
|
||||
|
||||
"github.com/go-webauthn/webauthn/protocol/webauthncose"
|
||||
didv1 "github.com/onsonr/sonr/api/did/v1"
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
)
|
||||
|
||||
func APIFormatDIDNamespace(namespace types.DIDNamespace) didv1.DIDNamespace {
|
||||
return didv1.DIDNamespace(namespace)
|
||||
}
|
||||
|
||||
func APIFormatDIDNamespaces(namespaces []types.DIDNamespace) []didv1.DIDNamespace {
|
||||
var s []didv1.DIDNamespace
|
||||
for _, namespace := range namespaces {
|
||||
s = append(s, APIFormatDIDNamespace(namespace))
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func APIFormatKeyRole(role types.KeyRole) didv1.KeyRole {
|
||||
return didv1.KeyRole(role)
|
||||
}
|
||||
|
||||
func APIFormatKeyAlgorithm(algorithm types.KeyAlgorithm) didv1.KeyAlgorithm {
|
||||
return didv1.KeyAlgorithm(algorithm)
|
||||
}
|
||||
|
||||
func APIFormatKeyEncoding(encoding types.KeyEncoding) didv1.KeyEncoding {
|
||||
return didv1.KeyEncoding(encoding)
|
||||
}
|
||||
|
||||
func APIFormatKeyCurve(curve types.KeyCurve) didv1.KeyCurve {
|
||||
return didv1.KeyCurve(curve)
|
||||
}
|
||||
|
||||
func APIFormatKeyType(keyType types.KeyType) didv1.KeyType {
|
||||
return didv1.KeyType(keyType)
|
||||
}
|
||||
|
||||
func APIFormatPermissions(permissions *types.Permissions) *didv1.Permissions {
|
||||
if permissions == nil {
|
||||
return nil
|
||||
}
|
||||
p := didv1.Permissions{
|
||||
Grants: APIFormatDIDNamespaces(permissions.Grants),
|
||||
Scopes: APIFormatPermissionScopes(permissions.Scopes),
|
||||
}
|
||||
return &p
|
||||
}
|
||||
|
||||
func APIFormatPermissionScope(scope types.PermissionScope) didv1.PermissionScope {
|
||||
return didv1.PermissionScope(scope)
|
||||
}
|
||||
|
||||
func APIFormatPermissionScopes(scopes []types.PermissionScope) []didv1.PermissionScope {
|
||||
var s []didv1.PermissionScope
|
||||
for _, scope := range scopes {
|
||||
s = append(s, APIFormatPermissionScope(scope))
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func APIFormatPubKeyJWK(jwk *types.PubKey_JWK) *didv1.PubKey_JWK {
|
||||
return &didv1.PubKey_JWK{
|
||||
Kty: jwk.Kty,
|
||||
Crv: jwk.Crv,
|
||||
X: jwk.X,
|
||||
Y: jwk.Y,
|
||||
N: jwk.N,
|
||||
E: jwk.E,
|
||||
}
|
||||
}
|
||||
|
||||
func APIFormatPubKey(key *types.PubKey) *didv1.PubKey {
|
||||
return &didv1.PubKey{
|
||||
Role: APIFormatKeyRole(key.GetRole()),
|
||||
Algorithm: APIFormatKeyAlgorithm(key.GetAlgorithm()),
|
||||
Encoding: APIFormatKeyEncoding(key.GetEncoding()),
|
||||
Curve: APIFormatKeyCurve(key.GetCurve()),
|
||||
KeyType: APIFormatKeyType(key.GetKeyType()),
|
||||
Raw: key.GetRaw(),
|
||||
}
|
||||
}
|
||||
|
||||
func FormatEC2PublicKey(key *webauthncose.EC2PublicKeyData) (*types.PubKey_JWK, error) {
|
||||
curve, err := GetCOSECurveName(key.Curve)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
jwkMap := map[string]interface{}{
|
||||
"kty": "EC",
|
||||
"crv": curve,
|
||||
"x": base64.RawURLEncoding.EncodeToString(key.XCoord),
|
||||
"y": base64.RawURLEncoding.EncodeToString(key.YCoord),
|
||||
}
|
||||
|
||||
return MapToJWK(jwkMap)
|
||||
}
|
||||
|
||||
func FormatRSAPublicKey(key *webauthncose.RSAPublicKeyData) (*types.PubKey_JWK, error) {
|
||||
jwkMap := map[string]interface{}{
|
||||
"kty": "RSA",
|
||||
"n": base64.RawURLEncoding.EncodeToString(key.Modulus),
|
||||
"e": base64.RawURLEncoding.EncodeToString(key.Exponent),
|
||||
}
|
||||
|
||||
return MapToJWK(jwkMap)
|
||||
}
|
||||
|
||||
func FormatOKPPublicKey(key *webauthncose.OKPPublicKeyData) (*types.PubKey_JWK, error) {
|
||||
curve, err := GetOKPCurveName(key.Curve)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
jwkMap := map[string]interface{}{
|
||||
"kty": "OKP",
|
||||
"crv": curve,
|
||||
"x": base64.RawURLEncoding.EncodeToString(key.XCoord),
|
||||
}
|
||||
|
||||
return MapToJWK(jwkMap)
|
||||
}
|
||||
|
||||
func MapToJWK(m map[string]interface{}) (*types.PubKey_JWK, error) {
|
||||
jwk := &types.PubKey_JWK{}
|
||||
for k, v := range m {
|
||||
switch k {
|
||||
case "kty":
|
||||
jwk.Kty = v.(string)
|
||||
case "crv":
|
||||
jwk.Crv = v.(string)
|
||||
case "x":
|
||||
jwk.X = v.(string)
|
||||
case "y":
|
||||
jwk.Y = v.(string)
|
||||
case "n":
|
||||
jwk.N = v.(string)
|
||||
case "e":
|
||||
jwk.E = v.(string)
|
||||
}
|
||||
}
|
||||
return jwk, nil
|
||||
}
|
||||
|
||||
func GetCOSECurveName(curveID int64) (string, error) {
|
||||
switch curveID {
|
||||
case int64(webauthncose.P256):
|
||||
return "P-256", nil
|
||||
case int64(webauthncose.P384):
|
||||
return "P-384", nil
|
||||
case int64(webauthncose.P521):
|
||||
return "P-521", nil
|
||||
default:
|
||||
return "", fmt.Errorf("unknown curve ID: %d", curveID)
|
||||
}
|
||||
}
|
||||
|
||||
func GetOKPCurveName(curveID int64) (string, error) {
|
||||
switch curveID {
|
||||
case int64(webauthncose.Ed25519):
|
||||
return "Ed25519", nil
|
||||
default:
|
||||
return "", fmt.Errorf("unknown OKP curve ID: %d", curveID)
|
||||
}
|
||||
}
|
||||
|
||||
// NormalizeTransports returns the transports as strings
|
||||
func NormalizeTransports(transports []protocol.AuthenticatorTransport) []string {
|
||||
tss := make([]string, len(transports))
|
||||
for i, t := range transports {
|
||||
tss[i] = string(t)
|
||||
}
|
||||
return tss
|
||||
}
|
||||
|
||||
// GetTransports returns the protocol.AuthenticatorTransport
|
||||
func ModuleTransportsToProtocol(transport []string) []protocol.AuthenticatorTransport {
|
||||
tss := make([]protocol.AuthenticatorTransport, len(transport))
|
||||
for i, t := range transport {
|
||||
tss[i] = protocol.AuthenticatorTransport(t)
|
||||
}
|
||||
return tss
|
||||
}
|
||||
|
||||
func ModuleFormatAPIPermissions(permissions *didv1.Permissions) *types.Permissions {
|
||||
if permissions == nil {
|
||||
return nil
|
||||
}
|
||||
p := types.Permissions{
|
||||
Grants: ModuleFormatAPIDIDNamespaces(permissions.Grants),
|
||||
Scopes: ModuleFormatAPIPermissionScopes(permissions.Scopes),
|
||||
}
|
||||
return &p
|
||||
}
|
||||
|
||||
func ModuleFormatAPIPermissionScope(scope didv1.PermissionScope) types.PermissionScope {
|
||||
return types.PermissionScope(scope)
|
||||
}
|
||||
|
||||
func ModuleFormatAPIPermissionScopes(scopes []didv1.PermissionScope) []types.PermissionScope {
|
||||
var s []types.PermissionScope
|
||||
for _, scope := range scopes {
|
||||
s = append(s, ModuleFormatAPIPermissionScope(scope))
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func ModuleFormatAPIDIDNamespace(namespace didv1.DIDNamespace) types.DIDNamespace {
|
||||
return types.DIDNamespace(namespace)
|
||||
}
|
||||
|
||||
func ModuleFormatAPIDIDNamespaces(namespaces []didv1.DIDNamespace) []types.DIDNamespace {
|
||||
var s []types.DIDNamespace
|
||||
for _, namespace := range namespaces {
|
||||
s = append(s, ModuleFormatAPIDIDNamespace(namespace))
|
||||
}
|
||||
return s
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"crypto/hmac"
|
||||
"crypto/sha512"
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
"math/big"
|
||||
|
||||
"github.com/btcsuite/btcd/btcec/v2"
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
)
|
||||
|
||||
// ComputeAccountPublicKey computes the public key of a child key given the extended public key, chain code, and index.
|
||||
func computeBip32AccountPublicKey(extPubKey PublicKey, chainCode types.ChainCode, index int) (*types.PubKey, error) {
|
||||
// Check if the index is a hardened child key
|
||||
if chainCode&0x80000000 != 0 && index < 0 {
|
||||
return nil, errors.New("invalid index")
|
||||
}
|
||||
|
||||
// Serialize the public key
|
||||
pubKey, err := btcec.ParsePubKey(extPubKey.GetRaw())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pubKeyBytes := pubKey.SerializeCompressed()
|
||||
|
||||
// Serialize the index
|
||||
indexBytes := make([]byte, 4)
|
||||
binary.BigEndian.PutUint32(indexBytes, uint32(index))
|
||||
|
||||
// Compute the HMAC-SHA512
|
||||
mac := hmac.New(sha512.New, []byte{byte(chainCode)})
|
||||
mac.Write(pubKeyBytes)
|
||||
mac.Write(indexBytes)
|
||||
I := mac.Sum(nil)
|
||||
|
||||
// Split I into two 32-byte sequences
|
||||
IL := I[:32]
|
||||
|
||||
// Convert IL to a big integer
|
||||
ilNum := new(big.Int).SetBytes(IL)
|
||||
|
||||
// Check if parse256(IL) >= n
|
||||
curve := btcec.S256()
|
||||
if ilNum.Cmp(curve.N) >= 0 {
|
||||
return nil, errors.New("invalid child key")
|
||||
}
|
||||
|
||||
// Compute the child public key
|
||||
ilx, ily := curve.ScalarBaseMult(IL)
|
||||
childX, childY := curve.Add(ilx, ily, pubKey.X(), pubKey.Y())
|
||||
lx := newBigIntFieldVal(childX)
|
||||
ly := newBigIntFieldVal(childY)
|
||||
|
||||
// Create the child public key
|
||||
childPubKey := btcec.NewPublicKey(lx, ly)
|
||||
pk, err := types.NewPublicKey(childPubKey.SerializeCompressed(), types.ChainCodeKeyInfos[chainCode])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return pk, nil
|
||||
}
|
||||
|
||||
// newBigIntFieldVal creates a new field value from a big integer.
|
||||
func newBigIntFieldVal(val *big.Int) *btcec.FieldVal {
|
||||
lx := new(btcec.FieldVal)
|
||||
lx.SetByteSlice(val.Bytes())
|
||||
return lx
|
||||
}
|
||||
@@ -1,334 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
)
|
||||
|
||||
type (
|
||||
AuthenticatorAttachment string
|
||||
AuthenticatorTransport string
|
||||
)
|
||||
|
||||
const (
|
||||
// Platform represents a platform authenticator is attached using a client device-specific transport, called
|
||||
// platform attachment, and is usually not removable from the client device. A public key credential bound to a
|
||||
// platform authenticator is called a platform credential.
|
||||
Platform AuthenticatorAttachment = "platform"
|
||||
|
||||
// CrossPlatform represents a roaming authenticator is attached using cross-platform transports, called
|
||||
// cross-platform attachment. Authenticators of this class are removable from, and can "roam" among, client devices.
|
||||
// A public key credential bound to a roaming authenticator is called a roaming credential.
|
||||
CrossPlatform AuthenticatorAttachment = "cross-platform"
|
||||
)
|
||||
|
||||
func ParseAuthenticatorAttachment(s string) AuthenticatorAttachment {
|
||||
switch s {
|
||||
case "platform":
|
||||
return Platform
|
||||
default:
|
||||
return CrossPlatform
|
||||
}
|
||||
}
|
||||
|
||||
const (
|
||||
// USB indicates the respective authenticator can be contacted over removable USB.
|
||||
USB AuthenticatorTransport = "usb"
|
||||
|
||||
// NFC indicates the respective authenticator can be contacted over Near Field Communication (NFC).
|
||||
NFC AuthenticatorTransport = "nfc"
|
||||
|
||||
// BLE indicates the respective authenticator can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).
|
||||
BLE AuthenticatorTransport = "ble"
|
||||
|
||||
// SmartCard indicates the respective authenticator can be contacted over ISO/IEC 7816 smart card with contacts.
|
||||
//
|
||||
// WebAuthn Level 3.
|
||||
SmartCard AuthenticatorTransport = "smart-card"
|
||||
|
||||
// Hybrid indicates the respective authenticator can be contacted using a combination of (often separate)
|
||||
// data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using
|
||||
// a smartphone.
|
||||
//
|
||||
// WebAuthn Level 3.
|
||||
Hybrid AuthenticatorTransport = "hybrid"
|
||||
|
||||
// Internal indicates the respective authenticator is contacted using a client device-specific transport, i.e., it
|
||||
// is a platform authenticator. These authenticators are not removable from the client device.
|
||||
Internal AuthenticatorTransport = "internal"
|
||||
)
|
||||
|
||||
func ParseAuthenticatorTransport(s string) AuthenticatorTransport {
|
||||
switch s {
|
||||
case "usb":
|
||||
return USB
|
||||
case "nfc":
|
||||
return NFC
|
||||
case "ble":
|
||||
return BLE
|
||||
case "smart-card":
|
||||
return SmartCard
|
||||
case "hybrid":
|
||||
return Hybrid
|
||||
default:
|
||||
return Internal
|
||||
}
|
||||
}
|
||||
|
||||
type AuthenticatorFlags byte
|
||||
|
||||
const (
|
||||
// FlagUserPresent Bit 00000001 in the byte sequence. Tells us if user is present. Also referred to as the UP flag.
|
||||
FlagUserPresent AuthenticatorFlags = 1 << iota // Referred to as UP
|
||||
|
||||
// FlagRFU1 is a reserved for future use flag.
|
||||
FlagRFU1
|
||||
|
||||
// FlagUserVerified Bit 00000100 in the byte sequence. Tells us if user is verified
|
||||
// by the authenticator using a biometric or PIN. Also referred to as the UV flag.
|
||||
FlagUserVerified
|
||||
|
||||
// FlagBackupEligible Bit 00001000 in the byte sequence. Tells us if a backup is eligible for device. Also referred
|
||||
// to as the BE flag.
|
||||
FlagBackupEligible // Referred to as BE
|
||||
|
||||
// FlagBackupState Bit 00010000 in the byte sequence. Tells us if a backup state for device. Also referred to as the
|
||||
// BS flag.
|
||||
FlagBackupState
|
||||
|
||||
// FlagRFU2 is a reserved for future use flag.
|
||||
FlagRFU2
|
||||
|
||||
// FlagAttestedCredentialData Bit 01000000 in the byte sequence. Indicates whether
|
||||
// the authenticator added attested credential data. Also referred to as the AT flag.
|
||||
FlagAttestedCredentialData
|
||||
|
||||
// FlagHasExtensions Bit 10000000 in the byte sequence. Indicates if the authenticator data has extensions. Also
|
||||
// referred to as the ED flag.
|
||||
FlagHasExtensions
|
||||
)
|
||||
|
||||
type AttestationFormat string
|
||||
|
||||
const (
|
||||
// AttestationFormatPacked is the "packed" attestation statement format is a WebAuthn-optimized format for
|
||||
// attestation. It uses a very compact but still extensible encoding method. This format is implementable by
|
||||
// authenticators with limited resources (e.g., secure elements).
|
||||
AttestationFormatPacked AttestationFormat = "packed"
|
||||
|
||||
// AttestationFormatTPM is the TPM attestation statement format returns an attestation statement in the same format
|
||||
// as the packed attestation statement format, although the rawData and signature fields are computed differently.
|
||||
AttestationFormatTPM AttestationFormat = "tpm"
|
||||
|
||||
// AttestationFormatAndroidKey is the attestation statement format for platform authenticators on versions "N", and
|
||||
// later, which may provide this proprietary "hardware attestation" statement.
|
||||
AttestationFormatAndroidKey AttestationFormat = "android-key"
|
||||
|
||||
// AttestationFormatAndroidSafetyNet is the attestation statement format that Android-based platform authenticators
|
||||
// MAY produce an attestation statement based on the Android SafetyNet API.
|
||||
AttestationFormatAndroidSafetyNet AttestationFormat = "android-safetynet"
|
||||
|
||||
// AttestationFormatFIDOUniversalSecondFactor is the attestation statement format that is used with FIDO U2F
|
||||
// authenticators.
|
||||
AttestationFormatFIDOUniversalSecondFactor AttestationFormat = "fido-u2f"
|
||||
|
||||
// AttestationFormatApple is the attestation statement format that is used with Apple devices' platform
|
||||
// authenticators.
|
||||
AttestationFormatApple AttestationFormat = "apple"
|
||||
|
||||
// AttestationFormatNone is the attestation statement format that is used to replace any authenticator-provided
|
||||
// attestation statement when a WebAuthn Relying Party indicates it does not wish to receive attestation information.
|
||||
AttestationFormatNone AttestationFormat = "none"
|
||||
)
|
||||
|
||||
func ExtractAttestationFormats(p *types.Params) []AttestationFormat {
|
||||
var formats []AttestationFormat
|
||||
for _, v := range p.AttestationFormats {
|
||||
formats = append(formats, parseAttestationFormat(v))
|
||||
}
|
||||
return formats
|
||||
}
|
||||
|
||||
func parseAttestationFormat(s string) AttestationFormat {
|
||||
switch s {
|
||||
case "packed":
|
||||
return AttestationFormatPacked
|
||||
case "tpm":
|
||||
return AttestationFormatTPM
|
||||
case "android-key":
|
||||
return AttestationFormatAndroidKey
|
||||
case "android-safetynet":
|
||||
return AttestationFormatAndroidSafetyNet
|
||||
case "fido-u2f":
|
||||
return AttestationFormatFIDOUniversalSecondFactor
|
||||
case "apple":
|
||||
return AttestationFormatApple
|
||||
case "none":
|
||||
return AttestationFormatNone
|
||||
default:
|
||||
return AttestationFormatPacked
|
||||
}
|
||||
}
|
||||
|
||||
type CredentialType string
|
||||
|
||||
const (
|
||||
CredentialTypePublicKeyCredential CredentialType = "public-key"
|
||||
)
|
||||
|
||||
type ConveyancePreference string
|
||||
|
||||
const (
|
||||
// PreferNoAttestation is a ConveyancePreference value.
|
||||
//
|
||||
// This value indicates that the Relying Party is not interested in authenticator attestation. For example, in order
|
||||
// to potentially avoid having to obtain user consent to relay identifying information to the Relying Party, or to
|
||||
// save a round trip to an Attestation CA or Anonymization CA.
|
||||
//
|
||||
// This is the default value.
|
||||
//
|
||||
// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-none)
|
||||
PreferNoAttestation ConveyancePreference = "none"
|
||||
|
||||
// PreferIndirectAttestation is a ConveyancePreference value.
|
||||
//
|
||||
// This value indicates that the Relying Party prefers an attestation conveyance yielding verifiable attestation
|
||||
// statements, but allows the client to decide how to obtain such attestation statements. The client MAY replace the
|
||||
// authenticator-generated attestation statements with attestation statements generated by an Anonymization CA, in
|
||||
// order to protect the user’s privacy, or to assist Relying Parties with attestation verification in a
|
||||
// heterogeneous ecosystem.
|
||||
//
|
||||
// Note: There is no guarantee that the Relying Party will obtain a verifiable attestation statement in this case.
|
||||
// For example, in the case that the authenticator employs self attestation.
|
||||
//
|
||||
// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-indirect)
|
||||
PreferIndirectAttestation ConveyancePreference = "indirect"
|
||||
|
||||
// PreferDirectAttestation is a ConveyancePreference value.
|
||||
//
|
||||
// This value indicates that the Relying Party wants to receive the attestation statement as generated by the
|
||||
// authenticator.
|
||||
//
|
||||
// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-direct)
|
||||
PreferDirectAttestation ConveyancePreference = "direct"
|
||||
|
||||
// PreferEnterpriseAttestation is a ConveyancePreference value.
|
||||
//
|
||||
// This value indicates that the Relying Party wants to receive an attestation statement that may include uniquely
|
||||
// identifying information. This is intended for controlled deployments within an enterprise where the organization
|
||||
// wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless
|
||||
// the user agent or authenticator configuration permits it for the requested RP ID.
|
||||
//
|
||||
// If permitted, the user agent SHOULD signal to the authenticator (at invocation time) that enterprise
|
||||
// attestation is requested, and convey the resulting AAGUID and attestation statement, unaltered, to the Relying
|
||||
// Party.
|
||||
//
|
||||
// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-enterprise)
|
||||
PreferEnterpriseAttestation ConveyancePreference = "enterprise"
|
||||
)
|
||||
|
||||
func ExtractConveyancePreference(p *types.Params) ConveyancePreference {
|
||||
switch p.ConveyancePreference {
|
||||
case "none":
|
||||
return PreferNoAttestation
|
||||
case "indirect":
|
||||
return PreferIndirectAttestation
|
||||
case "direct":
|
||||
return PreferDirectAttestation
|
||||
case "enterprise":
|
||||
return PreferEnterpriseAttestation
|
||||
default:
|
||||
return PreferNoAttestation
|
||||
}
|
||||
}
|
||||
|
||||
type PublicKeyCredentialHints string
|
||||
|
||||
const (
|
||||
// PublicKeyCredentialHintSecurityKey is a PublicKeyCredentialHint that indicates that the Relying Party believes
|
||||
// that users will satisfy this request with a physical security key. For example, an enterprise Relying Party may
|
||||
// set this hint if they have issued security keys to their employees and will only accept those authenticators for
|
||||
// registration and authentication.
|
||||
//
|
||||
// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
|
||||
// authenticatorAttachment SHOULD be set to cross-platform.
|
||||
PublicKeyCredentialHintSecurityKey PublicKeyCredentialHints = "security-key"
|
||||
|
||||
// PublicKeyCredentialHintClientDevice is a PublicKeyCredentialHint that indicates that the Relying Party believes
|
||||
// that users will satisfy this request with a platform authenticator attached to the client device.
|
||||
//
|
||||
// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
|
||||
// authenticatorAttachment SHOULD be set to platform.
|
||||
PublicKeyCredentialHintClientDevice PublicKeyCredentialHints = "client-device"
|
||||
|
||||
// PublicKeyCredentialHintHybrid is a PublicKeyCredentialHint that indicates that the Relying Party believes that
|
||||
// users will satisfy this request with general-purpose authenticators such as smartphones. For example, a consumer
|
||||
// Relying Party may believe that only a small fraction of their customers possesses dedicated security keys. This
|
||||
// option also implies that the local platform authenticator should not be promoted in the UI.
|
||||
//
|
||||
// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
|
||||
// authenticatorAttachment SHOULD be set to cross-platform.
|
||||
PublicKeyCredentialHintHybrid PublicKeyCredentialHints = "hybrid"
|
||||
)
|
||||
|
||||
func ParsePublicKeyCredentialHints(s string) PublicKeyCredentialHints {
|
||||
switch s {
|
||||
case "security-key":
|
||||
return PublicKeyCredentialHintSecurityKey
|
||||
case "client-device":
|
||||
return PublicKeyCredentialHintClientDevice
|
||||
case "hybrid":
|
||||
return PublicKeyCredentialHintHybrid
|
||||
default:
|
||||
return ""
|
||||
}
|
||||
}
|
||||
|
||||
type AttestedCredentialData struct {
|
||||
AAGUID []byte `json:"aaguid"`
|
||||
CredentialID []byte `json:"credential_id"`
|
||||
|
||||
// The raw credential public key bytes received from the attestation data.
|
||||
CredentialPublicKey []byte `json:"public_key"`
|
||||
}
|
||||
|
||||
type ResidentKeyRequirement string
|
||||
|
||||
const (
|
||||
// ResidentKeyRequirementDiscouraged indicates the Relying Party prefers creating a server-side credential, but will
|
||||
// accept a client-side discoverable credential. This is the default.
|
||||
ResidentKeyRequirementDiscouraged ResidentKeyRequirement = "discouraged"
|
||||
|
||||
// ResidentKeyRequirementPreferred indicates to the client we would prefer a discoverable credential.
|
||||
ResidentKeyRequirementPreferred ResidentKeyRequirement = "preferred"
|
||||
|
||||
// ResidentKeyRequirementRequired indicates the Relying Party requires a client-side discoverable credential, and is
|
||||
// prepared to receive an error if a client-side discoverable credential cannot be created.
|
||||
ResidentKeyRequirementRequired ResidentKeyRequirement = "required"
|
||||
)
|
||||
|
||||
func ParseResidentKeyRequirement(s string) ResidentKeyRequirement {
|
||||
switch s {
|
||||
case "discouraged":
|
||||
return ResidentKeyRequirementDiscouraged
|
||||
case "preferred":
|
||||
return ResidentKeyRequirementPreferred
|
||||
default:
|
||||
return ResidentKeyRequirementRequired
|
||||
}
|
||||
}
|
||||
|
||||
type (
|
||||
AuthenticationExtensions map[string]any
|
||||
UserVerificationRequirement string
|
||||
)
|
||||
|
||||
const (
|
||||
// VerificationRequired User verification is required to create/release a credential
|
||||
VerificationRequired UserVerificationRequirement = "required"
|
||||
|
||||
// VerificationPreferred User verification is preferred to create/release a credential
|
||||
VerificationPreferred UserVerificationRequirement = "preferred" // This is the default
|
||||
|
||||
// VerificationDiscouraged The authenticator should not verify the user for the credential
|
||||
VerificationDiscouraged UserVerificationRequirement = "discouraged"
|
||||
)
|
||||
@@ -1,48 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"github.com/labstack/echo/v4"
|
||||
"gopkg.in/macaroon.v2"
|
||||
|
||||
"gopkg.in/macaroon-bakery.v2/bakery/checkers"
|
||||
)
|
||||
|
||||
var PermissionNamespace *checkers.Namespace
|
||||
|
||||
func ValidateMacaroonMiddleware(secretKey []byte, location string) echo.MiddlewareFunc {
|
||||
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c echo.Context) error {
|
||||
// Extract the macaroon from the Authorization header
|
||||
auth := c.Request().Header.Get("Authorization")
|
||||
if auth == "" {
|
||||
return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Missing Authorization header"})
|
||||
}
|
||||
|
||||
// Decode the macaroon
|
||||
mac, err := macaroon.Base64Decode([]byte(auth))
|
||||
if err != nil {
|
||||
return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon encoding"})
|
||||
}
|
||||
|
||||
token, err := macaroon.New(secretKey, mac, location, macaroon.LatestVersion)
|
||||
if err != nil {
|
||||
return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon"})
|
||||
}
|
||||
|
||||
// Verify the macaroon
|
||||
err = token.Verify(secretKey, func(caveat string) error {
|
||||
// Implement your caveat verification logic here
|
||||
// For example, you might check if the caveat is still valid (e.g., not expired)
|
||||
return nil // Return nil if the caveat is valid
|
||||
}, nil)
|
||||
if err != nil {
|
||||
return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid macaroon"})
|
||||
}
|
||||
|
||||
// Macaroon is valid, proceed to the next handler
|
||||
return next(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
package builder
|
||||
|
||||
//
|
||||
// func GetDiscovery(origin string) *types.DiscoveryDocument {
|
||||
// baseURL := "https://" + origin // Ensure this is the correct base URL for your service
|
||||
// discoveryDoc := &types.DiscoveryDocument{
|
||||
// Issuer: baseURL,
|
||||
// AuthorizationEndpoint: fmt.Sprintf("%s/auth", baseURL),
|
||||
// TokenEndpoint: fmt.Sprintf("%s/token", baseURL),
|
||||
// UserinfoEndpoint: fmt.Sprintf("%s/userinfo", baseURL),
|
||||
// JwksUri: fmt.Sprintf("%s/jwks", baseURL),
|
||||
// RegistrationEndpoint: fmt.Sprintf("%s/register", baseURL),
|
||||
// ScopesSupported: []string{"openid", "profile", "email", "web3", "sonr"},
|
||||
// ResponseTypesSupported: []string{"code"},
|
||||
// ResponseModesSupported: []string{"query", "form_post"},
|
||||
// GrantTypesSupported: []string{"authorization_code", "refresh_token"},
|
||||
// AcrValuesSupported: []string{"passkey"},
|
||||
// SubjectTypesSupported: []string{"public"},
|
||||
// ClaimsSupported: []string{"sub", "iss", "name", "email"},
|
||||
// }
|
||||
// return discoveryDoc
|
||||
// }
|
||||
@@ -1,82 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
)
|
||||
|
||||
type AuthenticatorResponse struct {
|
||||
// From the spec https://www.w3.org/TR/webauthn/#dom-authenticatorresponse-clientdatajson
|
||||
// This attribute contains a JSON serialization of the client data passed to the authenticator
|
||||
// by the client in its call to either create() or get().
|
||||
ClientDataJSON URLEncodedBase64 `json:"clientDataJSON"`
|
||||
}
|
||||
|
||||
type AuthenticatorAttestationResponse struct {
|
||||
// The byte slice of clientDataJSON, which becomes CollectedClientData
|
||||
AuthenticatorResponse
|
||||
|
||||
Transports []string `json:"transports,omitempty"`
|
||||
|
||||
AuthenticatorData URLEncodedBase64 `json:"authenticatorData"`
|
||||
|
||||
PublicKey URLEncodedBase64 `json:"publicKey"`
|
||||
|
||||
PublicKeyAlgorithm int64 `json:"publicKeyAlgorithm"`
|
||||
|
||||
// AttestationObject is the byte slice version of attestationObject.
|
||||
// This attribute contains an attestation object, which is opaque to, and
|
||||
// cryptographically protected against tampering by, the client. The
|
||||
// attestation object contains both authenticator data and an attestation
|
||||
// statement. The former contains the AAGUID, a unique credential ID, and
|
||||
// the credential public key. The contents of the attestation statement are
|
||||
// determined by the attestation statement format used by the authenticator.
|
||||
// It also contains any additional information that the Relying Party's server
|
||||
// requires to validate the attestation statement, as well as to decode and
|
||||
// validate the authenticator data along with the JSON-serialized client data.
|
||||
AttestationObject URLEncodedBase64 `json:"attestationObject"`
|
||||
}
|
||||
|
||||
type PublicKeyCredentialCreationOptions struct {
|
||||
RelyingParty RelyingPartyEntity `json:"rp"`
|
||||
User UserEntity `json:"user"`
|
||||
Challenge URLEncodedBase64 `json:"challenge"`
|
||||
Parameters []CredentialParameter `json:"pubKeyCredParams,omitempty"`
|
||||
Timeout int `json:"timeout,omitempty"`
|
||||
CredentialExcludeList []CredentialDescriptor `json:"excludeCredentials,omitempty"`
|
||||
AuthenticatorSelection AuthenticatorSelection `json:"authenticatorSelection,omitempty"`
|
||||
Hints []PublicKeyCredentialHints `json:"hints,omitempty"`
|
||||
Attestation ConveyancePreference `json:"attestation,omitempty"`
|
||||
AttestationFormats []AttestationFormat `json:"attestationFormats,omitempty"`
|
||||
Extensions AuthenticationExtensions `json:"extensions,omitempty"`
|
||||
}
|
||||
|
||||
func GetPublicKeyCredentialCreationOptions(origin string, subject string, vaultCID string, params *types.Params) (*PublicKeyCredentialCreationOptions, error) {
|
||||
chal, err := CreateChallenge()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &PublicKeyCredentialCreationOptions{
|
||||
RelyingParty: NewRelayingParty(origin, subject),
|
||||
User: NewUserEntity(subject, subject, vaultCID),
|
||||
Parameters: ExtractCredentialParameters(params),
|
||||
Timeout: 20,
|
||||
CredentialExcludeList: nil,
|
||||
Challenge: chal,
|
||||
AuthenticatorSelection: AuthenticatorSelection{},
|
||||
Hints: nil,
|
||||
Attestation: ExtractConveyancePreference(params),
|
||||
AttestationFormats: ExtractAttestationFormats(params),
|
||||
Extensions: nil,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func UnmarshalAuthenticatorResponse(data []byte) (*AuthenticatorResponse, error) {
|
||||
var ar AuthenticatorResponse
|
||||
err := json.Unmarshal(data, &ar)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ar, nil
|
||||
}
|
||||
@@ -1,81 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
cryptotypes "github.com/cosmos/cosmos-sdk/crypto/types"
|
||||
didv1 "github.com/onsonr/sonr/api/did/v1"
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
|
||||
"github.com/go-webauthn/webauthn/protocol/webauthncose"
|
||||
)
|
||||
|
||||
// PublicKey is an interface for a public key
|
||||
type PublicKey interface {
|
||||
cryptotypes.PubKey
|
||||
Clone() cryptotypes.PubKey
|
||||
GetRaw() []byte
|
||||
GetRole() types.KeyRole
|
||||
GetAlgorithm() types.KeyAlgorithm
|
||||
GetEncoding() types.KeyEncoding
|
||||
GetCurve() types.KeyCurve
|
||||
GetKeyType() types.KeyType
|
||||
}
|
||||
|
||||
// CreateAuthnVerification creates a new verification method for an authn method
|
||||
func CreateAuthnVerification(namespace types.DIDNamespace, issuer string, controller string, pubkey *types.PubKey, identifier string) *types.Verification {
|
||||
return &types.Verification{
|
||||
Method: namespace,
|
||||
Controller: controller,
|
||||
PublicKey: pubkey,
|
||||
Id: identifier,
|
||||
Issuer: issuer,
|
||||
}
|
||||
}
|
||||
|
||||
// CreateWalletVerification creates a new verification method for a wallet
|
||||
func CreateWalletVerification(namespace types.DIDNamespace, controller string, pubkey *types.PubKey, identifier string) *didv1.Verification {
|
||||
return &didv1.Verification{
|
||||
Method: APIFormatDIDNamespace(namespace),
|
||||
Controller: controller,
|
||||
PublicKey: APIFormatPubKey(pubkey),
|
||||
Id: identifier,
|
||||
}
|
||||
}
|
||||
|
||||
// ExtractWebAuthnPublicKey parses the raw public key bytes and returns a JWK representation
|
||||
func ExtractWebAuthnPublicKey(keyBytes []byte) (*types.PubKey_JWK, error) {
|
||||
key, err := webauthncose.ParsePublicKey(keyBytes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to parse public key: %w", err)
|
||||
}
|
||||
|
||||
switch k := key.(type) {
|
||||
case *webauthncose.EC2PublicKeyData:
|
||||
return FormatEC2PublicKey(k)
|
||||
case *webauthncose.RSAPublicKeyData:
|
||||
return FormatRSAPublicKey(k)
|
||||
case *webauthncose.OKPPublicKeyData:
|
||||
return FormatOKPPublicKey(k)
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported key type")
|
||||
}
|
||||
}
|
||||
|
||||
// NewInitialWalletAccounts creates a new set of verification methods for a wallet
|
||||
func NewInitialWalletAccounts(controller string, pubkey *types.PubKey) ([]*didv1.Verification, error) {
|
||||
var verificationMethods []*didv1.Verification
|
||||
for method, chain := range types.InitialChainCodes {
|
||||
nk, err := computeBip32AccountPublicKey(pubkey, chain, 0)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
addr, err := chain.FormatAddress(nk)
|
||||
if err != nil {
|
||||
return nil, nil
|
||||
}
|
||||
verificationMethods = append(verificationMethods, CreateWalletVerification(method, controller, nk, method.FormatDID(addr)))
|
||||
}
|
||||
return verificationMethods, nil
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
"gopkg.in/macaroon-bakery.v2/bakery/checkers"
|
||||
)
|
||||
|
||||
var (
|
||||
GenericPermissionScopeStrings = [...]string{
|
||||
"profile.name",
|
||||
"identifiers.email",
|
||||
"identifiers.phone",
|
||||
"transactions.read",
|
||||
"transactions.write",
|
||||
"wallets.read",
|
||||
"wallets.create",
|
||||
"wallets.subscribe",
|
||||
"wallets.update",
|
||||
"transactions.verify",
|
||||
"transactions.broadcast",
|
||||
"admin.user",
|
||||
"admin.validator",
|
||||
}
|
||||
|
||||
StringToModulePermissionScope = map[string]types.PermissionScope{
|
||||
"PERMISSION_SCOPE_UNSPECIFIED": types.PermissionScope_PERMISSION_SCOPE_UNSPECIFIED,
|
||||
"PERMISSION_SCOPE_BASIC_INFO": types.PermissionScope_PERMISSION_SCOPE_BASIC_INFO,
|
||||
"PERMISSION_SCOPE_IDENTIFIERS_EMAIL": types.PermissionScope_PERMISSION_SCOPE_PERMISSIONS_READ,
|
||||
"PERMISSION_SCOPE_IDENTIFIERS_PHONE": types.PermissionScope_PERMISSION_SCOPE_PERMISSIONS_WRITE,
|
||||
"PERMISSION_SCOPE_TRANSACTIONS_READ": types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_READ,
|
||||
"PERMISSION_SCOPE_TRANSACTIONS_WRITE": types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_WRITE,
|
||||
"PERMISSION_SCOPE_WALLETS_READ": types.PermissionScope_PERMISSION_SCOPE_WALLETS_READ,
|
||||
"PERMISSION_SCOPE_WALLETS_CREATE": types.PermissionScope_PERMISSION_SCOPE_WALLETS_CREATE,
|
||||
"PERMISSION_SCOPE_WALLETS_SUBSCRIBE": types.PermissionScope_PERMISSION_SCOPE_WALLETS_SUBSCRIBE,
|
||||
"PERMISSION_SCOPE_WALLETS_UPDATE": types.PermissionScope_PERMISSION_SCOPE_WALLETS_UPDATE,
|
||||
"PERMISSION_SCOPE_TRANSACTIONS_VERIFY": types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_VERIFY,
|
||||
"PERMISSION_SCOPE_TRANSACTIONS_BROADCAST": types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_BROADCAST,
|
||||
"PERMISSION_SCOPE_ADMIN_USER": types.PermissionScope_PERMISSION_SCOPE_ADMIN_USER,
|
||||
"PERMISSION_SCOPE_ADMIN_VALIDATOR": types.PermissionScope_PERMISSION_SCOPE_ADMIN_VALIDATOR,
|
||||
}
|
||||
)
|
||||
|
||||
func ResolvePermissionScope(scope string) (types.PermissionScope, bool) {
|
||||
uriToPrefix := make(map[string]string)
|
||||
for _, scope := range GenericPermissionScopeStrings {
|
||||
uriToPrefix["https://example.com/auth/"+scope] = scope
|
||||
}
|
||||
PermissionNamespace := checkers.NewNamespace(uriToPrefix)
|
||||
|
||||
prefix, ok := PermissionNamespace.Resolve("https://example.com/auth/" + scope)
|
||||
if !ok {
|
||||
return 0, false
|
||||
}
|
||||
permScope, ok := StringToModulePermissionScope[prefix]
|
||||
return permScope, ok
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"strings"
|
||||
|
||||
"github.com/onsonr/sonr/x/did/types"
|
||||
)
|
||||
|
||||
// ChallengeLength - Length of bytes to generate for a challenge.
|
||||
const ChallengeLength = 32
|
||||
|
||||
// CreateChallenge creates a new challenge that should be signed and returned by the authenticator. The spec recommends
|
||||
// using at least 16 bytes with 100 bits of entropy. We use 32 bytes.
|
||||
func CreateChallenge() (challenge URLEncodedBase64, err error) {
|
||||
challenge = make([]byte, ChallengeLength)
|
||||
|
||||
if _, err = rand.Read(challenge); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return challenge, nil
|
||||
}
|
||||
|
||||
type CredentialEntity struct {
|
||||
// A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents:
|
||||
//
|
||||
// When inherited by PublicKeyCredentialRpEntity it is a human-palatable identifier for the Relying Party,
|
||||
// intended only for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".
|
||||
//
|
||||
// When inherited by PublicKeyCredentialUserEntity, it is a human-palatable identifier for a user account. It is
|
||||
// intended only for display, i.e., aiding the user in determining the difference between user accounts with similar
|
||||
// displayNames. For example, "alexm", "alex.p.mueller@example.com" or "+14255551234".
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
func NewCredentialEntity(name string) CredentialEntity {
|
||||
return CredentialEntity{
|
||||
Name: name,
|
||||
}
|
||||
}
|
||||
|
||||
type CredentialParameter struct {
|
||||
Type CredentialType `json:"type"`
|
||||
Algorithm types.COSEAlgorithmIdentifier `json:"alg"`
|
||||
}
|
||||
|
||||
func NewCredentialParameter(ki *types.KeyInfo) CredentialParameter {
|
||||
return CredentialParameter{
|
||||
Type: CredentialTypePublicKeyCredential,
|
||||
Algorithm: ki.Algorithm.CoseIdentifier(),
|
||||
}
|
||||
}
|
||||
|
||||
func ExtractCredentialParameters(p *types.Params) []CredentialParameter {
|
||||
var keys []*types.KeyInfo
|
||||
for k, v := range p.AllowedPublicKeys {
|
||||
if strings.Contains(k, "webauthn") {
|
||||
keys = append(keys, v)
|
||||
}
|
||||
}
|
||||
var cparams []CredentialParameter
|
||||
for _, ki := range keys {
|
||||
cparams = append(cparams, NewCredentialParameter(ki))
|
||||
}
|
||||
return cparams
|
||||
}
|
||||
|
||||
type RelyingPartyEntity struct {
|
||||
CredentialEntity
|
||||
|
||||
// A unique identifier for the Relying Party entity, which sets the RP ID.
|
||||
ID string `json:"id"`
|
||||
}
|
||||
|
||||
func NewRelayingParty(name string, origin string) RelyingPartyEntity {
|
||||
return RelyingPartyEntity{
|
||||
CredentialEntity: NewCredentialEntity(origin),
|
||||
ID: origin,
|
||||
}
|
||||
}
|
||||
|
||||
type UserEntity struct {
|
||||
CredentialEntity
|
||||
// A human-palatable name for the user account, intended only for display.
|
||||
// For example, "Alex P. Müller" or "田中 倫". The Relying Party SHOULD let
|
||||
// the user choose this, and SHOULD NOT restrict the choice more than necessary.
|
||||
DisplayName string `json:"displayName"`
|
||||
|
||||
// ID is the user handle of the user account entity. To ensure secure operation,
|
||||
// authentication and authorization decisions MUST be made on the basis of this id
|
||||
// member, not the displayName nor name members. See Section 6.1 of
|
||||
// [RFC8266](https://www.w3.org/TR/webauthn/#biblio-rfc8266).
|
||||
ID any `json:"id"`
|
||||
}
|
||||
|
||||
func NewUserEntity(name string, subject string, cid string) UserEntity {
|
||||
return UserEntity{
|
||||
CredentialEntity: NewCredentialEntity(name),
|
||||
DisplayName: subject,
|
||||
ID: cid,
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
package builder
|
||||
@@ -1,169 +0,0 @@
|
||||
package builder
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/base64"
|
||||
"reflect"
|
||||
|
||||
"github.com/go-webauthn/webauthn/protocol"
|
||||
)
|
||||
|
||||
// Credential contains all needed information about a WebAuthn credential for storage.
|
||||
type Credential struct {
|
||||
Subject string `json:"handle"`
|
||||
AttestationType string `json:"attestationType"`
|
||||
Origin string `json:"origin"`
|
||||
CredentialID []byte `json:"id"`
|
||||
PublicKey []byte `json:"publicKey"`
|
||||
Transport []string `json:"transport"`
|
||||
SignCount uint32 `json:"signCount"`
|
||||
UserPresent bool `json:"userPresent"`
|
||||
UserVerified bool `json:"userVerified"`
|
||||
BackupEligible bool `json:"backupEligible"`
|
||||
BackupState bool `json:"backupState"`
|
||||
CloneWarning bool `json:"cloneWarning"`
|
||||
}
|
||||
|
||||
// NewCredential will return a credential pointer on successful validation of a registration response.
|
||||
func NewCredential(c *protocol.ParsedCredentialCreationData, origin, handle string) *Credential {
|
||||
return &Credential{
|
||||
Subject: handle,
|
||||
Origin: origin,
|
||||
AttestationType: c.Response.AttestationObject.Format,
|
||||
CredentialID: c.Response.AttestationObject.AuthData.AttData.CredentialID,
|
||||
PublicKey: c.Response.AttestationObject.AuthData.AttData.CredentialPublicKey,
|
||||
Transport: NormalizeTransports(c.Response.Transports),
|
||||
SignCount: c.Response.AttestationObject.AuthData.Counter,
|
||||
UserPresent: c.Response.AttestationObject.AuthData.Flags.HasUserPresent(),
|
||||
UserVerified: c.Response.AttestationObject.AuthData.Flags.HasUserVerified(),
|
||||
BackupEligible: c.Response.AttestationObject.AuthData.Flags.HasBackupEligible(),
|
||||
BackupState: c.Response.AttestationObject.AuthData.Flags.HasAttestedCredentialData(),
|
||||
}
|
||||
}
|
||||
|
||||
// Descriptor converts a Credential into a protocol.CredentialDescriptor.
|
||||
func (c *Credential) Descriptor() protocol.CredentialDescriptor {
|
||||
return protocol.CredentialDescriptor{
|
||||
Type: protocol.PublicKeyCredentialType,
|
||||
CredentialID: c.CredentialID,
|
||||
Transport: ModuleTransportsToProtocol(c.Transport),
|
||||
AttestationType: c.AttestationType,
|
||||
}
|
||||
}
|
||||
|
||||
// This is a signal that the authenticator may be cloned, see CloneWarning above for more information.
|
||||
func (a *Credential) UpdateCounter(authDataCount uint32) {
|
||||
if authDataCount <= a.SignCount && (authDataCount != 0 || a.SignCount != 0) {
|
||||
a.CloneWarning = true
|
||||
return
|
||||
}
|
||||
|
||||
a.SignCount = authDataCount
|
||||
}
|
||||
|
||||
type CredentialDescriptor struct {
|
||||
// The valid credential types.
|
||||
Type CredentialType `json:"type"`
|
||||
|
||||
// CredentialID The ID of a credential to allow/disallow.
|
||||
CredentialID URLEncodedBase64 `json:"id"`
|
||||
|
||||
// The authenticator transports that can be used.
|
||||
Transport []AuthenticatorTransport `json:"transports,omitempty"`
|
||||
|
||||
// The AttestationType from the Credential. Used internally only.
|
||||
AttestationType string `json:"-"`
|
||||
}
|
||||
|
||||
func NewCredentialDescriptor(credentialID string, transports []AuthenticatorTransport, attestationType string) *CredentialDescriptor {
|
||||
return &CredentialDescriptor{
|
||||
CredentialID: URLEncodedBase64(credentialID),
|
||||
Transport: transports,
|
||||
AttestationType: attestationType,
|
||||
Type: CredentialTypePublicKeyCredential,
|
||||
}
|
||||
}
|
||||
|
||||
type AuthenticatorSelection struct {
|
||||
// AuthenticatorAttachment If this member is present, eligible authenticators are filtered to only
|
||||
// authenticators attached with the specified AuthenticatorAttachment enum.
|
||||
AuthenticatorAttachment AuthenticatorAttachment `json:"authenticatorAttachment,omitempty"`
|
||||
|
||||
// RequireResidentKey this member describes the Relying Party's requirements regarding resident
|
||||
// credentials. If the parameter is set to true, the authenticator MUST create a client-side-resident
|
||||
// public key credential source when creating a public key credential.
|
||||
RequireResidentKey *bool `json:"requireResidentKey,omitempty"`
|
||||
|
||||
// ResidentKey this member describes the Relying Party's requirements regarding resident
|
||||
// credentials per Webauthn Level 2.
|
||||
ResidentKey ResidentKeyRequirement `json:"residentKey,omitempty"`
|
||||
|
||||
// UserVerification This member describes the Relying Party's requirements regarding user verification for
|
||||
// the create() operation. Eligible authenticators are filtered to only those capable of satisfying this
|
||||
// requirement.
|
||||
UserVerification UserVerificationRequirement `json:"userVerification,omitempty"`
|
||||
}
|
||||
|
||||
type AuthenticatorData struct {
|
||||
RPIDHash []byte `json:"rpid"`
|
||||
Flags AuthenticatorFlags `json:"flags"`
|
||||
Counter uint32 `json:"sign_count"`
|
||||
AttData AttestedCredentialData `json:"att_data"`
|
||||
ExtData []byte `json:"ext_data"`
|
||||
}
|
||||
|
||||
type AttestationObject struct {
|
||||
// The authenticator data, including the newly created public key. See AuthenticatorData for more info
|
||||
AuthData AuthenticatorData
|
||||
|
||||
// The byteform version of the authenticator data, used in part for signature validation
|
||||
RawAuthData []byte `json:"authData"`
|
||||
|
||||
// The format of the Attestation data.
|
||||
Format string `json:"fmt"`
|
||||
|
||||
// The attestation statement data sent back if attestation is requested.
|
||||
AttStatement map[string]any `json:"attStmt,omitempty"`
|
||||
}
|
||||
|
||||
type URLEncodedBase64 []byte
|
||||
|
||||
func (e URLEncodedBase64) String() string {
|
||||
return base64.RawURLEncoding.EncodeToString(e)
|
||||
}
|
||||
|
||||
// UnmarshalJSON base64 decodes a URL-encoded value, storing the result in the
|
||||
// provided byte slice.
|
||||
func (e *URLEncodedBase64) UnmarshalJSON(data []byte) error {
|
||||
if bytes.Equal(data, []byte("null")) {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Trim the leading spaces.
|
||||
data = bytes.Trim(data, "\"")
|
||||
|
||||
// Trim the trailing equal characters.
|
||||
data = bytes.TrimRight(data, "=")
|
||||
|
||||
out := make([]byte, base64.RawURLEncoding.DecodedLen(len(data)))
|
||||
|
||||
n, err := base64.RawURLEncoding.Decode(out, data)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
v := reflect.ValueOf(e).Elem()
|
||||
v.SetBytes(out[:n])
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalJSON base64 encodes a non URL-encoded value, storing the result in the
|
||||
// provided byte slice.
|
||||
func (e URLEncodedBase64) MarshalJSON() ([]byte, error) {
|
||||
if e == nil {
|
||||
return []byte("null"), nil
|
||||
}
|
||||
|
||||
return []byte(`"` + base64.RawURLEncoding.EncodeToString(e) + `"`), nil
|
||||
}
|
||||
Reference in New Issue
Block a user