a
    žlJhÏ*  ã                
   @   s  d Z ddlmZmZmZmZ ddlmZmZ ddl	m	Z	 ddlm
Z
 erTddlmZ z8dd	lmZ dd
lmZmZ ddlmZ ddlmZ W n0 ey¼ Z ze d¡e‚W Y dZ[n
dZ[0 0 zddlmZ dZW n eyè   dZY n0 dZG dd„ deƒZG dd„ de
ƒZ dS )zWebAuthn Authentication Plugin.é    )ÚTYPE_CHECKINGÚAnyÚCallableÚOptionalé   )ÚerrorsÚutils)Úloggeré   )ÚMySQLAuthPlugin)ÚMySQLSocket)Ú
dump_bytes)ÚFido2ClientÚUserInteraction)ÚCtapHidDevice)Ú!PublicKeyCredentialRequestOptionszxModule fido2 is required for WebAuthn authentication mechanism but was not found. Unable to authenticate with the serverN)ÚCtapPcscDeviceTFÚMySQLWebAuthnAuthPluginc                   @   s2   e Zd ZdZd	ee dœdd„Zddœdd„ZdS )
ÚClientInteractionz(Provides user interaction to the Client.N)Úcallbackc                 C   s   || _ d| _d S )NzTPlease insert FIDO device and perform gesture action for authentication to complete.)r   Úmsg)Úselfr   © r   úh/var/www/shaz/venv/lib/python3.9/site-packages/mysql/connector/plugins/authentication_webauthn_client.pyÚ__init__B   s    ÿzClientInteraction.__init__©Úreturnc                 C   s&   | j du rt| jƒ n|   | j¡ dS )z=Prompt message for the user interaction with the FIDO device.N)r   Úprintr   ©r   r   r   r   Ú	prompt_upI   s    
zClientInteraction.prompt_up)N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   r   r   r   r   r   r   r   ?   s   r   c                   @   s¾   e Zd ZU dZdZee ed< dZee	 ed< ddg dœZ
eed< eedœdd	„ƒZeedœd
d„ƒZdee edœdd„Zeeee dœdd„Zdeeedœdd„Zdeeedœdd„ZdS )r   z<Class implementing the MySQL WebAuthn authentication plugin.NÚclientr   )ÚrpIdÚ	challengeÚallowCredentialsÚoptionsr   c                 C   s   dS )zPlugin official name.Zauthentication_webauthn_clientr   r   r   r   r   ÚnameX   s    zMySQLWebAuthnAuthPlugin.namec                 C   s   dS )z'Signals whether or not SSL is required.Fr   r   r   r   r   Úrequires_ssl]   s    z$MySQLWebAuthnAuthPlugin.requires_ssl)Úcredential_idr   c           
      C   sö   | j du rt d¡‚|dur.|ddœg| jd< | j  t | j¡¡}t| ¡ ƒ}d}t	 
d¡}|t	 
|¡7 }t|ƒD ]X}| |¡}t|jƒ}|j}	|t	 
t|ƒ¡7 }||7 }|t	 
t|	ƒ¡7 }||	7 }|j}qr|t	 
t|ƒ¡7 }||7 }t d|¡ |S )	zôGet assertion from authenticator and return the response.

        Args:
            credential_id (Optional[bytearray]): The credential ID.

        Returns:
            bytearray: The response packet with the data from the assertion.
        NzNo WebAuthn client foundz
public-key)ÚidÚtyper'   ó    r   z&WebAuthn - payload response packet: %s)r$   r   ÚInterfaceErrorr(   Zget_assertionr   Ú	from_dictÚlenZget_assertionsr   Úlc_intÚrangeZget_responseÚcbor_dump_bytesÚauthenticator_dataÚ	signatureZclient_datar	   Údebug)
r   r+   Z	assertionZnumber_of_assertionsZclient_data_jsonÚpacketÚiZassertion_responser5   r6   r   r   r   Úget_assertion_responseb   s6    

þÿ

ÿ


z.MySQLWebAuthnAuthPlugin.get_assertion_response)Ú	auth_dataÚkwargsr   c           	   
   K   s2  zjt  |d¡\}}t  |¡\}}|| jd< | ¡ | jd< t d|¡ t d| jd ¡ t d| jd ¡ W n0 tyš } zt 	d¡|‚W Y d}~n
d}~0 0 t
t ¡ dƒ}|dur¾t d	¡ ntrÐt
t ¡ dƒ}|du rât 	d
¡‚t|d| jd › t| jƒd| _| jjj d¡s$t d¡ dS t d¡ dS )aE  Find authenticator device and check if supports resident keys.

        It also creates a Fido2Client using the relying party ID from the server.

        Raises:
            InterfaceError: When the FIDO device is not found.

        Returns:
            bytes: 2 if the authenticator supports resident keys else 1.
        r
   r&   r%   zWebAuthn - capability: %dzWebAuthn - challenge: %szWebAuthn - relying party id: %sz2Unable to parse MySQL WebAuthn authentication dataNzWebAuthn - Use USB HID channelzNo FIDO device foundzhttps://)Zuser_interactionZrkz6WebAuthn - Authenticator doesn't support resident keysó   1z<WebAuthn - Authenticator with support for resident key foundó   2)r   Zread_intZread_lc_string_listr(   Údecoder	   r7   Ú
ValueErrorr   r/   Únextr   Zlist_devicesÚCTAP_PCSC_DEVICE_AVAILABLEr   r   r   r   r$   ÚinfoÚget)	r   r;   r<   ZpacketsZ
capabilityr&   Zrp_idÚerrZdevicer   r   r   Úauth_response¨   s>    
ÿþ
ý

z%MySQLWebAuthnAuthPlugin.auth_responser   )Úsockr;   r<   r   c                 K   sP   t  |¡\}}|  |¡}t d|t|ƒ¡ | |¡ t| ¡ ƒ}t d|¡ |S )aE  Handles server's `auth more data` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Authentication method data (from a packet representing
                       an `auth more data` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        úWebAuthn - request: %s size: %sú%WebAuthn - server response packet: %s)	r   Zread_lc_stringr:   r	   r7   r1   ÚsendÚbytesÚrecv)r   rG   r;   r<   Ú_r+   ÚresponseÚpktr   r   r   Úauth_more_responseØ   s    

z*MySQLWebAuthnAuthPlugin.auth_more_responsec                 K   s°   |  d¡p|  d¡}t|tƒr(t |¡n|| _|  |¡}d}|dkrnt d¡ | 	t 
t|ƒ¡¡ t| ¡ ƒS |  |¡}t d|t|ƒ¡ | 	|¡ t| ¡ ƒ}t d|¡ |S )aS  Handles server's `auth switch request` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Plugin provided data (extracted from a packet
                       representing an `auth switch request` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        Zwebauthn_callbackZfido_callbackNr=   z WebAuthn - request credential_idrH   rI   )rD   Ú
isinstanceÚstrr   Zimport_objectr   rF   r	   r7   rJ   r2   ÚintrK   rL   r:   r1   )r   rG   r;   r<   Zwebauth_callbackrN   r+   rO   r   r   r   Úauth_switch_responseõ   s&    ÿÿý



z,MySQLWebAuthnAuthPlugin.auth_switch_response)N)r    r!   r"   r#   r$   r   r   Ú__annotations__r   r   r(   ÚdictÚpropertyrR   r)   Úboolr*   Ú	bytearrayrK   r:   r   rF   rP   rT   r   r   r   r   r   Q   s(   
 ÿþF1þþ)!r#   Útypingr   r   r   r   Ú r   r   r	   r   Únetworkr   Z
fido2.cborr   r4   Zfido2.clientr   r   Z	fido2.hidr   Zfido2.webauthnr   ÚImportErrorZ
import_errZProgrammingErrorZ
fido2.pcscr   rB   ÚModuleNotFoundErrorZAUTHENTICATION_PLUGIN_CLASSr   r   r   r   r   r   Ú<module>   s2   ÿý
