
    Aah*                     8   d Z ddlmZmZmZmZ ddlmZmZ ddl	m	Z	 ddlm
Z
 erddlmZ 	 dd	lmZ dd
lmZmZ ddlmZ ddlmZ n# e$ rZ ej        d          edZ[ww xY w	 ddlmZ dZn# e$ r dZY nw xY wdZ G d de          Z G d de
          Z dS )zWebAuthn Authentication Plugin.    )TYPE_CHECKINGAnyCallableOptional   )errorsutils)logger   )MySQLAuthPlugin)MySQLSocket)
dump_bytes)Fido2ClientUserInteraction)CtapHidDevice)!PublicKeyCredentialRequestOptionszxModule fido2 is required for WebAuthn authentication mechanism but was not found. Unable to authenticate with the serverN)CtapPcscDeviceTFMySQLWebAuthnAuthPluginc                   4    e Zd ZdZddee         fdZddZdS )	ClientInteractionz(Provides user interaction to the Client.Ncallbackc                 "    || _         d| _        d S )NzTPlease insert FIDO device and perform gesture action for authentication to complete.)r   msg)selfr   s     h/var/www/lms/venv/lib/python3.11/site-packages/mysql/connector/plugins/authentication_webauthn_client.py__init__zClientInteraction.__init__B   s      	    returnc                 t    | j         t          | j                   dS |                      | j                   dS )z=Prompt message for the user interaction with the FIDO device.N)r   printr   r   s    r   	prompt_upzClientInteraction.prompt_upI   s5    = $(OOOOOMM$(#####r   N)r   N)__name__
__module____qualname____doc__r   r   r   r"    r   r   r   r   ?   sS        22
 
(!3 
 
 
 
$ $ $ $ $ $r   r   c                      e Zd ZU dZdZee         ed<   dZee	         ed<   ddg dZ
eed<   edefd            Zedefd	            Z	 dd
ee         defdZdededee         fdZdddededefdZdddededefdZdS )r   z<Class implementing the MySQL WebAuthn authentication plugin.Nclientr   )rpId	challengeallowCredentialsoptionsr   c                     dS )zPlugin official name.authentication_webauthn_clientr(   r!   s    r   namezMySQLWebAuthnAuthPlugin.nameX   s
     0/r   c                     dS )z'Signals whether or not SSL is required.Fr(   r!   s    r   requires_sslz$MySQLWebAuthnAuthPlugin.requires_ssl]   s	     ur   credential_idc                    | j         t          j        d          ||ddg| j        d<   | j                             t          j        | j                            }t          |                                          }d}t          j
        d          }|t          j
        |          z  }t          |          D ]}|                    |          }t          |j                  }|j        }	|t          j
        t          |                    z  }||z  }|t          j
        t          |	                    z  }||	z  }|j        }|t          j
        t          |                    z  }||z  }t#          j        d|           |S )	zGet assertion from authenticator and return the response.

        Args:
            credential_id (Optional[bytearray]): The credential ID.

        Returns:
            bytearray: The response packet with the data from the assertion.
        NzNo WebAuthn client foundz
public-key)idtyper-   r   r   z&WebAuthn - payload response packet: %s)r*   r   InterfaceErrorr.   get_assertionr   	from_dictlenget_assertionsr	   lc_intrangeget_responsecbor_dump_bytesauthenticator_data	signatureclient_datar
   debug)
r   r4   	assertionnumber_of_assertionsclient_data_jsonpacketiassertion_responserA   rB   s
             r   get_assertion_responsez.MySQLWebAuthnAuthPlugin.get_assertion_responseb   s    ;'(BCCC$
 (( 0DL+, K---7EE
 
	  #9#;#;#=#=>> a%,3444 +,, 	> 	>A!*!7!7!:!: "11C1V!W!W +4Iel3'9#:#:;;;F((Fel3y>>222FiF  2=%,s#344555""=vFFFr   	auth_datakwargsc                    	 t          j        |d          \  }}t          j        |          \  }}|| j        d<   |                                | j        d<   t          j        d|           t          j        d| j        d                    t          j        d| j        d                    n'# t          $ r}t          j	        d          |d}~ww xY wt          t          j                    d          }|t          j        d	           n(t          r!t          t          j                    d          }|t          j	        d
          t          |d| j        d          t!          | j                            | _        | j        j        j                            d          st          j        d           dS t          j        d           dS )aE  Find authenticator device and check if supports resident keys.

        It also creates a Fido2Client using the relying party ID from the server.

        Raises:
            InterfaceError: When the FIDO device is not found.

        Returns:
            bytes: 2 if the authenticator supports resident keys else 1.
        r   r,   r+   zWebAuthn - capability: %dzWebAuthn - challenge: %szWebAuthn - relying party id: %sz2Unable to parse MySQL WebAuthn authentication dataNzWebAuthn - Use USB HID channelzNo FIDO device foundzhttps://)user_interactionrkz6WebAuthn - Authenticator doesn't support resident keys   1z<WebAuthn - Authenticator with support for resident key found   2)r	   read_intread_lc_string_listr.   decoder
   rD   
ValueErrorr   r8   nextr   list_devicesCTAP_PCSC_DEVICE_AVAILABLEr   r   r   r   r*   infoget)	r   rL   rM   packets
capabilityr,   rp_iderrdevices	            r   auth_responsez%MySQLWebAuthnAuthPlugin.auth_response   s   	"'.A">">GZ$8AAIu(1DL%#(<<>>DL L4jAAAL3T\+5NOOOL:DL<PQQQQ 	 	 	'D 	 m022D99L9::::' 	?.577>>F>'(>??? "-t|F+--.t}==
 
 
 {'++D11 	LQRRR4STTTts   B*B- -
C7CCsockr   c                 :   t          j        |          \  }}|                     |          }t          j        d|t          |                     |                    |           t          |                                          }t          j        d|           |S )aE  Handles server's `auth more data` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Authentication method data (from a packet representing
                       an `auth more data` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        WebAuthn - request: %s size: %s%WebAuthn - server response packet: %s)	r	   read_lc_stringrK   r
   rD   r;   sendbytesrecv)r   rb   rL   rM   _r4   responsepkts           r   auth_more_responsez*MySQLWebAuthnAuthPlugin.auth_more_response   s    " !/	::=..}==6#h--PPP		(DIIKK  <cBBB
r   c                    |                     d          p|                     d          }t          |t                    rt          j        |          n|| _        |                     |          }d}|dk    rit          j        d           |	                    t          j
        t          |                               t          |                                          S |                     |          }t          j        d|t          |                     |	                    |           t          |                                          }t          j        d|           |S )aS  Handles server's `auth switch request` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Plugin provided data (extracted from a packet
                       representing an `auth switch request` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        webauthn_callbackfido_callbackNrQ   z WebAuthn - request credential_idrd   re   )r[   
isinstancestrr	   import_objectr   ra   r
   rD   rg   r=   intrh   ri   rK   r;   )r   rb   rL   rM   webauth_callbackrk   r4   rl   s           r   auth_switch_responsez,MySQLWebAuthnAuthPlugin.auth_switch_response   s<   " "::&9:: 
fjj?
 ?

 *C00"E 0111! 	 %%i00tL;<<<IIel3x==11222 %%%..}==6#h--PPP		(DIIKK  <cBBB
r   r#   )r$   r%   r&   r'   r*   r   r   __annotations__r   r   r.   dictpropertyrr   r1   boolr3   	bytearrayrh   rK   r   ra   rm   rv   r(   r   r   r   r   Q   s}        FF$(FH[!(((#'Hhx '''!"MMGTMMM0c 0 0 0 X0 d    X
 48D D%i0D	D D D DL.u . . . . . .`!.3?B	   :-!-.3-?B-	- - - - - -r   )!r'   typingr   r   r   r    r   r	   r
   r   networkr   
fido2.cborr   r@   fido2.clientr   r   	fido2.hidr   fido2.webauthnr   ImportError
import_errProgrammingError
fido2.pcscr   rY   ModuleNotFoundErrorAUTHENTICATION_PLUGIN_CLASSr   r   r(   r   r   <module>r      s  : & % : 9 9 9 9 9 9 9 9 9 9 9                     &%%%%%%	88888899999999''''''@@@@@@@   
!&
!	<  '))))))!% ' ' '!&' 8 $ $ $ $ $ $ $ $$Q Q Q Q Qo Q Q Q Q Qs)   A A"AA"&A/ /A98A9