
    a-h*                     *   d Z ddlmZmZmZmZ ddlmZmZ ddl	m	Z	 ddlm
Z
 erddlmZ 	 dd	lmZ dd
lmZmZ ddlmZ ddlmZ 	 ddlmZ dZdZ G d de      Z G d de
      Z y# e$ rZ ej2                  d      edZ[ww xY w# e$ r dZY Bw xY w)zWebAuthn Authentication Plugin.    )TYPE_CHECKINGAnyCallableOptional   )errorsutils)logger   )MySQLAuthPlugin)MySQLSocket)
dump_bytes)Fido2ClientUserInteraction)CtapHidDevice)!PublicKeyCredentialRequestOptionszxModule fido2 is required for WebAuthn authentication mechanism but was not found. Unable to authenticate with the serverN)CtapPcscDeviceTFMySQLWebAuthnAuthPluginc                   ,    e Zd ZdZddee   fdZddZy)ClientInteractionz(Provides user interaction to the Client.Ncallbackc                      || _         d| _        y )NzTPlease insert FIDO device and perform gesture action for authentication to complete.)r   msg)selfr   s     |/var/www/core.comfia.cic-ware.com/crm/lib/python3.12/site-packages/mysql/connector/plugins/authentication_webauthn_client.py__init__zClientInteraction.__init__B   s      	    c                 ~    | j                   t        | j                         y| j                  | j                         y)z=Prompt message for the user interaction with the FIDO device.N)r   printr   r   s    r   	prompt_upzClientInteraction.prompt_upI   s'    == $((OMM$((#r   N)returnN)__name__
__module____qualname____doc__r   r   r   r!    r   r   r   r   ?   s    2
(!3 
$r   r   c                       e Zd ZU dZdZee   ed<   dZee	   ed<   ddg dZ
eed<   edefd       Zedefd	       Z	 dd
ee   defdZdededee   fdZdddededefdZdddededefdZy)r   z<Class implementing the MySQL WebAuthn authentication plugin.Nclientr   )rpId	challengeallowCredentialsoptionsr#   c                      y)zPlugin official name.authentication_webauthn_clientr(   r    s    r   namezMySQLWebAuthnAuthPlugin.nameX   s     0r   c                      y)z'Signals whether or not SSL is required.Fr(   r    s    r   requires_sslz$MySQLWebAuthnAuthPlugin.requires_ssl]   s     r   credential_idc                    | j                   t        j                  d      ||ddg| j                  d<   | j                   j	                  t        j                  | j                              }t        |j                               }d}t        j                  d      }|t        j                  |      z  }t        |      D ]  }|j                  |      }t        |j                        }|j                  }	|t        j                  t        |            z  }||z  }|t        j                  t        |	            z  }||	z  }|j                   } |t        j                  t        |            z  }||z  }t#        j$                  d|       |S )zGet assertion from authenticator and return the response.

        Args:
            credential_id (Optional[bytearray]): The credential ID.

        Returns:
            bytearray: The response packet with the data from the assertion.
        zNo WebAuthn client foundz
public-key)idtyper-   r   r   z&WebAuthn - payload response packet: %s)r*   r   InterfaceErrorr.   get_assertionr   	from_dictlenget_assertionsr	   lc_intrangeget_responsecbor_dump_bytesauthenticator_data	signatureclient_datar
   debug)
r   r4   	assertionnumber_of_assertionsclient_data_jsonpacketiassertion_responserA   rB   s
             r   get_assertion_responsez.MySQLWebAuthnAuthPlugin.get_assertion_responseb   s    ;;''(BCC$
 ((0DLL+, KK---77E
	  #9#;#;#=> a%,,344 +, 	>A!*!7!7!: "11C1V1V!W +44Iell3'9#:;;F((Fell3y>22FiF  2==	>" 	%,,s#3455""=vFr   	auth_datakwargsc                    	 t        j                  |d      \  }}t        j                  |      \  }}|| j                  d<   |j	                         | j                  d<   t        j                  d|       t        j                  d| j                  d          t        j                  d| j                  d          t        t        j                         d      }|t        j                  d	       n$t        rt        t        j                         d      }|t        j                  d
      t        |d| j                  d    t!        | j"                              | _        | j$                  j&                  j                  j)                  d      st        j                  d       yt        j                  d       y# t        $ r}t        j                  d      |d}~ww xY w)aE  Find authenticator device and check if supports resident keys.

        It also creates a Fido2Client using the relying party ID from the server.

        Raises:
            InterfaceError: When the FIDO device is not found.

        Returns:
            bytes: 2 if the authenticator supports resident keys else 1.
        r   r,   r+   zWebAuthn - capability: %dzWebAuthn - challenge: %szWebAuthn - relying party id: %sz2Unable to parse MySQL WebAuthn authentication dataNzWebAuthn - Use USB HID channelzNo FIDO device foundzhttps://)user_interactionrkz6WebAuthn - Authenticator doesn't support resident keys   1z<WebAuthn - Authenticator with support for resident key found   2)r	   read_intread_lc_string_listr.   decoder
   rD   
ValueErrorr   r8   nextr   list_devicesCTAP_PCSC_DEVICE_AVAILABLEr   r   r   r   r*   infoget)	r   rL   rM   packets
capabilityr,   rp_iderrdevices	            r   auth_responsez%MySQLWebAuthnAuthPlugin.auth_response   s   	"'..A">GZ$88AIu(1DLL%#(<<>DLL LL4jALL3T\\+5NOLL:DLL<PQ m002D9LL9:'.557>F>''(>?? "t||F+,-.t}}=
 {{''++D1LLQRST7  	''D	s   B9F= =	G!GG!sockr   c                    t        j                  |      \  }}| j                  |      }t        j                  d|t        |             |j                  |       t        |j                               }t        j                  d|       |S )aE  Handles server's `auth more data` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Authentication method data (from a packet representing
                       an `auth more data` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        WebAuthn - request: %s size: %s%WebAuthn - server response packet: %s)	r	   read_lc_stringrK   r
   rD   r;   sendbytesrecv)r   rb   rL   rM   _r4   responsepkts           r   auth_more_responsez*MySQLWebAuthnAuthPlugin.auth_more_response   sn    " !//	:=..}=6#h-P		(DIIK <cB
r   c                 n   |j                  d      xs |j                  d      }t        |t              rt        j                  |      n|| _        | j                  |      }d}|dk(  r[t        j                  d       |j                  t        j                  t        |                   t        |j                               S | j                  |      }t        j                  d|t        |             |j                  |       t        |j                               }t        j                  d|       |S )aS  Handles server's `auth switch request` response.

        Args:
            sock: Pointer to the socket connection.
            auth_data: Plugin provided data (extracted from a packet
                       representing an `auth switch request` response).
            kwargs: Custom configuration to be passed to the auth plugin
                    when invoked. The parameters defined here will override the ones
                    defined in the auth plugin itself.

        Returns:
            packet: Last server's response after back-and-forth
                    communication.
        webauthn_callbackfido_callbackNrQ   z WebAuthn - request credential_idrd   re   )r[   
isinstancestrr	   import_objectr   ra   r
   rD   rg   r=   intrh   ri   rK   r;   )r   rb   rL   rM   webauth_callbackrk   r4   rl   s           r   auth_switch_responsez,MySQLWebAuthnAuthPlugin.auth_switch_response   s    " "::&9: 
fjj?

 *C0  01! 	 %%i0tLL;<IIell3x=12 %%..}=6#h-P		(DIIK <cB
r   r"   )r$   r%   r&   r'   r*   r   r   __annotations__r   r   r.   dictpropertyrr   r1   boolr3   	bytearrayrh   rK   r   ra   rm   rv   r(   r   r   r   r   Q   s    F$(FH[!(#'Hhx '!"MGTM0c 0 0 d  
 48D%i0D	DL.u . . .`!.3?B	:-!-.3-?B-	-r   )!r'   typingr   r   r   r    r   r	   r
   r   networkr   
fido2.cborr   r@   fido2.clientr   r   	fido2.hidr   fido2.webauthnr   ImportError
import_errProgrammingError
fido2.pcscr   rY   ModuleNotFoundErrorAUTHENTICATION_PLUGIN_CLASSr   r   r(   r   r   <module>r      s   : & : 9   %	89'@')!%
 8 $ $$Qo QG  
!&
!
!	<   '!&'s)   A( B (B-B  BBB