├── src
    ├── Signal
    │   ├── Signal.php
    │   ├── CurrentUserDetails.php
    │   ├── UnknownCredential.php
    │   └── AllAcceptedCredentials.php
    ├── Event
    │   ├── WebauthnEvent.php
    │   ├── CanDispatchEvents.php
    │   ├── NullEventDispatcher.php
    │   ├── AttestationObjectLoaded.php
    │   ├── MetadataStatementFound.php
    │   ├── AttestationStatementLoaded.php
    │   ├── AuthenticatorAttestationResponseValidationFailedEvent.php
    │   ├── BeforeCertificateChainValidation.php
    │   ├── CertificateChainValidationFailed.php
    │   ├── CertificateChainValidationSucceeded.php
    │   ├── BackupEligibilityChangedEvent.php
    │   ├── AuthenticatorAttestationResponseValidationSucceededEvent.php
    │   ├── BackupStatusChangedEvent.php
    │   ├── AuthenticatorAssertionResponseValidationSucceededEvent.php
    │   └── AuthenticatorAssertionResponseValidationFailedEvent.php
    ├── TrustPath
    │   ├── TrustPath.php
    │   ├── EmptyTrustPath.php
    │   └── CertificateTrustPath.php
    ├── Exception
    │   ├── AttestationStatementException.php
    │   ├── MetadataStatementException.php
    │   ├── RevokedCertificateException.php
    │   ├── WebauthnException.php
    │   ├── InvalidTrustPathException.php
    │   ├── MetadataServiceException.php
    │   ├── UnsupportedFeatureException.php
    │   ├── AuthenticationExtensionException.php
    │   ├── AuthenticatorResponseVerificationException.php
    │   ├── InvalidUserHandleException.php
    │   ├── CertificateException.php
    │   ├── AttestationStatementVerificationException.php
    │   ├── MetadataStatementLoadingException.php
    │   ├── ExpiredCertificateException.php
    │   ├── InvalidDataException.php
    │   ├── InvalidCertificateException.php
    │   ├── CertificateRevocationListException.php
    │   ├── MissingMetadataStatementException.php
    │   ├── CounterException.php
    │   ├── InvalidAttestationStatementException.php
    │   ├── AttestationStatementLoadingException.php
    │   └── CertificateChainException.php
    ├── CeremonyStep
    │   ├── TopOriginValidator.php
    │   ├── HostTopOriginValidator.php
    │   ├── CeremonyStep.php
    │   ├── CheckCredentialId.php
    │   ├── CeremonyStepManager.php
    │   ├── CheckChallenge.php
    │   ├── CheckBackupBitsAreConsistent.php
    │   ├── CheckCounter.php
    │   ├── CheckHasAttestedCredentialData.php
    │   ├── CheckAllowedCredentialList.php
    │   ├── CheckExtensions.php
    │   ├── CheckClientDataCollectorType.php
    │   ├── CheckTopOrigin.php
    │   ├── CheckUserVerification.php
    │   ├── CheckUserHandle.php
    │   ├── CheckUserWasPresent.php
    │   ├── CheckAttestationFormatIsKnownAndValid.php
    │   └── CheckRelyingPartyIdIdHash.php
    ├── AuthenticationExtensions
    │   ├── PseudoRandomFunctionInputExtension.php
    │   ├── ExtensionOutputChecker.php
    │   ├── AppIdExcludeInputExtension.php
    │   ├── AuthenticationExtension.php
    │   ├── UvmInputExtension.php
    │   ├── AppIdInputExtension.php
    │   ├── CredentialPropertiesInputExtension.php
    │   ├── ExtensionOutputError.php
    │   ├── ExtensionOutputCheckerHandler.php
    │   ├── AuthenticationExtensionLoader.php
    │   ├── LargeBlobInputExtension.php
    │   ├── PseudoRandomFunctionInputExtensionBuilder.php
    │   └── AuthenticationExtensions.php
    ├── MetadataService
    │   ├── CanLogData.php
    │   ├── MetadataStatementRepository.php
    │   ├── StatusReportRepository.php
    │   ├── CertificateChain
    │   │   ├── CertificateChainValidator.php
    │   │   └── CertificateToolbox.php
    │   ├── Statement
    │   │   ├── RogueListEntry.php
    │   │   ├── AuthenticatorGetInfo.php
    │   │   ├── AlternativeDescriptions.php
    │   │   ├── VerificationMethodANDCombinations.php
    │   │   ├── AbstractDescriptor.php
    │   │   ├── RgbPaletteEntry.php
    │   │   ├── Version.php
    │   │   ├── PatternAccuracyDescriptor.php
    │   │   ├── BiometricAccuracyDescriptor.php
    │   │   ├── ExtensionDescriptor.php
    │   │   ├── CodeAccuracyDescriptor.php
    │   │   ├── BiometricStatusReport.php
    │   │   ├── StatusReport.php
    │   │   ├── DisplayPNGCharacteristicsDescriptor.php
    │   │   └── AuthenticatorStatus.php
    │   └── Service
    │   │   ├── MetadataBLOBPayload.php
    │   │   ├── MetadataService.php
    │   │   ├── ChainedMetadataServices.php
    │   │   ├── InMemoryMetadataService.php
    │   │   ├── MetadataBLOBPayloadEntry.php
    │   │   ├── JsonMetadataService.php
    │   │   ├── FolderResourceMetadataService.php
    │   │   └── LocalResourceMetadataService.php
    ├── AttestationStatement
    │   ├── AttestationStatementSupportManagerAwareInterface.php
    │   ├── AttestationStatementSupportManagerAwareTrait.php
    │   ├── AttestationStatementSupport.php
    │   ├── AttestationObject.php
    │   ├── AttestationStatementSupportManager.php
    │   ├── NoneAttestationStatementSupport.php
    │   └── AttestationStatement.php
    ├── Counter
    │   ├── CounterChecker.php
    │   └── ThrowExceptionIfInvalid.php
    ├── AuthenticatorResponse.php
    ├── FakeCredentialGenerator.php
    ├── Credential.php
    ├── PublicKeyCredentialRpEntity.php
    ├── PublicKeyCredentialParameters.php
    ├── Util
    │   ├── Base64.php
    │   └── CoseSignatureFixer.php
    ├── ClientDataCollector
    │   ├── ClientDataCollector.php
    │   ├── WebauthnAuthenticationCollector.php
    │   └── ClientDataCollectorManager.php
    ├── AttestedCredentialData.php
    ├── PublicKeyCredentialUserEntity.php
    ├── Url.php
    ├── PublicKeyCredential.php
    ├── AuthenticatorAttestationResponse.php
    ├── Denormalizer
    │   ├── AuthenticationExtensionNormalizer.php
    │   ├── ExtensionDescriptorDenormalizer.php
    │   ├── CollectedClientDataDenormalizer.php
    │   ├── PublicKeyCredentialParametersDenormalizer.php
    │   ├── AttestationStatementDenormalizer.php
    │   ├── PublicKeyCredentialRpEntityDenormalizer.php
    │   ├── AttestedCredentialDataNormalizer.php
    │   ├── PublicKeyCredentialDescriptorNormalizer.php
    │   ├── SignalUnknownCredentialDenormalizer.php
    │   ├── VerificationMethodANDCombinationsDenormalizer.php
    │   ├── SignalCurrentUserDetailsDenormalizer.php
    │   ├── AuthenticatorResponseDenormalizer.php
    │   ├── PublicKeyCredentialDenormalizer.php
    │   ├── UrlNormalizer.php
    │   ├── SignalAllAcceptedCredentialsDenormalizer.php
    │   ├── PublicKeyCredentialUserEntityDenormalizer.php
    │   ├── AuthenticatorAttestationResponseDenormalizer.php
    │   ├── TrustPathDenormalizer.php
    │   ├── AuthenticationExtensionsDenormalizer.php
    │   ├── AttestationObjectDenormalizer.php
    │   └── AuthenticatorAssertionResponseDenormalizer.php
    ├── AuthenticatorAssertionResponse.php
    ├── PublicKeyCredentialEntity.php
    ├── PasskeyEndpointsResponse.php
    ├── StringStream.php
    ├── PublicKeyCredentialDescriptor.php
    ├── U2FPublicKey.php
    ├── PublicKeyCredentialOptions.php
    ├── SimpleFakeCredentialGenerator.php
    ├── PublicKeyCredentialSource.php
    ├── CredentialRecord.php
    ├── PublicKeyCredentialRequestOptions.php
    ├── AuthenticatorData.php
    └── AuthenticatorSelectionCriteria.php
├── LICENSE
└── composer.json


/src/Signal/Signal.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Signal;
 6 | 
 7 | interface Signal
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Event/WebauthnEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | interface WebauthnEvent
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/TrustPath/TrustPath.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\TrustPath;
 6 | 
 7 | interface TrustPath
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Exception/AttestationStatementException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | class AttestationStatementException extends WebauthnException
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Exception/MetadataStatementException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | class MetadataStatementException extends MetadataServiceException
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Exception/RevokedCertificateException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | final class RevokedCertificateException extends CertificateException
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/TopOriginValidator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | interface TopOriginValidator
 8 | {
 9 |     public function validate(string $topOrigin): void;
10 | }
11 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/PseudoRandomFunctionInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | final class PseudoRandomFunctionInputExtension extends AuthenticationExtension
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/MetadataService/CanLogData.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService;
 6 | 
 7 | use Psr\Log\LoggerInterface;
 8 | 
 9 | interface CanLogData
10 | {
11 |     public function setLogger(LoggerInterface $logger): void;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/TrustPath/EmptyTrustPath.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\TrustPath;
 6 | 
 7 | final readonly class EmptyTrustPath implements TrustPath
 8 | {
 9 |     public static function create(): self
10 |     {
11 |         return new self();
12 |     }
13 | }
14 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/ExtensionOutputChecker.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | interface ExtensionOutputChecker
 8 | {
 9 |     public function check(AuthenticationExtensions $inputs, AuthenticationExtensions $outputs): void;
10 | }
11 | 


--------------------------------------------------------------------------------
/src/Event/CanDispatchEvents.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Psr\EventDispatcher\EventDispatcherInterface;
 8 | 
 9 | interface CanDispatchEvents
10 | {
11 |     public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): void;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/MetadataService/MetadataStatementRepository.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService;
 6 | 
 7 | use Webauthn\MetadataService\Statement\MetadataStatement;
 8 | 
 9 | interface MetadataStatementRepository
10 | {
11 |     public function findOneByAAGUID(string $aaguid): ?MetadataStatement;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationStatementSupportManagerAwareInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | interface AttestationStatementSupportManagerAwareInterface
 8 | {
 9 |     public function setAttestationStatementSupportManager(AttestationStatementSupportManager $manager): void;
10 | }
11 | 


--------------------------------------------------------------------------------
/src/Counter/CounterChecker.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Counter;
 6 | 
 7 | use Webauthn\CredentialRecord;
 8 | use Webauthn\PublicKeyCredentialSource;
 9 | 
10 | interface CounterChecker
11 | {
12 |     public function check(CredentialRecord|PublicKeyCredentialSource $credentialRecord, int $currentCounter): void;
13 | }
14 | 


--------------------------------------------------------------------------------
/src/AuthenticatorResponse.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | /**
 8 |  * @see https://www.w3.org/TR/webauthn/#authenticatorresponse
 9 |  */
10 | abstract class AuthenticatorResponse
11 | {
12 |     public function __construct(
13 |         public readonly CollectedClientData $clientDataJSON
14 |     ) {
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/src/Event/NullEventDispatcher.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Psr\EventDispatcher\EventDispatcherInterface;
 8 | 
 9 | final class NullEventDispatcher implements EventDispatcherInterface
10 | {
11 |     public function dispatch(object $event): object
12 |     {
13 |         return $event;
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/FakeCredentialGenerator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Symfony\Component\HttpFoundation\Request;
 8 | 
 9 | interface FakeCredentialGenerator
10 | {
11 |     /**
12 |      * @return PublicKeyCredentialDescriptor[]
13 |      */
14 |     public function generate(Request $request, string $username): array;
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Credential.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | /**
 8 |  * @see https://w3c.github.io/webappsec-credential-management/#credential
 9 |  */
10 | abstract class Credential
11 | {
12 |     public function __construct(
13 |         public readonly string $type,
14 |         public readonly string $rawId,
15 |     ) {
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Exception/WebauthnException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Exception;
 8 | use Throwable;
 9 | 
10 | class WebauthnException extends Exception
11 | {
12 |     public function __construct(string $message, ?Throwable $previous = null)
13 |     {
14 |         parent::__construct($message, 0, $previous);
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/src/MetadataService/StatusReportRepository.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService;
 6 | 
 7 | use Webauthn\MetadataService\Statement\StatusReport;
 8 | 
 9 | interface StatusReportRepository
10 | {
11 |     /**
12 |      * @return StatusReport[]
13 |      */
14 |     public function findStatusReportsByAAGUID(string $aaguid): array;
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Exception/InvalidTrustPathException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class InvalidTrustPathException extends WebauthnException
10 | {
11 |     public static function create(string $message, ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/AppIdExcludeInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | final class AppIdExcludeInputExtension extends AuthenticationExtension
 8 | {
 9 |     public static function enable(string $value): AuthenticationExtension
10 |     {
11 |         return self::create('appidExclude', $value);
12 |     }
13 | }
14 | 


--------------------------------------------------------------------------------
/src/Exception/MetadataServiceException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Exception;
 8 | use Throwable;
 9 | 
10 | class MetadataServiceException extends Exception
11 | {
12 |     public function __construct(string $message, ?Throwable $previous = null)
13 |     {
14 |         parent::__construct($message, 0, $previous);
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/src/Exception/UnsupportedFeatureException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class UnsupportedFeatureException extends WebauthnException
10 | {
11 |     public static function create(string $message, ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Exception/AuthenticationExtensionException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class AuthenticationExtensionException extends WebauthnException
10 | {
11 |     public static function create(string $message, ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Exception/AuthenticatorResponseVerificationException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | class AuthenticatorResponseVerificationException extends WebauthnException
10 | {
11 |     public static function create(string $message, ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Exception/InvalidUserHandleException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class InvalidUserHandleException extends AuthenticatorResponseVerificationException
10 | {
11 |     public static function create(string $message = 'Invalid user handle', ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/MetadataService/CertificateChain/CertificateChainValidator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\CertificateChain;
 6 | 
 7 | interface CertificateChainValidator
 8 | {
 9 |     /**
10 |      * @param string[] $untrustedCertificates
11 |      * @param string[] $trustedCertificates
12 |      */
13 |     public function check(array $untrustedCertificates, array $trustedCertificates): void;
14 | }
15 | 


--------------------------------------------------------------------------------
/src/Signal/CurrentUserDetails.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Signal;
 6 | 
 7 | use Webauthn\PublicKeyCredentialRpEntity;
 8 | use Webauthn\PublicKeyCredentialUserEntity;
 9 | 
10 | readonly class CurrentUserDetails implements Signal
11 | {
12 |     public function __construct(
13 |         public PublicKeyCredentialRpEntity $rp,
14 |         public PublicKeyCredentialUserEntity $user,
15 |     ) {
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Exception/CertificateException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | class CertificateException extends MetadataServiceException
10 | {
11 |     public function __construct(
12 |         public readonly string $certificate,
13 |         string $message,
14 |         ?Throwable $previous = null
15 |     ) {
16 |         parent::__construct($message, $previous);
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/RogueListEntry.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | readonly class RogueListEntry
 8 | {
 9 |     public function __construct(
10 |         public string $sk,
11 |         public string $date
12 |     ) {
13 |     }
14 | 
15 |     public static function create(string $sk, string $date): self
16 |     {
17 |         return new self($sk, $date);
18 |     }
19 | }
20 | 


--------------------------------------------------------------------------------
/src/Signal/UnknownCredential.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Signal;
 6 | 
 7 | use Webauthn\PublicKeyCredentialDescriptor;
 8 | use Webauthn\PublicKeyCredentialRpEntity;
 9 | 
10 | readonly class UnknownCredential implements Signal
11 | {
12 |     public function __construct(
13 |         public PublicKeyCredentialRpEntity $rp,
14 |         public PublicKeyCredentialDescriptor $credential,
15 |     ) {
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Exception/AttestationStatementVerificationException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class AttestationStatementVerificationException extends AttestationStatementException
10 | {
11 |     public static function create(string $message = 'Invalid attestation object', ?Throwable $previous = null): self
12 |     {
13 |         return new self($message, $previous);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/AuthenticationExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | class AuthenticationExtension
 8 | {
 9 |     public function __construct(
10 |         public readonly string $name,
11 |         public readonly mixed $value
12 |     ) {
13 |     }
14 | 
15 |     public static function create(string $name, mixed $value): self
16 |     {
17 |         return new self($name, $value);
18 |     }
19 | }
20 | 


--------------------------------------------------------------------------------
/src/Exception/MetadataStatementLoadingException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class MetadataStatementLoadingException extends MetadataStatementException
10 | {
11 |     public static function create(
12 |         string $message = 'Unable to load the metadata statement',
13 |         ?Throwable $previous = null
14 |     ): self {
15 |         return new self($message, $previous);
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Exception/ExpiredCertificateException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class ExpiredCertificateException extends CertificateException
10 | {
11 |     public static function create(
12 |         string $certificate,
13 |         string $message = 'Expired certificate',
14 |         ?Throwable $previous = null
15 |     ): self {
16 |         return new self($certificate, $message, $previous);
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/UvmInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | final class UvmInputExtension extends AuthenticationExtension
 8 | {
 9 |     public static function enable(): AuthenticationExtension
10 |     {
11 |         return self::create('uvm', true);
12 |     }
13 | 
14 |     public static function disable(): AuthenticationExtension
15 |     {
16 |         return self::create('uvm', false);
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/AppIdInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | final class AppIdInputExtension extends AuthenticationExtension
 8 | {
 9 |     public static function enable(): AuthenticationExtension
10 |     {
11 |         return self::create('appid', true);
12 |     }
13 | 
14 |     public static function disable(): AuthenticationExtension
15 |     {
16 |         return self::create('appid', false);
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/MetadataBLOBPayload.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | class MetadataBLOBPayload
 8 | {
 9 |     /**
10 |      * @param MetadataBLOBPayloadEntry[] $entries
11 |      */
12 |     public function __construct(
13 |         public readonly int $no,
14 |         public readonly string $nextUpdate,
15 |         public readonly ?string $legalHeader = null,
16 |         public array $entries = [],
17 |     ) {
18 |     }
19 | }
20 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/MetadataService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use Webauthn\MetadataService\Statement\MetadataStatement;
 8 | 
 9 | interface MetadataService
10 | {
11 |     /**
12 |      * @return string[] The list of AAGUID supported by the service
13 |      */
14 |     public function list(): iterable;
15 | 
16 |     public function has(string $aaguid): bool;
17 | 
18 |     public function get(string $aaguid): MetadataStatement;
19 | }
20 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationStatementSupportManagerAwareTrait.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | trait AttestationStatementSupportManagerAwareTrait
 8 | {
 9 |     private AttestationStatementSupportManager $attestationStatementSupportManager;
10 | 
11 |     public function setAttestationStatementSupportManager(AttestationStatementSupportManager $manager): void
12 |     {
13 |         $this->attestationStatementSupportManager = $manager;
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Event/AttestationObjectLoaded.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Webauthn\AttestationStatement\AttestationObject;
 8 | 
 9 | class AttestationObjectLoaded implements WebauthnEvent
10 | {
11 |     public function __construct(
12 |         public readonly AttestationObject $attestationObject
13 |     ) {
14 |     }
15 | 
16 |     public static function create(AttestationObject $attestationObject): self
17 |     {
18 |         return new self($attestationObject);
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/CredentialPropertiesInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | final class CredentialPropertiesInputExtension extends AuthenticationExtension
 8 | {
 9 |     public static function enable(): AuthenticationExtension
10 |     {
11 |         return self::create('credProps', true);
12 |     }
13 | 
14 |     public static function disable(): AuthenticationExtension
15 |     {
16 |         return self::create('credProps', false);
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Event/MetadataStatementFound.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Webauthn\MetadataService\Statement\MetadataStatement;
 8 | 
 9 | final readonly class MetadataStatementFound implements WebauthnEvent
10 | {
11 |     public function __construct(
12 |         public MetadataStatement $metadataStatement
13 |     ) {
14 |     }
15 | 
16 |     public static function create(MetadataStatement $metadataStatement): self
17 |     {
18 |         return new self($metadataStatement);
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/ExtensionOutputError.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | use Exception;
 8 | use Throwable;
 9 | 
10 | class ExtensionOutputError extends Exception
11 | {
12 |     public function __construct(
13 |         public readonly AuthenticationExtension $authenticationExtension,
14 |         string $message = '',
15 |         int $code = 0,
16 |         ?Throwable $previous = null
17 |     ) {
18 |         parent::__construct($message, $code, $previous);
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/Event/AttestationStatementLoaded.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Webauthn\AttestationStatement\AttestationStatement;
 8 | 
 9 | class AttestationStatementLoaded implements WebauthnEvent
10 | {
11 |     public function __construct(
12 |         public readonly AttestationStatement $attestationStatement
13 |     ) {
14 |     }
15 | 
16 |     public static function create(AttestationStatement $attestationStatement): self
17 |     {
18 |         return new self($attestationStatement);
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/AuthenticatorGetInfo.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | class AuthenticatorGetInfo
 8 | {
 9 |     /**
10 |      * @param array<array-key, mixed> $info
11 |      */
12 |     public function __construct(
13 |         public array $info = []
14 |     ) {
15 |     }
16 | 
17 |     /**
18 |      * @param array<array-key, mixed> $info
19 |      */
20 |     public static function create(array $info = []): self
21 |     {
22 |         return new self($info);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/TrustPath/CertificateTrustPath.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\TrustPath;
 6 | 
 7 | final readonly class CertificateTrustPath implements TrustPath
 8 | {
 9 |     /**
10 |      * @param string[] $certificates
11 |      */
12 |     public function __construct(
13 |         public array $certificates
14 |     ) {
15 |     }
16 | 
17 |     /**
18 |      * @param string[] $certificates
19 |      */
20 |     public static function create(array $certificates): self
21 |     {
22 |         return new self($certificates);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialRpEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | class PublicKeyCredentialRpEntity extends PublicKeyCredentialEntity
 8 | {
 9 |     public function __construct(
10 |         string $name = '',
11 |         public readonly ?string $id = null,
12 |         ?string $icon = null
13 |     ) {
14 | 
15 |         parent::__construct($name, $icon);
16 |     }
17 | 
18 |     public static function create(string $name = '', ?string $id = null, ?string $icon = null): self
19 |     {
20 |         return new self($name, $id, $icon);
21 |     }
22 | }
23 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/AlternativeDescriptions.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | class AlternativeDescriptions
 8 | {
 9 |     /**
10 |      * @param array<string, string> $descriptions
11 |      */
12 |     public function __construct(
13 |         public array $descriptions = []
14 |     ) {
15 |     }
16 | 
17 |     /**
18 |      * @param array<string, string> $descriptions
19 |      */
20 |     public static function create(array $descriptions = []): self
21 |     {
22 |         return new self($descriptions);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialParameters.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | readonly class PublicKeyCredentialParameters
 8 | {
 9 |     public function __construct(
10 |         public string $type,
11 |         public int $alg
12 |     ) {
13 |     }
14 | 
15 |     public static function create(string $type, int $alg): self
16 |     {
17 |         return new self($type, $alg);
18 |     }
19 | 
20 |     public static function createPk(int $alg): self
21 |     {
22 |         return self::create(PublicKeyCredentialDescriptor::CREDENTIAL_TYPE_PUBLIC_KEY, $alg);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Exception/InvalidDataException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class InvalidDataException extends WebauthnException
10 | {
11 |     public function __construct(
12 |         public readonly mixed $data,
13 |         string $message,
14 |         ?Throwable $previous = null
15 |     ) {
16 |         parent::__construct($message, $previous);
17 |     }
18 | 
19 |     public static function create(mixed $data, string $message, ?Throwable $previous = null): self
20 |     {
21 |         return new self($data, $message, $previous);
22 |     }
23 | }
24 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationStatementSupport.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | use Webauthn\AuthenticatorData;
 8 | 
 9 | interface AttestationStatementSupport
10 | {
11 |     public function name(): string;
12 | 
13 |     /**
14 |      * @param array<string, mixed> $attestation
15 |      */
16 |     public function load(array $attestation): AttestationStatement;
17 | 
18 |     public function isValid(
19 |         string $clientDataJSONHash,
20 |         AttestationStatement $attestationStatement,
21 |         AuthenticatorData $authenticatorData
22 |     ): bool;
23 | }
24 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/HostTopOriginValidator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
 8 | 
 9 | final readonly class HostTopOriginValidator implements TopOriginValidator
10 | {
11 |     public function __construct(
12 |         private string $host
13 |     ) {
14 |     }
15 | 
16 |     public function validate(string $topOrigin): void
17 |     {
18 |         $topOrigin === $this->host || throw AuthenticatorResponseVerificationException::create(
19 |             'The top origin does not correspond to the host.'
20 |         );
21 |     }
22 | }
23 | 


--------------------------------------------------------------------------------
/src/Signal/AllAcceptedCredentials.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Signal;
 6 | 
 7 | use Webauthn\PublicKeyCredentialDescriptor;
 8 | use Webauthn\PublicKeyCredentialRpEntity;
 9 | use Webauthn\PublicKeyCredentialUserEntity;
10 | 
11 | readonly class AllAcceptedCredentials implements Signal
12 | {
13 |     /**
14 |      * @param PublicKeyCredentialDescriptor[] $allAcceptedCredentials
15 |      */
16 |     public function __construct(
17 |         public PublicKeyCredentialRpEntity $rp,
18 |         public PublicKeyCredentialUserEntity $user,
19 |         public array $allAcceptedCredentials,
20 |     ) {
21 |     }
22 | }
23 | 


--------------------------------------------------------------------------------
/src/Event/AuthenticatorAttestationResponseValidationFailedEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use Throwable;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\PublicKeyCredentialCreationOptions;
10 | 
11 | readonly class AuthenticatorAttestationResponseValidationFailedEvent
12 | {
13 |     public function __construct(
14 |         public AuthenticatorAttestationResponse $authenticatorAttestationResponse,
15 |         public PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions,
16 |         public string $host,
17 |         public Throwable $throwable
18 |     ) {
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/src/Exception/InvalidCertificateException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class InvalidCertificateException extends MetadataServiceException
10 | {
11 |     public function __construct(
12 |         public readonly string $certificate,
13 |         string $message,
14 |         ?Throwable $previous = null
15 |     ) {
16 |         parent::__construct($message, $previous);
17 |     }
18 | 
19 |     public static function create(string $certificate, string $message, ?Throwable $previous = null): self
20 |     {
21 |         return new self($certificate, $message, $previous);
22 |     }
23 | }
24 | 


--------------------------------------------------------------------------------
/src/Exception/CertificateRevocationListException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class CertificateRevocationListException extends MetadataServiceException
10 | {
11 |     public function __construct(
12 |         public readonly string $url,
13 |         string $message,
14 |         ?Throwable $previous = null
15 |     ) {
16 |         parent::__construct($message, $previous);
17 |     }
18 | 
19 |     public static function create(string $url, string $message = 'Invalid CRL.', ?Throwable $previous = null): self
20 |     {
21 |         return new self($url, $message, $previous);
22 |     }
23 | }
24 | 


--------------------------------------------------------------------------------
/src/Util/Base64.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Util;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Throwable;
 9 | use Webauthn\Exception\InvalidDataException;
10 | 
11 | abstract class Base64
12 | {
13 |     public static function decode(string $data): string
14 |     {
15 |         try {
16 |             return Base64UrlSafe::decode($data);
17 |         } catch (Throwable) {
18 |         }
19 | 
20 |         try {
21 |             return \ParagonIE\ConstantTime\Base64::decode($data);
22 |         } catch (Throwable $e) {
23 |             throw InvalidDataException::create($data, 'Invalid data submitted', $e);
24 |         }
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/ClientDataCollector/ClientDataCollector.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\ClientDataCollector;
 6 | 
 7 | use Webauthn\AuthenticatorResponse;
 8 | use Webauthn\CollectedClientData;
 9 | use Webauthn\PublicKeyCredentialOptions;
10 | 
11 | interface ClientDataCollector
12 | {
13 |     /**
14 |      * @return string[]
15 |      */
16 |     public function supportedTypes(): array;
17 | 
18 |     public function verifyCollectedClientData(
19 |         CollectedClientData $collectedClientData,
20 |         PublicKeyCredentialOptions $publicKeyCredentialOptions,
21 |         AuthenticatorResponse $authenticatorResponse,
22 |         string $host
23 |     ): void;
24 | }
25 | 


--------------------------------------------------------------------------------
/src/AttestedCredentialData.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Symfony\Component\Uid\Uuid;
 8 | 
 9 | /**
10 |  * @see https://www.w3.org/TR/webauthn/#sec-attested-credential-data
11 |  */
12 | class AttestedCredentialData
13 | {
14 |     public function __construct(
15 |         public Uuid $aaguid,
16 |         public readonly string $credentialId,
17 |         public readonly ?string $credentialPublicKey
18 |     ) {
19 |     }
20 | 
21 |     public static function create(Uuid $aaguid, string $credentialId, ?string $credentialPublicKey = null): self
22 |     {
23 |         return new self($aaguid, $credentialId, $credentialPublicKey);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Event/BeforeCertificateChainValidation.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | final readonly class BeforeCertificateChainValidation implements WebauthnEvent
 8 | {
 9 |     /**
10 |      * @param string[] $untrustedCertificates
11 |      */
12 |     public function __construct(
13 |         public array $untrustedCertificates,
14 |         public string $trustedCertificate
15 |     ) {
16 |     }
17 | 
18 |     /**
19 |      * @param string[] $untrustedCertificates
20 |      */
21 |     public static function create(array $untrustedCertificates, string $trustedCertificate): self
22 |     {
23 |         return new self($untrustedCertificates, $trustedCertificate);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Event/CertificateChainValidationFailed.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | final readonly class CertificateChainValidationFailed implements WebauthnEvent
 8 | {
 9 |     /**
10 |      * @param string[] $untrustedCertificates
11 |      */
12 |     public function __construct(
13 |         public array $untrustedCertificates,
14 |         public string $trustedCertificate
15 |     ) {
16 |     }
17 | 
18 |     /**
19 |      * @param string[] $untrustedCertificates
20 |      */
21 |     public static function create(array $untrustedCertificates, string $trustedCertificate): self
22 |     {
23 |         return new self($untrustedCertificates, $trustedCertificate);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/VerificationMethodANDCombinations.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | class VerificationMethodANDCombinations
 8 | {
 9 |     /**
10 |      * @param VerificationMethodDescriptor[] $verificationMethods
11 |      */
12 |     public function __construct(
13 |         /**
14 |          * @readonly
15 |          */
16 |         public array $verificationMethods = []
17 |     ) {
18 |     }
19 | 
20 |     /**
21 |      * @param VerificationMethodDescriptor[] $verificationMethods
22 |      */
23 |     public static function create(array $verificationMethods): self
24 |     {
25 |         return new self($verificationMethods);
26 |     }
27 | }
28 | 


--------------------------------------------------------------------------------
/src/Event/CertificateChainValidationSucceeded.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | final readonly class CertificateChainValidationSucceeded implements WebauthnEvent
 8 | {
 9 |     /**
10 |      * @param string[] $untrustedCertificates
11 |      */
12 |     public function __construct(
13 |         public array $untrustedCertificates,
14 |         public string $trustedCertificate
15 |     ) {
16 |     }
17 | 
18 |     /**
19 |      * @param string[] $untrustedCertificates
20 |      */
21 |     public static function create(array $untrustedCertificates, string $trustedCertificate): self
22 |     {
23 |         return new self($untrustedCertificates, $trustedCertificate);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Exception/MissingMetadataStatementException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class MissingMetadataStatementException extends MetadataStatementException
10 | {
11 |     public function __construct(
12 |         public readonly string $aaguid,
13 |         string $message,
14 |         ?Throwable $previous = null
15 |     ) {
16 |         parent::__construct($message, $previous);
17 |     }
18 | 
19 |     public static function create(
20 |         string $aaguid,
21 |         string $message = 'The Metadata Statement is missing',
22 |         ?Throwable $previous = null
23 |     ): self {
24 |         return new self($aaguid, $message, $previous);
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Exception/CounterException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class CounterException extends WebauthnException
10 | {
11 |     public function __construct(
12 |         public int $currentCounter,
13 |         public int $authenticatorCounter,
14 |         string $message,
15 |         ?Throwable $previous = null
16 |     ) {
17 |         parent::__construct($message, $previous);
18 |     }
19 | 
20 |     public static function create(
21 |         int $currentCounter,
22 |         int $authenticatorCounter,
23 |         string $message,
24 |         ?Throwable $previous = null
25 |     ): self {
26 |         return new self($currentCounter, $authenticatorCounter, $message, $previous);
27 |     }
28 | }
29 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/AbstractDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | abstract class AbstractDescriptor
10 | {
11 |     public function __construct(
12 |         public readonly ?int $maxRetries = null,
13 |         public readonly ?int $blockSlowdown = null
14 |     ) {
15 |         $maxRetries >= 0 || throw MetadataStatementLoadingException::create(
16 |             'Invalid data. The value of "maxRetries" must be a positive integer'
17 |         );
18 |         $blockSlowdown >= 0 || throw MetadataStatementLoadingException::create(
19 |             'Invalid data. The value of "blockSlowdown" must be a positive integer'
20 |         );
21 |     }
22 | }
23 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/ExtensionOutputCheckerHandler.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | class ExtensionOutputCheckerHandler
 8 | {
 9 |     /**
10 |      * @var ExtensionOutputChecker[]
11 |      */
12 |     private array $checkers = [];
13 | 
14 |     public static function create(): self
15 |     {
16 |         return new self();
17 |     }
18 | 
19 |     public function add(ExtensionOutputChecker $checker): void
20 |     {
21 |         $this->checkers[] = $checker;
22 |     }
23 | 
24 |     public function check(AuthenticationExtensions $inputs, AuthenticationExtensions $outputs): void
25 |     {
26 |         foreach ($this->checkers as $checker) {
27 |             $checker->check($inputs, $outputs);
28 |         }
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CeremonyStep.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\PublicKeyCredentialCreationOptions;
11 | use Webauthn\PublicKeyCredentialRequestOptions;
12 | use Webauthn\PublicKeyCredentialSource;
13 | 
14 | interface CeremonyStep
15 | {
16 |     public function process(
17 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
18 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
19 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
20 |         ?string $userHandle,
21 |         string $host
22 |     ): void;
23 | }
24 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationObject.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | use Webauthn\AuthenticatorData;
 8 | use Webauthn\MetadataService\Statement\MetadataStatement;
 9 | 
10 | class AttestationObject
11 | {
12 |     public ?MetadataStatement $metadataStatement = null;
13 | 
14 |     public function __construct(
15 |         public readonly string $rawAttestationObject,
16 |         public AttestationStatement $attStmt,
17 |         public readonly AuthenticatorData $authData
18 |     ) {
19 |     }
20 | 
21 |     public static function create(
22 |         string $rawAttestationObject,
23 |         AttestationStatement $attStmt,
24 |         AuthenticatorData $authData
25 |     ): self {
26 |         return new self($rawAttestationObject, $attStmt, $authData);
27 |     }
28 | }
29 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/RgbPaletteEntry.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | readonly class RgbPaletteEntry
10 | {
11 |     public function __construct(
12 |         public int $r,
13 |         public int $g,
14 |         public int $b,
15 |     ) {
16 |         ($r >= 0 && $r <= 255) || throw MetadataStatementLoadingException::create('The key "r" is invalid');
17 |         ($g >= 0 && $g <= 255) || throw MetadataStatementLoadingException::create('The key "g" is invalid');
18 |         ($b >= 0 && $b <= 255) || throw MetadataStatementLoadingException::create('The key "b" is invalid');
19 |     }
20 | 
21 |     public static function create(int $r, int $g, int $b): self
22 |     {
23 |         return new self($r, $g, $b);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/AuthenticationExtensionLoader.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | use CBOR\CBORObject;
 8 | use CBOR\MapObject;
 9 | use Webauthn\Exception\AuthenticationExtensionException;
10 | 
11 | abstract class AuthenticationExtensionLoader
12 | {
13 |     public static function load(CBORObject $object): AuthenticationExtensions
14 |     {
15 |         $object instanceof MapObject || throw AuthenticationExtensionException::create('Invalid extension object');
16 |         $data = $object->normalize();
17 |         return AuthenticationExtensions::create(
18 |             array_map(
19 |                 fn (mixed $value, string $key) => AuthenticationExtension::create($key, $value),
20 |                 $data,
21 |                 array_keys($data)
22 |             )
23 |         );
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Exception/InvalidAttestationStatementException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | use Webauthn\AttestationStatement\AttestationStatement;
 9 | 
10 | final class InvalidAttestationStatementException extends AttestationStatementException
11 | {
12 |     public function __construct(
13 |         public readonly AttestationStatement $attestationStatement,
14 |         string $message,
15 |         ?Throwable $previous = null
16 |     ) {
17 |         parent::__construct($message, $previous);
18 |     }
19 | 
20 |     public static function create(
21 |         AttestationStatement $attestationStatement,
22 |         string $message = 'Invalid attestation statement',
23 |         ?Throwable $previous = null
24 |     ): self {
25 |         return new self($attestationStatement, $message, $previous);
26 |     }
27 | }
28 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/Version.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | readonly class Version
10 | {
11 |     public function __construct(
12 |         public ?int $major,
13 |         public ?int $minor
14 |     ) {
15 |         if ($major === null && $minor === null) {
16 |             throw MetadataStatementLoadingException::create('Invalid data. Must contain at least one item');
17 |         }
18 |         $major >= 0 || throw MetadataStatementLoadingException::create('Invalid argument "major"');
19 |         $minor >= 0 || throw MetadataStatementLoadingException::create('Invalid argument "minor"');
20 |     }
21 | 
22 |     public static function create(?int $major, ?int $minor): self
23 |     {
24 |         return new self($major, $minor);
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Exception/AttestationStatementLoadingException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | final class AttestationStatementLoadingException extends AttestationStatementException
10 | {
11 |     /**
12 |      * @param array<string, mixed> $attestation
13 |      */
14 |     public function __construct(
15 |         public readonly array $attestation,
16 |         string $message,
17 |         ?Throwable $previous = null
18 |     ) {
19 |         parent::__construct($message, $previous);
20 |     }
21 | 
22 |     /**
23 |      * @param array<string, mixed> $attestation
24 |      */
25 |     public static function create(
26 |         array $attestation,
27 |         string $message = 'Invalid attestation object',
28 |         ?Throwable $previous = null
29 |     ): self {
30 |         return new self($attestation, $message, $previous);
31 |     }
32 | }
33 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialUserEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Webauthn\Exception\InvalidDataException;
 8 | use function strlen;
 9 | 
10 | class PublicKeyCredentialUserEntity extends PublicKeyCredentialEntity
11 | {
12 |     public readonly string $id;
13 | 
14 |     public function __construct(
15 |         string $name,
16 |         string $id,
17 |         public readonly string $displayName,
18 |         ?string $icon = null
19 |     ) {
20 |         parent::__construct('', $icon);
21 |         strlen($id) <= 64 || throw InvalidDataException::create($id, 'User ID max length is 64 bytes');
22 |         $this->id = $id;
23 |         $this->name = $name;
24 |     }
25 | 
26 |     public static function create(string $name, string $id, string $displayName, ?string $icon = null): self
27 |     {
28 |         return new self($name, $id, $displayName, $icon);
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/PatternAccuracyDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | class PatternAccuracyDescriptor extends AbstractDescriptor
10 | {
11 |     public function __construct(
12 |         public readonly int $minComplexity,
13 |         ?int $maxRetries = null,
14 |         ?int $blockSlowdown = null
15 |     ) {
16 |         $minComplexity >= 0 || throw MetadataStatementLoadingException::create(
17 |             'Invalid data. The value of "minComplexity" must be a positive integer'
18 |         );
19 |         parent::__construct($maxRetries, $blockSlowdown);
20 |     }
21 | 
22 |     public static function create(int $minComplexity, ?int $maxRetries = null, ?int $blockSlowdown = null): self
23 |     {
24 |         return new self($minComplexity, $maxRetries, $blockSlowdown);
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/src/Url.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | /**
 8 |  * Represents a URL that can be either an absolute HTTPS URL or a Symfony route name.
 9 |  * For Passkey Endpoints, URLs must always be absolute HTTPS URLs.
10 |  *
11 |  * @see https://w3c.github.io/webappsec-passkey-endpoints/
12 |  */
13 | final readonly class Url
14 | {
15 |     /**
16 |      * @param string $path The absolute HTTPS URL or Symfony route name
17 |      * @param array<string, mixed> $params Route parameters (only used when path is a route name)
18 |      */
19 |     public function __construct(
20 |         public string $path,
21 |         public array $params = [],
22 |     ) {
23 |     }
24 | 
25 |     /**
26 |      * @param array<string, mixed> $params Route parameters
27 |      */
28 |     public static function create(string $path, array $params = []): self
29 |     {
30 |         return new self($path, $params);
31 |     }
32 | }
33 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/BiometricAccuracyDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | class BiometricAccuracyDescriptor extends AbstractDescriptor
 8 | {
 9 |     public function __construct(
10 |         public readonly ?float $selfAttestedFRR,
11 |         public readonly ?float $selfAttestedFAR,
12 |         public readonly ?float $maxTemplates,
13 |         ?int $maxRetries = null,
14 |         ?int $blockSlowdown = null
15 |     ) {
16 |         parent::__construct($maxRetries, $blockSlowdown);
17 |     }
18 | 
19 |     public static function create(
20 |         ?float $selfAttestedFRR,
21 |         ?float $selfAttestedFAR,
22 |         ?float $maxTemplates,
23 |         ?int $maxRetries = null,
24 |         ?int $blockSlowdown = null
25 |     ): self {
26 |         return new self($selfAttestedFRR, $selfAttestedFAR, $maxTemplates, $maxRetries, $blockSlowdown);
27 |     }
28 | }
29 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredential.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | /**
 8 |  * @see https://www.w3.org/TR/webauthn/#iface-pkcredential
 9 |  */
10 | class PublicKeyCredential extends Credential
11 | {
12 |     public function __construct(
13 |         string $type,
14 |         string $rawId,
15 |         public readonly AuthenticatorResponse $response
16 |     ) {
17 |         parent::__construct($type, $rawId);
18 |     }
19 | 
20 |     public static function create(string $type, string $rawId, AuthenticatorResponse $response): self
21 |     {
22 |         return new self($type, $rawId, $response);
23 |     }
24 | 
25 |     public function getPublicKeyCredentialDescriptor(): PublicKeyCredentialDescriptor
26 |     {
27 |         $transport = $this->response instanceof AuthenticatorAttestationResponse ? $this->response->transports : [];
28 | 
29 |         return PublicKeyCredentialDescriptor::create($this->type, $this->rawId, $transport);
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/AuthenticatorAttestationResponse.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Webauthn\AttestationStatement\AttestationObject;
 8 | 
 9 | /**
10 |  * @see https://www.w3.org/TR/webauthn/#authenticatorattestationresponse
11 |  */
12 | class AuthenticatorAttestationResponse extends AuthenticatorResponse
13 | {
14 |     /**
15 |      * @param string[] $transports
16 |      */
17 |     public function __construct(
18 |         CollectedClientData $clientDataJSON,
19 |         public readonly AttestationObject $attestationObject,
20 |         public readonly array $transports = []
21 |     ) {
22 |         parent::__construct($clientDataJSON);
23 |     }
24 | 
25 |     /**
26 |      * @param string[] $transports
27 |      */
28 |     public static function create(
29 |         CollectedClientData $clientDataJSON,
30 |         AttestationObject $attestationObject,
31 |         array $transports = []
32 |     ): self {
33 |         return new self($clientDataJSON, $attestationObject, $transports);
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/ExtensionDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Symfony\Component\Serializer\Attribute\SerializedName;
 8 | use Webauthn\Exception\MetadataStatementLoadingException;
 9 | 
10 | readonly class ExtensionDescriptor
11 | {
12 |     public function __construct(
13 |         public string $id,
14 |         public ?int $tag,
15 |         public ?string $data,
16 |         #[SerializedName('fail_if_unknown')]
17 |         public bool $failIfUnknown
18 |     ) {
19 |         if ($tag !== null) {
20 |             $tag >= 0 || throw MetadataStatementLoadingException::create(
21 |                 'Invalid data. The parameter "tag" shall be a positive integer'
22 |             );
23 |         }
24 |     }
25 | 
26 |     public static function create(
27 |         string $id,
28 |         ?int $tag = null,
29 |         ?string $data = null,
30 |         bool $failIfUnknown = false
31 |     ): self {
32 |         return new self($id, $tag, $data, $failIfUnknown);
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/LargeBlobInputExtension.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | use function assert;
 8 | use function in_array;
 9 | 
10 | final class LargeBlobInputExtension extends AuthenticationExtension
11 | {
12 |     public const REQUIRED = 'required';
13 | 
14 |     public const PREFERRED = 'preferred';
15 | 
16 |     public static function support(string $support): AuthenticationExtension
17 |     {
18 |         assert(in_array($support, [self::REQUIRED, self::PREFERRED], true), 'Invalid support value.');
19 | 
20 |         return self::create('largeBlob', [
21 |             'support' => $support,
22 |         ]);
23 |     }
24 | 
25 |     public static function read(): AuthenticationExtension
26 |     {
27 |         return self::create('largeBlob', [
28 |             'read' => true,
29 |         ]);
30 |     }
31 | 
32 |     public static function write(string $value): AuthenticationExtension
33 |     {
34 |         return self::create('largeBlob', [
35 |             'write' => $value,
36 |         ]);
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AuthenticationExtensionNormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 8 | use Webauthn\AuthenticationExtensions\AuthenticationExtension;
 9 | use function assert;
10 | 
11 | final class AuthenticationExtensionNormalizer implements NormalizerInterface
12 | {
13 |     /**
14 |      * @return array<class-string, bool>
15 |      */
16 |     public function getSupportedTypes(?string $format): array
17 |     {
18 |         return [
19 |             AuthenticationExtension::class => true,
20 |         ];
21 |     }
22 | 
23 |     /**
24 |      * @return array<mixed>
25 |      */
26 |     public function normalize(mixed $object, ?string $format = null, array $context = []): array
27 |     {
28 |         assert($object instanceof AuthenticationExtension);
29 | 
30 |         return $object->value;
31 |     }
32 | 
33 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
34 |     {
35 |         return $data instanceof AuthenticationExtension;
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2018-2022 Spomky-Labs
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/CodeAccuracyDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | class CodeAccuracyDescriptor extends AbstractDescriptor
10 | {
11 |     public function __construct(
12 |         public readonly int $base,
13 |         public readonly int $minLength,
14 |         ?int $maxRetries = null,
15 |         ?int $blockSlowdown = null
16 |     ) {
17 |         $base >= 0 || throw MetadataStatementLoadingException::create(
18 |             'Invalid data. The value of "base" must be a positive integer'
19 |         );
20 |         $minLength >= 0 || throw MetadataStatementLoadingException::create(
21 |             'Invalid data. The value of "minLength" must be a positive integer'
22 |         );
23 |         parent::__construct($maxRetries, $blockSlowdown);
24 |     }
25 | 
26 |     public static function create(int $base, int $minLength, ?int $maxRetries = null, ?int $blockSlowdown = null): self
27 |     {
28 |         return new self($base, $minLength, $maxRetries, $blockSlowdown);
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/Exception/CertificateChainException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Exception;
 6 | 
 7 | use Throwable;
 8 | 
 9 | class CertificateChainException extends MetadataServiceException
10 | {
11 |     /**
12 |      * @param array<string> $untrustedCertificates
13 |      * @param array<string> $trustedCertificates
14 |      */
15 |     public function __construct(
16 |         public readonly array $untrustedCertificates,
17 |         public readonly array $trustedCertificates,
18 |         string $message,
19 |         ?Throwable $previous = null
20 |     ) {
21 |         parent::__construct($message, $previous);
22 |     }
23 | 
24 |     /**
25 |      * @param array<string> $untrustedCertificates
26 |      * @param array<string> $trustedCertificates
27 |      */
28 |     public static function create(
29 |         array $untrustedCertificates,
30 |         array $trustedCertificates,
31 |         string $message = 'Unable to validate the certificate chain.',
32 |         ?Throwable $previous = null
33 |     ): self {
34 |         return new self($untrustedCertificates, $trustedCertificates, $message, $previous);
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/src/AuthenticatorAssertionResponse.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Webauthn\AttestationStatement\AttestationObject;
 8 | 
 9 | /**
10 |  * @see https://www.w3.org/TR/webauthn/#authenticatorassertionresponse
11 |  */
12 | class AuthenticatorAssertionResponse extends AuthenticatorResponse
13 | {
14 |     public function __construct(
15 |         CollectedClientData $clientDataJSON,
16 |         public readonly AuthenticatorData $authenticatorData,
17 |         public readonly string $signature,
18 |         public readonly ?string $userHandle,
19 |         public readonly null|AttestationObject $attestationObject = null,
20 |     ) {
21 |         parent::__construct($clientDataJSON);
22 |     }
23 | 
24 |     public static function create(
25 |         CollectedClientData $clientDataJSON,
26 |         AuthenticatorData $authenticatorData,
27 |         string $signature,
28 |         ?string $userHandle = null,
29 |         null|AttestationObject $attestationObject = null,
30 |     ): self {
31 |         return new self($clientDataJSON, $authenticatorData, $signature, $userHandle, $attestationObject);
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/src/ClientDataCollector/WebauthnAuthenticationCollector.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\ClientDataCollector;
 6 | 
 7 | use Webauthn\AuthenticatorResponse;
 8 | use Webauthn\CollectedClientData;
 9 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
10 | use Webauthn\PublicKeyCredentialOptions;
11 | use function in_array;
12 | use function sprintf;
13 | 
14 | final class WebauthnAuthenticationCollector implements ClientDataCollector
15 | {
16 |     public function supportedTypes(): array
17 |     {
18 |         return ['webauthn.get', 'webauthn.create'];
19 |     }
20 | 
21 |     public function verifyCollectedClientData(
22 |         CollectedClientData $collectedClientData,
23 |         PublicKeyCredentialOptions $publicKeyCredentialOptions,
24 |         AuthenticatorResponse $authenticatorResponse,
25 |         string $host
26 |     ): void {
27 |         in_array(
28 |             $collectedClientData->type,
29 |             $this->supportedTypes(),
30 |             true
31 |         ) || throw AuthenticatorResponseVerificationException::create(
32 |             sprintf('The client data type is not "%s" supported.', implode('", "', $this->supportedTypes()))
33 |         );
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/BiometricStatusReport.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | readonly class BiometricStatusReport
 8 | {
 9 |     private function __construct(
10 |         public ?int $certLevel,
11 |         public ?int $modality,
12 |         public ?string $effectiveDate,
13 |         public ?string $certificationDescriptor,
14 |         public ?string $certificateNumber,
15 |         public ?string $certificationPolicyVersion,
16 |         public ?string $certificationRequirementsVersion,
17 |     ) {
18 |     }
19 | 
20 |     public static function create(
21 |         ?int $certLevel,
22 |         ?int $modality,
23 |         ?string $effectiveDate,
24 |         ?string $certificationDescriptor,
25 |         ?string $certificateNumber,
26 |         ?string $certificationPolicyVersion,
27 |         ?string $certificationRequirementsVersion,
28 |     ): self {
29 |         return new self(
30 |             $certLevel,
31 |             $modality,
32 |             $effectiveDate,
33 |             $certificationDescriptor,
34 |             $certificateNumber,
35 |             $certificationPolicyVersion,
36 |             $certificationRequirementsVersion,
37 |         );
38 |     }
39 | }
40 | 


--------------------------------------------------------------------------------
/src/Denormalizer/ExtensionDescriptorDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 8 | use Webauthn\MetadataService\Statement\ExtensionDescriptor;
 9 | use function array_key_exists;
10 | 
11 | final class ExtensionDescriptorDenormalizer implements DenormalizerInterface
12 | {
13 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
14 |     {
15 |         if (array_key_exists('fail_if_unknown', $data)) {
16 |             $data['failIfUnknown'] = $data['fail_if_unknown'];
17 |             unset($data['fail_if_unknown']);
18 |         }
19 | 
20 |         return ExtensionDescriptor::create(...$data);
21 |     }
22 | 
23 |     public function supportsDenormalization(
24 |         mixed $data,
25 |         string $type,
26 |         ?string $format = null,
27 |         array $context = []
28 |     ): bool {
29 |         return $type === ExtensionDescriptor::class;
30 |     }
31 | 
32 |     /**
33 |      * @return array<class-string, bool>
34 |      */
35 |     public function getSupportedTypes(?string $format): array
36 |     {
37 |         return [
38 |             ExtensionDescriptor::class => true,
39 |         ];
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | abstract class PublicKeyCredentialEntity
 8 | {
 9 |     /**
10 |      * @deprecated since 5.3.0 and will be removed in 6.0.0. Please set "" and use PublicKeyCredentialUserEntity.name instead.
11 |      */
12 |     public string $name;
13 | 
14 |     /**
15 |      * @deprecated since 5.1.0 and will be removed in 6.0.0. This value is always null.
16 |      */
17 |     public ?string $icon = null;
18 | 
19 |     public function __construct(string $name, ?string $icon = null)
20 |     {
21 |         if ($name !== '') {
22 |             trigger_deprecation(
23 |                 'web-auth/webauthn-lib',
24 |                 '5.3.0',
25 |                 'The parameter "$name" is deprecated since 5.3.0 and will be removed in 6.0.0. Please set "" and use PublicKeyCredentialUserEntity.name instead.'
26 |             );
27 |         }
28 |         $this->name = $name;
29 | 
30 |         if ($icon !== null) {
31 |             trigger_deprecation(
32 |                 'web-auth/webauthn-lib',
33 |                 '5.1.0',
34 |                 'The parameter "$icon" is deprecated since 5.1.0 and will be removed in 6.0.0. This value has no effect. Please set "null" instead.'
35 |             );
36 |         }
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/src/Denormalizer/CollectedClientDataDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
10 | use Webauthn\CollectedClientData;
11 | use const JSON_THROW_ON_ERROR;
12 | 
13 | final class CollectedClientDataDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
14 | {
15 |     use DenormalizerAwareTrait;
16 | 
17 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
18 |     {
19 |         return CollectedClientData::create($data, json_decode((string) $data, true, flags: JSON_THROW_ON_ERROR));
20 |     }
21 | 
22 |     public function supportsDenormalization(
23 |         mixed $data,
24 |         string $type,
25 |         ?string $format = null,
26 |         array $context = []
27 |     ): bool {
28 |         return $type === CollectedClientData::class;
29 |     }
30 | 
31 |     /**
32 |      * @return array<class-string, bool>
33 |      */
34 |     public function getSupportedTypes(?string $format): array
35 |     {
36 |         return [
37 |             CollectedClientData::class => true,
38 |         ];
39 |     }
40 | }
41 | 


--------------------------------------------------------------------------------
/src/Denormalizer/PublicKeyCredentialParametersDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 8 | use Webauthn\Exception\InvalidDataException;
 9 | use Webauthn\PublicKeyCredentialParameters;
10 | use function array_key_exists;
11 | 
12 | final class PublicKeyCredentialParametersDenormalizer implements DenormalizerInterface
13 | {
14 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
15 |     {
16 |         if (! array_key_exists('type', $data) || ! array_key_exists('alg', $data)) {
17 |             throw new InvalidDataException($data, 'Missing type or alg');
18 |         }
19 | 
20 |         return PublicKeyCredentialParameters::create($data['type'], $data['alg']);
21 |     }
22 | 
23 |     public function supportsDenormalization(
24 |         mixed $data,
25 |         string $type,
26 |         ?string $format = null,
27 |         array $context = []
28 |     ): bool {
29 |         return $type === PublicKeyCredentialParameters::class;
30 |     }
31 | 
32 |     /**
33 |      * @return array<class-string, bool>
34 |      */
35 |     public function getSupportedTypes(?string $format): array
36 |     {
37 |         return [
38 |             PublicKeyCredentialParameters::class => true,
39 |         ];
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AttestationStatementDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 8 | use Webauthn\AttestationStatement\AttestationStatement;
 9 | use Webauthn\AttestationStatement\AttestationStatementSupportManager;
10 | 
11 | final readonly class AttestationStatementDenormalizer implements DenormalizerInterface
12 | {
13 |     public function __construct(
14 |         private AttestationStatementSupportManager $attestationStatementSupportManager
15 |     ) {
16 |     }
17 | 
18 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
19 |     {
20 |         $attestationStatementSupport = $this->attestationStatementSupportManager->get($data['fmt']);
21 | 
22 |         return $attestationStatementSupport->load($data);
23 |     }
24 | 
25 |     public function supportsDenormalization(
26 |         mixed $data,
27 |         string $type,
28 |         ?string $format = null,
29 |         array $context = []
30 |     ): bool {
31 |         return $type === AttestationStatement::class;
32 |     }
33 | 
34 |     /**
35 |      * @return array<class-string, bool>
36 |      */
37 |     public function getSupportedTypes(?string $format): array
38 |     {
39 |         return [
40 |             AttestationStatement::class => true,
41 |         ];
42 |     }
43 | }
44 | 


--------------------------------------------------------------------------------
/src/Denormalizer/PublicKeyCredentialRpEntityDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 8 | use Webauthn\PublicKeyCredentialRpEntity;
 9 | use function assert;
10 | 
11 | final class PublicKeyCredentialRpEntityDenormalizer implements NormalizerInterface
12 | {
13 |     /**
14 |      * @return array<class-string, bool>
15 |      */
16 |     public function getSupportedTypes(?string $format): array
17 |     {
18 |         return [
19 |             PublicKeyCredentialRpEntity::class => true,
20 |         ];
21 |     }
22 | 
23 |     /**
24 |      * @return array<string, mixed>
25 |      */
26 |     public function normalize(mixed $object, ?string $format = null, array $context = []): ?array
27 |     {
28 |         assert($object instanceof PublicKeyCredentialRpEntity);
29 |         $data = array_filter(
30 |             [
31 |                 'id' => $object->id,
32 |                 'name' => $object->name,
33 |                 'icon' => $object->icon,
34 |             ],
35 |             static fn (?string $value): bool => ($value !== null && $value !== ''),
36 |         );
37 | 
38 |         return $data === [] ? null : $data;
39 |     }
40 | 
41 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
42 |     {
43 |         return $data instanceof PublicKeyCredentialRpEntity;
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/src/ClientDataCollector/ClientDataCollectorManager.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\ClientDataCollector;
 6 | 
 7 | use Webauthn\AuthenticatorResponse;
 8 | use Webauthn\CollectedClientData;
 9 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
10 | use Webauthn\PublicKeyCredentialOptions;
11 | use function in_array;
12 | 
13 | final readonly class ClientDataCollectorManager
14 | {
15 |     /**
16 |      * @param ClientDataCollector[] $clientDataCollectors
17 |      */
18 |     public function __construct(
19 |         private iterable $clientDataCollectors,
20 |     ) {
21 |     }
22 | 
23 |     public function collect(
24 |         CollectedClientData $collectedClientData,
25 |         PublicKeyCredentialOptions $publicKeyCredentialOptions,
26 |         AuthenticatorResponse $authenticatorResponse,
27 |         string $host
28 |     ): void {
29 |         foreach ($this->clientDataCollectors as $clientDataCollector) {
30 |             if (in_array($collectedClientData->type, $clientDataCollector->supportedTypes(), true)) {
31 |                 $clientDataCollector->verifyCollectedClientData(
32 |                     $collectedClientData,
33 |                     $publicKeyCredentialOptions,
34 |                     $authenticatorResponse,
35 |                     $host
36 |                 );
37 |                 return;
38 |             }
39 |         }
40 | 
41 |         throw AuthenticatorResponseVerificationException::create('No client data collector found.');
42 |     }
43 | }
44 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AttestedCredentialDataNormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\AttestedCredentialData;
11 | use function assert;
12 | 
13 | final class AttestedCredentialDataNormalizer implements NormalizerInterface, NormalizerAwareInterface
14 | {
15 |     use NormalizerAwareTrait;
16 | 
17 |     /**
18 |      * @return array<string, mixed>
19 |      */
20 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
21 |     {
22 |         assert($data instanceof AttestedCredentialData);
23 |         $result = [
24 |             'aaguid' => $this->normalizer->normalize($data->aaguid, $format, $context),
25 |             'credentialId' => base64_encode($data->credentialId),
26 |         ];
27 |         if ($data->credentialPublicKey !== null) {
28 |             $result['credentialPublicKey'] = base64_encode($data->credentialPublicKey);
29 |         }
30 | 
31 |         return $result;
32 |     }
33 | 
34 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
35 |     {
36 |         return $data instanceof AttestedCredentialData;
37 |     }
38 | 
39 |     public function getSupportedTypes(?string $format): array
40 |     {
41 |         return [
42 |             AttestedCredentialData::class => true,
43 |         ];
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckCredentialId.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function strlen;
15 | use function trigger_deprecation;
16 | 
17 | class CheckCredentialId implements CeremonyStep
18 | {
19 |     public function process(
20 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
21 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
22 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
23 |         ?string $userHandle,
24 |         string $host
25 |     ): void {
26 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
27 |             trigger_deprecation(
28 |                 'web-auth/webauthn-lib',
29 |                 '5.3',
30 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
31 |                 self::class
32 |             );
33 |         }
34 |         $credentialId = $credentialRecord->publicKeyCredentialId;
35 |         strlen($credentialId) <= 1023 || throw new AuthenticatorResponseVerificationException(
36 |             'Credential ID too long.'
37 |         );
38 |     }
39 | }
40 | 


--------------------------------------------------------------------------------
/src/Denormalizer/PublicKeyCredentialDescriptorNormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
10 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
11 | use Webauthn\PublicKeyCredentialDescriptor;
12 | use function assert;
13 | use function count;
14 | 
15 | final class PublicKeyCredentialDescriptorNormalizer implements NormalizerInterface, NormalizerAwareInterface
16 | {
17 |     use NormalizerAwareTrait;
18 | 
19 |     /**
20 |      * @return array<string, mixed>
21 |      */
22 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
23 |     {
24 |         assert($data instanceof PublicKeyCredentialDescriptor);
25 |         $result = [
26 |             'type' => $data->type,
27 |             'id' => Base64UrlSafe::encodeUnpadded($data->id),
28 |         ];
29 |         if (count($data->transports) !== 0) {
30 |             $result['transports'] = $data->transports;
31 |         }
32 | 
33 |         return $result;
34 |     }
35 | 
36 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
37 |     {
38 |         return $data instanceof PublicKeyCredentialDescriptor;
39 |     }
40 | 
41 |     public function getSupportedTypes(?string $format): array
42 |     {
43 |         return [
44 |             PublicKeyCredentialDescriptor::class => true,
45 |         ];
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/Denormalizer/SignalUnknownCredentialDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\Signal\UnknownCredential;
11 | use function assert;
12 | 
13 | class SignalUnknownCredentialDenormalizer implements NormalizerInterface, NormalizerAwareInterface
14 | {
15 |     use NormalizerAwareTrait;
16 | 
17 |     /**
18 |      * @return array<class-string, bool>
19 |      */
20 |     public function getSupportedTypes(?string $format): array
21 |     {
22 |         return [
23 |             UnknownCredential::class => true,
24 |         ];
25 |     }
26 | 
27 |     /**
28 |      * @return array<string, mixed>
29 |      */
30 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
31 |     {
32 |         assert($data instanceof UnknownCredential);
33 | 
34 |         $normalized_rp = $this->normalizer->normalize($data->rp, $format, $context);
35 | 
36 |         $normalized_credential = $this->normalizer->normalize($data->credential, $format, $context);
37 | 
38 |         return [
39 |             'rpId' => $normalized_rp['id'],
40 |             'credentialId' => $normalized_credential['id'],
41 |         ];
42 |     }
43 | 
44 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
45 |     {
46 |         return $data instanceof UnknownCredential;
47 |     }
48 | }
49 | 


--------------------------------------------------------------------------------
/src/PasskeyEndpointsResponse.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | /**
 8 |  * Represents the Passkey Endpoints response as defined in the W3C Passkey Endpoints specification.
 9 |  *
10 |  * @see https://w3c.github.io/webappsec-passkey-endpoints/
11 |  */
12 | final readonly class PasskeyEndpointsResponse
13 | {
14 |     /**
15 |      * @param null|Url $enroll URL to the passkey enrollment/creation interface
16 |      * @param null|Url $manage URL to the passkey management interface
17 |      * @param null|Url $prfUsageDetails URL to informational page about PRF (Pseudo-Random Function) extension usage
18 |      */
19 |     public function __construct(
20 |         public null|Url $enroll = null,
21 |         public null|Url $manage = null,
22 |         public null|Url $prfUsageDetails = null,
23 |     ) {
24 |     }
25 | 
26 |     /**
27 |      * @param null|Url $enroll URL to the passkey enrollment/creation interface
28 |      * @param null|Url $manage URL to the passkey management interface
29 |      * @param null|Url $prfUsageDetails URL to informational page about PRF extension usage
30 |      */
31 |     public static function create(
32 |         null|Url $enroll = null,
33 |         null|Url $manage = null,
34 |         null|Url $prfUsageDetails = null,
35 |     ): self {
36 |         return new self($enroll, $manage, $prfUsageDetails);
37 |     }
38 | 
39 |     /**
40 |      * Creates an empty response indicating passkey support without exposing specific endpoints.
41 |      */
42 |     public static function createEmpty(): self
43 |     {
44 |         return new self();
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/src/Denormalizer/VerificationMethodANDCombinationsDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\MetadataService\Statement\VerificationMethodANDCombinations;
11 | use Webauthn\MetadataService\Statement\VerificationMethodDescriptor;
12 | use function assert;
13 | 
14 | final class VerificationMethodANDCombinationsDenormalizer implements NormalizerInterface, NormalizerAwareInterface
15 | {
16 |     use NormalizerAwareTrait;
17 | 
18 |     /**
19 |      * @return array<class-string, bool>
20 |      */
21 |     public function getSupportedTypes(?string $format): array
22 |     {
23 |         return [
24 |             VerificationMethodANDCombinations::class => true,
25 |         ];
26 |     }
27 | 
28 |     /**
29 |      * @return array<VerificationMethodDescriptor>
30 |      */
31 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
32 |     {
33 |         assert($data instanceof VerificationMethodANDCombinations);
34 | 
35 |         return array_map(
36 |             fn ($verificationMethod) => $this->normalizer->normalize($verificationMethod, $format, $context),
37 |             $data->verificationMethods
38 |         );
39 |     }
40 | 
41 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
42 |     {
43 |         return $data instanceof VerificationMethodANDCombinations;
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/src/Denormalizer/SignalCurrentUserDetailsDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\Signal\CurrentUserDetails;
11 | use function assert;
12 | 
13 | class SignalCurrentUserDetailsDenormalizer implements NormalizerInterface, NormalizerAwareInterface
14 | {
15 |     use NormalizerAwareTrait;
16 | 
17 |     /**
18 |      * @return array<class-string, bool>
19 |      */
20 |     public function getSupportedTypes(?string $format): array
21 |     {
22 |         return [
23 |             CurrentUserDetails::class => true,
24 |         ];
25 |     }
26 | 
27 |     /**
28 |      * @return array<string, mixed>
29 |      */
30 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
31 |     {
32 |         assert($data instanceof CurrentUserDetails);
33 | 
34 |         $normalized_rp = $this->normalizer->normalize($data->rp, $format, $context);
35 | 
36 |         $normalized_user = $this->normalizer->normalize($data->user, $format, $context);
37 | 
38 |         return [
39 |             'rpId' => $normalized_rp['id'],
40 |             'userId' => $normalized_user['id'],
41 |             'name' => $normalized_user['name'],
42 |             'displayName' => $normalized_user['displayName'],
43 |         ];
44 |     }
45 | 
46 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
47 |     {
48 |         return $data instanceof CurrentUserDetails;
49 |     }
50 | }
51 | 


--------------------------------------------------------------------------------
/src/MetadataService/CertificateChain/CertificateToolbox.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\CertificateChain;
 6 | 
 7 | use const PHP_EOL;
 8 | 
 9 | final readonly class CertificateToolbox
10 | {
11 |     private const PEM_HEADER = '-----BEGIN ';
12 | 
13 |     private const PEM_FOOTER = '-----END ';
14 | 
15 |     /**
16 |      * @param string[] $data
17 |      *
18 |      * @return string[]
19 |      */
20 |     public static function fixPEMStructures(array $data, string $type = 'CERTIFICATE'): array
21 |     {
22 |         return array_map(static fn ($d): string => self::fixPEMStructure($d, $type), $data);
23 |     }
24 | 
25 |     public static function fixPEMStructure(string $data, string $type = 'CERTIFICATE'): string
26 |     {
27 |         if (str_contains($data, self::PEM_HEADER)) {
28 |             return trim($data);
29 |         }
30 |         $pem = self::PEM_HEADER . $type . '-----' . PHP_EOL;
31 |         $pem .= chunk_split($data, 64, PHP_EOL);
32 | 
33 |         return $pem . (self::PEM_FOOTER . $type . '-----' . PHP_EOL);
34 |     }
35 | 
36 |     public static function convertDERToPEM(string $data, string $type = 'CERTIFICATE'): string
37 |     {
38 |         if (str_contains($data, self::PEM_HEADER)) {
39 |             return $data;
40 |         }
41 | 
42 |         return self::fixPEMStructure(base64_encode($data), $type);
43 |     }
44 | 
45 |     /**
46 |      * @param string[] $data
47 |      *
48 |      * @return string[]
49 |      */
50 |     public static function convertAllDERToPEM(array $data, string $type = 'CERTIFICATE'): array
51 |     {
52 |         return array_map(static fn ($d): string => self::convertDERToPEM($d, $type), $data);
53 |     }
54 | }
55 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CeremonyStepManager.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\PublicKeyCredentialCreationOptions;
11 | use Webauthn\PublicKeyCredentialRequestOptions;
12 | use Webauthn\PublicKeyCredentialSource;
13 | use function trigger_deprecation;
14 | 
15 | final readonly class CeremonyStepManager
16 | {
17 |     /**
18 |      * @param CeremonyStep[] $steps
19 |      */
20 |     public function __construct(
21 |         private array $steps
22 |     ) {
23 |     }
24 | 
25 |     public function process(
26 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
27 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
28 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
29 |         ?string $userHandle,
30 |         string $host
31 |     ): void {
32 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
33 |             trigger_deprecation(
34 |                 'web-auth/webauthn-lib',
35 |                 '5.3',
36 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
37 |                 self::class
38 |             );
39 |         }
40 | 
41 |         foreach ($this->steps as $step) {
42 |             $step->process(
43 |                 $credentialRecord,
44 |                 $authenticatorResponse,
45 |                 $publicKeyCredentialOptions,
46 |                 $userHandle,
47 |                 $host
48 |             );
49 |         }
50 |     }
51 | }
52 | 


--------------------------------------------------------------------------------
/src/StringStream.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use CBOR\Stream;
 8 | use Webauthn\Exception\InvalidDataException;
 9 | use function assert;
10 | use function fclose;
11 | use function fopen;
12 | use function fread;
13 | use function fwrite;
14 | use function rewind;
15 | use function sprintf;
16 | use function strlen;
17 | 
18 | final class StringStream implements Stream
19 | {
20 |     /**
21 |      * @var resource
22 |      */
23 |     private $data;
24 | 
25 |     private readonly int $length;
26 | 
27 |     private int $totalRead = 0;
28 | 
29 |     public function __construct(string $data)
30 |     {
31 |         $this->length = strlen($data);
32 |         $resource = fopen('php://memory', 'rb+');
33 |         assert($resource !== false, 'The resource could not be opened.');
34 |         fwrite($resource, $data);
35 |         rewind($resource);
36 |         $this->data = $resource;
37 |     }
38 | 
39 |     public function read(int $length): string
40 |     {
41 |         if ($length <= 0) {
42 |             return '';
43 |         }
44 |         $read = fread($this->data, $length);
45 |         assert($read !== false, 'The data could not be read.');
46 |         $bytesRead = strlen($read);
47 |         strlen($read) === $length || throw InvalidDataException::create(null, sprintf(
48 |             'Out of range. Expected: %d, read: %d.',
49 |             $length,
50 |             $bytesRead
51 |         ));
52 |         $this->totalRead += $bytesRead;
53 | 
54 |         return $read;
55 |     }
56 | 
57 |     public function close(): void
58 |     {
59 |         fclose($this->data);
60 |     }
61 | 
62 |     public function isEOF(): bool
63 |     {
64 |         return $this->totalRead === $this->length;
65 |     }
66 | }
67 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckChallenge.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final class CheckChallenge implements CeremonyStep
17 | {
18 |     public function process(
19 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
20 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
21 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
22 |         ?string $userHandle,
23 |         string $host
24 |     ): void {
25 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
26 |             trigger_deprecation(
27 |                 'web-auth/webauthn-lib',
28 |                 '5.3',
29 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
30 |                 self::class
31 |             );
32 |         }
33 |         $publicKeyCredentialOptions->challenge !== '' || throw AuthenticatorResponseVerificationException::create(
34 |             'Invalid challenge.'
35 |         );
36 |         hash_equals(
37 |             $publicKeyCredentialOptions->challenge,
38 |             $authenticatorResponse->clientDataJSON->challenge
39 |         ) || throw AuthenticatorResponseVerificationException::create('Invalid challenge.');
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | class PublicKeyCredentialDescriptor
 8 | {
 9 |     final public const CREDENTIAL_TYPE_PUBLIC_KEY = 'public-key';
10 | 
11 |     final public const AUTHENTICATOR_TRANSPORT_USB = 'usb';
12 | 
13 |     final public const AUTHENTICATOR_TRANSPORT_NFC = 'nfc';
14 | 
15 |     final public const AUTHENTICATOR_TRANSPORT_BLE = 'ble';
16 | 
17 |     /**
18 |      * @deprecated Please use AUTHENTICATOR_TRANSPORT_BLE instead. Will be removed in 6.0.0
19 |      */
20 |     final public const AUTHENTICATOR_TRANSPORT_CABLE = 'cable';
21 | 
22 |     final public const AUTHENTICATOR_TRANSPORT_SMART_CARD = 'smart-card';
23 | 
24 |     final public const AUTHENTICATOR_TRANSPORT_HYBRID = 'hybrid';
25 | 
26 |     final public const AUTHENTICATOR_TRANSPORT_INTERNAL = 'internal';
27 | 
28 |     final public const AUTHENTICATOR_TRANSPORTS = [
29 |         self::AUTHENTICATOR_TRANSPORT_USB,
30 |         self::AUTHENTICATOR_TRANSPORT_NFC,
31 |         self::AUTHENTICATOR_TRANSPORT_BLE,
32 |         self::AUTHENTICATOR_TRANSPORT_CABLE,
33 |         self::AUTHENTICATOR_TRANSPORT_SMART_CARD,
34 |         self::AUTHENTICATOR_TRANSPORT_HYBRID,
35 |         self::AUTHENTICATOR_TRANSPORT_INTERNAL,
36 |     ];
37 | 
38 |     /**
39 |      * @param string[] $transports
40 |      */
41 |     public function __construct(
42 |         public readonly string $type,
43 |         public readonly string $id,
44 |         public readonly array $transports = []
45 |     ) {
46 |     }
47 | 
48 |     /**
49 |      * @param string[] $transports
50 |      */
51 |     public static function create(string $type, string $id, array $transports = []): self
52 |     {
53 |         return new self($type, $id, $transports);
54 |     }
55 | }
56 | 


--------------------------------------------------------------------------------
/src/Counter/ThrowExceptionIfInvalid.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Counter;
 6 | 
 7 | use Psr\Log\LoggerInterface;
 8 | use Psr\Log\NullLogger;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\CounterException;
11 | use Webauthn\MetadataService\CanLogData;
12 | use Webauthn\PublicKeyCredentialSource;
13 | use function trigger_deprecation;
14 | 
15 | final class ThrowExceptionIfInvalid implements CounterChecker, CanLogData
16 | {
17 |     public function __construct(
18 |         private LoggerInterface $logger = new NullLogger()
19 |     ) {
20 |     }
21 | 
22 |     public function setLogger(LoggerInterface $logger): void
23 |     {
24 |         $this->logger = $logger;
25 |     }
26 | 
27 |     public function check(CredentialRecord|PublicKeyCredentialSource $credentialRecord, int $currentCounter): void
28 |     {
29 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
30 |             trigger_deprecation(
31 |                 'web-auth/webauthn-lib',
32 |                 '5.3',
33 |                 'Passing a PublicKeyCredentialSource to "%s::check()" is deprecated, pass a CredentialRecord instead.',
34 |                 self::class
35 |             );
36 |         }
37 | 
38 |         try {
39 |             $currentCounter > $credentialRecord->counter || throw CounterException::create(
40 |                 $currentCounter,
41 |                 $credentialRecord->counter,
42 |                 'Invalid counter.'
43 |             );
44 |         } catch (CounterException $throwable) {
45 |             $this->logger->error('The counter is invalid', [
46 |                 'current' => $currentCounter,
47 |                 'new' => $credentialRecord->counter,
48 |             ]);
49 |             throw $throwable;
50 |         }
51 |     }
52 | }
53 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/ChainedMetadataServices.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use Webauthn\Exception\MissingMetadataStatementException;
 8 | use Webauthn\MetadataService\Statement\MetadataStatement;
 9 | 
10 | final class ChainedMetadataServices implements MetadataService
11 | {
12 |     /**
13 |      * @var MetadataService[]
14 |      */
15 |     private array $services = [];
16 | 
17 |     public function __construct(MetadataService ...$services)
18 |     {
19 |         foreach ($services as $service) {
20 |             $this->addServices($service);
21 |         }
22 |     }
23 | 
24 |     public static function create(MetadataService ...$services): self
25 |     {
26 |         return new self(...$services);
27 |     }
28 | 
29 |     public function addServices(MetadataService ...$services): self
30 |     {
31 |         foreach ($services as $service) {
32 |             $this->services[] = $service;
33 |         }
34 | 
35 |         return $this;
36 |     }
37 | 
38 |     public function list(): iterable
39 |     {
40 |         foreach ($this->services as $service) {
41 |             yield from $service->list();
42 |         }
43 |     }
44 | 
45 |     public function has(string $aaguid): bool
46 |     {
47 |         foreach ($this->services as $service) {
48 |             if ($service->has($aaguid)) {
49 |                 return true;
50 |             }
51 |         }
52 | 
53 |         return false;
54 |     }
55 | 
56 |     public function get(string $aaguid): MetadataStatement
57 |     {
58 |         foreach ($this->services as $service) {
59 |             if ($service->has($aaguid)) {
60 |                 return $service->get($aaguid);
61 |             }
62 |         }
63 | 
64 |         throw MissingMetadataStatementException::create($aaguid);
65 |     }
66 | }
67 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckBackupBitsAreConsistent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final class CheckBackupBitsAreConsistent implements CeremonyStep
17 | {
18 |     public function process(
19 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
20 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
21 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
22 |         ?string $userHandle,
23 |         string $host
24 |     ): void {
25 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
26 |             trigger_deprecation(
27 |                 'web-auth/webauthn-lib',
28 |                 '5.3',
29 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
30 |                 self::class
31 |             );
32 |         }
33 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
34 |         if ($authData->isBackupEligible()) {
35 |             return;
36 |         }
37 |         $authData->isBackedUp() !== true || throw AuthenticatorResponseVerificationException::create(
38 |             'Backup up bit is set but the backup is not eligible.'
39 |         );
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AuthenticatorResponseDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
10 | use Webauthn\AuthenticatorAssertionResponse;
11 | use Webauthn\AuthenticatorAttestationResponse;
12 | use Webauthn\AuthenticatorResponse;
13 | use Webauthn\Exception\InvalidDataException;
14 | use function array_key_exists;
15 | 
16 | final class AuthenticatorResponseDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
17 | {
18 |     use DenormalizerAwareTrait;
19 | 
20 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
21 |     {
22 |         $realType = match (true) {
23 |             array_key_exists('attestationObject', $data) => AuthenticatorAttestationResponse::class,
24 |             array_key_exists('signature', $data) => AuthenticatorAssertionResponse::class,
25 |             default => throw InvalidDataException::create($data, 'Unable to create the response object'),
26 |         };
27 | 
28 |         return $this->denormalizer->denormalize($data, $realType, $format, $context);
29 |     }
30 | 
31 |     public function supportsDenormalization(
32 |         mixed $data,
33 |         string $type,
34 |         ?string $format = null,
35 |         array $context = []
36 |     ): bool {
37 |         return $type === AuthenticatorResponse::class;
38 |     }
39 | 
40 |     /**
41 |      * @return array<class-string, bool>
42 |      */
43 |     public function getSupportedTypes(?string $format): array
44 |     {
45 |         return [
46 |             AuthenticatorResponse::class => true,
47 |         ];
48 |     }
49 | }
50 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/PseudoRandomFunctionInputExtensionBuilder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AuthenticationExtensions;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use function array_key_exists;
 9 | 
10 | final class PseudoRandomFunctionInputExtensionBuilder
11 | {
12 |     /**
13 |      * @var array{eval?: array{first: string, second?: string}, evalByCredential?: array<string, array{first: string, second?: string}>
14 |      */
15 |     private array $values = [];
16 | 
17 |     private function __construct()
18 |     {
19 |     }
20 | 
21 |     public static function create(): self
22 |     {
23 |         return new self();
24 |     }
25 | 
26 |     public function withInputs(string $first, null|string $second = null): self
27 |     {
28 |         $eval = [
29 |             'first' => Base64UrlSafe::encodeUnpadded($first),
30 |         ];
31 |         if ($second !== null) {
32 |             $eval['second'] = Base64UrlSafe::encodeUnpadded($second);
33 |         }
34 |         $this->values['eval'] = $eval;
35 | 
36 |         return $this;
37 |     }
38 | 
39 |     public function withCredentialInputs(string $credentialId, string $first, null|string $second = null): self
40 |     {
41 |         $eval = [
42 |             'first' => Base64UrlSafe::encodeUnpadded($first),
43 |         ];
44 |         if ($second !== null) {
45 |             $eval['second'] = Base64UrlSafe::encodeUnpadded($second);
46 |         }
47 |         if (! array_key_exists('evalByCredential', $this->values)) {
48 |             $this->values['evalByCredential'] = [];
49 |         }
50 |         $this->values['evalByCredential'][$credentialId] = $eval;
51 | 
52 |         return $this;
53 |     }
54 | 
55 |     public function build(): PseudoRandomFunctionInputExtension
56 |     {
57 |         return new PseudoRandomFunctionInputExtension('prf', $this->values);
58 |     }
59 | }
60 | 


--------------------------------------------------------------------------------
/src/U2FPublicKey.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use CBOR\ByteStringObject;
 8 | use CBOR\MapItem;
 9 | use CBOR\MapObject;
10 | use CBOR\NegativeIntegerObject;
11 | use CBOR\UnsignedIntegerObject;
12 | use Cose\Algorithms;
13 | use Cose\Key\Ec2Key;
14 | use function strlen;
15 | 
16 | /**
17 |  * @internal
18 |  */
19 | final readonly class U2FPublicKey
20 | {
21 |     private const U2F_KEY_PREFIX = "\x04";
22 | 
23 |     private const U2F_KEY_LENGTH = 65;
24 | 
25 |     private const U2F_KEY_PART_SIZE = 32;
26 | 
27 |     public static function isU2FKey(string $publicKey): bool
28 |     {
29 |         return $publicKey[0] === self::U2F_KEY_PREFIX && strlen($publicKey) === self::U2F_KEY_LENGTH;
30 |     }
31 | 
32 |     public static function convertToCoseKey(string $publicKey): string
33 |     {
34 |         return MapObject::create([
35 |             MapItem::create(
36 |                 UnsignedIntegerObject::create(Ec2Key::TYPE),
37 |                 UnsignedIntegerObject::create(Ec2Key::TYPE_EC2)
38 |             ),
39 |             MapItem::create(
40 |                 UnsignedIntegerObject::create(Ec2Key::ALG),
41 |                 NegativeIntegerObject::create(Algorithms::COSE_ALGORITHM_ES256)
42 |             ),
43 |             MapItem::create(
44 |                 NegativeIntegerObject::create(Ec2Key::DATA_CURVE),
45 |                 UnsignedIntegerObject::create(Ec2Key::CURVE_P256)
46 |             ),
47 |             MapItem::create(
48 |                 NegativeIntegerObject::create(Ec2Key::DATA_X),
49 |                 ByteStringObject::create(substr($publicKey, 1, self::U2F_KEY_PART_SIZE))
50 |             ),
51 |             MapItem::create(
52 |                 NegativeIntegerObject::create(Ec2Key::DATA_Y),
53 |                 ByteStringObject::create(substr($publicKey, 1 + self::U2F_KEY_PART_SIZE))
54 |             ),
55 |         ])->__toString();
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckCounter.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\Counter\CounterChecker;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final readonly class CheckCounter implements CeremonyStep
17 | {
18 |     public function __construct(
19 |         private CounterChecker $counterChecker
20 |     ) {
21 |     }
22 | 
23 |     public function process(
24 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
25 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
26 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
27 |         ?string $userHandle,
28 |         string $host
29 |     ): void {
30 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
31 |             trigger_deprecation(
32 |                 'web-auth/webauthn-lib',
33 |                 '5.3',
34 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
35 |                 self::class
36 |             );
37 |         }
38 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
39 |         $storedCounter = $credentialRecord->counter;
40 |         $responseCounter = $authData->signCount;
41 |         if ($responseCounter !== 0 || $storedCounter !== 0) {
42 |             $this->counterChecker->check($credentialRecord, $responseCounter);
43 |         }
44 |         $credentialRecord->counter = $responseCounter;
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckHasAttestedCredentialData.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final class CheckHasAttestedCredentialData implements CeremonyStep
17 | {
18 |     public function process(
19 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
20 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
21 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
22 |         ?string $userHandle,
23 |         string $host
24 |     ): void {
25 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
26 |             trigger_deprecation(
27 |                 'web-auth/webauthn-lib',
28 |                 '5.3',
29 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
30 |                 self::class
31 |             );
32 |         }
33 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
34 |         $authData
35 |             ->hasAttestedCredentialData() || throw AuthenticatorResponseVerificationException::create(
36 |                 'There is no attested credential data.'
37 |             );
38 |         $authData->attestedCredentialData !== null || throw AuthenticatorResponseVerificationException::create(
39 |             'There is no attested credential data.'
40 |         );
41 |     }
42 | }
43 | 


--------------------------------------------------------------------------------
/src/Denormalizer/PublicKeyCredentialDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
10 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
11 | use Webauthn\AuthenticatorResponse;
12 | use Webauthn\Exception\InvalidDataException;
13 | use Webauthn\PublicKeyCredential;
14 | use Webauthn\Util\Base64;
15 | use function array_key_exists;
16 | 
17 | final class PublicKeyCredentialDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
18 | {
19 |     use DenormalizerAwareTrait;
20 | 
21 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
22 |     {
23 |         if (! array_key_exists('id', $data)) {
24 |             return $data;
25 |         }
26 |         $id = Base64UrlSafe::decodeNoPadding($data['id']);
27 |         $rawId = Base64::decode($data['rawId']);
28 |         hash_equals($id, $rawId) || throw InvalidDataException::create($data, 'Invalid ID');
29 |         $data['rawId'] = $rawId;
30 | 
31 |         return PublicKeyCredential::create(
32 |             $data['type'],
33 |             $data['rawId'],
34 |             $this->denormalizer->denormalize($data['response'], AuthenticatorResponse::class, $format, $context),
35 |         );
36 |     }
37 | 
38 |     public function supportsDenormalization(
39 |         mixed $data,
40 |         string $type,
41 |         ?string $format = null,
42 |         array $context = []
43 |     ): bool {
44 |         return $type === PublicKeyCredential::class;
45 |     }
46 | 
47 |     /**
48 |      * @return array<class-string, bool>
49 |      */
50 |     public function getSupportedTypes(?string $format): array
51 |     {
52 |         return [
53 |             PublicKeyCredential::class => true,
54 |         ];
55 |     }
56 | }
57 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckAllowedCredentialList.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function count;
15 | use function trigger_deprecation;
16 | 
17 | final class CheckAllowedCredentialList implements CeremonyStep
18 | {
19 |     public function process(
20 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
21 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
22 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
23 |         ?string $userHandle,
24 |         string $host
25 |     ): void {
26 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
27 |             trigger_deprecation(
28 |                 'web-auth/webauthn-lib',
29 |                 '5.3',
30 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
31 |                 self::class
32 |             );
33 |         }
34 |         if (! $publicKeyCredentialOptions instanceof PublicKeyCredentialRequestOptions) {
35 |             return;
36 |         }
37 |         if (count($publicKeyCredentialOptions->allowCredentials) === 0) {
38 |             return;
39 |         }
40 | 
41 |         foreach ($publicKeyCredentialOptions->allowCredentials as $allowedCredential) {
42 |             if (hash_equals($allowedCredential->id, $credentialRecord->publicKeyCredentialId)) {
43 |                 return;
44 |             }
45 |         }
46 |         throw AuthenticatorResponseVerificationException::create('The credential ID is not allowed.');
47 |     }
48 | }
49 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckExtensions.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticationExtensions\ExtensionOutputCheckerHandler;
 8 | use Webauthn\AuthenticatorAssertionResponse;
 9 | use Webauthn\AuthenticatorAttestationResponse;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final readonly class CheckExtensions implements CeremonyStep
17 | {
18 |     public function __construct(
19 |         private ExtensionOutputCheckerHandler $extensionOutputCheckerHandler,
20 |     ) {
21 |     }
22 | 
23 |     public function process(
24 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
25 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
26 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
27 |         ?string $userHandle,
28 |         string $host
29 |     ): void {
30 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
31 |             trigger_deprecation(
32 |                 'web-auth/webauthn-lib',
33 |                 '5.3',
34 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
35 |                 self::class
36 |             );
37 |         }
38 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
39 |         $extensionsClientOutputs = $authData->extensions;
40 |         if ($extensionsClientOutputs !== null) {
41 |             $this->extensionOutputCheckerHandler->check(
42 |                 $publicKeyCredentialOptions->extensions,
43 |                 $extensionsClientOutputs
44 |             );
45 |         }
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationStatementSupportManager.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | use Webauthn\Exception\InvalidDataException;
 8 | use function array_key_exists;
 9 | use function sprintf;
10 | 
11 | class AttestationStatementSupportManager
12 | {
13 |     /**
14 |      * @param AttestationStatementSupport[] $attestationStatementSupports
15 |      */
16 |     public function __construct(
17 |         private array $attestationStatementSupports = []
18 |     ) {
19 |         $this->add(new NoneAttestationStatementSupport());
20 |         foreach ($attestationStatementSupports as $attestationStatementSupport) {
21 |             if ($attestationStatementSupport instanceof AttestationStatementSupportManagerAwareInterface) {
22 |                 $attestationStatementSupport->setAttestationStatementSupportManager($this);
23 |             }
24 |             $this->add($attestationStatementSupport);
25 |         }
26 |     }
27 | 
28 |     /**
29 |      * @param AttestationStatementSupport[] $attestationStatementSupports
30 |      */
31 |     public static function create(array $attestationStatementSupports = []): self
32 |     {
33 |         return new self($attestationStatementSupports);
34 |     }
35 | 
36 |     public function add(AttestationStatementSupport $attestationStatementSupport): void
37 |     {
38 |         $this->attestationStatementSupports[$attestationStatementSupport->name()] = $attestationStatementSupport;
39 |     }
40 | 
41 |     public function has(string $name): bool
42 |     {
43 |         return array_key_exists($name, $this->attestationStatementSupports);
44 |     }
45 | 
46 |     public function get(string $name): AttestationStatementSupport
47 |     {
48 |         $this->has($name) || throw InvalidDataException::create($name, sprintf(
49 |             'The attestation statement format "%s" is not supported.',
50 |             $name
51 |         ));
52 | 
53 |         return $this->attestationStatementSupports[$name];
54 |     }
55 | }
56 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialOptions.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use InvalidArgumentException;
 8 | use Webauthn\AuthenticationExtensions\AuthenticationExtensions;
 9 | use function in_array;
10 | use function is_string;
11 | use function sprintf;
12 | 
13 | abstract class PublicKeyCredentialOptions
14 | {
15 |     public const HINT_SECURITY_KEY = 'security-key';
16 | 
17 |     public const HINT_CLIENT_DEVICE = 'client-device';
18 | 
19 |     public const HINT_HYBRID = 'hybrid';
20 | 
21 |     public const HINTS = [self::HINT_SECURITY_KEY, self::HINT_CLIENT_DEVICE, self::HINT_HYBRID];
22 | 
23 |     public AuthenticationExtensions $extensions;
24 | 
25 |     /**
26 |      * @param positive-int|null $timeout
27 |      * @param null|AuthenticationExtensions|array<array-key, AuthenticationExtensions> $extensions
28 |      * @param string[] $hints
29 |      * @protected
30 |      */
31 |     public function __construct(
32 |         public string $challenge,
33 |         public null|int $timeout = null,
34 |         null|array|AuthenticationExtensions $extensions = null,
35 |         public array $hints = [],
36 |     ) {
37 |         ($this->timeout === null || $this->timeout > 0) || throw new InvalidArgumentException('Invalid timeout');
38 |         if ($extensions === null) {
39 |             $this->extensions = AuthenticationExtensions::create();
40 |         } elseif ($extensions instanceof AuthenticationExtensions) {
41 |             $this->extensions = $extensions;
42 |         } else {
43 |             $this->extensions = AuthenticationExtensions::create($extensions);
44 |         }
45 | 
46 |         foreach ($this->hints as $hint) {
47 |             is_string($hint) || throw new InvalidArgumentException('Invalid hint: hints must be strings');
48 |             in_array($hint, self::HINTS, true) || throw new InvalidArgumentException(
49 |                 sprintf('Invalid hint "%s". Allowed values are: %s', $hint, implode(', ', self::HINTS))
50 |             );
51 |         }
52 |     }
53 | }
54 | 


--------------------------------------------------------------------------------
/src/Util/CoseSignatureFixer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Util;
 6 | 
 7 | use Cose\Algorithm\Signature\ECDSA\ECSignature;
 8 | use Cose\Algorithm\Signature\ECDSA\ES256;
 9 | use Cose\Algorithm\Signature\ECDSA\ES256K;
10 | use Cose\Algorithm\Signature\ECDSA\ES384;
11 | use Cose\Algorithm\Signature\ECDSA\ES512;
12 | use Cose\Algorithm\Signature\Signature;
13 | use function strlen;
14 | 
15 | /**
16 |  * This class fixes the signature of the ECDSA based algorithms.
17 |  *
18 |  * @internal
19 |  *
20 |  * @see https://www.w3.org/TR/webauthn/#signature-attestation-types
21 |  */
22 | final readonly class CoseSignatureFixer
23 | {
24 |     private const ES256_SIGNATURE_LENGTH = 64;
25 | 
26 |     private const ES384_SIGNATURE_LENGTH = 96;
27 | 
28 |     private const ES512_SIGNATURE_LENGTH = 132;
29 | 
30 |     public static function fix(string $signature, Signature $algorithm): string
31 |     {
32 |         switch ($algorithm::identifier()) {
33 |             case ES256K::ID:
34 |             case ES256::ID:
35 |                 if (strlen($signature) === self::ES256_SIGNATURE_LENGTH) {
36 |                     return $signature;
37 |                 }
38 | 
39 |                 return ECSignature::fromAsn1(
40 |                     $signature,
41 |                     self::ES256_SIGNATURE_LENGTH
42 |                 ); //TODO: fix this hardcoded value by adding a dedicated method for the algorithms
43 |             case ES384::ID:
44 |                 if (strlen($signature) === self::ES384_SIGNATURE_LENGTH) {
45 |                     return $signature;
46 |                 }
47 | 
48 |                 return ECSignature::fromAsn1($signature, self::ES384_SIGNATURE_LENGTH);
49 |             case ES512::ID:
50 |                 if (strlen($signature) === self::ES512_SIGNATURE_LENGTH) {
51 |                     return $signature;
52 |                 }
53 | 
54 |                 return ECSignature::fromAsn1($signature, self::ES512_SIGNATURE_LENGTH);
55 |         }
56 | 
57 |         return $signature;
58 |     }
59 | }
60 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "web-auth/webauthn-lib",
 3 |     "type": "library",
 4 |     "license": "MIT",
 5 |     "description": "FIDO2/Webauthn Support For PHP",
 6 |     "keywords": [
 7 |         "FIDO",
 8 |         "FIDO2",
 9 |         "webauthn"
10 |     ],
11 |     "homepage": "https://github.com/web-auth",
12 |     "authors": [
13 |         {
14 |             "name": "Florent Morselli",
15 |             "homepage": "https://github.com/Spomky"
16 |         },
17 |         {
18 |             "name": "All contributors",
19 |             "homepage": "https://github.com/web-auth/webauthn-library/contributors"
20 |         }
21 |     ],
22 |     "require": {
23 |         "php": ">=8.2",
24 |         "ext-json": "*",
25 |         "ext-openssl": "*",
26 |         "paragonie/constant_time_encoding": "^2.6|^3.0",
27 |         "phpdocumentor/reflection-docblock": "^5.3",
28 |         "psr/clock": "^1.0",
29 |         "psr/event-dispatcher": "^1.0",
30 |         "psr/log": "^1.0|^2.0|^3.0",
31 |         "spomky-labs/cbor-php": "^3.0",
32 |         "symfony/clock": "^6.4|^7.0|^8.0",
33 |         "symfony/uid": "^6.4|^7.0|^8.0",
34 |         "spomky-labs/pki-framework": "^1.0",
35 |         "symfony/property-info": "^6.4|^7.0|^8.0",
36 |         "symfony/property-access": "^6.4|^7.0|^8.0",
37 |         "symfony/serializer": "^6.4|^7.0|^8.0",
38 |         "symfony/deprecation-contracts": "^3.2",
39 |         "web-auth/cose-lib": "^4.2.3"
40 |     },
41 |     "autoload": {
42 |         "psr-4": {
43 |             "Webauthn\\": "src/"
44 |         }
45 |     },
46 |     "extra": {
47 |         "thanks": {
48 |             "name": "web-auth/webauthn-framework",
49 |             "url": "https://github.com/web-auth/webauthn-framework"
50 |         }
51 |     },
52 |     "suggest": {
53 |         "psr/log-implementation": "Recommended to receive logs from the library",
54 |         "symfony/event-dispatcher": "Recommended to use dispatched events",
55 |         "web-token/jwt-library": "Mandatory for fetching Metadata Statement from distant sources"
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckClientDataCollectorType.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\ClientDataCollector\ClientDataCollectorManager;
10 | use Webauthn\ClientDataCollector\WebauthnAuthenticationCollector;
11 | use Webauthn\CredentialRecord;
12 | use Webauthn\PublicKeyCredentialCreationOptions;
13 | use Webauthn\PublicKeyCredentialRequestOptions;
14 | use Webauthn\PublicKeyCredentialSource;
15 | use function trigger_deprecation;
16 | 
17 | final readonly class CheckClientDataCollectorType implements CeremonyStep
18 | {
19 |     private ClientDataCollectorManager $clientDataCollectorManager;
20 | 
21 |     public function __construct(null|ClientDataCollectorManager $clientDataCollectorManager = null)
22 |     {
23 |         $this->clientDataCollectorManager = $clientDataCollectorManager ?? new ClientDataCollectorManager([
24 |             new WebauthnAuthenticationCollector(),
25 |         ]);
26 |     }
27 | 
28 |     public function process(
29 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
30 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
31 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
32 |         ?string $userHandle,
33 |         string $host
34 |     ): void {
35 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
36 |             trigger_deprecation(
37 |                 'web-auth/webauthn-lib',
38 |                 '5.3',
39 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
40 |                 self::class
41 |             );
42 |         }
43 |         $this->clientDataCollectorManager->collect(
44 |             $authenticatorResponse->clientDataJSON,
45 |             $publicKeyCredentialOptions,
46 |             $authenticatorResponse,
47 |             $host
48 |         );
49 |     }
50 | }
51 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckTopOrigin.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | class CheckTopOrigin implements CeremonyStep
17 | {
18 |     public function __construct(
19 |         private readonly null|TopOriginValidator $topOriginValidator = null
20 |     ) {
21 |     }
22 | 
23 |     public function process(
24 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
25 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
26 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
27 |         ?string $userHandle,
28 |         string $host
29 |     ): void {
30 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
31 |             trigger_deprecation(
32 |                 'web-auth/webauthn-lib',
33 |                 '5.3',
34 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
35 |                 self::class
36 |             );
37 |         }
38 |         $topOrigin = $authenticatorResponse->clientDataJSON->topOrigin;
39 |         if ($topOrigin === null) {
40 |             return;
41 |         }
42 |         if ($authenticatorResponse->clientDataJSON->crossOrigin !== true) {
43 |             throw AuthenticatorResponseVerificationException::create('The response is not cross-origin.');
44 |         }
45 |         if ($this->topOriginValidator === null) {
46 |             (new HostTopOriginValidator($host))->validate($topOrigin);
47 |         } else {
48 |             $this->topOriginValidator->validate($topOrigin);
49 |         }
50 |     }
51 | }
52 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/StatusReport.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | use function in_array;
 9 | 
10 | readonly class StatusReport
11 | {
12 |     /**
13 |      * @see AuthenticatorStatus
14 |      */
15 |     public function __construct(
16 |         public string $status,
17 |         public ?string $effectiveDate,
18 |         public ?string $certificate,
19 |         public ?string $url,
20 |         public ?string $certificationDescriptor,
21 |         public ?string $certificateNumber,
22 |         public ?string $certificationPolicyVersion,
23 |         public ?string $certificationRequirementsVersion
24 |     ) {
25 |         in_array($status, AuthenticatorStatus::STATUSES, true) || throw MetadataStatementLoadingException::create(
26 |             'The value of the key "status" is not acceptable'
27 |         );
28 |     }
29 | 
30 |     public static function create(
31 |         string $status,
32 |         ?string $effectiveDate,
33 |         ?string $certificate,
34 |         ?string $url,
35 |         ?string $certificationDescriptor,
36 |         ?string $certificateNumber,
37 |         ?string $certificationPolicyVersion,
38 |         ?string $certificationRequirementsVersion
39 |     ): self {
40 |         return new self(
41 |             $status,
42 |             $effectiveDate,
43 |             $certificate,
44 |             $url,
45 |             $certificationDescriptor,
46 |             $certificateNumber,
47 |             $certificationPolicyVersion,
48 |             $certificationRequirementsVersion
49 |         );
50 |     }
51 | 
52 |     public function isCompromised(): bool
53 |     {
54 |         return in_array($this->status, [
55 |             AuthenticatorStatus::ATTESTATION_KEY_COMPROMISE,
56 |             AuthenticatorStatus::USER_KEY_PHYSICAL_COMPROMISE,
57 |             AuthenticatorStatus::USER_KEY_REMOTE_COMPROMISE,
58 |             AuthenticatorStatus::USER_VERIFICATION_BYPASS,
59 |         ], true);
60 |     }
61 | }
62 | 


--------------------------------------------------------------------------------
/src/Denormalizer/UrlNormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 9 | use Throwable;
10 | use Webauthn\Url;
11 | use function assert;
12 | use function filter_var;
13 | use const FILTER_VALIDATE_URL;
14 | 
15 | /**
16 |  * Normalizes Url objects to absolute HTTPS URLs.
17 |  * Either returns the URL directly if already absolute, or generates it from a Symfony route.
18 |  */
19 | final readonly class UrlNormalizer implements NormalizerInterface
20 | {
21 |     public function __construct(
22 |         private ?UrlGeneratorInterface $urlGenerator = null,
23 |     ) {
24 |     }
25 | 
26 |     public function normalize(mixed $data, ?string $format = null, array $context = []): string
27 |     {
28 |         assert($data instanceof Url);
29 | 
30 |         // If no URL generator available, return the path as-is
31 |         if ($this->urlGenerator === null) {
32 |             return $data->path;
33 |         }
34 | 
35 |         // If the path is already a valid absolute URL (https://...), return it directly
36 |         if (filter_var($data->path, FILTER_VALIDATE_URL) !== false) {
37 |             return $data->path;
38 |         }
39 | 
40 |         // Otherwise, try to generate an absolute URL from a Symfony route name
41 |         try {
42 |             return $this->urlGenerator->generate($data->path, $data->params, UrlGeneratorInterface::ABSOLUTE_URL);
43 |         } catch (Throwable) {
44 |             // If the URL cannot be generated, return the path as is
45 |             return $data->path;
46 |         }
47 |     }
48 | 
49 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
50 |     {
51 |         return $data instanceof Url;
52 |     }
53 | 
54 |     /**
55 |      * @return array<class-string, bool>
56 |      */
57 |     public function getSupportedTypes(?string $format): array
58 |     {
59 |         return [
60 |             Url::class => true,
61 |         ];
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckUserVerification.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\AuthenticatorSelectionCriteria;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
12 | use Webauthn\PublicKeyCredentialCreationOptions;
13 | use Webauthn\PublicKeyCredentialRequestOptions;
14 | use Webauthn\PublicKeyCredentialSource;
15 | use function trigger_deprecation;
16 | 
17 | final class CheckUserVerification implements CeremonyStep
18 | {
19 |     public function process(
20 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
21 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
22 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
23 |         ?string $userHandle,
24 |         string $host
25 |     ): void {
26 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
27 |             trigger_deprecation(
28 |                 'web-auth/webauthn-lib',
29 |                 '5.3',
30 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
31 |                 self::class
32 |             );
33 |         }
34 |         $userVerification = $publicKeyCredentialOptions instanceof PublicKeyCredentialRequestOptions ? $publicKeyCredentialOptions->userVerification : $publicKeyCredentialOptions->authenticatorSelection?->userVerification;
35 |         if ($userVerification !== AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_REQUIRED) {
36 |             return;
37 |         }
38 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
39 |         $authData->isUserVerified() || throw AuthenticatorResponseVerificationException::create(
40 |             'User authentication required.'
41 |         );
42 |     }
43 | }
44 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/DisplayPNGCharacteristicsDescriptor.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | 
 9 | class DisplayPNGCharacteristicsDescriptor
10 | {
11 |     /**
12 |      * @param RgbPaletteEntry[] $plte
13 |      */
14 |     public function __construct(
15 |         public readonly int $width,
16 |         public readonly int $height,
17 |         public readonly int $bitDepth,
18 |         public readonly int $colorType,
19 |         public readonly int $compression,
20 |         public readonly int $filter,
21 |         public readonly int $interlace,
22 |         /**
23 |          * @readonly
24 |          */
25 |         public array $plte = [],
26 |     ) {
27 |         $width >= 0 || throw MetadataStatementLoadingException::create('Invalid width');
28 |         $height >= 0 || throw MetadataStatementLoadingException::create('Invalid height');
29 |         ($bitDepth >= 0 && $bitDepth <= 254) || throw MetadataStatementLoadingException::create('Invalid bit depth');
30 |         ($colorType >= 0 && $colorType <= 254) || throw MetadataStatementLoadingException::create(
31 |             'Invalid color type'
32 |         );
33 |         ($compression >= 0 && $compression <= 254) || throw MetadataStatementLoadingException::create(
34 |             'Invalid compression'
35 |         );
36 |         ($filter >= 0 && $filter <= 254) || throw MetadataStatementLoadingException::create('Invalid filter');
37 |         ($interlace >= 0 && $interlace <= 254) || throw MetadataStatementLoadingException::create(
38 |             'Invalid interlace'
39 |         );
40 |     }
41 | 
42 |     /**
43 |      * @param RgbPaletteEntry[] $plte
44 |      */
45 |     public static function create(
46 |         int $width,
47 |         int $height,
48 |         int $bitDepth,
49 |         int $colorType,
50 |         int $compression,
51 |         int $filter,
52 |         int $interlace,
53 |         array $plte = []
54 |     ): self {
55 |         return new self($width, $height, $bitDepth, $colorType, $compression, $filter, $interlace, $plte);
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/src/Denormalizer/SignalAllAcceptedCredentialsDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\PublicKeyCredentialDescriptor;
11 | use Webauthn\Signal\AllAcceptedCredentials;
12 | use function assert;
13 | 
14 | class SignalAllAcceptedCredentialsDenormalizer implements NormalizerInterface, NormalizerAwareInterface
15 | {
16 |     use NormalizerAwareTrait;
17 | 
18 |     /**
19 |      * @return array<class-string, bool>
20 |      */
21 |     public function getSupportedTypes(?string $format): array
22 |     {
23 |         return [
24 |             AllAcceptedCredentials::class => true,
25 |         ];
26 |     }
27 | 
28 |     /**
29 |      * @return array<string, mixed>
30 |      */
31 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
32 |     {
33 |         assert($data instanceof AllAcceptedCredentials);
34 | 
35 |         $normalized_rp = $this->normalizer->normalize($data->rp, $format, $context);
36 | 
37 |         $normalized_user = $this->normalizer->normalize($data->user, $format, $context);
38 | 
39 |         $normalized_credentials = array_map(
40 |             fn (PublicKeyCredentialDescriptor $credential) => $this->normalizer->normalize(
41 |                 $credential,
42 |                 $format,
43 |                 $context
44 |             ),
45 |             $data->allAcceptedCredentials
46 |         );
47 | 
48 |         return [
49 |             'rpId' => $normalized_rp['id'],
50 |             'userId' => $normalized_user['id'],
51 |             'allAcceptedCredentialIds' => array_map(
52 |                 fn (array $credential): string => $credential['id'],
53 |                 $normalized_credentials
54 |             ),
55 |         ];
56 |     }
57 | 
58 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
59 |     {
60 |         return $data instanceof AllAcceptedCredentials;
61 |     }
62 | }
63 | 


--------------------------------------------------------------------------------
/src/Denormalizer/PublicKeyCredentialUserEntityDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 9 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
10 | use Webauthn\PublicKeyCredentialUserEntity;
11 | use Webauthn\Util\Base64;
12 | use function array_key_exists;
13 | use function assert;
14 | 
15 | final class PublicKeyCredentialUserEntityDenormalizer implements DenormalizerInterface, NormalizerInterface
16 | {
17 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
18 |     {
19 |         if (! array_key_exists('id', $data)) {
20 |             return $data;
21 |         }
22 |         $data['id'] = Base64::decode($data['id']);
23 | 
24 |         return PublicKeyCredentialUserEntity::create($data['name'], $data['id'], $data['displayName']);
25 |     }
26 | 
27 |     public function supportsDenormalization(
28 |         mixed $data,
29 |         string $type,
30 |         ?string $format = null,
31 |         array $context = []
32 |     ): bool {
33 |         return $type === PublicKeyCredentialUserEntity::class;
34 |     }
35 | 
36 |     /**
37 |      * @return array<class-string, bool>
38 |      */
39 |     public function getSupportedTypes(?string $format): array
40 |     {
41 |         return [
42 |             PublicKeyCredentialUserEntity::class => true,
43 |         ];
44 |     }
45 | 
46 |     /**
47 |      * @return array<string, mixed>
48 |      */
49 |     public function normalize(mixed $object, ?string $format = null, array $context = []): array
50 |     {
51 |         assert($object instanceof PublicKeyCredentialUserEntity);
52 |         return [
53 |             'id' => Base64UrlSafe::encodeUnpadded($object->id),
54 |             'name' => $object->name,
55 |             'displayName' => $object->displayName,
56 |         ];
57 |     }
58 | 
59 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
60 |     {
61 |         return $data instanceof PublicKeyCredentialUserEntity;
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckUserHandle.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\InvalidUserHandleException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | final class CheckUserHandle implements CeremonyStep
17 | {
18 |     public function process(
19 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
20 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
21 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
22 |         ?string $userHandle,
23 |         string $host
24 |     ): void {
25 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
26 |             trigger_deprecation(
27 |                 'web-auth/webauthn-lib',
28 |                 '5.3',
29 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
30 |                 self::class
31 |             );
32 |         }
33 |         if (! $authenticatorResponse instanceof AuthenticatorAssertionResponse) {
34 |             return;
35 |         }
36 |         $credentialUserHandle = $credentialRecord->userHandle;
37 |         $responseUserHandle = $authenticatorResponse->userHandle;
38 |         if ($userHandle !== null) { //If the user was identified before the authentication ceremony was initiated,
39 |             $credentialUserHandle === $userHandle || throw InvalidUserHandleException::create();
40 |             if ($responseUserHandle !== null && $responseUserHandle !== '') {
41 |                 $credentialUserHandle === $responseUserHandle || throw InvalidUserHandleException::create();
42 |             }
43 |         } else {
44 |             ($responseUserHandle !== '' && $credentialUserHandle === $responseUserHandle) || throw InvalidUserHandleException::create();
45 |         }
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AuthenticatorAttestationResponseDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
10 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
11 | use Webauthn\AttestationStatement\AttestationObject;
12 | use Webauthn\AuthenticatorAttestationResponse;
13 | use Webauthn\CollectedClientData;
14 | use Webauthn\Util\Base64;
15 | 
16 | final class AuthenticatorAttestationResponseDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
17 | {
18 |     use DenormalizerAwareTrait;
19 | 
20 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
21 |     {
22 |         $data['clientDataJSON'] = Base64UrlSafe::decodeNoPadding($data['clientDataJSON']);
23 |         $data['attestationObject'] = Base64::decode($data['attestationObject']);
24 | 
25 |         $clientDataJSON = $this->denormalizer->denormalize(
26 |             $data['clientDataJSON'],
27 |             CollectedClientData::class,
28 |             $format,
29 |             $context
30 |         );
31 |         $attestationObject = $this->denormalizer->denormalize(
32 |             $data['attestationObject'],
33 |             AttestationObject::class,
34 |             $format,
35 |             $context
36 |         );
37 | 
38 |         return AuthenticatorAttestationResponse::create(
39 |             $clientDataJSON,
40 |             $attestationObject,
41 |             $data['transports'] ?? [],
42 |         );
43 |     }
44 | 
45 |     public function supportsDenormalization(
46 |         mixed $data,
47 |         string $type,
48 |         ?string $format = null,
49 |         array $context = []
50 |     ): bool {
51 |         return $type === AuthenticatorAttestationResponse::class;
52 |     }
53 | 
54 |     /**
55 |      * @return array<class-string, bool>
56 |      */
57 |     public function getSupportedTypes(?string $format): array
58 |     {
59 |         return [
60 |             AuthenticatorAttestationResponse::class => true,
61 |         ];
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/src/MetadataService/Statement/AuthenticatorStatus.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Statement;
 6 | 
 7 | final class AuthenticatorStatus
 8 | {
 9 |     final public const NOT_FIDO_CERTIFIED = 'NOT_FIDO_CERTIFIED';
10 | 
11 |     final public const FIDO_CERTIFIED = 'FIDO_CERTIFIED';
12 | 
13 |     final public const USER_VERIFICATION_BYPASS = 'USER_VERIFICATION_BYPASS';
14 | 
15 |     final public const ATTESTATION_KEY_COMPROMISE = 'ATTESTATION_KEY_COMPROMISE';
16 | 
17 |     final public const USER_KEY_REMOTE_COMPROMISE = 'USER_KEY_REMOTE_COMPROMISE';
18 | 
19 |     final public const USER_KEY_PHYSICAL_COMPROMISE = 'USER_KEY_PHYSICAL_COMPROMISE';
20 | 
21 |     final public const UPDATE_AVAILABLE = 'UPDATE_AVAILABLE';
22 | 
23 |     final public const REVOKED = 'REVOKED';
24 | 
25 |     final public const SELF_ASSERTION_SUBMITTED = 'SELF_ASSERTION_SUBMITTED';
26 | 
27 |     final public const FIDO_CERTIFIED_L1 = 'FIDO_CERTIFIED_L1';
28 | 
29 |     final public const FIDO_CERTIFIED_L1plus = 'FIDO_CERTIFIED_L1plus';
30 | 
31 |     final public const FIDO_CERTIFIED_L2 = 'FIDO_CERTIFIED_L2';
32 | 
33 |     final public const FIDO_CERTIFIED_L2plus = 'FIDO_CERTIFIED_L2plus';
34 | 
35 |     final public const FIDO_CERTIFIED_L3 = 'FIDO_CERTIFIED_L3';
36 | 
37 |     final public const FIDO_CERTIFIED_L3plus = 'FIDO_CERTIFIED_L3plus';
38 | 
39 |     final public const FIDO_CERTIFIED_L4 = 'FIDO_CERTIFIED_L4';
40 | 
41 |     final public const FIDO_CERTIFIED_L5 = 'FIDO_CERTIFIED_L5';
42 | 
43 |     final public const STATUSES = [
44 |         self::NOT_FIDO_CERTIFIED,
45 |         self::FIDO_CERTIFIED,
46 |         self::USER_VERIFICATION_BYPASS,
47 |         self::ATTESTATION_KEY_COMPROMISE,
48 |         self::USER_KEY_REMOTE_COMPROMISE,
49 |         self::USER_KEY_PHYSICAL_COMPROMISE,
50 |         self::UPDATE_AVAILABLE,
51 |         self::REVOKED,
52 |         self::SELF_ASSERTION_SUBMITTED,
53 |         self::FIDO_CERTIFIED_L1,
54 |         self::FIDO_CERTIFIED_L1plus,
55 |         self::FIDO_CERTIFIED_L2,
56 |         self::FIDO_CERTIFIED_L2plus,
57 |         self::FIDO_CERTIFIED_L3,
58 |         self::FIDO_CERTIFIED_L3plus,
59 |         self::FIDO_CERTIFIED_L4,
60 |         self::FIDO_CERTIFIED_L5,
61 |     ];
62 | }
63 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckUserWasPresent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticatorAssertionResponse;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
11 | use Webauthn\PublicKeyCredentialCreationOptions;
12 | use Webauthn\PublicKeyCredentialRequestOptions;
13 | use Webauthn\PublicKeyCredentialSource;
14 | use function trigger_deprecation;
15 | 
16 | /**
17 |  * Conditional check for user presence
18 |  *
19 |  * This step allows user presence to be false for Conditional Create scenarios
20 |  * where mediation: 'conditional' is used (e.g., auto-register after password login).
21 |  *
22 |  * @see https://github.com/w3c/webauthn/wiki/Explainer:-Conditional-Create
23 |  */
24 | final readonly class CheckUserWasPresent implements CeremonyStep
25 | {
26 |     public function __construct(
27 |         private bool $requireUserPresence = true
28 |     ) {
29 |     }
30 | 
31 |     public function process(
32 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
33 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
34 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
35 |         ?string $userHandle,
36 |         string $host
37 |     ): void {
38 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
39 |             trigger_deprecation(
40 |                 'web-auth/webauthn-lib',
41 |                 '5.3',
42 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
43 |                 self::class
44 |             );
45 |         }
46 |         if (! $this->requireUserPresence) {
47 |             return;
48 |         }
49 | 
50 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse
51 |             ? $authenticatorResponse->authenticatorData
52 |             : $authenticatorResponse->attestationObject->authData;
53 | 
54 |         $authData->isUserPresent() || throw AuthenticatorResponseVerificationException::create(
55 |             'User was not present'
56 |         );
57 |     }
58 | }
59 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/InMemoryMetadataService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use Psr\EventDispatcher\EventDispatcherInterface;
 8 | use Webauthn\Event\CanDispatchEvents;
 9 | use Webauthn\Event\MetadataStatementFound;
10 | use Webauthn\Event\NullEventDispatcher;
11 | use Webauthn\Exception\MissingMetadataStatementException;
12 | use Webauthn\MetadataService\Statement\MetadataStatement;
13 | use function array_key_exists;
14 | 
15 | final class InMemoryMetadataService implements MetadataService, CanDispatchEvents
16 | {
17 |     /**
18 |      * @var MetadataStatement[]
19 |      */
20 |     private array $statements = [];
21 | 
22 |     private EventDispatcherInterface $dispatcher;
23 | 
24 |     public function __construct(MetadataStatement ...$statements)
25 |     {
26 |         foreach ($statements as $statement) {
27 |             $this->addStatements($statement);
28 |         }
29 |         $this->dispatcher = new NullEventDispatcher();
30 |     }
31 | 
32 |     public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): void
33 |     {
34 |         $this->dispatcher = $eventDispatcher;
35 |     }
36 | 
37 |     public static function create(MetadataStatement ...$statements): self
38 |     {
39 |         return new self(...$statements);
40 |     }
41 | 
42 |     public function addStatements(MetadataStatement ...$statements): self
43 |     {
44 |         foreach ($statements as $statement) {
45 |             $aaguid = $statement->aaguid;
46 |             if ($aaguid === null) {
47 |                 continue;
48 |             }
49 |             $this->statements[$aaguid] = $statement;
50 |         }
51 | 
52 |         return $this;
53 |     }
54 | 
55 |     public function list(): iterable
56 |     {
57 |         yield from array_keys($this->statements);
58 |     }
59 | 
60 |     public function has(string $aaguid): bool
61 |     {
62 |         return array_key_exists($aaguid, $this->statements);
63 |     }
64 | 
65 |     public function get(string $aaguid): MetadataStatement
66 |     {
67 |         array_key_exists($aaguid, $this->statements) || throw MissingMetadataStatementException::create($aaguid);
68 |         $mds = $this->statements[$aaguid];
69 |         $this->dispatcher->dispatch(MetadataStatementFound::create($mds));
70 | 
71 |         return $mds;
72 |     }
73 | }
74 | 


--------------------------------------------------------------------------------
/src/Event/BackupEligibilityChangedEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use LogicException;
 8 | use Webauthn\CredentialRecord;
 9 | use Webauthn\PublicKeyCredentialSource;
10 | use function sprintf;
11 | 
12 | /**
13 |  * Event dispatched when the backup eligibility flag (BE) changes.
14 |  *
15 |  * The BE flag indicates whether the authenticator is capable of backing up
16 |  * the credential. A change in this flag may indicate device capabilities have changed.
17 |  */
18 | final readonly class BackupEligibilityChangedEvent implements WebauthnEvent
19 | {
20 |     public function __construct(
21 |         public CredentialRecord|PublicKeyCredentialSource $credentialRecord,
22 |         public ?bool $previousValue,
23 |         public ?bool $newValue
24 |     ) {
25 |     }
26 | 
27 |     /**
28 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
29 |      */
30 |     public function __get(string $name): mixed
31 |     {
32 |         if ($name === 'publicKeyCredentialSource') {
33 |             return $this->getPublicKeyCredentialSource();
34 |         }
35 | 
36 |         throw new LogicException(sprintf('Undefined property: %s::$%s', self::class, $name));
37 |     }
38 | 
39 |     /**
40 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
41 |      */
42 |     public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
43 |     {
44 |         if ($this->credentialRecord instanceof PublicKeyCredentialSource) {
45 |             return $this->credentialRecord;
46 |         }
47 | 
48 |         return PublicKeyCredentialSource::create(
49 |             $this->credentialRecord->publicKeyCredentialId,
50 |             $this->credentialRecord->type,
51 |             $this->credentialRecord->transports,
52 |             $this->credentialRecord->attestationType,
53 |             $this->credentialRecord->trustPath,
54 |             $this->credentialRecord->aaguid,
55 |             $this->credentialRecord->credentialPublicKey,
56 |             $this->credentialRecord->userHandle,
57 |             $this->credentialRecord->counter,
58 |             $this->credentialRecord->otherUI,
59 |             $this->credentialRecord->backupEligible,
60 |             $this->credentialRecord->backupStatus,
61 |             $this->credentialRecord->uvInitialized,
62 |         );
63 |     }
64 | }
65 | 


--------------------------------------------------------------------------------
/src/Denormalizer/TrustPathDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 9 | use Webauthn\Exception\InvalidTrustPathException;
10 | use Webauthn\TrustPath\CertificateTrustPath;
11 | use Webauthn\TrustPath\EmptyTrustPath;
12 | use Webauthn\TrustPath\TrustPath;
13 | use function array_key_exists;
14 | use function assert;
15 | use function is_array;
16 | 
17 | final class TrustPathDenormalizer implements DenormalizerInterface, NormalizerInterface
18 | {
19 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
20 |     {
21 |         return match (true) {
22 |             array_key_exists('x5c', $data) && is_array($data['x5c']) => CertificateTrustPath::create($data['x5c']),
23 |             $data === [], isset($data['type']) && $data['type'] === EmptyTrustPath::class => EmptyTrustPath::create(),
24 |             default => throw new InvalidTrustPathException('Unsupported trust path type'),
25 |         };
26 |     }
27 | 
28 |     public function supportsDenormalization(
29 |         mixed $data,
30 |         string $type,
31 |         ?string $format = null,
32 |         array $context = []
33 |     ): bool {
34 |         return $type === TrustPath::class;
35 |     }
36 | 
37 |     /**
38 |      * @return array<class-string, bool>
39 |      */
40 |     public function getSupportedTypes(?string $format): array
41 |     {
42 |         return [
43 |             TrustPath::class => true,
44 |         ];
45 |     }
46 | 
47 |     /**
48 |      * @return array<string, mixed>
49 |      */
50 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
51 |     {
52 |         assert($data instanceof TrustPath);
53 |         return match (true) {
54 |             $data instanceof CertificateTrustPath => [
55 |                 'x5c' => $data->certificates,
56 |             ],
57 |             $data instanceof EmptyTrustPath => [],
58 |             default => throw new InvalidTrustPathException('Unsupported trust path type'),
59 |         };
60 |     }
61 | 
62 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
63 |     {
64 |         return $data instanceof TrustPath;
65 |     }
66 | }
67 | 


--------------------------------------------------------------------------------
/src/SimpleFakeCredentialGenerator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Psr\Cache\CacheItemPoolInterface;
 8 | use Symfony\Component\HttpFoundation\Request;
 9 | use function count;
10 | use function is_int;
11 | 
12 | final readonly class SimpleFakeCredentialGenerator implements FakeCredentialGenerator
13 | {
14 |     public function __construct(
15 |         private null|CacheItemPoolInterface $cache = null
16 |     ) {
17 |     }
18 | 
19 |     /**
20 |      * @return PublicKeyCredentialDescriptor[]
21 |      */
22 |     public function generate(Request $request, string $username): array
23 |     {
24 |         if ($this->cache === null) {
25 |             return $this->generateCredentials($username);
26 |         }
27 | 
28 |         $cacheKey = 'fake_credentials_' . hash('xxh128', $username);
29 |         $cacheItem = $this->cache->getItem($cacheKey);
30 |         if ($cacheItem->isHit()) {
31 |             return $cacheItem->get();
32 |         }
33 | 
34 |         $credentials = $this->generateCredentials($username);
35 |         $cacheItem->set($credentials);
36 |         $this->cache->save($cacheItem);
37 | 
38 |         return $credentials;
39 |     }
40 | 
41 |     /**
42 |      * @return PublicKeyCredentialDescriptor[]
43 |      */
44 |     private function generateCredentials(string $username): array
45 |     {
46 |         $transports = [
47 |             PublicKeyCredentialDescriptor::AUTHENTICATOR_TRANSPORT_USB,
48 |             PublicKeyCredentialDescriptor::AUTHENTICATOR_TRANSPORT_NFC,
49 |             PublicKeyCredentialDescriptor::AUTHENTICATOR_TRANSPORT_BLE,
50 |         ];
51 |         $credentials = [];
52 |         for ($i = 0; $i < random_int(1, 3); $i++) {
53 |             $randomTransportKeys = array_rand($transports, random_int(1, count($transports)));
54 |             if (is_int($randomTransportKeys)) {
55 |                 $randomTransportKeys = [$randomTransportKeys];
56 |             }
57 |             $randomTransports = array_values(array_intersect_key($transports, array_flip($randomTransportKeys)));
58 |             $credentials[] = PublicKeyCredentialDescriptor::create(
59 |                 PublicKeyCredentialDescriptor::CREDENTIAL_TYPE_PUBLIC_KEY,
60 |                 hash('sha256', random_bytes(16) . $username),
61 |                 $randomTransports
62 |             );
63 |         }
64 | 
65 |         return $credentials;
66 |     }
67 | }
68 | 


--------------------------------------------------------------------------------
/src/Event/AuthenticatorAttestationResponseValidationSucceededEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use LogicException;
 8 | use Webauthn\AuthenticatorAttestationResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\PublicKeyCredentialCreationOptions;
11 | use Webauthn\PublicKeyCredentialSource;
12 | use function sprintf;
13 | 
14 | class AuthenticatorAttestationResponseValidationSucceededEvent
15 | {
16 |     public function __construct(
17 |         public readonly AuthenticatorAttestationResponse $authenticatorAttestationResponse,
18 |         public readonly PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions,
19 |         public readonly string $host,
20 |         public readonly CredentialRecord|PublicKeyCredentialSource $credentialRecord
21 |     ) {
22 |     }
23 | 
24 |     /**
25 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
26 |      */
27 |     public function __get(string $name): mixed
28 |     {
29 |         if ($name === 'publicKeyCredentialSource') {
30 |             return $this->getPublicKeyCredentialSource();
31 |         }
32 | 
33 |         throw new LogicException(sprintf('Undefined property: %s::$%s', self::class, $name));
34 |     }
35 | 
36 |     /**
37 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
38 |      */
39 |     public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
40 |     {
41 |         if ($this->credentialRecord instanceof PublicKeyCredentialSource) {
42 |             return $this->credentialRecord;
43 |         }
44 | 
45 |         return PublicKeyCredentialSource::create(
46 |             $this->credentialRecord->publicKeyCredentialId,
47 |             $this->credentialRecord->type,
48 |             $this->credentialRecord->transports,
49 |             $this->credentialRecord->attestationType,
50 |             $this->credentialRecord->trustPath,
51 |             $this->credentialRecord->aaguid,
52 |             $this->credentialRecord->credentialPublicKey,
53 |             $this->credentialRecord->userHandle,
54 |             $this->credentialRecord->counter,
55 |             $this->credentialRecord->otherUI,
56 |             $this->credentialRecord->backupEligible,
57 |             $this->credentialRecord->backupStatus,
58 |             $this->credentialRecord->uvInitialized,
59 |         );
60 |     }
61 | }
62 | 


--------------------------------------------------------------------------------
/src/Event/BackupStatusChangedEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use LogicException;
 8 | use Webauthn\CredentialRecord;
 9 | use Webauthn\PublicKeyCredentialSource;
10 | use function sprintf;
11 | 
12 | /**
13 |  * Event dispatched when the backup status flag (BS) changes.
14 |  *
15 |  * The BS flag indicates whether the credential is currently backed up.
16 |  * A change in this flag, especially from true to false, may indicate
17 |  * that the user should add an additional authenticator for redundancy.
18 |  */
19 | final readonly class BackupStatusChangedEvent implements WebauthnEvent
20 | {
21 |     public function __construct(
22 |         public CredentialRecord|PublicKeyCredentialSource $credentialRecord,
23 |         public ?bool $previousValue,
24 |         public ?bool $newValue
25 |     ) {
26 |     }
27 | 
28 |     /**
29 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
30 |      */
31 |     public function __get(string $name): mixed
32 |     {
33 |         if ($name === 'publicKeyCredentialSource') {
34 |             return $this->getPublicKeyCredentialSource();
35 |         }
36 | 
37 |         throw new LogicException(sprintf('Undefined property: %s::$%s', self::class, $name));
38 |     }
39 | 
40 |     /**
41 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
42 |      */
43 |     public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
44 |     {
45 |         if ($this->credentialRecord instanceof PublicKeyCredentialSource) {
46 |             return $this->credentialRecord;
47 |         }
48 | 
49 |         return PublicKeyCredentialSource::create(
50 |             $this->credentialRecord->publicKeyCredentialId,
51 |             $this->credentialRecord->type,
52 |             $this->credentialRecord->transports,
53 |             $this->credentialRecord->attestationType,
54 |             $this->credentialRecord->trustPath,
55 |             $this->credentialRecord->aaguid,
56 |             $this->credentialRecord->credentialPublicKey,
57 |             $this->credentialRecord->userHandle,
58 |             $this->credentialRecord->counter,
59 |             $this->credentialRecord->otherUI,
60 |             $this->credentialRecord->backupEligible,
61 |             $this->credentialRecord->backupStatus,
62 |             $this->credentialRecord->uvInitialized,
63 |         );
64 |     }
65 | }
66 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/MetadataBLOBPayloadEntry.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use Webauthn\Exception\MetadataStatementLoadingException;
 8 | use Webauthn\MetadataService\Statement\BiometricStatusReport;
 9 | use Webauthn\MetadataService\Statement\MetadataStatement;
10 | use Webauthn\MetadataService\Statement\StatusReport;
11 | use function count;
12 | use function is_string;
13 | 
14 | class MetadataBLOBPayloadEntry
15 | {
16 |     /**
17 |      * @param StatusReport[] $statusReports
18 |      * @param BiometricStatusReport[] $biometricStatusReports
19 |      * @param string[] $attestationCertificateKeyIdentifiers
20 |      */
21 |     public function __construct(
22 |         public readonly string $timeOfLastStatusChange,
23 |         public array $statusReports,
24 |         public readonly ?string $aaid = null,
25 |         public readonly ?string $aaguid = null,
26 |         public array $attestationCertificateKeyIdentifiers = [],
27 |         public readonly ?MetadataStatement $metadataStatement = null,
28 |         public readonly ?string $rogueListURL = null,
29 |         public readonly ?string $rogueListHash = null,
30 |         public array $biometricStatusReports = []
31 |     ) {
32 |         if ($aaid !== null && $aaguid !== null) {
33 |             throw MetadataStatementLoadingException::create('Authenticators cannot support both AAID and AAGUID');
34 |         }
35 |         if ($aaid === null && $aaguid === null && count($attestationCertificateKeyIdentifiers) === 0) {
36 |             throw MetadataStatementLoadingException::create(
37 |                 'If neither AAID nor AAGUID are set, the attestation certificate identifier list shall not be empty'
38 |             );
39 |         }
40 |         foreach ($attestationCertificateKeyIdentifiers as $attestationCertificateKeyIdentifier) {
41 |             is_string($attestationCertificateKeyIdentifier) || throw MetadataStatementLoadingException::create(
42 |                 'Invalid attestation certificate identifier. Shall be a list of strings'
43 |             );
44 |             preg_match(
45 |                 '/^[0-9a-f]+$/',
46 |                 $attestationCertificateKeyIdentifier
47 |             ) === 1 || throw MetadataStatementLoadingException::create(
48 |                 'Invalid attestation certificate identifier. Shall be a list of strings'
49 |             );
50 |         }
51 |     }
52 | }
53 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AuthenticationExtensionsDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 8 | use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 9 | use Webauthn\AuthenticationExtensions\AuthenticationExtension;
10 | use Webauthn\AuthenticationExtensions\AuthenticationExtensions;
11 | use function assert;
12 | use function is_array;
13 | use function is_string;
14 | 
15 | final class AuthenticationExtensionsDenormalizer implements DenormalizerInterface, NormalizerInterface
16 | {
17 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
18 |     {
19 |         if ($data instanceof AuthenticationExtensions) {
20 |             return AuthenticationExtensions::create($data->extensions);
21 |         }
22 |         assert(is_array($data), 'The data should be an array.');
23 |         foreach ($data as $key => $value) {
24 |             if (! is_string($key)) {
25 |                 continue;
26 |             }
27 |             $data[$key] = AuthenticationExtension::create($key, $value);
28 |         }
29 | 
30 |         return AuthenticationExtensions::create($data);
31 |     }
32 | 
33 |     public function supportsDenormalization(
34 |         mixed $data,
35 |         string $type,
36 |         ?string $format = null,
37 |         array $context = []
38 |     ): bool {
39 |         return $type === AuthenticationExtensions::class;
40 |     }
41 | 
42 |     /**
43 |      * @return array<class-string, bool>
44 |      */
45 |     public function getSupportedTypes(?string $format): array
46 |     {
47 |         return [
48 |             AuthenticationExtensions::class => true,
49 |         ];
50 |     }
51 | 
52 |     /**
53 |      * @return array<string, mixed>
54 |      */
55 |     public function normalize(mixed $data, ?string $format = null, array $context = []): array
56 |     {
57 |         assert($data instanceof AuthenticationExtensions);
58 |         $extensions = [];
59 |         foreach ($data->extensions as $extension) {
60 |             $extensions[$extension->name] = $extension->value;
61 |         }
62 | 
63 |         return $extensions;
64 |     }
65 | 
66 |     public function supportsNormalization(mixed $data, ?string $format = null, array $context = []): bool
67 |     {
68 |         return $data instanceof AuthenticationExtensions;
69 |     }
70 | }
71 | 


--------------------------------------------------------------------------------
/src/Event/AuthenticatorAssertionResponseValidationSucceededEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use LogicException;
 8 | use Webauthn\AuthenticatorAssertionResponse;
 9 | use Webauthn\CredentialRecord;
10 | use Webauthn\PublicKeyCredentialRequestOptions;
11 | use Webauthn\PublicKeyCredentialSource;
12 | use function sprintf;
13 | 
14 | class AuthenticatorAssertionResponseValidationSucceededEvent
15 | {
16 |     public function __construct(
17 |         public readonly AuthenticatorAssertionResponse $authenticatorAssertionResponse,
18 |         public readonly PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions,
19 |         public readonly string $host,
20 |         public readonly ?string $userHandle,
21 |         public readonly CredentialRecord|PublicKeyCredentialSource $credentialRecord
22 |     ) {
23 |     }
24 | 
25 |     /**
26 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
27 |      */
28 |     public function __get(string $name): mixed
29 |     {
30 |         if ($name === 'publicKeyCredentialSource') {
31 |             return $this->getPublicKeyCredentialSource();
32 |         }
33 | 
34 |         throw new LogicException(sprintf('Undefined property: %s::$%s', self::class, $name));
35 |     }
36 | 
37 |     /**
38 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
39 |      */
40 |     public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
41 |     {
42 |         if ($this->credentialRecord instanceof PublicKeyCredentialSource) {
43 |             return $this->credentialRecord;
44 |         }
45 | 
46 |         return PublicKeyCredentialSource::create(
47 |             $this->credentialRecord->publicKeyCredentialId,
48 |             $this->credentialRecord->type,
49 |             $this->credentialRecord->transports,
50 |             $this->credentialRecord->attestationType,
51 |             $this->credentialRecord->trustPath,
52 |             $this->credentialRecord->aaguid,
53 |             $this->credentialRecord->credentialPublicKey,
54 |             $this->credentialRecord->userHandle,
55 |             $this->credentialRecord->counter,
56 |             $this->credentialRecord->otherUI,
57 |             $this->credentialRecord->backupEligible,
58 |             $this->credentialRecord->backupStatus,
59 |             $this->credentialRecord->uvInitialized,
60 |         );
61 |     }
62 | }
63 | 


--------------------------------------------------------------------------------
/src/Event/AuthenticatorAssertionResponseValidationFailedEvent.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Event;
 6 | 
 7 | use LogicException;
 8 | use Throwable;
 9 | use Webauthn\AuthenticatorAssertionResponse;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\PublicKeyCredentialRequestOptions;
12 | use Webauthn\PublicKeyCredentialSource;
13 | use function sprintf;
14 | 
15 | class AuthenticatorAssertionResponseValidationFailedEvent
16 | {
17 |     public function __construct(
18 |         public readonly CredentialRecord|PublicKeyCredentialSource $credentialRecord,
19 |         public readonly AuthenticatorAssertionResponse $authenticatorAssertionResponse,
20 |         public readonly PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions,
21 |         public readonly string $host,
22 |         public readonly ?string $userHandle,
23 |         public readonly Throwable $throwable
24 |     ) {
25 |     }
26 | 
27 |     /**
28 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
29 |      */
30 |     public function __get(string $name): mixed
31 |     {
32 |         if ($name === 'credentialSource') {
33 |             return $this->getPublicKeyCredentialSource();
34 |         }
35 | 
36 |         throw new LogicException(sprintf('Undefined property: %s::$%s', self::class, $name));
37 |     }
38 | 
39 |     /**
40 |      * @deprecated since 5.3, use credentialRecord instead. Will be removed in 6.0.
41 |      */
42 |     public function getPublicKeyCredentialSource(): PublicKeyCredentialSource
43 |     {
44 |         if ($this->credentialRecord instanceof PublicKeyCredentialSource) {
45 |             return $this->credentialRecord;
46 |         }
47 | 
48 |         return PublicKeyCredentialSource::create(
49 |             $this->credentialRecord->publicKeyCredentialId,
50 |             $this->credentialRecord->type,
51 |             $this->credentialRecord->transports,
52 |             $this->credentialRecord->attestationType,
53 |             $this->credentialRecord->trustPath,
54 |             $this->credentialRecord->aaguid,
55 |             $this->credentialRecord->credentialPublicKey,
56 |             $this->credentialRecord->userHandle,
57 |             $this->credentialRecord->counter,
58 |             $this->credentialRecord->otherUI,
59 |             $this->credentialRecord->backupEligible,
60 |             $this->credentialRecord->backupStatus,
61 |             $this->credentialRecord->uvInitialized,
62 |         );
63 |     }
64 | }
65 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AttestationObjectDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use CBOR\Decoder;
 8 | use CBOR\Normalizable;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
10 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
11 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
12 | use Webauthn\AttestationStatement\AttestationObject;
13 | use Webauthn\AttestationStatement\AttestationStatement;
14 | use Webauthn\AuthenticatorData;
15 | use Webauthn\Exception\InvalidDataException;
16 | use Webauthn\StringStream;
17 | 
18 | final class AttestationObjectDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
19 | {
20 |     use DenormalizerAwareTrait;
21 | 
22 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
23 |     {
24 |         $stream = new StringStream($data);
25 |         $parsed = Decoder::create()->decode($stream);
26 | 
27 |         $parsed instanceof Normalizable || throw InvalidDataException::create(
28 |             $parsed,
29 |             'Invalid attestation object. Unexpected object.'
30 |         );
31 |         $attestationObject = $parsed->normalize();
32 |         $stream->isEOF() || throw InvalidDataException::create(
33 |             null,
34 |             'Invalid attestation object. Presence of extra bytes.'
35 |         );
36 |         $stream->close();
37 |         $authData = $attestationObject['authData'] ?? throw InvalidDataException::create(
38 |             $attestationObject,
39 |             'Invalid attestation object. Missing "authData" field.'
40 |         );
41 | 
42 |         return AttestationObject::create(
43 |             $data,
44 |             $this->denormalizer->denormalize($attestationObject, AttestationStatement::class, $format, $context),
45 |             $this->denormalizer->denormalize($authData, AuthenticatorData::class, $format, $context),
46 |         );
47 |     }
48 | 
49 |     public function supportsDenormalization(
50 |         mixed $data,
51 |         string $type,
52 |         ?string $format = null,
53 |         array $context = []
54 |     ): bool {
55 |         return $type === AttestationObject::class;
56 |     }
57 | 
58 |     /**
59 |      * @return array<class-string, bool>
60 |      */
61 |     public function getSupportedTypes(?string $format): array
62 |     {
63 |         return [
64 |             AttestationObject::class => true,
65 |         ];
66 |     }
67 | }
68 | 


--------------------------------------------------------------------------------
/src/Denormalizer/AuthenticatorAssertionResponseDenormalizer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\Denormalizer;
 6 | 
 7 | use ParagonIE\ConstantTime\Base64UrlSafe;
 8 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
 9 | use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
10 | use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
11 | use Webauthn\AttestationStatement\AttestationObject;
12 | use Webauthn\AuthenticatorAssertionResponse;
13 | use Webauthn\AuthenticatorData;
14 | use Webauthn\CollectedClientData;
15 | use Webauthn\Util\Base64;
16 | 
17 | final class AuthenticatorAssertionResponseDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
18 | {
19 |     use DenormalizerAwareTrait;
20 | 
21 |     public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
22 |     {
23 |         $data['authenticatorData'] = Base64::decode($data['authenticatorData']);
24 |         $data['signature'] = Base64::decode($data['signature']);
25 |         $data['clientDataJSON'] = Base64UrlSafe::decodeNoPadding($data['clientDataJSON']);
26 |         $userHandle = $data['userHandle'] ?? null;
27 |         if ($userHandle !== '' && $userHandle !== null) {
28 |             $userHandle = Base64::decode($userHandle);
29 |         }
30 | 
31 |         return AuthenticatorAssertionResponse::create(
32 |             $this->denormalizer->denormalize($data['clientDataJSON'], CollectedClientData::class, $format, $context),
33 |             $this->denormalizer->denormalize($data['authenticatorData'], AuthenticatorData::class, $format, $context),
34 |             $data['signature'],
35 |             $userHandle ?? null,
36 |             ! isset($data['attestationObject']) ? null : $this->denormalizer->denormalize(
37 |                 $data['attestationObject'],
38 |                 AttestationObject::class,
39 |                 $format,
40 |                 $context
41 |             ),
42 |         );
43 |     }
44 | 
45 |     public function supportsDenormalization(
46 |         mixed $data,
47 |         string $type,
48 |         ?string $format = null,
49 |         array $context = []
50 |     ): bool {
51 |         return $type === AuthenticatorAssertionResponse::class;
52 |     }
53 | 
54 |     /**
55 |      * @return array<class-string, bool>
56 |      */
57 |     public function getSupportedTypes(?string $format): array
58 |     {
59 |         return [
60 |             AuthenticatorAssertionResponse::class => true,
61 |         ];
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckAttestationFormatIsKnownAndValid.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AttestationStatement\AttestationStatementSupportManager;
 8 | use Webauthn\AuthenticatorAssertionResponse;
 9 | use Webauthn\AuthenticatorAttestationResponse;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
12 | use Webauthn\PublicKeyCredentialCreationOptions;
13 | use Webauthn\PublicKeyCredentialRequestOptions;
14 | use Webauthn\PublicKeyCredentialSource;
15 | use function trigger_deprecation;
16 | 
17 | final readonly class CheckAttestationFormatIsKnownAndValid implements CeremonyStep
18 | {
19 |     public function __construct(
20 |         private AttestationStatementSupportManager $attestationStatementSupportManager,
21 |     ) {
22 |     }
23 | 
24 |     public function process(
25 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
26 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
27 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
28 |         ?string $userHandle,
29 |         string $host
30 |     ): void {
31 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
32 |             trigger_deprecation(
33 |                 'web-auth/webauthn-lib',
34 |                 '5.3',
35 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
36 |                 self::class
37 |             );
38 |         }
39 |         $attestationObject = $authenticatorResponse->attestationObject;
40 |         if ($attestationObject === null) {
41 |             return;
42 |         }
43 | 
44 |         $fmt = $attestationObject->attStmt
45 |             ->fmt;
46 |         $this->attestationStatementSupportManager->has(
47 |             $fmt
48 |         ) || throw AuthenticatorResponseVerificationException::create('Unsupported attestation statement format.');
49 | 
50 |         $attestationStatementSupport = $this->attestationStatementSupportManager->get($fmt);
51 |         $clientDataJSONHash = hash('sha256', $authenticatorResponse->clientDataJSON ->rawData, true);
52 |         $attestationStatementSupport->isValid(
53 |             $clientDataJSONHash,
54 |             $attestationObject->attStmt,
55 |             $attestationObject->authData
56 |         ) || throw AuthenticatorResponseVerificationException::create('Invalid attestation statement.');
57 |     }
58 | }
59 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/NoneAttestationStatementSupport.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | use Psr\EventDispatcher\EventDispatcherInterface;
 8 | use Webauthn\AuthenticatorData;
 9 | use Webauthn\Event\AttestationStatementLoaded;
10 | use Webauthn\Event\CanDispatchEvents;
11 | use Webauthn\Event\NullEventDispatcher;
12 | use Webauthn\Exception\AttestationStatementLoadingException;
13 | use Webauthn\TrustPath\EmptyTrustPath;
14 | use function count;
15 | use function is_array;
16 | use function is_string;
17 | 
18 | final class NoneAttestationStatementSupport implements AttestationStatementSupport, CanDispatchEvents
19 | {
20 |     private EventDispatcherInterface $dispatcher;
21 | 
22 |     public function __construct()
23 |     {
24 |         $this->dispatcher = new NullEventDispatcher();
25 |     }
26 | 
27 |     public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): void
28 |     {
29 |         $this->dispatcher = $eventDispatcher;
30 |     }
31 | 
32 |     public static function create(): self
33 |     {
34 |         return new self();
35 |     }
36 | 
37 |     public function name(): string
38 |     {
39 |         return 'none';
40 |     }
41 | 
42 |     /**
43 |      * @param array<string, mixed> $attestation
44 |      */
45 |     public function load(array $attestation): AttestationStatement
46 |     {
47 |         $format = $attestation['fmt'] ?? null;
48 |         $attestationStatement = $attestation['attStmt'] ?? [];
49 | 
50 |         (is_string($format) && $format !== '') || throw AttestationStatementLoadingException::create(
51 |             $attestation,
52 |             'Invalid attestation object'
53 |         );
54 |         (is_array(
55 |             $attestationStatement
56 |         ) && $attestationStatement === []) || throw AttestationStatementLoadingException::create(
57 |             $attestation,
58 |             'Invalid attestation object'
59 |         );
60 | 
61 |         $attestationStatement = AttestationStatement::createNone(
62 |             $format,
63 |             $attestationStatement,
64 |             EmptyTrustPath::create()
65 |         );
66 |         $this->dispatcher->dispatch(AttestationStatementLoaded::create($attestationStatement));
67 | 
68 |         return $attestationStatement;
69 |     }
70 | 
71 |     public function isValid(
72 |         string $clientDataJSONHash,
73 |         AttestationStatement $attestationStatement,
74 |         AuthenticatorData $authenticatorData
75 |     ): bool {
76 |         return count($attestationStatement->attStmt) === 0;
77 |     }
78 | }
79 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialSource.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Symfony\Component\Uid\Uuid;
 8 | use Webauthn\TrustPath\TrustPath;
 9 | 
10 | /**
11 |  * @see https://www.w3.org/TR/webauthn/#iface-pkcredential
12 |  *
13 |  * @deprecated since 5.3, use CredentialRecord instead. Will be removed in 6.0.
14 |  */
15 | class PublicKeyCredentialSource
16 | {
17 |     /**
18 |      * @param string[] $transports
19 |      * @param array<string, mixed>|null $otherUI
20 |      */
21 |     public function __construct(
22 |         public string $publicKeyCredentialId,
23 |         public string $type,
24 |         public array $transports,
25 |         public string $attestationType,
26 |         public TrustPath $trustPath,
27 |         public Uuid $aaguid,
28 |         public string $credentialPublicKey,
29 |         public string $userHandle,
30 |         public int $counter,
31 |         public ?array $otherUI = null,
32 |         public ?bool $backupEligible = null,
33 |         public ?bool $backupStatus = null,
34 |         public ?bool $uvInitialized = null,
35 |     ) {
36 |     }
37 | 
38 |     /**
39 |      * @param string[] $transports
40 |      * @param array<string, mixed>|null $otherUI
41 |      */
42 |     public static function create(
43 |         string $publicKeyCredentialId,
44 |         string $type,
45 |         array $transports,
46 |         string $attestationType,
47 |         TrustPath $trustPath,
48 |         Uuid $aaguid,
49 |         string $credentialPublicKey,
50 |         string $userHandle,
51 |         int $counter,
52 |         ?array $otherUI = null,
53 |         ?bool $backupEligible = null,
54 |         ?bool $backupStatus = null,
55 |         ?bool $uvInitialized = null,
56 |     ): self {
57 |         return new self(
58 |             $publicKeyCredentialId,
59 |             $type,
60 |             $transports,
61 |             $attestationType,
62 |             $trustPath,
63 |             $aaguid,
64 |             $credentialPublicKey,
65 |             $userHandle,
66 |             $counter,
67 |             $otherUI,
68 |             $backupEligible,
69 |             $backupStatus,
70 |             $uvInitialized
71 |         );
72 |     }
73 | 
74 |     public function getPublicKeyCredentialDescriptor(): PublicKeyCredentialDescriptor
75 |     {
76 |         return PublicKeyCredentialDescriptor::create($this->type, $this->publicKeyCredentialId, $this->transports);
77 |     }
78 | 
79 |     public function getAttestedCredentialData(): AttestedCredentialData
80 |     {
81 |         return AttestedCredentialData::create($this->aaguid, $this->publicKeyCredentialId, $this->credentialPublicKey);
82 |     }
83 | }
84 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/JsonMetadataService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use Psr\EventDispatcher\EventDispatcherInterface;
 8 | use Symfony\Component\Serializer\Encoder\JsonEncoder;
 9 | use Symfony\Component\Serializer\SerializerInterface;
10 | use Webauthn\AttestationStatement\AttestationStatementSupportManager;
11 | use Webauthn\Denormalizer\WebauthnSerializerFactory;
12 | use Webauthn\Event\CanDispatchEvents;
13 | use Webauthn\Event\MetadataStatementFound;
14 | use Webauthn\Event\NullEventDispatcher;
15 | use Webauthn\Exception\MissingMetadataStatementException;
16 | use Webauthn\MetadataService\Statement\MetadataStatement;
17 | use function array_key_exists;
18 | 
19 | final class JsonMetadataService implements MetadataService, CanDispatchEvents
20 | {
21 |     /**
22 |      * @var MetadataStatement[]
23 |      */
24 |     private array $statements = [];
25 | 
26 |     private EventDispatcherInterface $dispatcher;
27 | 
28 |     private readonly SerializerInterface $serializer;
29 | 
30 |     /**
31 |      * @param string[] $statements
32 |      */
33 |     public function __construct(array $statements, ?SerializerInterface $serializer = null)
34 |     {
35 |         $this->dispatcher = new NullEventDispatcher();
36 |         $this->serializer = $serializer ?? (new WebauthnSerializerFactory(
37 |             AttestationStatementSupportManager::create()
38 |         ))->create();
39 |         foreach ($statements as $statement) {
40 |             $this->addStatement($statement);
41 |         }
42 |     }
43 | 
44 |     public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): void
45 |     {
46 |         $this->dispatcher = $eventDispatcher;
47 |     }
48 | 
49 |     public function list(): iterable
50 |     {
51 |         yield from array_keys($this->statements);
52 |     }
53 | 
54 |     public function has(string $aaguid): bool
55 |     {
56 |         return array_key_exists($aaguid, $this->statements);
57 |     }
58 | 
59 |     public function get(string $aaguid): MetadataStatement
60 |     {
61 |         array_key_exists($aaguid, $this->statements) || throw MissingMetadataStatementException::create($aaguid);
62 |         $mds = $this->statements[$aaguid];
63 |         $this->dispatcher->dispatch(MetadataStatementFound::create($mds));
64 | 
65 |         return $mds;
66 |     }
67 | 
68 |     private function addStatement(string $statement): void
69 |     {
70 |         $mds = $this->serializer->deserialize($statement, MetadataStatement::class, JsonEncoder::FORMAT);
71 |         if ($mds->aaguid === null) {
72 |             return;
73 |         }
74 |         $this->statements[$mds->aaguid] = $mds;
75 |     }
76 | }
77 | 


--------------------------------------------------------------------------------
/src/CredentialRecord.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Symfony\Component\Uid\Uuid;
 8 | use Webauthn\TrustPath\TrustPath;
 9 | 
10 | /**
11 |  * Credential Record represents a stored credential on the server side.
12 |  * It contains all the necessary data for validating authentication assertions.
13 |  *
14 |  * @see https://www.w3.org/TR/webauthn-3/#credential-record
15 |  */
16 | class CredentialRecord
17 | {
18 |     /**
19 |      * @param string[] $transports
20 |      * @param array<string, mixed>|null $otherUI
21 |      */
22 |     public function __construct(
23 |         public string $publicKeyCredentialId,
24 |         public string $type,
25 |         public array $transports,
26 |         public string $attestationType,
27 |         public TrustPath $trustPath,
28 |         public Uuid $aaguid,
29 |         public string $credentialPublicKey,
30 |         public string $userHandle,
31 |         public int $counter,
32 |         public ?array $otherUI = null,
33 |         public ?bool $backupEligible = null,
34 |         public ?bool $backupStatus = null,
35 |         public ?bool $uvInitialized = null,
36 |     ) {
37 |     }
38 | 
39 |     /**
40 |      * @param string[] $transports
41 |      * @param array<string, mixed>|null $otherUI
42 |      */
43 |     public static function create(
44 |         string $publicKeyCredentialId,
45 |         string $type,
46 |         array $transports,
47 |         string $attestationType,
48 |         TrustPath $trustPath,
49 |         Uuid $aaguid,
50 |         string $credentialPublicKey,
51 |         string $userHandle,
52 |         int $counter,
53 |         ?array $otherUI = null,
54 |         ?bool $backupEligible = null,
55 |         ?bool $backupStatus = null,
56 |         ?bool $uvInitialized = null,
57 |     ): self {
58 |         return new self(
59 |             $publicKeyCredentialId,
60 |             $type,
61 |             $transports,
62 |             $attestationType,
63 |             $trustPath,
64 |             $aaguid,
65 |             $credentialPublicKey,
66 |             $userHandle,
67 |             $counter,
68 |             $otherUI,
69 |             $backupEligible,
70 |             $backupStatus,
71 |             $uvInitialized
72 |         );
73 |     }
74 | 
75 |     public function getPublicKeyCredentialDescriptor(): PublicKeyCredentialDescriptor
76 |     {
77 |         return PublicKeyCredentialDescriptor::create($this->type, $this->publicKeyCredentialId, $this->transports);
78 |     }
79 | 
80 |     public function getAttestedCredentialData(): AttestedCredentialData
81 |     {
82 |         return AttestedCredentialData::create($this->aaguid, $this->publicKeyCredentialId, $this->credentialPublicKey);
83 |     }
84 | }
85 | 


--------------------------------------------------------------------------------
/src/PublicKeyCredentialRequestOptions.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Webauthn\AuthenticationExtensions\AuthenticationExtensions;
 8 | use Webauthn\Exception\InvalidDataException;
 9 | use function in_array;
10 | 
11 | final class PublicKeyCredentialRequestOptions extends PublicKeyCredentialOptions
12 | {
13 |     public const USER_VERIFICATION_REQUIREMENT_DEFAULT = null;
14 | 
15 |     public const USER_VERIFICATION_REQUIREMENT_REQUIRED = 'required';
16 | 
17 |     public const USER_VERIFICATION_REQUIREMENT_PREFERRED = 'preferred';
18 | 
19 |     public const USER_VERIFICATION_REQUIREMENT_DISCOURAGED = 'discouraged';
20 | 
21 |     public const USER_VERIFICATION_REQUIREMENTS = [
22 |         self::USER_VERIFICATION_REQUIREMENT_DEFAULT,
23 |         self::USER_VERIFICATION_REQUIREMENT_REQUIRED,
24 |         self::USER_VERIFICATION_REQUIREMENT_PREFERRED,
25 |         self::USER_VERIFICATION_REQUIREMENT_DISCOURAGED,
26 |     ];
27 | 
28 |     /**
29 |      * @param PublicKeyCredentialDescriptor[] $allowCredentials
30 |      * @param null|AuthenticationExtensions|array<array-key, mixed|AuthenticationExtensions> $extensions
31 |      * @param string[] $hints
32 |      */
33 |     public function __construct(
34 |         string $challenge,
35 |         public null|string $rpId = null,
36 |         public array $allowCredentials = [],
37 |         public null|string $userVerification = null,
38 |         null|int $timeout = null,
39 |         null|array|AuthenticationExtensions $extensions = null,
40 |         array $hints = [],
41 |     ) {
42 |         in_array($userVerification, self::USER_VERIFICATION_REQUIREMENTS, true) || throw InvalidDataException::create(
43 |             $userVerification,
44 |             'Invalid user verification requirement'
45 |         );
46 |         parent::__construct(
47 |             $challenge,
48 |             $timeout,
49 |             $extensions,
50 |             $hints
51 |         );
52 |     }
53 | 
54 |     /**
55 |      * @param PublicKeyCredentialDescriptor[] $allowCredentials
56 |      * @param positive-int $timeout
57 |      * @param null|AuthenticationExtensions|array<array-key, AuthenticationExtensions> $extensions
58 |      * @param string[] $hints
59 |      */
60 |     public static function create(
61 |         string $challenge,
62 |         null|string $rpId = null,
63 |         array $allowCredentials = [],
64 |         null|string $userVerification = null,
65 |         null|int $timeout = null,
66 |         null|array|AuthenticationExtensions $extensions = null,
67 |         array $hints = [],
68 |     ): self {
69 |         return new self($challenge, $rpId, $allowCredentials, $userVerification, $timeout, $extensions, $hints);
70 |     }
71 | }
72 | 


--------------------------------------------------------------------------------
/src/AuthenticatorData.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use Webauthn\AuthenticationExtensions\AuthenticationExtensions;
 8 | use function ord;
 9 | 
10 | /**
11 |  * @see https://www.w3.org/TR/webauthn/#sec-authenticator-data
12 |  * @see https://www.w3.org/TR/webauthn/#flags
13 |  */
14 | class AuthenticatorData
15 | {
16 |     final public const FLAG_UP = 0b00000001;
17 | 
18 |     final public const FLAG_RFU1 = 0b00000010;
19 | 
20 |     final public const FLAG_UV = 0b00000100;
21 | 
22 |     final public const FLAG_BE = 0b00001000;
23 | 
24 |     final public const FLAG_BS = 0b00010000;
25 | 
26 |     /**
27 |      * TODO: remove bits 3 and 4 as they have been assigned to BE and BS in Webauthn level 3.
28 |      */
29 |     final public const FLAG_RFU2 = 0b00111000;
30 | 
31 |     final public const FLAG_AT = 0b01000000;
32 | 
33 |     final public const FLAG_ED = 0b10000000;
34 | 
35 |     public function __construct(
36 |         public readonly string $authData,
37 |         public readonly string $rpIdHash,
38 |         public readonly string $flags,
39 |         public readonly int $signCount,
40 |         public readonly null|AttestedCredentialData $attestedCredentialData,
41 |         public readonly null|AuthenticationExtensions $extensions
42 |     ) {
43 |     }
44 | 
45 |     public static function create(
46 |         string $authData,
47 |         string $rpIdHash,
48 |         string $flags,
49 |         int $signCount,
50 |         null|AttestedCredentialData $attestedCredentialData = null,
51 |         null|AuthenticationExtensions $extensions = null
52 |     ): self {
53 |         return new self($authData, $rpIdHash, $flags, $signCount, $attestedCredentialData, $extensions);
54 |     }
55 | 
56 |     public function isUserPresent(): bool
57 |     {
58 |         return 0 !== (ord($this->flags) & self::FLAG_UP);
59 |     }
60 | 
61 |     public function isUserVerified(): bool
62 |     {
63 |         return 0 !== (ord($this->flags) & self::FLAG_UV);
64 |     }
65 | 
66 |     public function isBackupEligible(): bool
67 |     {
68 |         return 0 !== (ord($this->flags) & self::FLAG_BE);
69 |     }
70 | 
71 |     public function isBackedUp(): bool
72 |     {
73 |         return 0 !== (ord($this->flags) & self::FLAG_BS);
74 |     }
75 | 
76 |     public function hasAttestedCredentialData(): bool
77 |     {
78 |         return 0 !== (ord($this->flags) & self::FLAG_AT);
79 |     }
80 | 
81 |     public function hasExtensions(): bool
82 |     {
83 |         return 0 !== (ord($this->flags) & self::FLAG_ED);
84 |     }
85 | 
86 |     public function getReservedForFutureUse1(): int
87 |     {
88 |         return ord($this->flags) & self::FLAG_RFU1;
89 |     }
90 | 
91 |     public function getReservedForFutureUse2(): int
92 |     {
93 |         return ord($this->flags) & self::FLAG_RFU2;
94 |     }
95 | }
96 | 


--------------------------------------------------------------------------------
/src/AttestationStatement/AttestationStatement.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\AttestationStatement;
 6 | 
 7 | use Webauthn\Exception\InvalidDataException;
 8 | use Webauthn\TrustPath\TrustPath;
 9 | use function array_key_exists;
10 | use function sprintf;
11 | 
12 | class AttestationStatement
13 | {
14 |     final public const TYPE_NONE = 'none';
15 | 
16 |     final public const TYPE_BASIC = 'basic';
17 | 
18 |     final public const TYPE_SELF = 'self';
19 | 
20 |     final public const TYPE_ATTCA = 'attca';
21 | 
22 |     final public const TYPE_ANONCA = 'anonca';
23 | 
24 |     /**
25 |      * @param array<string, mixed> $attStmt
26 |      */
27 |     public function __construct(
28 |         public readonly string $fmt,
29 |         public readonly array $attStmt,
30 |         public readonly string $type,
31 |         public readonly TrustPath $trustPath
32 |     ) {
33 |     }
34 | 
35 |     public static function create(string $fmt, array $attStmt, string $type, TrustPath $trustPath): self
36 |     {
37 |         return new self($fmt, $attStmt, $type, $trustPath);
38 |     }
39 | 
40 |     /**
41 |      * @param array<string, mixed> $attStmt
42 |      */
43 |     public static function createNone(string $fmt, array $attStmt, TrustPath $trustPath): self
44 |     {
45 |         return self::create($fmt, $attStmt, self::TYPE_NONE, $trustPath);
46 |     }
47 | 
48 |     /**
49 |      * @param array<string, mixed> $attStmt
50 |      */
51 |     public static function createBasic(string $fmt, array $attStmt, TrustPath $trustPath): self
52 |     {
53 |         return self::create($fmt, $attStmt, self::TYPE_BASIC, $trustPath);
54 |     }
55 | 
56 |     /**
57 |      * @param array<string, mixed> $attStmt
58 |      */
59 |     public static function createSelf(string $fmt, array $attStmt, TrustPath $trustPath): self
60 |     {
61 |         return self::create($fmt, $attStmt, self::TYPE_SELF, $trustPath);
62 |     }
63 | 
64 |     /**
65 |      * @param array<string, mixed> $attStmt
66 |      */
67 |     public static function createAttCA(string $fmt, array $attStmt, TrustPath $trustPath): self
68 |     {
69 |         return self::create($fmt, $attStmt, self::TYPE_ATTCA, $trustPath);
70 |     }
71 | 
72 |     /**
73 |      * @param array<string, mixed> $attStmt
74 |      */
75 |     public static function createAnonymizationCA(string $fmt, array $attStmt, TrustPath $trustPath): self
76 |     {
77 |         return self::create($fmt, $attStmt, self::TYPE_ANONCA, $trustPath);
78 |     }
79 | 
80 |     public function has(string $key): bool
81 |     {
82 |         return array_key_exists($key, $this->attStmt);
83 |     }
84 | 
85 |     public function get(string $key): mixed
86 |     {
87 |         $this->has($key) || throw InvalidDataException::create($this->attStmt, sprintf(
88 |             'The attestation statement has no key "%s".',
89 |             $key
90 |         ));
91 | 
92 |         return $this->attStmt[$key];
93 |     }
94 | }
95 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/FolderResourceMetadataService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\MetadataService\Service;
 6 | 
 7 | use InvalidArgumentException;
 8 | use Symfony\Component\Serializer\Encoder\JsonEncoder;
 9 | use Symfony\Component\Serializer\SerializerInterface;
10 | use Webauthn\AttestationStatement\AttestationStatementSupportManager;
11 | use Webauthn\Denormalizer\WebauthnSerializerFactory;
12 | use Webauthn\Exception\MetadataStatementLoadingException;
13 | use Webauthn\MetadataService\Statement\MetadataStatement;
14 | use function assert;
15 | use function file_get_contents;
16 | use function is_array;
17 | use function sprintf;
18 | use const DIRECTORY_SEPARATOR;
19 | 
20 | final class FolderResourceMetadataService implements MetadataService
21 | {
22 |     private readonly SerializerInterface $serializer;
23 | 
24 |     public function __construct(
25 |         private string $rootPath,
26 |         ?SerializerInterface $serializer = null,
27 |     ) {
28 |         $this->serializer = $serializer ?? (new WebauthnSerializerFactory(
29 |             AttestationStatementSupportManager::create()
30 |         ))->create();
31 |         $this->rootPath = rtrim($rootPath, DIRECTORY_SEPARATOR);
32 |         is_dir($this->rootPath) || throw new InvalidArgumentException('The given parameter is not a valid folder.');
33 |         is_readable($this->rootPath) || throw new InvalidArgumentException(
34 |             'The given parameter is not a valid folder.'
35 |         );
36 |     }
37 | 
38 |     public static function create(string $rootPath, ?SerializerInterface $serializer = null): self
39 |     {
40 |         return new self($rootPath, $serializer);
41 |     }
42 | 
43 |     public function list(): iterable
44 |     {
45 |         $files = glob($this->rootPath . DIRECTORY_SEPARATOR . '*');
46 |         is_array($files) || throw MetadataStatementLoadingException::create('Unable to read files.');
47 |         foreach ($files as $file) {
48 |             if (is_dir($file) || ! is_readable($file)) {
49 |                 continue;
50 |             }
51 | 
52 |             yield basename($file);
53 |         }
54 |     }
55 | 
56 |     public function has(string $aaguid): bool
57 |     {
58 |         $filename = $this->rootPath . DIRECTORY_SEPARATOR . $aaguid;
59 | 
60 |         return is_file($filename) && is_readable($filename);
61 |     }
62 | 
63 |     public function get(string $aaguid): MetadataStatement
64 |     {
65 |         $this->has($aaguid) || throw new InvalidArgumentException(sprintf(
66 |             'The MDS with the AAGUID "%s" does not exist.',
67 |             $aaguid
68 |         ));
69 |         $filename = $this->rootPath . DIRECTORY_SEPARATOR . $aaguid;
70 |         $content = file_get_contents($filename);
71 |         assert($content !== false, 'The file exists and is readable.');
72 |         $data = trim($content);
73 |         $mds = $this->serializer->deserialize($data, MetadataStatement::class, JsonEncoder::FORMAT);
74 |         $mds->aaguid !== null || throw MetadataStatementLoadingException::create('Invalid Metadata Statement.');
75 | 
76 |         return $mds;
77 |     }
78 | }
79 | 


--------------------------------------------------------------------------------
/src/CeremonyStep/CheckRelyingPartyIdIdHash.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn\CeremonyStep;
 6 | 
 7 | use Webauthn\AuthenticationExtensions\AuthenticationExtensions;
 8 | use Webauthn\AuthenticatorAssertionResponse;
 9 | use Webauthn\AuthenticatorAttestationResponse;
10 | use Webauthn\CredentialRecord;
11 | use Webauthn\Exception\AuthenticatorResponseVerificationException;
12 | use Webauthn\PublicKeyCredentialCreationOptions;
13 | use Webauthn\PublicKeyCredentialRequestOptions;
14 | use Webauthn\PublicKeyCredentialSource;
15 | use Webauthn\U2FPublicKey;
16 | use function is_string;
17 | use function trigger_deprecation;
18 | 
19 | final class CheckRelyingPartyIdIdHash implements CeremonyStep
20 | {
21 |     public function process(
22 |         CredentialRecord|PublicKeyCredentialSource $credentialRecord,
23 |         AuthenticatorAssertionResponse|AuthenticatorAttestationResponse $authenticatorResponse,
24 |         PublicKeyCredentialRequestOptions|PublicKeyCredentialCreationOptions $publicKeyCredentialOptions,
25 |         ?string $userHandle,
26 |         string $host
27 |     ): void {
28 |         if ($credentialRecord instanceof PublicKeyCredentialSource) {
29 |             trigger_deprecation(
30 |                 'web-auth/webauthn-lib',
31 |                 '5.3',
32 |                 'Passing a PublicKeyCredentialSource to "%s::process()" is deprecated, pass a CredentialRecord instead.',
33 |                 self::class
34 |             );
35 |         }
36 |         $authData = $authenticatorResponse instanceof AuthenticatorAssertionResponse ? $authenticatorResponse->authenticatorData : $authenticatorResponse->attestationObject->authData;
37 |         $C = $authenticatorResponse->clientDataJSON;
38 |         $attestedCredentialData = $credentialRecord->getAttestedCredentialData();
39 |         $credentialPublicKey = $attestedCredentialData->credentialPublicKey;
40 |         $credentialPublicKey !== null || throw AuthenticatorResponseVerificationException::create(
41 |             'No public key available.'
42 |         );
43 |         $isU2F = U2FPublicKey::isU2FKey($credentialPublicKey);
44 |         $rpId = $publicKeyCredentialOptions->rpId ?? $publicKeyCredentialOptions->rp->id ?? $host;
45 |         $facetId = $this->getFacetId($rpId, $publicKeyCredentialOptions->extensions, $authData ->extensions);
46 |         $rpIdHash = hash('sha256', $isU2F ? $C->origin : $facetId, true);
47 |         hash_equals(
48 |             $rpIdHash,
49 |             $authData
50 |                 ->rpIdHash
51 |         ) || throw AuthenticatorResponseVerificationException::create('rpId hash mismatch.');
52 |     }
53 | 
54 |     private function getFacetId(
55 |         string $rpId,
56 |         AuthenticationExtensions $AuthenticationExtensions,
57 |         null|AuthenticationExtensions $authenticationExtensionsClientOutputs
58 |     ): string {
59 |         if ($authenticationExtensionsClientOutputs === null || ! $AuthenticationExtensions->has(
60 |             'appid'
61 |         ) || ! $authenticationExtensionsClientOutputs->has('appid')) {
62 |             return $rpId;
63 |         }
64 |         $appId = $AuthenticationExtensions->get('appid')
65 |             ->value;
66 |         $wasUsed = $authenticationExtensionsClientOutputs->get('appid')
67 |             ->value;
68 |         if (! is_string($appId) || $wasUsed !== true) {
69 |             return $rpId;
70 |         }
71 |         return $appId;
72 |     }
73 | }
74 | 


--------------------------------------------------------------------------------
/src/AuthenticationExtensions/AuthenticationExtensions.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | declare(strict_types=1);
  4 | 
  5 | namespace Webauthn\AuthenticationExtensions;
  6 | 
  7 | use ArrayAccess;
  8 | use ArrayIterator;
  9 | use Countable;
 10 | use Iterator;
 11 | use IteratorAggregate;
 12 | use Webauthn\Exception\AuthenticationExtensionException;
 13 | use function array_key_exists;
 14 | use function count;
 15 | use function is_string;
 16 | use function sprintf;
 17 | use const COUNT_NORMAL;
 18 | 
 19 | /**
 20 |  * @implements IteratorAggregate<AuthenticationExtension>
 21 |  */
 22 | final class AuthenticationExtensions implements Countable, IteratorAggregate, ArrayAccess
 23 | {
 24 |     /**
 25 |      * @var array<string, AuthenticationExtension>
 26 |      * @readonly
 27 |      */
 28 |     public array $extensions;
 29 | 
 30 |     /**
 31 |      * @param array<array-key, mixed|AuthenticationExtension> $extensions
 32 |      */
 33 |     public function __construct(array $extensions = [])
 34 |     {
 35 |         $list = [];
 36 |         foreach ($extensions as $key => $extension) {
 37 |             if ($extension instanceof AuthenticationExtension) {
 38 |                 $list[$extension->name] = $extension;
 39 | 
 40 |                 continue;
 41 |             }
 42 |             if (is_string($key)) {
 43 |                 $list[$key] = AuthenticationExtension::create($key, $extension);
 44 |                 continue;
 45 |             }
 46 |             throw new AuthenticationExtensionException('Invalid extension');
 47 |         }
 48 |         $this->extensions = $list;
 49 |     }
 50 | 
 51 |     /**
 52 |      * @param array<array-key, AuthenticationExtension> $extensions
 53 |      */
 54 |     public static function create(array $extensions = []): static
 55 |     {
 56 |         return new static($extensions);
 57 |     }
 58 | 
 59 |     public function has(string $key): bool
 60 |     {
 61 |         return array_key_exists($key, $this->extensions);
 62 |     }
 63 | 
 64 |     public function get(string $key): AuthenticationExtension
 65 |     {
 66 |         $this->has($key) || throw AuthenticationExtensionException::create(sprintf(
 67 |             'The extension with key "%s" is not available',
 68 |             $key
 69 |         ));
 70 | 
 71 |         return $this->extensions[$key];
 72 |     }
 73 | 
 74 |     /**
 75 |      * @return Iterator<string, AuthenticationExtension>
 76 |      */
 77 |     public function getIterator(): Iterator
 78 |     {
 79 |         return new ArrayIterator($this->extensions);
 80 |     }
 81 | 
 82 |     public function count(int $mode = COUNT_NORMAL): int
 83 |     {
 84 |         return count($this->extensions, $mode);
 85 |     }
 86 | 
 87 |     public function offsetExists(mixed $offset): bool
 88 |     {
 89 |         return array_key_exists($offset, $this->extensions);
 90 |     }
 91 | 
 92 |     public function offsetGet(mixed $offset): mixed
 93 |     {
 94 |         return $this->extensions[$offset];
 95 |     }
 96 | 
 97 |     public function offsetSet(mixed $offset, mixed $value): void
 98 |     {
 99 |         if ($value === null) {
100 |             return;
101 |         }
102 |         if ($value instanceof AuthenticationExtension) {
103 |             $this->extensions[$value->name] = $value;
104 |             return;
105 |         }
106 |         if (is_string($offset)) {
107 |             $this->extensions[$offset] = AuthenticationExtension::create($offset, $value);
108 |             return;
109 |         }
110 |         throw new AuthenticationExtensionException('Invalid extension');
111 |     }
112 | 
113 |     public function offsetUnset(mixed $offset): void
114 |     {
115 |         unset($this->extensions[$offset]);
116 |     }
117 | }
118 | 


--------------------------------------------------------------------------------
/src/AuthenticatorSelectionCriteria.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace Webauthn;
 6 | 
 7 | use InvalidArgumentException;
 8 | use function in_array;
 9 | 
10 | class AuthenticatorSelectionCriteria
11 | {
12 |     final public const AUTHENTICATOR_ATTACHMENT_NO_PREFERENCE = null;
13 | 
14 |     final public const AUTHENTICATOR_ATTACHMENT_PLATFORM = 'platform';
15 | 
16 |     final public const AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM = 'cross-platform';
17 | 
18 |     final public const AUTHENTICATOR_ATTACHMENTS = [
19 |         self::AUTHENTICATOR_ATTACHMENT_NO_PREFERENCE,
20 |         self::AUTHENTICATOR_ATTACHMENT_PLATFORM,
21 |         self::AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM,
22 |     ];
23 | 
24 |     final public const USER_VERIFICATION_REQUIREMENT_REQUIRED = 'required';
25 | 
26 |     final public const USER_VERIFICATION_REQUIREMENT_PREFERRED = 'preferred';
27 | 
28 |     final public const USER_VERIFICATION_REQUIREMENT_DISCOURAGED = 'discouraged';
29 | 
30 |     final public const USER_VERIFICATION_REQUIREMENTS = [
31 |         self::USER_VERIFICATION_REQUIREMENT_REQUIRED,
32 |         self::USER_VERIFICATION_REQUIREMENT_PREFERRED,
33 |         self::USER_VERIFICATION_REQUIREMENT_DISCOURAGED,
34 |     ];
35 | 
36 |     final public const RESIDENT_KEY_REQUIREMENT_NO_PREFERENCE = null;
37 | 
38 |     final public const RESIDENT_KEY_REQUIREMENT_REQUIRED = 'required';
39 | 
40 |     final public const RESIDENT_KEY_REQUIREMENT_PREFERRED = 'preferred';
41 | 
42 |     final public const RESIDENT_KEY_REQUIREMENT_DISCOURAGED = 'discouraged';
43 | 
44 |     final public const RESIDENT_KEY_REQUIREMENTS = [
45 |         self::RESIDENT_KEY_REQUIREMENT_NO_PREFERENCE,
46 |         self::RESIDENT_KEY_REQUIREMENT_REQUIRED,
47 |         self::RESIDENT_KEY_REQUIREMENT_PREFERRED,
48 |         self::RESIDENT_KEY_REQUIREMENT_DISCOURAGED,
49 |     ];
50 | 
51 |     /**
52 |      * Legacy property for backward compatibility.
53 |      *
54 |      * requireResidentKey is based on residentKey for backward compatibility
55 |      * Per WebAuthn Level 3 spec: "Relying Parties SHOULD set it to true if, and only if, residentKey is set to required."
56 |      * Only set when residentKey is "required"; leave uninitialized otherwise
57 |      */
58 |     public readonly ?bool $requireResidentKey;
59 | 
60 |     public function __construct(
61 |         public null|string $authenticatorAttachment = null,
62 |         public string $userVerification = self::USER_VERIFICATION_REQUIREMENT_PREFERRED,
63 |         public null|string $residentKey = self::RESIDENT_KEY_REQUIREMENT_NO_PREFERENCE,
64 |     ) {
65 |         in_array($authenticatorAttachment, self::AUTHENTICATOR_ATTACHMENTS, true) || throw new InvalidArgumentException(
66 |             'Invalid authenticator attachment'
67 |         );
68 |         in_array($userVerification, self::USER_VERIFICATION_REQUIREMENTS, true) || throw new InvalidArgumentException(
69 |             'Invalid user verification'
70 |         );
71 |         in_array($residentKey, self::RESIDENT_KEY_REQUIREMENTS, true) || throw new InvalidArgumentException(
72 |             'Invalid resident key'
73 |         );
74 | 
75 |         if ($residentKey === self::RESIDENT_KEY_REQUIREMENT_REQUIRED) {
76 |             $this->requireResidentKey = true;
77 |         } else {
78 |             $this->requireResidentKey = null;
79 |         }
80 |     }
81 | 
82 |     public static function create(
83 |         ?string $authenticatorAttachment = null,
84 |         string $userVerification = self::USER_VERIFICATION_REQUIREMENT_PREFERRED,
85 |         null|string $residentKey = self::RESIDENT_KEY_REQUIREMENT_NO_PREFERENCE,
86 |     ): self {
87 |         return new self($authenticatorAttachment, $userVerification, $residentKey);
88 |     }
89 | }
90 | 


--------------------------------------------------------------------------------
/src/MetadataService/Service/LocalResourceMetadataService.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | declare(strict_types=1);
  4 | 
  5 | namespace Webauthn\MetadataService\Service;
  6 | 
  7 | use ParagonIE\ConstantTime\Base64;
  8 | use Psr\EventDispatcher\EventDispatcherInterface;
  9 | use Symfony\Component\Serializer\Encoder\JsonEncoder;
 10 | use Symfony\Component\Serializer\SerializerInterface;
 11 | use Webauthn\AttestationStatement\AttestationStatementSupportManager;
 12 | use Webauthn\Denormalizer\WebauthnSerializerFactory;
 13 | use Webauthn\Event\CanDispatchEvents;
 14 | use Webauthn\Event\MetadataStatementFound;
 15 | use Webauthn\Event\NullEventDispatcher;
 16 | use Webauthn\Exception\MetadataStatementLoadingException;
 17 | use Webauthn\Exception\MissingMetadataStatementException;
 18 | use Webauthn\MetadataService\Statement\MetadataStatement;
 19 | use function assert;
 20 | use function file_get_contents;
 21 | 
 22 | final class LocalResourceMetadataService implements MetadataService, CanDispatchEvents
 23 | {
 24 |     private ?MetadataStatement $statement = null;
 25 | 
 26 |     private EventDispatcherInterface $dispatcher;
 27 | 
 28 |     private readonly SerializerInterface $serializer;
 29 | 
 30 |     public function __construct(
 31 |         private readonly string $filename,
 32 |         private readonly bool $isBase64Encoded = false,
 33 |         ?SerializerInterface $serializer = null,
 34 |     ) {
 35 |         $this->serializer = $serializer ?? (new WebauthnSerializerFactory(
 36 |             AttestationStatementSupportManager::create()
 37 |         ))->create();
 38 |         $this->dispatcher = new NullEventDispatcher();
 39 |     }
 40 | 
 41 |     public static function create(
 42 |         string $filename,
 43 |         bool $isBase64Encoded = false,
 44 |         ?SerializerInterface $serializer = null
 45 |     ): self {
 46 |         return new self($filename, $isBase64Encoded, $serializer);
 47 |     }
 48 | 
 49 |     public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): void
 50 |     {
 51 |         $this->dispatcher = $eventDispatcher;
 52 |     }
 53 | 
 54 |     public function list(): iterable
 55 |     {
 56 |         $this->loadData();
 57 |         $this->statement !== null || throw MetadataStatementLoadingException::create();
 58 |         $aaguid = $this->statement->aaguid;
 59 |         if ($aaguid === null) {
 60 |             yield from [];
 61 |         } else {
 62 |             yield from [$aaguid];
 63 |         }
 64 |     }
 65 | 
 66 |     public function has(string $aaguid): bool
 67 |     {
 68 |         $this->loadData();
 69 |         $this->statement !== null || throw MetadataStatementLoadingException::create();
 70 | 
 71 |         return $aaguid === $this->statement->aaguid;
 72 |     }
 73 | 
 74 |     public function get(string $aaguid): MetadataStatement
 75 |     {
 76 |         $this->loadData();
 77 |         $this->statement !== null || throw MetadataStatementLoadingException::create();
 78 | 
 79 |         if ($aaguid === $this->statement->aaguid) {
 80 |             $this->dispatcher->dispatch(MetadataStatementFound::create($this->statement));
 81 | 
 82 |             return $this->statement;
 83 |         }
 84 | 
 85 |         throw MissingMetadataStatementException::create($aaguid);
 86 |     }
 87 | 
 88 |     private function loadData(): void
 89 |     {
 90 |         if ($this->statement !== null) {
 91 |             return;
 92 |         }
 93 | 
 94 |         $content = file_get_contents($this->filename);
 95 |         assert($content !== false, 'The file could not be read');
 96 |         if ($this->isBase64Encoded) {
 97 |             $content = Base64::decode($content, true);
 98 |         }
 99 |         $this->statement = $this->serializer->deserialize($content, MetadataStatement::class, JsonEncoder::FORMAT);
100 |     }
101 | }
102 | 


--------------------------------------------------------------------------------