| 1 |
<?php |
| 2 |
|
| 3 |
declare(strict_types=1); |
| 4 |
|
| 5 |
/* |
| 6 |
* The MIT License (MIT) |
| 7 |
* |
| 8 |
* Copyright (c) 2014-2021 Spomky-Labs |
| 9 |
* |
| 10 |
* This software may be modified and distributed under the terms |
| 11 |
* of the MIT license. See the LICENSE file for details. |
| 12 |
*/ |
| 13 |
|
| 14 |
namespace Webauthn; |
| 15 |
|
| 16 |
use function array_key_exists; |
| 17 |
use Assert\Assertion; |
| 18 |
use Base64Url\Base64Url; |
| 19 |
use CBOR\Decoder; |
| 20 |
use CBOR\MapObject; |
| 21 |
use CBOR\OtherObject\OtherObjectManager; |
| 22 |
use CBOR\Tag\TagObjectManager; |
| 23 |
use InvalidArgumentException; |
| 24 |
use function ord; |
| 25 |
use Psr\Log\LoggerInterface; |
| 26 |
use Psr\Log\NullLogger; |
| 27 |
use Ramsey\Uuid\Uuid; |
| 28 |
use function Safe\json_decode; |
| 29 |
use function Safe\sprintf; |
| 30 |
use function Safe\unpack; |
| 31 |
use Throwable; |
| 32 |
use Webauthn\AttestationStatement\AttestationObjectLoader; |
| 33 |
use Webauthn\AuthenticationExtensions\AuthenticationExtensionsClientOutputsLoader; |
| 34 |
|
| 35 |
class PublicKeyCredentialLoader |
| 36 |
{ |
| 37 |
private const FLAG_AT = 0b01000000; |
| 38 |
private const FLAG_ED = 0b10000000; |
| 39 |
|
| 40 |
/** |
| 41 |
* @var AttestationObjectLoader |
| 42 |
*/ |
| 43 |
private $attestationObjectLoader; |
| 44 |
|
| 45 |
/** |
| 46 |
* @var Decoder |
| 47 |
*/ |
| 48 |
private $decoder; |
| 49 |
|
| 50 |
/** |
| 51 |
* @var LoggerInterface |
| 52 |
*/ |
| 53 |
private $logger; |
| 54 |
|
| 55 |
public function __construct(AttestationObjectLoader $attestationObjectLoader, ?LoggerInterface $logger = null) |
| 56 |
{ |
| 57 |
if (null !== $logger) { |
| 58 |
@trigger_error('The argument "logger" is deprecated since version 3.3 and will be removed in 4.0. Please use the method "setLogger".', E_USER_DEPRECATED); |
| 59 |
} |
| 60 |
$this->decoder = new Decoder(new TagObjectManager(), new OtherObjectManager()); |
| 61 |
$this->attestationObjectLoader = $attestationObjectLoader; |
| 62 |
$this->logger = $logger ?? new NullLogger(); |
| 63 |
} |
| 64 |
|
| 65 |
public static function create(AttestationObjectLoader $attestationObjectLoader): self |
| 66 |
{ |
| 67 |
return new self($attestationObjectLoader); |
| 68 |
} |
| 69 |
|
| 70 |
public function setLogger(LoggerInterface $logger): self |
| 71 |
{ |
| 72 |
$this->logger = $logger; |
| 73 |
|
| 74 |
return $this; |
| 75 |
} |
| 76 |
|
| 77 |
/** |
| 78 |
* @param mixed[] $json |
| 79 |
*/ |
| 80 |
public function loadArray(array $json): PublicKeyCredential |
| 81 |
{ |
| 82 |
$this->logger->info('Trying to load data from an array', ['data' => $json]); |
| 83 |
try { |
| 84 |
foreach (['id', 'rawId', 'type'] as $key) { |
| 85 |
Assertion::keyExists($json, $key, sprintf('The parameter "%s" is missing', $key)); |
| 86 |
Assertion::string($json[$key], sprintf('The parameter "%s" shall be a string', $key)); |
| 87 |
} |
| 88 |
Assertion::keyExists($json, 'response', 'The parameter "response" is missing'); |
| 89 |
Assertion::isArray($json['response'], 'The parameter "response" shall be an array'); |
| 90 |
Assertion::eq($json['type'], 'public-key', sprintf('Unsupported type "%s"', $json['type'])); |
| 91 |
|
| 92 |
$id = Base64Url::decode($json['id']); |
| 93 |
$rawId = Base64Url::decode($json['rawId']); |
| 94 |
Assertion::true(hash_equals($id, $rawId)); |
| 95 |
|
| 96 |
$publicKeyCredential = new PublicKeyCredential( |
| 97 |
$json['id'], |
| 98 |
$json['type'], |
| 99 |
$rawId, |
| 100 |
$this->createResponse($json['response']) |
| 101 |
); |
| 102 |
$this->logger->info('The data has been loaded'); |
| 103 |
$this->logger->debug('Public Key Credential', ['publicKeyCredential' => $publicKeyCredential]); |
| 104 |
|
| 105 |
return $publicKeyCredential; |
| 106 |
} catch (Throwable $throwable) { |
| 107 |
$this->logger->error('An error occurred', [ |
| 108 |
'exception' => $throwable, |
| 109 |
]); |
| 110 |
throw $throwable; |
| 111 |
} |
| 112 |
} |
| 113 |
|
| 114 |
public function load(string $data): PublicKeyCredential |
| 115 |
{ |
| 116 |
$this->logger->info('Trying to load data from a string', ['data' => $data]); |
| 117 |
try { |
| 118 |
$json = json_decode($data, true); |
| 119 |
|
| 120 |
return $this->loadArray($json); |
| 121 |
} catch (Throwable $throwable) { |
| 122 |
$this->logger->error('An error occurred', [ |
| 123 |
'exception' => $throwable, |
| 124 |
]); |
| 125 |
throw $throwable; |
| 126 |
} |
| 127 |
} |
| 128 |
|
| 129 |
/** |
| 130 |
* @param mixed[] $response |
| 131 |
*/ |
| 132 |
private function createResponse(array $response): AuthenticatorResponse |
| 133 |
{ |
| 134 |
Assertion::keyExists($response, 'clientDataJSON', 'Invalid data. The parameter "clientDataJSON" is missing'); |
| 135 |
Assertion::string($response['clientDataJSON'], 'Invalid data. The parameter "clientDataJSON" is invalid'); |
| 136 |
switch (true) { |
| 137 |
case array_key_exists('attestationObject', $response): |
| 138 |
Assertion::string($response['attestationObject'], 'Invalid data. The parameter "attestationObject " is invalid'); |
| 139 |
$attestationObject = $this->attestationObjectLoader->load($response['attestationObject']); |
| 140 |
|
| 141 |
return new AuthenticatorAttestationResponse(CollectedClientData::createFormJson($response['clientDataJSON']), $attestationObject); |
| 142 |
case array_key_exists('authenticatorData', $response) && array_key_exists('signature', $response): |
| 143 |
$authData = Base64Url::decode($response['authenticatorData']); |
| 144 |
|
| 145 |
$authDataStream = new StringStream($authData); |
| 146 |
$rp_id_hash = $authDataStream->read(32); |
| 147 |
$flags = $authDataStream->read(1); |
| 148 |
$signCount = $authDataStream->read(4); |
| 149 |
$signCount = unpack('N', $signCount)[1]; |
| 150 |
|
| 151 |
$attestedCredentialData = null; |
| 152 |
if (0 !== (ord($flags) & self::FLAG_AT)) { |
| 153 |
$aaguid = Uuid::fromBytes($authDataStream->read(16)); |
| 154 |
$credentialLength = $authDataStream->read(2); |
| 155 |
$credentialLength = unpack('n', $credentialLength)[1]; |
| 156 |
$credentialId = $authDataStream->read($credentialLength); |
| 157 |
$credentialPublicKey = $this->decoder->decode($authDataStream); |
| 158 |
Assertion::isInstanceOf($credentialPublicKey, MapObject::class, 'The data does not contain a valid credential public key.'); |
| 159 |
$attestedCredentialData = new AttestedCredentialData($aaguid, $credentialId, (string) $credentialPublicKey); |
| 160 |
} |
| 161 |
|
| 162 |
$extension = null; |
| 163 |
if (0 !== (ord($flags) & self::FLAG_ED)) { |
| 164 |
$extension = $this->decoder->decode($authDataStream); |
| 165 |
$extension = AuthenticationExtensionsClientOutputsLoader::load($extension); |
| 166 |
} |
| 167 |
Assertion::true($authDataStream->isEOF(), 'Invalid authentication data. Presence of extra bytes.'); |
| 168 |
$authDataStream->close(); |
| 169 |
$authenticatorData = new AuthenticatorData($authData, $rp_id_hash, $flags, $signCount, $attestedCredentialData, $extension); |
| 170 |
|
| 171 |
return new AuthenticatorAssertionResponse( |
| 172 |
CollectedClientData::createFormJson($response['clientDataJSON']), |
| 173 |
$authenticatorData, |
| 174 |
Base64Url::decode($response['signature']), |
| 175 |
$response['userHandle'] ?? null |
| 176 |
); |
| 177 |
default: |
| 178 |
throw new InvalidArgumentException('Unable to create the response object'); |
| 179 |
} |
| 180 |
} |
| 181 |
} |
| 182 |
|
