+ h`=cs|^RIHt^RIt^RIt^RIHtHtHtHt^RI H t ^RI H t ^RIHt^RIHt^RIHtHt^R IHtHtHtHtHtHtHtHtHtHtH t H!t!H"t"H#t#H$t$H%t%H&t&H't'H(t(H)t)]PT!]+4t,]]]-.R3,t.]]/.]03,t1R R lt2R R lt3RRRllt4RRlt5RRlt6!RR4t7R#)i) annotationsN)AnyCallableMappingSequence)InvalidSignature) constant_time)CoseKey verify_rp_id)websafe_decodewebsafe_encode)AttestationConveyancePreferenceAttestationObjectAttestedCredentialDataAuthenticationResponseAuthenticatorAttachmentAuthenticatorDataAuthenticatorSelectionCriteriaCollectedClientDataCredentialCreationOptionsCredentialRequestOptions"PublicKeyCredentialCreationOptionsPublicKeyCredentialDescriptorPublicKeyCredentialParameters!PublicKeyCredentialRequestOptionsPublicKeyCredentialRpEntityPublicKeyCredentialTypePublicKeyCredentialUserEntityRegistrationResponseResidentKeyRequirementUserVerificationRequirementc V^8dQhRRRR/#)rp_idstrreturn VerifyOriginZformat"1/usr/lib/python3.14/site-packages/fido2/server.py __annotate__r*Fs,,,,csaV3Rl#)cs<\SV4#Nr)Zor"s&r)ZZ'_verify_origin_for_rp..Gs \%+r+r&)r"sfr)_verify_origin_for_rpr-Fs ++r+cr )r! challenge bytes | Noner$bytesr&r'r(r)r*r*Js<Er+csVf\P!^ 4pV#\V\4'g \ R4h\ V4^8d \ R4hV#)Nz)Custom challenge must be of type 'bytes'.z&Custom challenge length must be >= 16.)osZurandom isinstancer0Z TypeErrorZlen ValueError)r.s&r)_validata_challenger4JsVJJrN  )U++GH H y>B EF F r+cr )r! credentialrr$rr&r'r(r)r*r*Us&"r+csN\\PVPVR7#)a~Converts an AttestedCredentialData to a PublicKeyCredentialDescriptor. :param credential: AttestedCredentialData containing the credential ID to use. :param transports: Optional list of AuthenticatorTransport strings to add to the descriptor. :return: A descriptor of the credential, for use with register_begin or authenticate_begin. :rtype: PublicKeyCredentialDescriptor )typeid transports)rr PUBLIC_KEY credential_id)r5r8&&r) to_descriptorr<Us& ) $ / /  # # r+cr )r!credsGSequence[AttestedCredentialData | PublicKeyCredentialDescriptor] | Noner$z.Sequence[PublicKeyCredentialDescriptor] | Noner&r'r(r)r*r*hs   R 3 r+csVfR#VUu.uF:p\V\4'd \V4M\P!V4NK< up#uupir,)r2rr<r from_dict)r=Zc& r)_wrap_credentialsrAhs_ }   A!344 ! .88; <   sAAc$V^8dQhRRRRRR/#)r!attestation_objectr client_data_hashr0r$ZNoner&r'r(r)r*r*ws$)=B r+csR#)zIgnore attestation.Nr&)rCrDr;r)_ignore_attestationrEwsr+csx]tRt^}tRtRRRlltRRRlltRRltRR R lltR R lt ] R Rl4t Rt R#) Fido2Servera FIDO2 server. :param rp: Relying party data as `PublicKeyCredentialRpEntity` instance. :param attestation: (optional) Requirement on authenticator attestation. :param verify_origin: (optional) Alternative function to validate an origin. :param verify_attestation: (optional) function to validate attestation, which is invoked with attestation_object and client_data_hash. It should return nothing and raise an exception on failure. By default, attestation is ignored. Attestation is also ignored if `attestation` is set to `none`. Nc(V^8dQhRRRRRRRR/#) r!rpr attestationz&AttestationConveyancePreference | None verify_originzVerifyOrigin | Noneverify_attestationzVerifyAttestation | Noner&r'r(r)r*Fido2Server.__annotate__s8CC 'C<C+ C 5 Cr+c s\P!V4VnT;'g \VPP4VnRVn\V4Vn\P!4Uu.uFp\\PVR7NK upVnT;'g\Vn\"P%RVP 24R#uupi)N)r6algz Fido2Server initialized for RP: )rr?rHr-r7_verifytimeoutr rIrZsupported_algorithmsrrr9allowed_algorithmsrE_verify_attestationloggerdebug)selfrHrIrJrKrMs&&&&& r)__init__ZFido2Server.__init__s.77;$II(=dggjj(I  :;G 335 # 6 *,77S 6 #  $6#L#L9L  7yAB# s8$Ccs4V^8dQhRRRRRRRRR R R R R R/#)r!userr credentialsr>resident_key_requirementzResidentKeyRequirement | Noneuser_verification"UserVerificationRequirement | Noneauthenticator_attachmentzAuthenticatorAttachment | Noner.r/r$z%tuple[CredentialCreationOptions, Any]r&r'r(r)r*rLs\B B +B  T B #@ B >B #AB  B  /B r+c sVP'g \R4h\V4p\V4pVP Wd4p \ P RRPRT;'g.44,4\\VP\P!V4TVPVPT\VVV34'd\VVVR7MRVP VR7 R7V 3#) aReturn a PublicKeyCredentialCreationOptions registration object and the internal state dictionary that needs to be passed as is to the corresponding `register_complete` call. :param user: The dict containing the user data. :param credentials: The list of previously registered credentials, these can be of type AttestedCredentialData, or PublicKeyCredentialDescriptor. :param resident_key_requirement: The desired RESIDENT_KEY_REQUIREMENT level. :param user_verification: The desired USER_VERIFICATION level. :param authenticator_attachment: The desired AUTHENTICATOR_ATTACHMENT or None to not provide a preference (and get both types). :param challenge: A custom challenge to sign and verify or None to use OS-specific random bytes. :return: Registration data, internal state.z!Server has no allowed algorithms.z1Starting new registration, existing credentials: , c3T"TFqPP4xK R#5ir,r7hexZ.0Zdr@r) Z-Fido2Server.register_begin..s>,=q ,=&()r[Z resident_keyrYN) rHrVr.Zpub_key_cred_paramsrOZexclude_credentialsZauthenticator_selectionrI extensions public_key)rPr3r4rA_make_internal_staterRrSjoinrrrHrr?rOZanyrrI) rTrVrWrXrYr[r.rc descriptorsstates &&&&&&&& r)register_beginZFido2Server.register_begins4&&&@A A' 2 ' 4 )))G ?ii>K,=,=2,=>> ? &=ww6@@F'(,(?(? LL(3 8 8 1 75M)A.?" $ 0 0)/ 6 9  r+cr )r!responsez(RegistrationResponse | Mapping[str, Any]r$rr&r'r(r)r*rLs 44;4  4r+c s\P!V4pVPPpVPPpVP \ PP8wd \R4hVPVP4'g \R4h\P!\VR,4VP4'g \R4h\P!VP P";'gRVP$P&4'g \R4hVP$P)4'g \R4hVR,\*P,8Xd,VP$P/4'g \R 4hVP0R \2P439d>\6P9R VP: 24VP=WTP>4VP$p\6PAR VPBPDPG4,4V#) zVerify the correctness of the registration data received from the client. :param state: The state data returned by the corresponding `register_begin`. :param response: The registration response from the client. :return: The authenticator data &Incorrect type in CollectedClientData.&Invalid origin in CollectedClientData.r.Wrong challenge in response.r+Wrong RP ID hash in response.User Present flag not set.rYz;User verification required, but User Verified flag not set.NzVerifying attestation of type zNew credential registered: )$rr?rk client_datarCr6rTYPEZCREATEr3rNoriginrbytes_eqr r.rHid_hash auth_data rp_id_hashis_user_presentrREQUIREDis_user_verifiedrIr ZNONErRrSZfmtrQhashinfoZcredential_datar:r_)rTrirkZ registrationrqrCrvs&&& r)register_completeZFido2Server.register_completes,55h? "++77 )22EE   277>> >EF F||K..//EF F%% 5- . 0E0E  ;< <%% GGOO " "s$6$@$@$K$K  <= =!++;;==9: : % &*E*N*N N&00AACCM    D*I*N*N#O O LL9:L:P:P9QR S  $ $%79I9I J'00  )''5599; < r+crG) r!rWr>rYrZr.r/r$z$tuple[CredentialRequestOptions, Any]r&r'r(r)r*rLs5* *  T* > *  *  .* r+c  s^\V4p\V4pVPW24pVf\P R4M2\P RRP RV44,4\ \VVPVPPVVVR7R7V3#)aReturn a PublicKeyCredentialRequestOptions assertion object and the internal state dictionary that needs to be passed as is to the corresponding `authenticate_complete` call. :param credentials: The list of previously registered credentials, these can be of type AttestedCredentialData, or PublicKeyCredentialDescriptor. :param user_verification: The desired USER_VERIFICATION level. :param challenge: A custom challenge to sign and verify or None to use OS-specific random bytes. :return: Assertion data, internal state.z/Starting new authentication without credentialsz.Starting new authentication, for credentials: r\c3r]r,r^r`r@r)raZ1Fido2Server.authenticate_begin..3s< 1DDHHJJ rb)r.rOr"Zallow_credentialsrYrcrd) r4rArfrRrSrgrrrOrHr7)rTrWrYr.rcrhris&&&&& r)authenticate_beginZFido2Server.authenticate_begins&( 2 ' 4 )))G   LLJ K LL@))< <<=  %<' LL''**&1&7)     r+crB)r!rWz Sequence[AttestedCredentialData]rkz*AuthenticationResponse | Mapping[str, Any]r$rr&r'r(r)r*rLDs*2323623= 23 23r+c sj\P!V4pVPpVPPpVPP pVPP pVP\PP8wd \R4hVPVP4'g \R4h\VR,4VP8wd \R4h\ P"!VP$P&;'gRVP(4'g \R4hVP+4'g \R4hVR,\,P.8Xd"VP14'g \R 4hVFkp V P2V8XgKV P4P7WvP8,V4\<P?R TPA4 24T u# \R 4h \:d \R 4hi;i) aVerify the correctness of the assertion data received from the client. :param state: The state data returned by the corresponding `register_begin`. :param credentials: The list of previously registered credentials. :param credential_id: The credential id from the client response. :param client_data: The client data. :param auth_data: The authenticator data. :param signature: The signature provided by the client.rlrmr.rnr+rorprYz;User verification required, but user verified flag not set.zInvalid signature.zCredential authenticated: zUnknown credential ID.)!rr?Zraw_idrkrqZauthenticator_data signaturer6rrrZGETr3rNrsr r.rrtrHrurwrxrryrzr:reZverifyr{_InvalidSignaturerRr|r_) rTrirWrkZauthenticationr:rqrvrZcreds &&&& r)authenticate_completeZ!Fido2Server.authenticate_completeDs"099(C&-- $--99 "++>> "++55   277;; ;EF F||K..//EF F % , -1F1F F;< <%%dggoo&<&<i>R>RSS<= =((**9: : % &*E*N*N N..00M  D!!]2;OO**97G7G+GS 89J9J9L8MNO  122 );$%9::;s 8,HH2cr )r!r.r0rYrZr&r'r(r)r*rLys   -O r+c s R\V4RV/#r.rY)r rr;r)rfZ Fido2Server._make_internal_statexs  2 !2  r+)rNrQrPrIrHrO)NNN)NNNNNN)NNNN) __name__Z __module__Z __qualname__Z__firstlineno__Z__doc__rUrjr}r~rZ staticmethodrfZ__static_attributes__r&r+r)rFrF}s: C*B H4l* X23h  r+rFr,)8Z __future__rZloggingr1ZtypingrrrrZcryptography.exceptionsrrZcryptography.hazmat.primitivesrZcoserZrpidr Zutilsr r Zwebauthnr r rrrrrrrrrrrrrrrrrrZ getLoggerrrRr0ZVerifyAttestationr#Zboolr%r-r4r<rArErFr&r+r)rs8# 33I81.   8 $/7=>t $ ,&  B B r+