+ h9]cs^RIHt^RIt^RIt^RIHtHtHtHt^RI H t H t ^RI H t ^RIHtHtHt^RIHt^RIHt^R IHtHtHt^R IHt^R IHt^R IHt^R I H!t!H"t"^RI#H$t$H%t%^RI&H't'^RI(H)t)H*t*]PV!],4t-RRlt.!RR]']/,4t0]!RRR7!RR]044t1]!RRR7!RR]044t2]!RRR7!RR]044t3!RR4t4R#) i) annotationsN)Field dataclassfieldfields)IntEnumunique)Event)AnyCallableMapping)default_backend)hashes)Cipher algorithmsmodes)HKDF)cbor)CoseKey) CtapDevice CtapError) CAPABILITYCTAPHID)_DataClassMapping)AaguidAuthenticatorDatacV^8dQhRR/#)returnzdict[int, Any]Zformat"5/usr/lib/python3.14/site-packages/fido2/ctap2/base.py __annotate__r!4sDD^DcsZ\V^4UUu/uF wrVfK WbK upp#uuppi)zConstructs a dict from a list of arguments for sending a CBOR command. None elements will be omitted. :param params: Arguments, in order, to add to the command. :return: The input parameters as a dict. )Z enumerate)ZparamsZiZvs* r argsr#4s-'vq1 C1TQQDAD1 CC Cs''cs,]tRt^>t]RRl4tRtR#)_CborDataObjectc V^8dQhRRRR/#)rrrrintrrrr r!Z_CborDataObject.__annotate__@s,,5,S,r"c sD\V4PV4^,#))rZindex)clsrs&&r _get_field_keyZ_CborDataObject._get_field_key?sc{  '!++r"rN)__name__ __module__ __qualname____firstlineno__ classmethodr)__static_attributes__rr"r r$r$>s,,r"r$FT)ZeqZfrozencsN]tRt^Dt$RtR]R&]!]R7tR]R&] Pt R]R&]!] R7t R]R &R tR ]R &]!]R7tR ]R&^tR ]R&^tR ]R&]!]R7tR]R&]!]R7tR]R&^tR ]R&RtR]R&^tR ]R&^tR ]R&^tR ]R&^tR ]R&^tR ]R&^tR ]R&]!] R7tR]R&R tR!]R"&]!]R7tR ]R#&]!R$R7tR]R%&R t R!]R&&Rt!R]R'&R t"R(]R)&]!]R7t#R]R*&R t$R+]R,&R t%R(]R-&^?t&R ]R.&R/R0lt'R1t(R #)2InfoaBinary CBOR encoded response data returned by the CTAP2 GET_INFO command. See: https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#authenticatorGetInfo for descriptions of these fields. Note that while many fields are optional when returned by the authenticator, this dataclass uses defaults to represent a missing value such as empty lists or dicts, or the integer value 0. These are used rather than None for omitted values as long as this can be done without introducing any practical ambiguity. This also means that several of these fields may have a 0 value even if the specification states that they should be non-zero when returned from the authenticator. :param _: The binary content of the Info data. z list[str]ZversionsZdefault_factory extensionsraaguidzdict[str, bool]optionsir& max_msg_sizez list[int]pin_uv_protocolsmax_creds_in_listmax_cred_id_length transportszlist[dict[str, Any]]rmax_large_blobFboolforce_pin_changemin_pin_lengthfirmware_versionmax_cred_blob_lengthmax_rpids_for_min_pinpreferred_platform_uv_attempts uv_modalitydictcertificationsN int | Noneremaining_disc_creds vendor_prototype_config_commandsc sR.#)Zpackedrrr"r ZZ Info.lsH:r"attestation_formatsuv_count_since_pinlong_touch_for_reset bytes | Noneenc_identifiertransports_for_reset bool | Nonepin_complexity_policypin_complexity_policy_urlmax_pin_lengthcr%)r pin_tokenbytesrrKrrrr r!ZInfo.__annotate__us///,/r"c sVP'gR#VPR,VPR,r2\4p\\P!4^RRVR7P V4p\ \P!V4\P!V4V4P4pVPV4VP4,#)z6Decrypt the device identifier using a persistent PUAT.N:NN:rTNNs encIdentifier)Z algorithmlengthZsaltinfoZbackends )rLr rr ZSHA256Zderiver rZAESrZCBCZ decryptorZupdateZfinalize)selfrRZivZctZbeZsecretZdecs&& r get_identifierZInfo.get_identifierus"""$$S)4+>+>s+CB  mmo!  &  Z^^F+UYYr]B?IIKzz"~ ..r"r))r*r+r,r-__doc____annotations__rZlistr2rZNONEr3rCr4r5r6r7r8r9rr:r<r=r>r?r@rArBrDrFrGrHrIrJrLrMrOrPrQrXr/rr"r r0r0Dst"!$7J 7[[FF $T:G_:L#"'"=i=s!$7J 7',T'BJ$BNC"d"NCc !#!!"3"*+"C+K 6ND6'+*+272M$iM%*;M%NN%) )!&$&#'NL'&+D&A)A)-;-.2|2NC//r"r0csr]tRt^t$RtR]R&R]R&R]R&RtR ]R &RtR ]R &]!] R 7t R]R&Rt R#)AttestationResponseaBinary CBOR encoded attestation object. :param _: The binary representation of the attestation object. :ivar fmt: The type of attestation used. :ivar auth_data: The attested authenticator data. :ivar att_stmt: The attestation statement. :ivar ep_att: Whether an enterprise attestation was returned for this credential. :ivar large_blob_key: The largeBlobKey for the credential, if requested. :ivar unsigned_extension_outputs: Any unsigned outputs of extensions. strZfmtr auth_datazdict[str, Any]Zatt_stmtNrNep_attrKlarge_blob_keyr1unsigned_extension_outputsr) r*r+r,r-rYrZr^r_rrCr`r/rr"r r[r[s>  H  FK#'NL'16t1LLr"r[cs]tRt^t$RtR]R&R]R&R]R&RtR ]R &RtR ]R &RtR ]R&Rt R]R&RRlt ] RRl4t Rt R#)AssertionResponseaBinary CBOR encoded assertion response. :param _: The binary representation of the assertion response. :ivar credential: The credential used for the assertion. :ivar auth_data: The authenticator data part of the response. :ivar signature: The digital signature of the assertion. :ivar user: The user data of the credential. :ivar number_of_credentials: The total number of responses available (only set for the first response, if > 1). Mapping[str, Any] credentialrr]rS signatureNzdict[str, Any] | NoneuserrEnumber_of_credentialsrN user_selectedrKr_cr%)r client_paramrS public_keyrrrrr r!AssertionResponse.__annotate__sII5IgIr"c s`VPVPV,VP4R#)zVerify the digital signature of the response with regard to the client_param, using the given public key. :param client_param: SHA256 hash of the ClientData used for the request. :param public_key: The public key of the credential, to verify. N)verifyr]rd)rWrhri&&&r rkZAssertionResponse.verifys! $..<7Hr"c$V^8dQhRRRRRR/#)r app_paramrSrcrbrz'AssertionResponse'rrrr r!rjs$   +<  r"c sV!V\P!VVP\PP,VP 4VP R7#)a.Create an AssertionResponse from a CTAP1 SignatureData instance. :param app_param: SHA256 hash of the RP ID used for the CTAP1 request. :param credential: Credential used for the CTAP1 request (from the allowList). :param authentication: The CTAP1 signature data. :return: The assertion response. )rcr]rd)rZcreateZ user_presenceZFLAGZUPZcounterrd)r(rnrcZauthentications&&&&r from_ctap1ZAssertionResponse.from_ctap1sT!'..,,/@/E/E/H/HH&& %..  r"r)r*r+r,r-rYrZrerfrgr_rkr.ror/rr"r raras_ "!  "&D &(,:,!%M;%#'NL'I  r"racsp]tRt^tRt]!RR]44tR&RRllt] RRl4t R'R RR R/R R lllt R Rlt R(R RR R/RRlllt R RR R/RRlltR(R RR R/RRllltR)R RR R/RRllltRRltRRltR*RRlltR(R RR R/RRllltR RR R/RR lltR)R!R"lltR*R#R$lltR%tR#)+Ctap2zImplementation of the CTAP2 specification. :param device: A CtapHidDevice handle supporting CTAP2. :param strict_cbor: Validate that CBOR returned from the Authenticator is canonical, defaults to True. csJ]tRt^t^t^t^t^t^t^t ^ t ^ t ^ t ^ t ^ t^@t^AtRtR#) Ctap2.CMDrN)r*r+r,r-MAKE_CREDENTIAL GET_ASSERTIONGET_INFO CLIENT_PINRESETGET_NEXT_ASSERTIONBIO_ENROLLMENTCREDENTIAL_MGMT SELECTION LARGE_BLOBSCONFIGBIO_ENROLLMENT_PRECREDENTIAL_MGMT_PREr/rr"r CMDrqsF  !  !"r"rcr%)rdevicer strict_cborr;rrrr r!Ctap2.__annotate__s%%z%%r"c sVP\P,'g \R4hWnW nVP 4VnR#)zDevice does not support CTAP2.N)Z capabilitiesrCBOR ValueErrorr _strict_cborget_info_info)rWrrrlr __init__ZCtap2.__init__s;""Z__44=> > ']]_ r"crrrr0rrrr r!rsdr"c sVP#)zGet a cached Info object which can be used to determine capabilities. :rtype: Info :return: The response of calling GetAuthenticatorInfo. )rrW&r rVZ Ctap2.infoszzr"Nevent on_keepalivec ,V^8dQhRRRRRRRRR R /#) rcmdr&dataMapping[int, Any] | Noner Event | NonerCallable[[int], None] | NonerMapping[int, Any]rrrr r!rs<$7$7 $7'$7  $7 3 $7 $7r"c sL\P!RV4pVeV\P!V4, pVPP \ PWSV4pV^,pV^8wd \V4hVR,pV'g/#\P!V4p VP'dJ\P!V 4p W8wd.\RVP4 RV P4 24h\V \4'dV #\R4h)aFSends a CBOR message to the device, and waits for a response. :param cmd: The command byte of the request. :param data: The payload to send (to be CBOR encoded). :param event: Optional threading.Event used to cancel the request. :param on_keepalive: Optional function called when keep-alive is sent by the authenticator. z>B:r'NNz,Non-canonical CBOR from Authenticator. Got: z Expected: zDecoded value of wrong type)structZpackrZencoderZcallrrrZdecoderrZhexZ isinstancer Z TypeError) rWrrrrZrequestZresponseZstatusZencZdecodedZexpecteds &&&$$ r send_cborZCtap2.send_cbors ++dC(   t{{4( (G;;##GLL',O! T>F# #rlI++c"    {{7+H GGI;l8<<>2BD gw ' 'N566r"crrrrrr r!r!sBB$Br"c z\PVP\PP 44#)zFCTAP2 getInfo command. :return: Information about the authenticator. )r0 from_dictrrprrtrrr rZCtap2.get_info!s& ~~dnnUYY-?-?@AAr"csDV^8dQhRRRRRRRRRRR RR R R R RRRRRR/ #)rpin_uv_protocolr&sub_cmd key_agreementr pin_uv_paramrK new_pin_enc pin_hash_enc permissionsrEpermissions_rpidz str | Nonerrrrrrrrrr r!r(sx0 0 0 0 0 0 # 0 " 0 #0  0 %0 0 30  0 r"c  sVP\PP\ VVVVVVRRVV4 V V R7#)aCTAP2 clientPin command, used for various PIN operations. This method is not intended to be called directly. It is intended to be used by an instance of the PinProtocolV1 class. :param pin_uv_protocol: The PIN/UV protocol version to use. :param sub_cmd: A clientPin sub command. :param key_agreement: The keyAgreement parameter. :param pin_uv_param: The pinAuth parameter. :param new_pin_enc: The newPinEnc parameter. :param pin_hash_enc: The pinHashEnc parameter. :param permissions: The permissions parameter. :param permissions_rpid: The permissions RPID parameter. :param event: Optional threading.Event used to cancel the request. :param on_keepalive: Optional callback function to handle keep-alive messages from the authenticator. :return: The response of the command, decoded. Nrr)rrprrur#) rWrrrrrrrrrrs &&&&&&&&&$$r client_pinZCtap2.client_pin(sV@~~ II   %  r"crmrrrrrrZNonerrrr r!rZs* 9 9 93 9  9r"c sVP\PPWR7\P R4R#)zCTAP2 reset command, erases all credentials and PIN. :param event: Optional threading.Event object used to cancel the request. :param on_keepalive: Optional callback function to handle keep-alive messages from the authenticator. rz!Reset completed - All data erasedN)rrprrvloggerrVrWrr&$$r resetZ Ctap2.resetZs) uyyeO 78r"csLV^8dQhRRRRRRRRRR R R R R R RRRRRRRRRRR/ #)rclient_data_hashrSrprbre key_paramszlist[Mapping[str, Any]] exclude_listlist[Mapping[str, Any]] | Noner2Mapping[str, Any] | Noner4rrKrrEenterprise_attestationrrrrrr[rrrr r!ris4 4 4  4  4 , 4 5 4 -4 *4 #4 $4 !+4 4 34  4 r"c  s\PR4\PVP \ P P\VVVVVVVVV V 4 V V R74#)a0CTAP2 makeCredential operation. :param client_data_hash: SHA256 hash of the ClientData. :param rp: PublicKeyCredentialRpEntity parameters. :param user: PublicKeyCredentialUserEntity parameters. :param key_params: List of acceptable credential types. :param exclude_list: Optional list of PublicKeyCredentialDescriptors. :param extensions: Optional dict of extensions. :param options: Optional dict of options. :param pin_uv_param: Optional PIN/UV auth parameter. :param pin_uv_protocol: The version of PIN/UV protocol used, if any. :param enterprise_attestation: Whether or not to request Enterprise Attestation. :param event: Optional threading.Event used to cancel the request. :param on_keepalive: Optional callback function to handle keep-alive messages from the authenticator. :return: The new credential. zCalling CTAP2 make_credentialr) rdebugr[rrrprrrr#) rWrrrerrr2r4rrrrrs &&&&&&&&&&&$$r make_credentialZCtap2.make_credentialisqB  45",, NN ))$  #* )    r"cs@V^8dQhRRRRRRRRR RR R R R RRRRRR/ #)rrp_idr\rrS allow_listrr2rr4rrKrrErrrrrrarrrr r!rsn+ + +  + 3 + - + * + #+ $+ + 3+  + r"c s\PR4\PVP \ P P\VVVVVVV4VV R74#)afCTAP2 getAssertion command. :param rp_id: The RP ID of the credential. :param client_data_hash: SHA256 hash of the ClientData used. :param allow_list: Optional list of PublicKeyCredentialDescriptors. :param extensions: Optional dict of extensions. :param options: Optional dict of options. :param pin_uv_param: Optional PIN/UV auth parameter. :param pin_uv_protocol: The version of PIN/UV protocol used, if any. :param event: Optional threading.Event used to cancel the request. :param on_keepalive: Optional callback function to handle keep-alive messages from the authenticator. :return: The new assertion. zCalling CTAP2 get_assertionr) rrrarrrprrsr#) rWrrrr2r4rrrrs &&&&&&&&$$r get_assertionZCtap2.get_assertionsg6  23 ** NN ''$ #)    r"cr)rrrarrrr r!rsYY$5Yr"c r)zQCTAP2 getNextAssertion command. :return: The next available assertion response. )rarrrprrwrrr get_next_assertionZCtap2.get_next_assertions( !**4>>%)):V:V+WXXr"cr)rrzlist[AssertionResponse]rrrr r!rs  1H r"c sVP!V/VBp\^VP;'g^4Uu.uFpVP4NK ppV.V,#uupi)zeConvenience method to get list of assertions. See get_assertion and get_next_assertion for details. )rZrangerfr)rWr#ZkwargsZfirstZ_Zrests&*, r get_assertionsZCtap2.get_assertionssl ""D3F31e99>>Q? ?  # # %?  w~  sAc r rrr&sub_cmd_paramsrrrErrKrrrrrr r!rs<     1  $  #    r"c  s(RVPP9d\PPpMARVPP9d\PP pM \ R4hVPV\WW444#)aCTAP2 credentialManagement command, used to manage resident credentials. NOTE: This implements the current draft version of the CTAP2 specification and should be considered highly experimental. This method is not intended to be called directly. It is intended to be used by an instance of the CredentialManagement class. :param sub_cmd: A CredentialManagement sub command. :param sub_cmd_params: Sub command specific parameters. :param pin_uv_protocol: PIN/UV auth protocol version used. :param pin_uv_param: PIN/UV Auth parameter. ZcredMgmtZcredentialMgmtPreviewz9Credential Management not supported by this Authenticator) rVr4rprryr~rrr#)rWrrrrrs&&&&& r credential_mgmtZCtap2.credential_mgmtsv* ** *))++C $ (9(9 9))//CK ~~  / H  r"cs<V^8dQhRRRRRRRRRRR R R R R RRR/ #)rmodalityrErrrrrrK get_modalityrNrrrrrrrrrr r!rsd. . . . 1 . $ . # . ". . 3.  . r"c  s6RVPP9d\PPp MARVPP9d\PP p M \ R4hVPV \VVVVVV4VVR7#)aCTAP2 bio enrollment command. Used to provision/enumerate/delete bio enrollments in the authenticator. NOTE: This implements the current draft version of the CTAP2 specification and should be considered highly experimental. This method is not intended to be called directly. It is intended to be used by an instance of the BioEnrollment class. :param modality: The user verification modality being used. :param sub_cmd: A BioEnrollment sub command. :param sub_cmd_params: Sub command specific parameters. :param pin_uv_protocol: PIN/UV protocol version used. :param pin_uv_param: PIN/UV auth param. :param get_modality: Get the user verification type modality. Z bioEnrollZuserVerificationMgmtPreviewz)Authenticator does not support Bio Enrollr) rVr4rprrxr}rrr#) rWrrrrrrrrrs &&&&&&&$$ r bio_enrollmentZCtap2.bio_enrollments8 $))++ +))**C *dii.?.? ?))..CHI I~~    %  r"crmrrrrr r!r1s/TTT3 T  Tr"c s\VP\PPWR7R#)aACTAP2 authenticator selection command. This command allows the platform to let a user select a certain authenticator by asking for user presence. :param event: Optional threading.Event used to cancel the request. :param on_keepalive: Optional callback function to handle keep-alive messages from the authenticator. rN)rrprrzrrr selectionZCtap2.selection1s uyy**%Sr"cs4V^8dQhRRRRRRRRRRR RR R /#) roffsetr&getrEsetrKrUrrrrrrrr r!rBsP        #  $   r"c  slVP\PP\ W#WWV44#)aCTAP2 authenticator large blobs command. This command is used to read and write the large blob array. This method is not intended to be called directly. It is intended to be used by an instance of the LargeBlobs class. :param offset: The offset of where to start reading/writing data. :param get: Optional (max) length of data to read. :param set: Optional data to write. :param length: Length of the payload in set. :param pin_uv_protocol: PIN/UV protocol version used. :param pin_uv_param: PIN/UV auth param. )rrprr{r#)rWrrrrUrrs&&&&&&&r large_blobsZCtap2.large_blobsBs..~~ II ! ! 6< I  r"c rrrrrr r!r^s<   1 $  #    r"c  sjVP\PP\ WW444#)aCTAP2 authenticator config command. This command is used to configure various authenticator features through the use of its subcommands. This method is not intended to be called directly. It is intended to be used by an instance of the Config class. :param sub_cmd: A Config sub command. :param sub_cmd_params: Sub command specific parameters. :param pin_uv_protocol: PIN/UV auth protocol version used. :param pin_uv_param: PIN/UV Auth parameter. )rrprr|r#)rWrrrrs&&&&&r configZ Ctap2.config^s,(~~ II   / H  r")rrr)T)N)NNNNNN)NNNNN)NNN)r*r+r,r-rYrrrrZpropertyrVrrrrrrrrrrrrrr/rr"r rprps1 #g# # %$7 # $7 6: $7$7LB0 #0 6:0 0 d 9# 96: 94 #4 6:4 4 l+ #+ 6:+ + ZY   D. #. 6:. . `T#T6: T" 8  r"rp)5Z __future__rZloggingrZ dataclassesrrrrZenumrrZ threadingrZtypingrr r Zcryptography.hazmat.backendsr Zcryptography.hazmat.primitivesr Z&cryptography.hazmat.primitives.ciphersr rrZ'cryptography.hazmat.primitives.kdf.hkdfrZrZcoserZctaprrZhidrrZutilsrZwebauthnrrZ getLoggerr*rr#r&r$r0r[rarprr"r rs8# 77 ))81LL8(%%0   8 $D,',,  eD!@/?@/"@/F eD!M/M"M( eD!1 1 "1 hc c r"