mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-06-09 16:01:24 -04:00
bafcc02b7d
This links up the `get_webauthn_credentials_for_user` and
`create_webauthn_credential_for_user` methods of the user api client to
notifications-api.
To send data to the API we need strings to be unicode, so we call
decode('utf-8') on base64 objects.
Co-authored-by: Leo Hemsted <leo.hemsted@digital.cabinet-office.gov.uk>
52 lines
1.5 KiB
Python
52 lines
1.5 KiB
Python
import base64
|
|
|
|
from fido2 import cbor
|
|
from fido2.client import ClientData
|
|
from fido2.ctap2 import AttestationObject, AttestedCredentialData
|
|
from flask import current_app
|
|
|
|
from app.models import JSONModel
|
|
|
|
|
|
class WebAuthnCredential(JSONModel):
|
|
ALLOWED_PROPERTIES = {
|
|
'id',
|
|
'name',
|
|
'credential_data', # contains public key and credential ID for auth
|
|
'registration_response', # sent to API for later auditing (not used)
|
|
'created_at',
|
|
'updated_at'
|
|
}
|
|
|
|
@classmethod
|
|
def from_registration(cls, state, response):
|
|
server = current_app.webauthn_server
|
|
|
|
auth_data = server.register_complete(
|
|
state,
|
|
ClientData(response["clientDataJSON"]),
|
|
AttestationObject(response["attestationObject"]),
|
|
)
|
|
|
|
return cls({
|
|
'name': 'Unnamed key',
|
|
'credential_data': base64.b64encode(
|
|
cbor.encode(auth_data.credential_data),
|
|
).decode('utf-8'),
|
|
'registration_response': base64.b64encode(
|
|
cbor.encode(response),
|
|
).decode('utf-8')
|
|
})
|
|
|
|
def to_credential_data(self):
|
|
return AttestedCredentialData(
|
|
cbor.decode(base64.b64decode(self.credential_data.encode()))
|
|
)
|
|
|
|
def serialize(self):
|
|
return {
|
|
'name': self.name,
|
|
'credential_data': self.credential_data,
|
|
'registration_response': self.registration_response,
|
|
}
|