Add Nix flake for mciasctl and mciasgrpcctl

Vendor dependencies and expose control program binaries via
nix build. Uses nixpkgs-unstable for Go 1.26 support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vendor/github.com/go-webauthn/webauthn/LICENSE

@@ -0,0 +1,26 @@
+Copyright (c) 2025 github.com/go-webauthn/webauthn authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/go-webauthn/webauthn/metadata/const.go

@@ -0,0 +1,41 @@
+package metadata
+
+const (
+	// ProductionMDSRoot is the root certificate for the MDS.
+	//
+	// See: https://secure.globalsign.com/cacert/root-r3.crt
+	ProductionMDSRoot = "MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmmKPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9f"
+
+	// ProductionMDSURL is the Production MDS URL.
+	ProductionMDSURL = "https://mds.fidoalliance.org"
+
+	// ConformanceMDSRoot is the root certificate for the MDS Conformance Suite.
+	//
+	// See: https://mds3.fido.tools/pki/MDS3ROOT.crt
+	ConformanceMDSRoot = "MIICaDCCAe6gAwIBAgIPBCqih0DiJLW7+UHXx/o1MAoGCCqGSM49BAMDMGcxCzAJBgNVBAYTAlVTMRYwFAYDVQQKDA1GSURPIEFsbGlhbmNlMScwJQYDVQQLDB5GQUtFIE1ldGFkYXRhIDMgQkxPQiBST09UIEZBS0UxFzAVBgNVBAMMDkZBS0UgUm9vdCBGQUtFMB4XDTE3MDIwMTAwMDAwMFoXDTQ1MDEzMTIzNTk1OVowZzELMAkGA1UEBhMCVVMxFjAUBgNVBAoMDUZJRE8gQWxsaWFuY2UxJzAlBgNVBAsMHkZBS0UgTWV0YWRhdGEgMyBCTE9CIFJPT1QgRkFLRTEXMBUGA1UEAwwORkFLRSBSb290IEZBS0UwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASKYiz3YltC6+lmxhPKwA1WFZlIqnX8yL5RybSLTKFAPEQeTD9O6mOz+tg8wcSdnVxHzwnXiQKJwhrav70rKc2ierQi/4QUrdsPes8TEirZOkCVJurpDFbXZOgs++pa4XmjYDBeMAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQGcfeCs0Y8D+lh6U5B2xSrR74eHTAfBgNVHSMEGDAWgBQGcfeCs0Y8D+lh6U5B2xSrR74eHTAKBggqhkjOPQQDAwNoADBlAjEA/xFsgri0xubSa3y3v5ormpPqCwfqn9s0MLBAtzCIgxQ/zkzPKctkiwoPtDzI51KnAjAmeMygX2S5Ht8+e+EQnezLJBJXtnkRWY+Zt491wgt/AwSs5PHHMv5QgjELOuMxQBc="
+
+	// ExampleMDSRoot is the example root certificate for the MDS.
+	//
+	// See: https://fidoalliance.org/specs/mds/fido-metadata-service-v3.1-ps-20250521.html#sctn-examples
+	ExampleMDSRoot = "MIIGGTCCBAGgAwIBAgIUdT9qLX0sVMRe8l0sLmHd3mZovQ0wDQYJKoZIhvcNAQELBQAwgZsxHzAdBgNVBAMMFkVYQU1QTEUgTURTMyBURVNUIFJPT1QxIjAgBgkqhkiG9w0BCQEWE2V4YW1wbGVAZXhhbXBsZS5jb20xFDASBgNVBAoMC0V4YW1wbGUgT1JHMRAwDgYDVQQLDAdFeGFtcGxlMQswCQYDVQQGEwJVUzELMAkGA1UECAwCTVkxEjAQBgNVBAcMCVdha2VmaWVsZDAeFw0yMTA0MTkxMTM1MDdaFw00ODA5MDQxMTM1MDdaMIGbMR8wHQYDVQQDDBZFWEFNUExFIE1EUzMgVEVTVCBST09UMSIwIAYJKoZIhvcNAQkBFhNleGFtcGxlQGV4YW1wbGUuY29tMRQwEgYDVQQKDAtFeGFtcGxlIE9SRzEQMA4GA1UECwwHRXhhbXBsZTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1ZMRIwEAYDVQQHDAlXYWtlZmllbGQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDDjF5wyEWuhwDHsZosGdGFTCcI677rW881vV+UfW38J+K2ioFFNeGVsxbcebK6AVOiCDPFj0974IpeD9SFOhwAHoDu/LCfXdQWp8ZgQ91ULYWoW8o7NNSp01nbN9zmaO6/xKNCa0bzjmXoGqglqnP1AtRcWYvXOSKZy1rcPeDv4Dhcpdp6W72fBw0eWIqOhsrItuY2/N8ItBPiG03EX72nACq4nZJ/nAIcUbER8STSFPPzvE97TvShsi1FD8aO6l1WkR/QkreAGjMI++GbB2Qc1nN9Y/VEDbMDhQtxXQRdpFwubTjejkN9hKOtF3B71YrwIrng3V9RoPMFdapWMzSlI+WWHog0oTj1PqwJDDg7+z1I6vSDeVWAMKr9mq1w1OGNzgBopIjd9lRWkRtt2kQSPX9XxqS4E1gDDr8MKbpM3JuubQtNCg9D7Ljvbz6vwvUrbPHH+oREvucsp0PZ5PpizloepGIcLFxDQqCulGY2n7Ahl0JOFXJqOFCaK3TWHwBvZsaY5DgBuUvdUrwtgZNg2eg2omWXEepiVFQn3Fvj43Wh2npPMgIe5P0rwncXvROxaczd4rtajKS1ucoB9b9iKqM2+M1y/FDIgVf1fWEHwK7YdzxMlgOeLdeV/kqRU5PEUlLU9a2EwdOErrPbPKZmIfbs/L4B3k4zejMDH3Y+ZwIDAQABo1MwUTAdBgNVHQ4EFgQU8sWwq1TrurK7xMTwO1dKfeJBbCMwHwYDVR0jBBgwFoAU8sWwq1TrurK7xMTwO1dKfeJBbCMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAFw6M1PiIfCPIBQ5EBUPNmRvRFuDpolOmDofnf/+mv63LqwQZAdo/W8tzZ9kOFhq24SiLw0H7fsdG/jeREXiIZMNoW/rA6Uac8sU+FYF7Q+qp6CQLlSQbDcpVMifTQjcBk2xh+aLK9SrrXBqnTAhwS+offGtAW8DpoLuH4tAcQmIjlgMlN65jnELCuqNR/wpA+zch8LZW8saQ2cwRCwdr8mAzZoLbsDSVCHxQF3/kQjPT7Nao1q2iWcY3OYcRmKrieHDP67yeLUbVmetfZis2d6ZlkqHLB4ZW1xX4otsEFkuTJA3HWDRsNyhTwx1YoCLsYut5Zp0myqPNBq28w6qGMyyoJN0Z4RzMEO3R6i/MQNfhK55/8O2HciM6xb5t/aBSuHPKlBDrFWhpRnKYkaNtlUo35qV5IbKGKau3SdZdSRciaXUd/p81YmoF01UlhhMz/Rqr1k2gyA0a9tF8+awCeanYt5izl8YO0FlrOU1SQ5UQw4szqqZqbrf4e8fRuU2TXNx4zk+ImE7WRB44f6mSD746ZCBRogZ/SA5jUBu+OPe4/sEtERWRcQD+fXgce9ZEN0+peyJIKAsl5Rm2Bmgyg5IoyWwSG5W+WekGyEokpslou2Yc6EjUj5ndZWz5EiHAiQ74hNfDoCZIxVVLU3Qbp8a0S1bmsoT2JOsspIbtZUg="
+)
+
+const (
+	HeaderX509URI         = "x5u"
+	HeaderX509Certificate = "x5c"
+)
+
+var (
+	errIntermediateCertRevoked = &Error{
+		Type:    "intermediate_revoked",
+		Details: "Intermediate certificate is on issuers revocation list",
+	}
+	errLeafCertRevoked = &Error{
+		Type:    "leaf_revoked",
+		Details: "Leaf certificate is on issuers revocation list",
+	}
+	errCRLUnavailable = &Error{
+		Type:    "crl_unavailable",
+		Details: "Certificate revocation list is unavailable",
+	}
+)

vendor/github.com/go-webauthn/webauthn/metadata/decode.go

@@ -0,0 +1,290 @@
+package metadata
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-viper/mapstructure/v2"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/go-webauthn/x/revoke"
+)
+
+// NewDecoder returns a new metadata decoder.
+func NewDecoder(opts ...DecoderOption) (decoder *Decoder, err error) {
+	decoder = &Decoder{
+		client: &http.Client{},
+		parser: jwt.NewParser(),
+		hook:   mapstructure.ComposeDecodeHookFunc(),
+	}
+
+	for _, opt := range opts {
+		if err = opt(decoder); err != nil {
+			return nil, fmt.Errorf("failed to apply decoder option: %w", err)
+		}
+	}
+
+	if decoder.root == "" {
+		decoder.root = ProductionMDSRoot
+	}
+
+	return decoder, nil
+}
+
+// Decoder handles decoding and specialized parsing of the metadata blob.
+type Decoder struct {
+	client                   *http.Client
+	parser                   *jwt.Parser
+	hook                     mapstructure.DecodeHookFunc
+	root                     string
+	ignoreEntryParsingErrors bool
+}
+
+// Parse handles parsing of the raw JSON values of the metadata blob. Should be used after using [Decoder.Decode] or
+// [Decoder.DecodeBytes].
+func (d *Decoder) Parse(payload *PayloadJSON) (metadata *Metadata, err error) {
+	metadata = &Metadata{
+		Parsed: Parsed{
+			LegalHeader: payload.LegalHeader,
+			Number:      payload.Number,
+		},
+	}
+
+	if metadata.Parsed.NextUpdate, err = time.Parse(time.DateOnly, payload.NextUpdate); err != nil {
+		return nil, fmt.Errorf("error occurred parsing next update value '%s': %w", payload.NextUpdate, err)
+	}
+
+	var parsed Entry
+
+	for _, entry := range payload.Entries {
+		if parsed, err = entry.Parse(); err != nil {
+			metadata.Unparsed = append(metadata.Unparsed, EntryError{
+				Error:     err,
+				EntryJSON: entry,
+			})
+
+			continue
+		}
+
+		metadata.Parsed.Entries = append(metadata.Parsed.Entries, parsed)
+	}
+
+	if n := len(metadata.Unparsed); n != 0 && !d.ignoreEntryParsingErrors {
+		return metadata, fmt.Errorf("error occurred parsing metadata: %d entries had errors during parsing", n)
+	}
+
+	return metadata, nil
+}
+
+// Decode the blob from an [io.Reader]. This function will close the [io.ReadCloser] after completing.
+func (d *Decoder) Decode(r io.Reader) (payload *PayloadJSON, err error) {
+	bytes, err := io.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+
+	return d.DecodeBytes(bytes)
+}
+
+// DecodeBytes handles decoding raw bytes. If you have a read closer it's suggested to use [Decoder.Decode].
+func (d *Decoder) DecodeBytes(bytes []byte) (payload *PayloadJSON, err error) {
+	var token *jwt.Token
+
+	if token, err = d.parser.Parse(string(bytes), func(token *jwt.Token) (any, error) {
+		// 2. If the x5u attribute is present in the JWT Header.
+		if _, ok := token.Header[HeaderX509URI].([]any); ok {
+			// Never seen an x5u here, although it is in the spec.
+			return nil, errors.New("x5u encountered in header of metadata TOC payload")
+		}
+
+		// 3. If the x5u attribute is missing, the chain should be retrieved from the x5c attribute.
+		var (
+			x5c, chain []any
+			ok, valid  bool
+		)
+
+		if x5c, ok = token.Header[HeaderX509Certificate].([]any); !ok {
+			// If that attribute is missing as well, Metadata TOC signing trust anchor is considered the TOC signing certificate chain.
+			chain = []any{d.root}
+		} else {
+			chain = x5c
+		}
+
+		// The certificate chain MUST be verified to properly chain to the metadata TOC signing trust anchor.
+		if valid, err = validateChain(d.root, chain); !valid || err != nil {
+			return nil, err
+		}
+
+		// Chain validated, extract the TOC signing certificate from the chain. Create a buffer large enough to hold the
+		// certificate bytes.
+		o := make([]byte, base64.StdEncoding.DecodedLen(len(chain[0].(string))))
+
+		var (
+			n    int
+			cert *x509.Certificate
+		)
+
+		// Decode the base64 certificate into the buffer.
+		if n, err = base64.StdEncoding.Decode(o, []byte(chain[0].(string))); err != nil {
+			return nil, err
+		}
+
+		// Parse the certificate from the buffer.
+		if cert, err = x509.ParseCertificate(o[:n]); err != nil {
+			return nil, err
+		}
+
+		// 4. Verify the signature of the Metadata TOC object using the TOC signing certificate chain
+		// jwt.Parse() uses the TOC signing certificate public key internally to verify the signature.
+		return cert.PublicKey, err
+	}); err != nil {
+		return nil, err
+	}
+
+	var decoder *mapstructure.Decoder
+
+	payload = &PayloadJSON{}
+
+	if decoder, err = mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Metadata:   nil,
+		Result:     payload,
+		DecodeHook: d.hook,
+		TagName:    "json",
+	}); err != nil {
+		return nil, err
+	}
+
+	if err = decoder.Decode(token.Claims); err != nil {
+		return payload, err
+	}
+
+	return payload, nil
+}
+
+// DecoderOption is a representation of a function that can set options within a decoder.
+type DecoderOption func(decoder *Decoder) (err error)
+
+// WithIgnoreEntryParsingErrors is a DecoderOption which ignores errors when parsing individual entries. The values for
+// these entries will exist as an unparsed entry.
+func WithIgnoreEntryParsingErrors() DecoderOption {
+	return func(decoder *Decoder) (err error) {
+		decoder.ignoreEntryParsingErrors = true
+
+		return nil
+	}
+}
+
+// WithRootCertificate overrides the root certificate used to validate the authenticity of the metadata payload.
+func WithRootCertificate(value string) DecoderOption {
+	return func(decoder *Decoder) (err error) {
+		decoder.root = value
+
+		return nil
+	}
+}
+
+func validateChain(root string, chain []any) (bool, error) {
+	oRoot := make([]byte, base64.StdEncoding.DecodedLen(len(root)))
+
+	nRoot, err := base64.StdEncoding.Decode(oRoot, []byte(root))
+	if err != nil {
+		return false, err
+	}
+
+	rootcert, err := x509.ParseCertificate(oRoot[:nRoot])
+	if err != nil {
+		return false, err
+	}
+
+	roots := x509.NewCertPool()
+
+	roots.AddCert(rootcert)
+
+	o := make([]byte, base64.StdEncoding.DecodedLen(len(chain[1].(string))))
+
+	n, err := base64.StdEncoding.Decode(o, []byte(chain[1].(string)))
+	if err != nil {
+		return false, err
+	}
+
+	intcert, err := x509.ParseCertificate(o[:n])
+	if err != nil {
+		return false, err
+	}
+
+	if revoked, ok := revoke.VerifyCertificate(intcert); !ok {
+		issuer := intcert.IssuingCertificateURL
+
+		if issuer != nil {
+			return false, errCRLUnavailable
+		}
+	} else if revoked {
+		return false, errIntermediateCertRevoked
+	}
+
+	ints := x509.NewCertPool()
+	ints.AddCert(intcert)
+
+	l := make([]byte, base64.StdEncoding.DecodedLen(len(chain[0].(string))))
+
+	n, err = base64.StdEncoding.Decode(l, []byte(chain[0].(string)))
+	if err != nil {
+		return false, err
+	}
+
+	leafcert, err := x509.ParseCertificate(l[:n])
+	if err != nil {
+		return false, err
+	}
+
+	if revoked, ok := revoke.VerifyCertificate(leafcert); !ok {
+		return false, errCRLUnavailable
+	} else if revoked {
+		return false, errLeafCertRevoked
+	}
+
+	opts := x509.VerifyOptions{
+		Roots:         roots,
+		Intermediates: ints,
+	}
+
+	_, err = leafcert.Verify(opts)
+
+	return err == nil, err
+}
+
+func mdsParseX509Certificate(value string) (certificate *x509.Certificate, err error) {
+	var n int
+
+	raw := make([]byte, base64.StdEncoding.DecodedLen(len(value)))
+
+	if n, err = base64.StdEncoding.Decode(raw, []byte(strings.TrimSpace(value))); err != nil {
+		return nil, fmt.Errorf("error occurred parsing *x509.certificate: error occurred decoding base64 data: %w", err)
+	}
+
+	if certificate, err = x509.ParseCertificate(raw[:n]); err != nil {
+		return nil, err
+	}
+
+	return certificate, nil
+}
+
+func mdsParseTimePointer(format, value string) (parsed *time.Time, err error) {
+	if value == "" {
+		return nil, nil
+	}
+
+	var p time.Time
+
+	if p, err = time.Parse(format, value); err != nil {
+		return nil, err
+	}
+
+	return &p, nil
+}

vendor/github.com/go-webauthn/webauthn/metadata/doc.go

@@ -0,0 +1,2 @@
+// Package metadata handles metadata validation instrumentation.
+package metadata

vendor/github.com/go-webauthn/webauthn/metadata/passkey_authenticator.go

@@ -0,0 +1,16 @@
+package metadata
+
+// PasskeyAuthenticator is a type that represents the schema from the Passkey Developer AAGUID listing.
+//
+// See: https://github.com/passkeydeveloper/passkey-authenticator-aaguids
+type PasskeyAuthenticator map[string]PassKeyAuthenticatorAAGUID
+
+// PassKeyAuthenticatorAAGUID is a type that represents the individual schema entry from the Passkey Developer AAGUID
+// listing. Used with [PasskeyAuthenticator].
+//
+// See: https://github.com/passkeydeveloper/passkey-authenticator-aaguids
+type PassKeyAuthenticatorAAGUID struct {
+	Name      string `json:"name"`
+	IconDark  string `json:"icon_dark,omitempty"`
+	IconLight string `json:"icon_light,omitempty"`
+}

vendor/github.com/go-webauthn/webauthn/metadata/status.go

@@ -0,0 +1,62 @@
+package metadata
+
+import (
+	"fmt"
+	"strings"
+)
+
+// ValidateStatusReports checks a list of [StatusReport] structs against a list of desired and undesired [AuthenticatorStatus]
+// values. If the reports contain all of the desired and none of the undesired status reports then no error is returned
+// otherwise an error describing the issue is returned.
+func ValidateStatusReports(reports []StatusReport, desired, undesired []AuthenticatorStatus) (err error) {
+	if len(desired) == 0 && (len(undesired) == 0 || len(reports) == 0) {
+		return nil
+	}
+
+	var present, absent []string
+
+	if len(undesired) != 0 {
+		for _, report := range reports {
+			for _, status := range undesired {
+				if report.Status == status {
+					present = append(present, string(status))
+
+					continue
+				}
+			}
+		}
+	}
+
+	if len(desired) != 0 {
+	desired:
+		for _, status := range desired {
+			for _, report := range reports {
+				if report.Status == status {
+					continue desired
+				}
+			}
+
+			absent = append(absent, string(status))
+		}
+	}
+
+	switch {
+	case len(present) == 0 && len(absent) == 0:
+		return nil
+	case len(present) != 0 && len(absent) == 0:
+		return &Error{
+			Type:    "invalid_status",
+			Details: fmt.Sprintf("The following undesired status reports were present: %s", strings.Join(present, ", ")),
+		}
+	case len(present) == 0 && len(absent) != 0:
+		return &Error{
+			Type:    "invalid_status",
+			Details: fmt.Sprintf("The following desired status reports were absent: %s", strings.Join(absent, ", ")),
+		}
+	default:
+		return &Error{
+			Type:    "invalid_status",
+			Details: fmt.Sprintf("The following undesired status reports were present: %s; the following desired status reports were absent: %s", strings.Join(present, ", "), strings.Join(absent, ", ")),
+		}
+	}
+}

vendor/github.com/go-webauthn/webauthn/metadata/types.go

@@ -0,0 +1,373 @@
+package metadata
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// The Provider is an interface which describes the elements required to satisfy validation of metadata.
+type Provider interface {
+	// GetEntry returns a MDS3 payload entry given a AAGUID.
+	GetEntry(ctx context.Context, aaguid uuid.UUID) (entry *Entry, err error)
+
+	// GetValidateEntry returns true if this provider requires an entry to exist with a AAGUID matching the attestation
+	// statement during registration.
+	GetValidateEntry(ctx context.Context) (validate bool)
+
+	// GetValidateEntryPermitZeroAAGUID returns true if attestation statements with zerod AAGUID should be permitted
+	// when considering the result from GetValidateEntry. i.e. if the AAGUID is zeroed, and GetValidateEntry returns
+	// true, and this implementation returns true, the attestation statement will pass validation.
+	GetValidateEntryPermitZeroAAGUID(ctx context.Context) (skip bool)
+
+	// GetValidateTrustAnchor returns true if trust anchor validation of attestation statements is enforced during
+	// registration.
+	GetValidateTrustAnchor(ctx context.Context) (validate bool)
+
+	// GetValidateStatus returns true if the status reports for an authenticator should be validated against desired and
+	// undesired statuses.
+	GetValidateStatus(ctx context.Context) (validate bool)
+
+	// GetValidateAttestationTypes if true will enforce checking that the provided attestation is possible with the
+	// given authenticator.
+	GetValidateAttestationTypes(ctx context.Context) (validate bool)
+
+	// ValidateStatusReports returns nil if the provided authenticator status reports are desired.
+	ValidateStatusReports(ctx context.Context, reports []StatusReport) (err error)
+}
+
+var (
+	ErrNotInitialized = errors.New("metadata: not initialized")
+)
+
+type PublicKeyCredentialParameters struct {
+	Type string                               `json:"type"`
+	Alg  webauthncose.COSEAlgorithmIdentifier `json:"alg"`
+}
+
+type AuthenticatorAttestationTypes []AuthenticatorAttestationType
+
+func (t AuthenticatorAttestationTypes) HasBasicFull() bool {
+	for _, a := range t {
+		if a == BasicFull || a == AttCA {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthenticatorAttestationType - The ATTESTATION constants are 16 bit long integers indicating the specific attestation that authenticator supports.
+// Each constant has a case-sensitive string representation (in quotes), which is used in the authoritative metadata for FIDO authenticators.
+type AuthenticatorAttestationType string
+
+const (
+	// BasicFull - Indicates full basic attestation, based on an attestation private key shared among a class of authenticators (e.g. same model). Authenticators must provide its attestation signature during the registration process for the same reason. The attestation trust anchor is shared with FIDO Servers out of band (as part of the Metadata). This sharing process should be done according to [UAFMetadataService].
+	BasicFull AuthenticatorAttestationType = "basic_full"
+
+	// BasicSurrogate - Just syntactically a Basic Attestation. The attestation object self-signed, i.e. it is signed using the UAuth.priv key, i.e. the key corresponding to the UAuth.pub key included in the attestation object. As a consequence it does not provide a cryptographic proof of the security characteristics. But it is the best thing we can do if the authenticator is not able to have an attestation private key.
+	BasicSurrogate AuthenticatorAttestationType = "basic_surrogate"
+
+	// Ecdaa - Indicates use of elliptic curve based direct anonymous attestation as defined in [FIDOEcdaaAlgorithm]. Support for this attestation type is optional at this time. It might be required by FIDO Certification.
+	Ecdaa AuthenticatorAttestationType = "ecdaa"
+
+	// AttCA - Indicates PrivacyCA attestation as defined in [TCG-CMCProfile-AIKCertEnroll]. Support for this attestation type is optional at this time. It might be required by FIDO Certification.
+	AttCA AuthenticatorAttestationType = "attca"
+
+	// AnonCA In this case, the authenticator uses an Anonymization CA which dynamically generates per-credential attestation certificates such that the attestation statements presented to Relying Parties do not provide uniquely identifiable information, e.g., that might be used for tracking purposes. The applicable [WebAuthn] attestation formats "fmt" are Google SafetyNet Attestation "android-safetynet", Android Keystore Attestation "android-key", Apple Anonymous Attestation "apple", and Apple Application Attestation "apple-appattest".
+	AnonCA AuthenticatorAttestationType = "anonca"
+
+	// None - Indicates absence of attestation.
+	None AuthenticatorAttestationType = "none"
+)
+
+type KeyScope string
+
+const (
+	KeyScopeNone                   KeyScope = ""
+	PublicKeyCredentialSource      KeyScope = "public-key-credential-source" //nolint:gosec
+	DeviceSupplementalPublicKeys   KeyScope = "device-spk"
+	ProviderSupplementalPublicKeys KeyScope = "provider-spk"
+)
+
+type MultiDeviceCredentialSupport string
+
+const (
+	MultiDeviceCredentialUnsupported MultiDeviceCredentialSupport = "unsupported"
+	MultiDeviceCredentialExplicit    MultiDeviceCredentialSupport = "explicit"
+	MultiDeviceCredentialImplicit    MultiDeviceCredentialSupport = "implicit"
+)
+
+// AuthenticatorStatus - This enumeration describes the status of an authenticator model as identified by its AAID and potentially some additional information (such as a specific attestation key).
+// https://fidoalliance.org/specs/mds/fido-metadata-service-v3.1-ps-20250521.html#sctn-authnr-stat
+type AuthenticatorStatus string
+
+const (
+	// NotFidoCertified - This authenticator is not FIDO certified.
+	NotFidoCertified AuthenticatorStatus = "NOT_FIDO_CERTIFIED"
+
+	// FidoCertified - This authenticator has passed FIDO functional certification. This certification scheme is phased out and will be replaced by FIDO_CERTIFIED_L1.
+	FidoCertified AuthenticatorStatus = "FIDO_CERTIFIED"
+
+	// UserVerificationBypass - Indicates that malware is able to bypass the user verification. This means that the authenticator could be used without the user's consent and potentially even without the user's knowledge.
+	//nolint:gosec
+	UserVerificationBypass AuthenticatorStatus = "USER_VERIFICATION_BYPASS"
+
+	// AttestationKeyCompromise - Indicates that an attestation key for this authenticator is known to be compromised. Additional data should be supplied, including the key identifier and the date of compromise, if known.
+	AttestationKeyCompromise AuthenticatorStatus = "ATTESTATION_KEY_COMPROMISE"
+
+	// UserKeyRemoteCompromise - This authenticator has identified weaknesses that allow registered keys to be compromised and should not be trusted. This would include both, e.g. weak entropy that causes predictable keys to be generated or side channels that allow keys or signatures to be forged, guessed or extracted.
+	UserKeyRemoteCompromise AuthenticatorStatus = "USER_KEY_REMOTE_COMPROMISE"
+
+	// UserKeyPhysicalCompromise - This authenticator has known weaknesses in its key protection mechanism(s) that allow user keys to be extracted by an adversary in physical possession of the device.
+	UserKeyPhysicalCompromise AuthenticatorStatus = "USER_KEY_PHYSICAL_COMPROMISE"
+
+	// UpdateAvailable - A software or firmware update is available for the device. Additional data should be supplied including a URL where users can obtain an update and the date the update was published.
+	UpdateAvailable AuthenticatorStatus = "UPDATE_AVAILABLE"
+
+	// Revoked - The FIDO Alliance has determined that this authenticator should not be trusted for any reason, for example if it is known to be a fraudulent product or contain a deliberate backdoor.
+	Revoked AuthenticatorStatus = "REVOKED"
+
+	// SelfAssertionSubmitted - The authenticator vendor has completed and submitted the self-certification checklist to the FIDO Alliance. If this completed checklist is publicly available, the URL will be specified in StatusReportJSON.url.
+	SelfAssertionSubmitted AuthenticatorStatus = "SELF_ASSERTION_SUBMITTED"
+
+	// FidoCertifiedL1 - The authenticator has passed FIDO Authenticator certification at level 1. This level is the more strict successor of FIDO_CERTIFIED.
+	FidoCertifiedL1 AuthenticatorStatus = "FIDO_CERTIFIED_L1"
+
+	// FidoCertifiedL1plus - The authenticator has passed FIDO Authenticator certification at level 1+. This level is the more than level 1.
+	FidoCertifiedL1plus AuthenticatorStatus = "FIDO_CERTIFIED_L1plus"
+
+	// FidoCertifiedL2 - The authenticator has passed FIDO Authenticator certification at level 2. This level is more strict than level 1+.
+	FidoCertifiedL2 AuthenticatorStatus = "FIDO_CERTIFIED_L2"
+
+	// FidoCertifiedL2plus - The authenticator has passed FIDO Authenticator certification at level 2+. This level is more strict than level 2.
+	FidoCertifiedL2plus AuthenticatorStatus = "FIDO_CERTIFIED_L2plus"
+
+	// FidoCertifiedL3 - The authenticator has passed FIDO Authenticator certification at level 3. This level is more strict than level 2+.
+	FidoCertifiedL3 AuthenticatorStatus = "FIDO_CERTIFIED_L3"
+
+	// FidoCertifiedL3plus - The authenticator has passed FIDO Authenticator certification at level 3+. This level is more strict than level 3.
+	FidoCertifiedL3plus AuthenticatorStatus = "FIDO_CERTIFIED_L3plus"
+
+	// FIPS140CertifiedL1 - The authenticator has passed FIPS 140 certification at overall level 1.
+	FIPS140CertifiedL1 AuthenticatorStatus = "FIPS140_CERTIFIED_L1"
+
+	// FIPS140CertifiedL2 - The authenticator has passed FIPS 140 certification at overall level 2.
+	FIPS140CertifiedL2 AuthenticatorStatus = "FIPS140_CERTIFIED_L2"
+
+	// FIPS140CertifiedL3 - The authenticator has passed FIPS 140 certification at overall level 3.
+	FIPS140CertifiedL3 AuthenticatorStatus = "FIPS140_CERTIFIED_L3"
+
+	// FIPS140CertifiedL4 - The authenticator has passed FIPS 140 certification at overall level 4.
+	FIPS140CertifiedL4 AuthenticatorStatus = "FIPS140_CERTIFIED_L4"
+)
+
+// defaultUndesiredAuthenticatorStatus is an array of undesirable authenticator statuses.
+var defaultUndesiredAuthenticatorStatus = [...]AuthenticatorStatus{
+	AttestationKeyCompromise,
+	UserVerificationBypass,
+	UserKeyRemoteCompromise,
+	UserKeyPhysicalCompromise,
+	Revoked,
+}
+
+// IsUndesiredAuthenticatorStatus returns whether the supplied authenticator status is desirable or not.
+func IsUndesiredAuthenticatorStatus(status AuthenticatorStatus) bool {
+	for _, s := range defaultUndesiredAuthenticatorStatus {
+		if s == status {
+			return true
+		}
+	}
+
+	return false
+}
+
+// IsUndesiredAuthenticatorStatusSlice returns whether the supplied authenticator status is desirable or not.
+func IsUndesiredAuthenticatorStatusSlice(status AuthenticatorStatus, values []AuthenticatorStatus) bool {
+	for _, s := range values {
+		if s == status {
+			return true
+		}
+	}
+
+	return false
+}
+
+// IsUndesiredAuthenticatorStatusMap returns whether the supplied authenticator status is desirable or not.
+func IsUndesiredAuthenticatorStatusMap(status AuthenticatorStatus, values map[AuthenticatorStatus]bool) bool {
+	_, ok := values[status]
+
+	return ok
+}
+
+type AuthenticationAlgorithm string
+
+const (
+	// ALG_SIGN_SECP256R1_ECDSA_SHA256_RAW is an ECDSA signature on the NIST secp256r1 curve which must have raw R and
+	// S buffers, encoded in big-endian order.
+	ALG_SIGN_SECP256R1_ECDSA_SHA256_RAW AuthenticationAlgorithm = "secp256r1_ecdsa_sha256_raw"
+
+	// ALG_SIGN_SECP256R1_ECDSA_SHA256_DER is a DER ITU-X690-2008 encoded ECDSA signature RFC5480 on the NIST secp256r1
+	// curve.
+	ALG_SIGN_SECP256R1_ECDSA_SHA256_DER AuthenticationAlgorithm = "secp256r1_ecdsa_sha256_der"
+
+	// ALG_SIGN_RSASSA_PSS_SHA256_RAW is a RSASSA-PSS RFC3447 signature must have raw S buffers, encoded in big-endian
+	// order RFC4055 RFC4056.
+	ALG_SIGN_RSASSA_PSS_SHA256_RAW AuthenticationAlgorithm = "rsassa_pss_sha256_raw"
+
+	// ALG_SIGN_RSASSA_PSS_SHA256_DER is a DER ITU-X690-2008 encoded OCTET STRING (not BIT STRING!) containing the
+	// RSASSA-PSS RFC3447 signature RFC4055 RFC4056.
+	ALG_SIGN_RSASSA_PSS_SHA256_DER AuthenticationAlgorithm = "rsassa_pss_sha256_der"
+
+	// ALG_SIGN_SECP256K1_ECDSA_SHA256_RAW is an ECDSA signature on the secp256k1 curve which must have raw R and S
+	// buffers, encoded in big-endian order.
+	ALG_SIGN_SECP256K1_ECDSA_SHA256_RAW AuthenticationAlgorithm = "secp256k1_ecdsa_sha256_raw"
+
+	// ALG_SIGN_SECP256K1_ECDSA_SHA256_DER is a DER ITU-X690-2008 encoded ECDSA signature RFC5480 on the secp256k1 curve.
+	ALG_SIGN_SECP256K1_ECDSA_SHA256_DER AuthenticationAlgorithm = "secp256k1_ecdsa_sha256_der"
+
+	// ALG_SIGN_SM2_SM3_RAW is a Chinese SM2 elliptic curve based signature algorithm combined with SM3 hash algorithm
+	// OSCCA-SM2 OSCCA-SM3.
+	ALG_SIGN_SM2_SM3_RAW AuthenticationAlgorithm = "sm2_sm3_raw"
+
+	// ALG_SIGN_RSA_EMSA_PKCS1_SHA256_RAW is the EMSA-PKCS1-v1_5 signature as defined in RFC3447.
+	ALG_SIGN_RSA_EMSA_PKCS1_SHA256_RAW AuthenticationAlgorithm = "rsa_emsa_pkcs1_sha256_raw"
+
+	// ALG_SIGN_RSA_EMSA_PKCS1_SHA256_DER is a DER ITU-X690-2008 encoded OCTET STRING (not BIT STRING!) containing the
+	// EMSA-PKCS1-v1_5 signature as defined in RFC3447.
+	ALG_SIGN_RSA_EMSA_PKCS1_SHA256_DER AuthenticationAlgorithm = "rsa_emsa_pkcs1_sha256_der"
+
+	// ALG_SIGN_RSASSA_PSS_SHA384_RAW is a RSASSA-PSS RFC3447 signature must have raw S buffers, encoded in big-endian
+	// order RFC4055 RFC4056.
+	ALG_SIGN_RSASSA_PSS_SHA384_RAW AuthenticationAlgorithm = "rsassa_pss_sha384_raw"
+
+	// ALG_SIGN_RSASSA_PSS_SHA512_RAW is a RSASSA-PSS RFC3447 signature must have raw S buffers, encoded in big-endian
+	// order RFC4055 RFC4056.
+	ALG_SIGN_RSASSA_PSS_SHA512_RAW AuthenticationAlgorithm = "rsassa_pss_sha512_raw"
+
+	// ALG_SIGN_RSASSA_PKCSV15_SHA256_RAW is a RSASSA-PKCS1-v1_5 RFC3447 with SHA256(aka RS256) signature must have raw
+	// S buffers, encoded in big-endian order RFC8017 RFC4056.
+	ALG_SIGN_RSASSA_PKCSV15_SHA256_RAW AuthenticationAlgorithm = "rsassa_pkcsv15_sha256_raw"
+
+	// ALG_SIGN_RSASSA_PKCSV15_SHA384_RAW is a RSASSA-PKCS1-v1_5 RFC3447 with SHA384(aka RS384) signature must have raw S buffers, encoded in big-endian order RFC8017 RFC4056.
+	ALG_SIGN_RSASSA_PKCSV15_SHA384_RAW AuthenticationAlgorithm = "rsassa_pkcsv15_sha384_raw"
+
+	// ALG_SIGN_RSASSA_PKCSV15_SHA512_RAW is a RSASSA-PKCS1-v1_5 RFC3447 with SHA512(aka RS512) signature must have raw
+	// S buffers, encoded in big-endian order RFC8017 RFC4056.
+	ALG_SIGN_RSASSA_PKCSV15_SHA512_RAW AuthenticationAlgorithm = "rsassa_pkcsv15_sha512_raw"
+
+	// ALG_SIGN_RSASSA_PKCSV15_SHA1_RAW is a RSASSA-PKCS1-v1_5 RFC3447 with SHA1(aka RS1) signature must have raw S
+	// buffers, encoded in big-endian order RFC8017 RFC4056.
+	ALG_SIGN_RSASSA_PKCSV15_SHA1_RAW AuthenticationAlgorithm = "rsassa_pkcsv15_sha1_raw"
+
+	// ALG_SIGN_SECP384R1_ECDSA_SHA384_RAW is an ECDSA signature on the NIST secp384r1 curve with SHA384(aka: ES384)
+	// which must have raw R and S buffers, encoded in big-endian order.
+	ALG_SIGN_SECP384R1_ECDSA_SHA384_RAW AuthenticationAlgorithm = "secp384r1_ecdsa_sha384_raw"
+
+	// ALG_SIGN_SECP521R1_ECDSA_SHA512_RAW is an ECDSA signature on the NIST secp512r1 curve with SHA512(aka: ES512)
+	// which must have raw R and S buffers, encoded in big-endian order.
+	ALG_SIGN_SECP521R1_ECDSA_SHA512_RAW AuthenticationAlgorithm = "secp521r1_ecdsa_sha512_raw"
+
+	// ALG_SIGN_ED25519_EDDSA_SHA512_RAW is an EdDSA signature on the curve 25519, which must have raw R and S buffers,
+	// encoded in big-endian order.
+	ALG_SIGN_ED25519_EDDSA_SHA512_RAW AuthenticationAlgorithm = "ed25519_eddsa_sha512_raw"
+
+	// ALG_SIGN_ED448_EDDSA_SHA512_RAW is an EdDSA signature on the curve Ed448, which must have raw R and S buffers,
+	// encoded in big-endian order.
+	ALG_SIGN_ED448_EDDSA_SHA512_RAW AuthenticationAlgorithm = "ed448_eddsa_sha512_raw"
+)
+
+// TODO: this goes away after webauthncose.CredentialPublicKey gets implemented.
+type algKeyCose struct {
+	KeyType   webauthncose.COSEKeyType
+	Algorithm webauthncose.COSEAlgorithmIdentifier
+	Curve     webauthncose.COSEEllipticCurve
+}
+
+func algKeyCoseDictionary() func(AuthenticationAlgorithm) algKeyCose {
+	mapping := map[AuthenticationAlgorithm]algKeyCose{
+		ALG_SIGN_SECP256R1_ECDSA_SHA256_RAW: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES256, Curve: webauthncose.P256},
+		ALG_SIGN_SECP256R1_ECDSA_SHA256_DER: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES256, Curve: webauthncose.P256},
+		ALG_SIGN_RSASSA_PSS_SHA256_RAW:      {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgPS256},
+		ALG_SIGN_RSASSA_PSS_SHA256_DER:      {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgPS256},
+		ALG_SIGN_SECP256K1_ECDSA_SHA256_RAW: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES256K, Curve: webauthncose.Secp256k1},
+		ALG_SIGN_SECP256K1_ECDSA_SHA256_DER: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES256K, Curve: webauthncose.Secp256k1},
+		ALG_SIGN_RSASSA_PSS_SHA384_RAW:      {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgPS384},
+		ALG_SIGN_RSASSA_PSS_SHA512_RAW:      {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgPS512},
+		ALG_SIGN_RSASSA_PKCSV15_SHA256_RAW:  {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgRS256},
+		ALG_SIGN_RSASSA_PKCSV15_SHA384_RAW:  {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgRS384},
+		ALG_SIGN_RSASSA_PKCSV15_SHA512_RAW:  {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgRS512},
+		ALG_SIGN_RSASSA_PKCSV15_SHA1_RAW:    {KeyType: webauthncose.RSAKey, Algorithm: webauthncose.AlgRS1},
+		ALG_SIGN_SECP384R1_ECDSA_SHA384_RAW: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES384, Curve: webauthncose.P384},
+		ALG_SIGN_SECP521R1_ECDSA_SHA512_RAW: {KeyType: webauthncose.EllipticKey, Algorithm: webauthncose.AlgES512, Curve: webauthncose.P521},
+		ALG_SIGN_ED25519_EDDSA_SHA512_RAW:   {KeyType: webauthncose.OctetKey, Algorithm: webauthncose.AlgEdDSA, Curve: webauthncose.Ed25519},
+		ALG_SIGN_ED448_EDDSA_SHA512_RAW:     {KeyType: webauthncose.OctetKey, Algorithm: webauthncose.AlgEdDSA, Curve: webauthncose.Ed448},
+	}
+
+	return func(key AuthenticationAlgorithm) algKeyCose {
+		return mapping[key]
+	}
+}
+
+func AlgKeyMatch(key algKeyCose, algs []AuthenticationAlgorithm) bool {
+	for _, alg := range algs {
+		if reflect.DeepEqual(algKeyCoseDictionary()(alg), key) {
+			return true
+		}
+	}
+
+	return false
+}
+
+type PublicKeyAlgAndEncoding string
+
+const (
+	// ALG_KEY_ECC_X962_RAW is a raw ANSI X9.62 formatted Elliptic Curve public key.
+	ALG_KEY_ECC_X962_RAW PublicKeyAlgAndEncoding = "ecc_x962_raw"
+
+	// ALG_KEY_ECC_X962_DER is a DER ITU-X690-2008 encoded ANSI X.9.62 formatted SubjectPublicKeyInfo RFC5480 specifying an elliptic curve public key.
+	ALG_KEY_ECC_X962_DER PublicKeyAlgAndEncoding = "ecc_x962_der"
+
+	// ALG_KEY_RSA_2048_RAW is a raw encoded 2048-bit RSA public key RFC3447.
+	ALG_KEY_RSA_2048_RAW PublicKeyAlgAndEncoding = "rsa_2048_raw"
+
+	// ALG_KEY_RSA_2048_DER is a ASN.1 DER [ITU-X690-2008] encoded 2048-bit RSA RFC3447 public key RFC4055.
+	ALG_KEY_RSA_2048_DER PublicKeyAlgAndEncoding = "rsa_2048_der"
+
+	// ALG_KEY_COSE is a COSE_Key format, as defined in Section 7 of RFC8152. This encoding includes its own field for indicating the public key algorithm.
+	ALG_KEY_COSE PublicKeyAlgAndEncoding = "cose"
+)
+
+type Error struct {
+	// Short name for the type of error that has occurred.
+	Type string `json:"type"`
+
+	// Additional details about the error.
+	Details string `json:"error"`
+
+	// Information to help debug the error.
+	DevInfo string `json:"debug"`
+}
+
+func (e *Error) Error() string {
+	return e.Details
+}
+
+// Clock is an interface used to implement clock functionality in various metadata areas.
+type Clock interface {
+	// Now returns the current time.
+	Now() time.Time
+}
+
+// RealClock is just a real clock.
+type RealClock struct{}
+
+// Now returns the current time.
+func (RealClock) Now() time.Time {
+	return time.Now()
+}

vendor/github.com/go-webauthn/webauthn/protocol/assertion.go

@@ -0,0 +1,199 @@
+package protocol
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// The CredentialAssertionResponse is the raw response returned to the Relying Party from an authenticator when we request a
+// credential for login/assertion.
+type CredentialAssertionResponse struct {
+	PublicKeyCredential
+
+	AssertionResponse AuthenticatorAssertionResponse `json:"response"`
+}
+
+// The ParsedCredentialAssertionData is the parsed [CredentialAssertionResponse] that has been marshalled into a format
+// that allows us to verify the client and authenticator data inside the response.
+type ParsedCredentialAssertionData struct {
+	ParsedPublicKeyCredential
+
+	Response ParsedAssertionResponse
+	Raw      CredentialAssertionResponse
+}
+
+// The AuthenticatorAssertionResponse contains the raw authenticator assertion data and is parsed into
+// [ParsedAssertionResponse].
+type AuthenticatorAssertionResponse struct {
+	AuthenticatorResponse
+
+	AuthenticatorData URLEncodedBase64 `json:"authenticatorData"`
+	Signature         URLEncodedBase64 `json:"signature"`
+	UserHandle        URLEncodedBase64 `json:"userHandle,omitempty"`
+}
+
+// ParsedAssertionResponse is the parsed form of [AuthenticatorAssertionResponse].
+type ParsedAssertionResponse struct {
+	CollectedClientData CollectedClientData
+	AuthenticatorData   AuthenticatorData
+	Signature           []byte
+	UserHandle          []byte
+}
+
+// ParseCredentialRequestResponse parses the credential request response into a format that is either required by the
+// specification or makes the assertion verification steps easier to complete. This takes a [*http.Request] that contains
+// the assertion response data in a raw, mostly base64 encoded format, and parses the data into manageable structures.
+func ParseCredentialRequestResponse(response *http.Request) (*ParsedCredentialAssertionData, error) {
+	if response == nil || response.Body == nil {
+		return nil, ErrBadRequest.WithDetails("No response given")
+	}
+
+	defer func(request *http.Request) {
+		_, _ = io.Copy(io.Discard, request.Body)
+		_ = request.Body.Close()
+	}(response)
+
+	return ParseCredentialRequestResponseBody(response.Body)
+}
+
+// ParseCredentialRequestResponseBody parses the credential request response into a format that is either required by
+// the specification or makes the assertion verification steps easier to complete. This takes an [io.Reader] that contains
+// the assertion response data in a raw, mostly base64 encoded format, and parses the data into manageable structures.
+func ParseCredentialRequestResponseBody(body io.Reader) (par *ParsedCredentialAssertionData, err error) {
+	var car CredentialAssertionResponse
+
+	if err = decodeBody(body, &car); err != nil {
+		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)
+	}
+
+	return car.Parse()
+}
+
+// ParseCredentialRequestResponseBytes is an alternative version of [ParseCredentialRequestResponseBody] that just takes
+// a byte slice.
+func ParseCredentialRequestResponseBytes(data []byte) (par *ParsedCredentialAssertionData, err error) {
+	var car CredentialAssertionResponse
+
+	if err = decodeBytes(data, &car); err != nil {
+		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)
+	}
+
+	return car.Parse()
+}
+
+// Parse validates and parses the [CredentialAssertionResponse] into a [ParseCredentialCreationResponseBody]. This receiver
+// is unlikely to be expressly guaranteed under the versioning policy. Users looking for this guarantee should see
+// [ParseCredentialRequestResponseBody] instead, and this receiver should only be used if that function is inadequate
+// for their use case.
+func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionData, err error) {
+	if car.ID == "" {
+		return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID missing")
+	}
+
+	if _, err = base64.RawURLEncoding.DecodeString(car.ID); err != nil {
+		return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID not base64url encoded").WithError(err)
+	}
+
+	if car.Type != string(PublicKeyCredentialType) {
+		return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with bad type")
+	}
+
+	var attachment AuthenticatorAttachment
+
+	switch att := AuthenticatorAttachment(car.AuthenticatorAttachment); att {
+	case Platform, CrossPlatform:
+		attachment = att
+	}
+
+	par = &ParsedCredentialAssertionData{
+		ParsedPublicKeyCredential{
+			ParsedCredential{car.ID, car.Type}, car.RawID, car.ClientExtensionResults, attachment,
+		},
+		ParsedAssertionResponse{
+			Signature:  car.AssertionResponse.Signature,
+			UserHandle: car.AssertionResponse.UserHandle,
+		},
+		car,
+	}
+
+	// Step 5. Let JSONtext be the result of running UTF-8 decode on the value of cData.
+	// We don't call it cData but this is Step 5 in the spec.
+	if err = json.Unmarshal(car.AssertionResponse.ClientDataJSON, &par.Response.CollectedClientData); err != nil {
+		return nil, err
+	}
+
+	if err = par.Response.AuthenticatorData.Unmarshal(car.AssertionResponse.AuthenticatorData); err != nil {
+		return nil, ErrParsingData.WithDetails("Error unmarshalling auth data").WithError(err)
+	}
+
+	return par, nil
+}
+
+// Verify the remaining elements of the assertion data by following the steps outlined in the referenced specification
+// documentation. It's important to note that the credentialBytes field is the CBOR representation of the credential.
+//
+// Specification: §7.2 Verifying an Authentication Assertion (https://www.w3.org/TR/webauthn/#sctn-verifying-assertion)
+func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPartyID string, rpOrigins, rpTopOrigins []string, rpTopOriginsVerify TopOriginVerificationMode, appID string, verifyUser bool, verifyUserPresence bool, credentialBytes []byte) error {
+	// Steps 4 through 6 in verifying the assertion data (https://www.w3.org/TR/webauthn/#verifying-assertion) are
+	// "assertive" steps, i.e. "Let JSONtext be the result of running UTF-8 decode on the value of cData."
+	// We handle these steps in part as we verify but also beforehand
+	//
+	// Handle steps 7 through 10 of assertion by verifying stored data against the Collected Client Data
+	// returned by the authenticator.
+	validError := p.Response.CollectedClientData.Verify(storedChallenge, AssertCeremony, rpOrigins, rpTopOrigins, rpTopOriginsVerify)
+	if validError != nil {
+		return validError
+	}
+
+	// Begin Step 11. Verify that the rpIdHash in authData is the SHA-256 hash of the RP ID expected by the RP.
+	rpIDHash := sha256.Sum256([]byte(relyingPartyID))
+
+	var appIDHash [32]byte
+	if appID != "" {
+		appIDHash = sha256.Sum256([]byte(appID))
+	}
+
+	// Handle steps 11 through 14, verifying the authenticator data.
+	validError = p.Response.AuthenticatorData.Verify(rpIDHash[:], appIDHash[:], verifyUser, verifyUserPresence)
+	if validError != nil {
+		return validError
+	}
+
+	// Step 15. Let hash be the result of computing a hash over the cData using SHA-256.
+	clientDataHash := sha256.Sum256(p.Raw.AssertionResponse.ClientDataJSON)
+
+	// Step 16. Using the credential public key looked up in step 3, verify that sig is
+	// a valid signature over the binary concatenation of authData and hash.
+
+	sigData := append(p.Raw.AssertionResponse.AuthenticatorData, clientDataHash[:]...) //nolint:gocritic // This is intentional.
+
+	var (
+		key any
+		err error
+	)
+
+	// If the Session Data does not contain the appID extension or it wasn't reported as used by the Client/RP then we
+	// use the standard CTAP2 public key parser.
+	if appID == "" {
+		key, err = webauthncose.ParsePublicKey(credentialBytes)
+	} else {
+		key, err = webauthncose.ParseFIDOPublicKey(credentialBytes)
+	}
+
+	if err != nil {
+		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err)).WithError(err)
+	}
+
+	valid, err := webauthncose.VerifySignature(key, sigData, p.Response.Signature)
+	if !valid || err != nil {
+		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err)).WithError(err)
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation.go

@@ -0,0 +1,234 @@
+package protocol
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol/webauthncbor"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// AuthenticatorAttestationResponse is the initial unpacked 'response' object received by the relying party. This
+// contains the clientDataJSON object, which will be marshalled into [CollectedClientData], and the 'attestationObject',
+// which contains information about the authenticator, and the newly minted public key credential. The information in
+// both objects are used to verify the authenticity of the ceremony and new credential.
+//
+// See: https://www.w3.org/TR/webauthn/#typedefdef-publickeycredentialjson
+type AuthenticatorAttestationResponse struct {
+	// The byte slice of clientDataJSON, which becomes CollectedClientData.
+	AuthenticatorResponse
+
+	Transports []string `json:"transports,omitempty"`
+
+	AuthenticatorData URLEncodedBase64 `json:"authenticatorData"`
+
+	PublicKey URLEncodedBase64 `json:"publicKey"`
+
+	PublicKeyAlgorithm int64 `json:"publicKeyAlgorithm"`
+
+	// AttestationObject is the byte slice version of attestationObject.
+	// This attribute contains an attestation object, which is opaque to, and
+	// cryptographically protected against tampering by, the client. The
+	// attestation object contains both authenticator data and an attestation
+	// statement. The former contains the AAGUID, a unique credential ID, and
+	// the credential public key. The contents of the attestation statement are
+	// determined by the attestation statement format used by the authenticator.
+	// It also contains any additional information that the Relying Party's server
+	// requires to validate the attestation statement, as well as to decode and
+	// validate the authenticator data along with the JSON-serialized client data.
+	AttestationObject URLEncodedBase64 `json:"attestationObject"`
+}
+
+// ParsedAttestationResponse is the parsed version of [AuthenticatorAttestationResponse].
+type ParsedAttestationResponse struct {
+	CollectedClientData CollectedClientData
+	AttestationObject   AttestationObject
+	Transports          []AuthenticatorTransport
+}
+
+// AttestationObject is the raw attestationObject.
+//
+// Authenticators SHOULD also provide some form of attestation, if possible. If an authenticator does, the basic
+// requirement is that the authenticator can produce, for each credential public key, an attestation statement
+// verifiable by the WebAuthn Relying Party. Typically, this attestation statement contains a signature by an
+// attestation private key over the attested credential public key and a challenge, as well as a certificate or similar
+// data providing provenance information for the attestation public key, enabling the Relying Party to make a trust
+// decision. However, if an attestation key pair is not available, then the authenticator MAY either perform self
+// attestation of the credential public key with the corresponding credential private key, or otherwise perform no
+// attestation. All this information is returned by authenticators any time a new public key credential is generated, in
+// the overall form of an attestation object.
+//
+// Specification: §6.5. Attestation (https://www.w3.org/TR/webauthn/#sctn-attestation)
+type AttestationObject struct {
+	// The authenticator data, including the newly created public key. See [AuthenticatorData] for more info.
+	AuthData AuthenticatorData
+
+	// The byteform version of the authenticator data, used in part for signature validation.
+	RawAuthData []byte `json:"authData"`
+
+	// The format of the Attestation data.
+	Format string `json:"fmt"`
+
+	// The attestation statement data sent back if attestation is requested.
+	AttStatement map[string]any `json:"attStmt,omitempty"`
+}
+
+type NonCompoundAttestationObject struct {
+	// The format of the Attestation data.
+	Format string `json:"fmt"`
+
+	// The attestation statement data sent back if attestation is requested.
+	AttStatement map[string]any `json:"attStmt,omitempty"`
+}
+
+type attestationFormatValidationHandler func(att AttestationObject, clientDataHash []byte, mds metadata.Provider) (attestationType string, x5cs []any, err error)
+
+var attestationRegistry = make(map[AttestationFormat]attestationFormatValidationHandler)
+
+// RegisterAttestationFormat is a method to register attestation formats with the library. Generally using one of the
+// locally registered attestation formats is enough.
+func RegisterAttestationFormat(format AttestationFormat, handler attestationFormatValidationHandler) {
+	attestationRegistry[format] = handler
+}
+
+// Parse the values returned in the authenticator response and perform attestation verification
+// Step 8. This returns a fully decoded struct with the data put into a format that can be
+// used to verify the user and credential that was created.
+func (ccr *AuthenticatorAttestationResponse) Parse() (p *ParsedAttestationResponse, err error) {
+	p = &ParsedAttestationResponse{}
+
+	if err = json.Unmarshal(ccr.ClientDataJSON, &p.CollectedClientData); err != nil {
+		return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)
+	}
+
+	if err = webauthncbor.Unmarshal(ccr.AttestationObject, &p.AttestationObject); err != nil {
+		return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)
+	}
+
+	// Step 8. Perform CBOR decoding on the attestationObject field of the AuthenticatorAttestationResponse
+	// structure to obtain the attestation statement format fmt, the authenticator data authData, and
+	// the attestation statement attStmt.
+	if err = p.AttestationObject.AuthData.Unmarshal(p.AttestationObject.RawAuthData); err != nil {
+		return nil, err
+	}
+
+	if !p.AttestationObject.AuthData.Flags.HasAttestedCredentialData() {
+		return nil, ErrAttestationFormat.WithInfo("Attestation missing attested credential data flag")
+	}
+
+	for _, t := range ccr.Transports {
+		if transport, ok := internalRemappedAuthenticatorTransport[t]; ok {
+			p.Transports = append(p.Transports, transport)
+		} else {
+			p.Transports = append(p.Transports, AuthenticatorTransport(t))
+		}
+	}
+
+	return p, nil
+}
+
+// Verify performs Steps 13 through 19 of registration verification.
+//
+// Steps 13 through 15 are verified against the auth data. These steps are identical to 15 through 18 for assertion so we
+// handle them with AuthData.
+func (a *AttestationObject) Verify(relyingPartyID string, clientDataHash []byte, userVerificationRequired bool, userPresenceRequired bool, mds metadata.Provider, credParams []CredentialParameter) (err error) {
+	rpIDHash := sha256.Sum256([]byte(relyingPartyID))
+
+	// Begin Step 13 through 15. Verify that the rpIdHash in authData is the SHA-256 hash of the RP ID expected by the RP.
+	if err = a.AuthData.Verify(rpIDHash[:], nil, userVerificationRequired, userPresenceRequired); err != nil {
+		return err
+	}
+
+	// Step 16. Verify that the "alg" parameter in the credential public key in
+	// authData matches the alg attribute of one of the items in options.pubKeyCredParams.
+	var pk webauthncose.PublicKeyData
+	if err = webauthncbor.Unmarshal(a.AuthData.AttData.CredentialPublicKey, &pk); err != nil {
+		return err
+	}
+
+	found := false
+
+	for _, credParam := range credParams {
+		if int(pk.Algorithm) == int(credParam.Algorithm) {
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		return ErrAttestationFormat.WithInfo("Credential public key algorithm not supported")
+	}
+
+	return a.VerifyAttestation(clientDataHash, mds)
+}
+
+// VerifyAttestation only verifies the attestation object excluding the AuthData values. If you wish to also verify the
+// AuthData values you should use [Verify].
+func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadata.Provider) (err error) {
+	// Step 18. Determine the attestation statement format by performing a
+	// USASCII case-sensitive match on fmt against the set of supported
+	// WebAuthn Attestation Statement Format Identifier values. The up-to-date
+	// list of registered WebAuthn Attestation Statement Format Identifier
+	// values is maintained in the IANA registry of the same name
+	// [WebAuthn-Registries] (https://www.w3.org/TR/webauthn/#biblio-webauthn-registries).
+	//
+	// Since there is not an active registry yet, we'll check it against our internal
+	// Supported types.
+	//
+	// But first let's make sure attestation is present. If it isn't, we don't need to handle
+	// any of the following steps.
+	if AttestationFormat(a.Format) == AttestationFormatNone {
+		if len(a.AttStatement) != 0 {
+			return ErrAttestationFormat.WithInfo("Attestation format none with attestation present")
+		}
+
+		return nil
+	}
+
+	var (
+		handler attestationFormatValidationHandler
+		valid   bool
+	)
+
+	if handler, valid = attestationRegistry[AttestationFormat(a.Format)]; !valid {
+		return ErrAttestationFormat.WithInfo(fmt.Sprintf("Attestation format %s is unsupported", a.Format))
+	}
+
+	var (
+		aaguid          uuid.UUID
+		attestationType string
+		x5cs            []any
+	)
+
+	// Step 19. Verify that attStmt is a correct attestation statement, conveying a valid attestation signature, by using
+	// the attestation statement format fmt’s verification procedure given attStmt, authData and the hash of the serialized
+	// client data computed in step 7.
+	if attestationType, x5cs, err = handler(*a, clientDataHash, mds); err != nil {
+		return err.(*Error).WithInfo(attestationType)
+	}
+
+	if attestationType == string(AttestationFormatCompound) {
+		return nil
+	}
+
+	if len(a.AuthData.AttData.AAGUID) != 0 {
+		if aaguid, err = uuid.FromBytes(a.AuthData.AttData.AAGUID); err != nil {
+			return ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error()).WithError(err)
+		}
+	}
+
+	if mds == nil {
+		return nil
+	}
+
+	if e := ValidateMetadata(context.Background(), mds, aaguid, attestationType, a.Format, x5cs); e != nil {
+		return ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", e)).WithDetails(e.DevInfo).WithError(e)
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_androidkey.go

@@ -0,0 +1,260 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/asn1"
+	"fmt"
+	"time"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// attestationFormatValidationHandlerAndroidKey is the handler for the Android Key Attestation Statement Format.
+//
+// An Android key attestation statement consists simply of the Android attestation statement, which is a series of DER
+// encoded X.509 certificates. See the Android developer documentation. Its syntax is defined as follows:
+//
+// $$attStmtType //= (
+//
+//	    fmt: "android-key",
+//	    attStmt: androidStmtFormat
+//	)
+//
+//	androidStmtFormat = {
+//	                      alg: COSEAlgorithmIdentifier,
+//	                      sig: bytes,
+//	                      x5c: [ credCert: bytes, * (caCert: bytes) ]
+//	                    }
+//
+// Specification: §8.4. Android Key Attestation Statement Format
+//
+// See: https://www.w3.org/TR/webauthn/#sctn-android-key-attestation
+func attestationFormatValidationHandlerAndroidKey(att AttestationObject, clientDataHash []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	var (
+		alg int64
+		sig []byte
+		ok  bool
+	)
+
+	// Given the verification procedure inputs attStmt, authenticatorData and clientDataHash, the verification procedure is as follows:
+	// §8.4.1. Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it to extract
+	// the contained fields.
+	// Get the alg value - A COSEAlgorithmIdentifier containing the identifier of the algorithm
+	// used to generate the attestation signature.
+	if alg, ok = att.AttStatement[stmtAlgorithm].(int64); !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Error retrieving alg value")
+	}
+
+	// Get the sig value - A byte string containing the attestation signature.
+	if sig, ok = att.AttStatement[stmtSignature].([]byte); !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Error retrieving sig value")
+	}
+
+	// §8.4.2. Verify that sig is a valid signature over the concatenation of authenticatorData and clientDataHash
+	// using the public key in the first certificate in x5c with the algorithm specified in alg.
+	var (
+		x5c   []any
+		certs []*x509.Certificate
+	)
+
+	if x5c, certs, err = attStatementParseX5CS(att.AttStatement, stmtX5C); err != nil {
+		return "", nil, err
+	}
+
+	if len(certs) == 0 {
+		return "", nil, ErrInvalidAttestation.WithDetails("No certificates in x5c")
+	}
+
+	credCert := certs[0]
+
+	if _, err = attStatementCertChainVerify(certs, attAndroidKeyHardwareRootsCertPool, true, time.Now().Add(time.Hour*8760).UTC()); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails("Error validating x5c cert chain").WithError(err)
+	}
+
+	signatureData := append(att.RawAuthData, clientDataHash...) //nolint:gocritic // This is intentional.
+
+	if sigAlg := webauthncose.SigAlgFromCOSEAlg(webauthncose.COSEAlgorithmIdentifier(alg)); sigAlg == x509.UnknownSignatureAlgorithm {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Unsupported COSE alg: %d", alg))
+	} else if err = credCert.CheckSignature(sigAlg, signatureData, sig); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v", err)).WithError(err)
+	}
+
+	// Verify that the public key in the first certificate in x5c matches the credentialPublicKey in the attestedCredentialData in authenticatorData.
+	var attPublicKeyData webauthncose.EC2PublicKeyData
+	if attPublicKeyData, err = verifyAttestationECDSAPublicKeyMatch(att, credCert); err != nil {
+		return "", nil, err
+	}
+
+	var valid bool
+	if valid, err = attPublicKeyData.Verify(signatureData, sig); err != nil || !valid {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v", err)).WithError(err)
+	}
+
+	// §8.4.3. Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.
+	// attCert.Extensions.
+	// As noted in §8.4.1 (https://www.w3.org/TR/webauthn/#key-attstn-cert-requirements) the Android Key Attestation
+	// certificate's android key attestation certificate extension data is identified by the OID
+	// "1.3.6.1.4.1.11129.2.1.17".
+	var attExtBytes []byte
+
+	for _, ext := range credCert.Extensions {
+		if ext.Id.Equal(oidExtensionAndroidKeystore) {
+			attExtBytes = ext.Value
+		}
+	}
+
+	if len(attExtBytes) == 0 {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate extensions missing 1.3.6.1.4.1.11129.2.1.17")
+	}
+
+	decoded := keyDescription{}
+
+	if _, err = asn1.Unmarshal(attExtBytes, &decoded); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse Android key attestation certificate extensions").WithError(err)
+	}
+
+	// Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.
+	if !bytes.Equal(decoded.AttestationChallenge, clientDataHash) {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation challenge not equal to clientDataHash")
+	}
+
+	// The AuthorizationList.allApplications field is not present on either authorization list (softwareEnforced nor teeEnforced), since PublicKeyCredential MUST be scoped to the RP ID.
+	if decoded.SoftwareEnforced.AllApplications != nil || decoded.TeeEnforced.AllApplications != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate extensions contains all applications field")
+	}
+
+	// For the following, use only the teeEnforced authorization list if the RP wants to accept only keys from a trusted execution environment, otherwise use the union of teeEnforced and softwareEnforced.
+	// The value in the AuthorizationList.origin field is equal to KM_ORIGIN_GENERATED (which == 0).
+	if decoded.SoftwareEnforced.Origin != KM_ORIGIN_GENERATED || decoded.TeeEnforced.Origin != KM_ORIGIN_GENERATED {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate extensions contains authorization list with origin not equal KM_ORIGIN_GENERATED")
+	}
+
+	// The value in the AuthorizationList.purpose field is equal to KM_PURPOSE_SIGN (which == 2).
+	if !contains(decoded.SoftwareEnforced.Purpose, KM_PURPOSE_SIGN) && !contains(decoded.TeeEnforced.Purpose, KM_PURPOSE_SIGN) {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate extensions contains authorization list with purpose not equal KM_PURPOSE_SIGN")
+	}
+
+	return string(metadata.BasicFull), x5c, err
+}
+
+func contains(s []int, e int) bool {
+	for _, a := range s {
+		if a == e {
+			return true
+		}
+	}
+
+	return false
+}
+
+type keyDescription struct {
+	AttestationVersion       int
+	AttestationSecurityLevel asn1.Enumerated
+	KeymasterVersion         int
+	KeymasterSecurityLevel   asn1.Enumerated
+	AttestationChallenge     []byte
+	UniqueID                 []byte
+	SoftwareEnforced         authorizationList
+	TeeEnforced              authorizationList
+}
+
+type authorizationList struct {
+	Purpose                     []int       `asn1:"tag:1,explicit,set,optional"`
+	Algorithm                   int         `asn1:"tag:2,explicit,optional"`
+	KeySize                     int         `asn1:"tag:3,explicit,optional"`
+	Digest                      []int       `asn1:"tag:5,explicit,set,optional"`
+	Padding                     []int       `asn1:"tag:6,explicit,set,optional"`
+	EcCurve                     int         `asn1:"tag:10,explicit,optional"`
+	RsaPublicExponent           int         `asn1:"tag:200,explicit,optional"`
+	RollbackResistance          any         `asn1:"tag:303,explicit,optional"`
+	ActiveDateTime              int         `asn1:"tag:400,explicit,optional"`
+	OriginationExpireDateTime   int         `asn1:"tag:401,explicit,optional"`
+	UsageExpireDateTime         int         `asn1:"tag:402,explicit,optional"`
+	NoAuthRequired              any         `asn1:"tag:503,explicit,optional"`
+	UserAuthType                int         `asn1:"tag:504,explicit,optional"`
+	AuthTimeout                 int         `asn1:"tag:505,explicit,optional"`
+	AllowWhileOnBody            any         `asn1:"tag:506,explicit,optional"`
+	TrustedUserPresenceRequired any         `asn1:"tag:507,explicit,optional"`
+	TrustedConfirmationRequired any         `asn1:"tag:508,explicit,optional"`
+	UnlockedDeviceRequired      any         `asn1:"tag:509,explicit,optional"`
+	AllApplications             any         `asn1:"tag:600,explicit,optional"`
+	ApplicationID               any         `asn1:"tag:601,explicit,optional"`
+	CreationDateTime            int         `asn1:"tag:701,explicit,optional"`
+	Origin                      int         `asn1:"tag:702,explicit,optional"`
+	RootOfTrust                 rootOfTrust `asn1:"tag:704,explicit,optional"`
+	OsVersion                   int         `asn1:"tag:705,explicit,optional"`
+	OsPatchLevel                int         `asn1:"tag:706,explicit,optional"`
+	AttestationApplicationID    []byte      `asn1:"tag:709,explicit,optional"`
+	AttestationIDBrand          []byte      `asn1:"tag:710,explicit,optional"`
+	AttestationIDDevice         []byte      `asn1:"tag:711,explicit,optional"`
+	AttestationIDProduct        []byte      `asn1:"tag:712,explicit,optional"`
+	AttestationIDSerial         []byte      `asn1:"tag:713,explicit,optional"`
+	AttestationIDImei           []byte      `asn1:"tag:714,explicit,optional"`
+	AttestationIDMeid           []byte      `asn1:"tag:715,explicit,optional"`
+	AttestationIDManufacturer   []byte      `asn1:"tag:716,explicit,optional"`
+	AttestationIDModel          []byte      `asn1:"tag:717,explicit,optional"`
+	VendorPatchLevel            int         `asn1:"tag:718,explicit,optional"`
+	BootPatchLevel              int         `asn1:"tag:719,explicit,optional"`
+}
+
+type rootOfTrust struct {
+	verifiedBootKey   []byte            //nolint:unused
+	deviceLocked      bool              //nolint:unused
+	verifiedBootState verifiedBootState //nolint:unused
+	verifiedBootHash  []byte            //nolint:unused
+}
+
+type verifiedBootState int
+
+const (
+	Verified verifiedBootState = iota
+	SelfSigned
+	Unverified
+	Failed
+)
+
+const (
+	// KM_ORIGIN_GENERATED means generated in keymaster. Should not exist outside the TEE.
+	KM_ORIGIN_GENERATED = iota
+
+	// KM_ORIGIN_DERIVED means derived inside keymaster. Likely exists off-device.
+	KM_ORIGIN_DERIVED
+
+	// KM_ORIGIN_IMPORTED means imported into keymaster. Existed as clear text in Android.
+	KM_ORIGIN_IMPORTED
+
+	// KM_ORIGIN_UNKNOWN means keymaster did not record origin.  This value can only be seen on keys in a keymaster0
+	// implementation. The keymaster0 adapter uses this value to document the fact that it is unknown whether the key
+	// was generated inside or imported into keymaster.
+	KM_ORIGIN_UNKNOWN
+)
+
+const (
+	// KM_PURPOSE_ENCRYPT is usable with RSA, EC and AES keys.
+	KM_PURPOSE_ENCRYPT = iota
+
+	// KM_PURPOSE_DECRYPT is usable with RSA, EC and AES keys.
+	KM_PURPOSE_DECRYPT
+
+	// KM_PURPOSE_SIGN is usable with RSA, EC and HMAC keys.
+	KM_PURPOSE_SIGN
+
+	// KM_PURPOSE_VERIFY is usable with RSA, EC and HMAC keys.
+	KM_PURPOSE_VERIFY
+
+	// KM_PURPOSE_DERIVE_KEY is usable with EC keys.
+	KM_PURPOSE_DERIVE_KEY
+
+	// KM_PURPOSE_WRAP is usable with wrapped keys.
+	KM_PURPOSE_WRAP
+)
+
+var (
+	attAndroidKeyHardwareRootsCertPool *x509.CertPool
+)
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatAndroidKey, attestationFormatValidationHandlerAndroidKey)
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_apple.go

@@ -0,0 +1,99 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/asn1"
+	"time"
+
+	"github.com/go-webauthn/webauthn/metadata"
+)
+
+// attestationFormatValidationHandlerAppleAnonymous is the handler for the Apple Anonymous Attestation Statement Format.
+//
+// The syntax of an Apple attestation statement is defined as follows:
+//
+// $$attStmtType //= (
+//
+//	    fmt: "apple",
+//	    attStmt: appleStmtFormat
+//	)
+//
+//	appleStmtFormat = {
+//	                      x5c: [ credCert: bytes, * (caCert: bytes) ]
+//	                  }
+//
+// Specification: §8.8. Apple Anonymous Attestation Statement Format
+//
+// See : https://www.w3.org/TR/webauthn/#sctn-apple-anonymous-attestation
+func attestationFormatValidationHandlerAppleAnonymous(att AttestationObject, clientDataHash []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	// Step 1. Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it
+	// to extract the contained fields.
+	var (
+		x5c   []any
+		certs []*x509.Certificate
+	)
+
+	if x5c, certs, err = attStatementParseX5CS(att.AttStatement, stmtX5C); err != nil {
+		return "", nil, err
+	}
+
+	credCert := certs[0]
+
+	if _, err = attStatementCertChainVerify(certs, attAppleHardwareRootsCertPool, true, time.Now().Add(time.Hour*8760).UTC()); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails("Error validating x5c cert chain").WithError(err)
+	}
+
+	// Step 2. Concatenate authenticatorData and clientDataHash to form nonceToHash.
+	nonceToHash := append(att.RawAuthData, clientDataHash...) //nolint:gocritic // This is intentional.
+
+	// Step 3. Perform SHA-256 hash of nonceToHash to produce nonce.
+	nonce := sha256.Sum256(nonceToHash)
+
+	// Step 4. Verify that nonce equals the value of the extension with OID 1.2.840.113635.100.8.2 in credCert.
+	var attExtBytes []byte
+
+	for _, ext := range credCert.Extensions {
+		if ext.Id.Equal(oidExtensionAppleAnonymousAttestation) {
+			attExtBytes = ext.Value
+		}
+	}
+
+	if len(attExtBytes) == 0 {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate extensions missing 1.2.840.113635.100.8.2")
+	}
+
+	decoded := AppleAnonymousAttestation{}
+
+	if _, err = asn1.Unmarshal(attExtBytes, &decoded); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse apple attestation certificate extensions").WithError(err)
+	}
+
+	if !bytes.Equal(decoded.Nonce, nonce[:]) {
+		return "", nil, ErrInvalidAttestation.WithDetails("Attestation certificate does not contain expected nonce")
+	}
+
+	// Step 5. Verify that the credential public key equals the Subject Public Key of credCert.
+	if _, err = verifyAttestationECDSAPublicKeyMatch(att, credCert); err != nil {
+		return "", nil, err
+	}
+
+	// Step 6. If successful, return implementation-specific values representing attestation type Anonymization CA and
+	// attestation trust path x5c.
+	return string(metadata.AnonCA), x5c, nil
+}
+
+// AppleAnonymousAttestation represents the attestation format for Apple, who have not yet published a schema for the
+// extension (as of JULY 2021.)
+type AppleAnonymousAttestation struct {
+	Nonce []byte `asn1:"tag:1,explicit"`
+}
+
+var (
+	attAppleHardwareRootsCertPool *x509.CertPool
+)
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatApple, attestationFormatValidationHandlerAppleAnonymous)
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_compound.go

@@ -0,0 +1,111 @@
+package protocol
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/go-webauthn/webauthn/metadata"
+)
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatCompound, attestationFormatValidationHandlerCompound)
+}
+
+// attestationFormatValidationHandlerCompound is the handler for the Compound Attestation Statement Format.
+//
+// The syntax of a Compound Attestation statement is defined by the following CDDL:
+//
+// $$attStmtType //= (
+//
+//	    fmt: "compound",
+//	    attStmt: [2* nonCompoundAttStmt]
+//	)
+//
+// nonCompoundAttStmt = { $$attStmtType } .within { fmt: text .ne "compound", * any => any }
+//
+// Specification: §8.9. Compound Attestation Statement Forma
+//
+// See: https://www.w3.org/TR/webauthn-3/#sctn-compound-attestation
+func attestationFormatValidationHandlerCompound(att AttestationObject, clientDataHash []byte, mds metadata.Provider) (attestationType string, x5cs []any, err error) {
+	var (
+		aaguid   uuid.UUID
+		raw      any
+		ok       bool
+		stmts    []any
+		subStmt  map[string]any
+		attStmts []NonCompoundAttestationObject
+	)
+
+	if len(att.AuthData.AttData.AAGUID) != 0 {
+		if aaguid, err = uuid.FromBytes(att.AuthData.AttData.AAGUID); err != nil {
+			return "", nil, ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error()).WithError(err)
+		}
+	}
+
+	if raw, ok = att.AttStatement[stmtAttStmt]; !ok {
+		return "", nil, ErrInvalidAttestation.WithDetails("Compound statement missing attStmt")
+	}
+
+	if stmts, ok = raw.([]any); !ok {
+		return "", nil, ErrInvalidAttestation.WithDetails("Compound statement attStmt isn't an array")
+	}
+
+	if len(stmts) < 2 {
+		return "", nil, ErrInvalidAttestation.WithDetails("Compound statement attStmt isn't an array with at least two other statements")
+	}
+
+	for _, stmt := range stmts {
+		if subStmt, ok = stmt.(map[string]any); !ok {
+			return "", nil, ErrInvalidAttestation.WithDetails("Compound statement attStmt contains one or more items that isn't an object")
+		}
+
+		var attStmt NonCompoundAttestationObject
+
+		if attStmt.Format, ok = subStmt[stmtFmt].(string); !ok {
+			return "", nil, ErrInvalidAttestation.WithDetails("Compound sub-statement does not have a format")
+		}
+
+		if attStmt.AttStatement, ok = subStmt[stmtAttStmt].(map[string]any); !ok {
+			return "", nil, ErrInvalidAttestation.WithDetails("Compound sub-statement does not have an attestation statement")
+		}
+
+		switch AttestationFormat(attStmt.Format) {
+		case AttestationFormatCompound:
+			return "", nil, ErrInvalidAttestation.WithDetails("Compound sub-statement has a format of compound which is not allowed")
+		case "":
+			return "", nil, ErrInvalidAttestation.WithDetails("Compound sub-statement has an empty format which is not allowed")
+		default:
+			if _, ok = attestationRegistry[AttestationFormat(attStmt.Format)]; !ok {
+				return "", nil, ErrAttestationFormat.WithInfo(fmt.Sprintf("Attestation sub-statement format %s is unsupported", attStmt.Format))
+			}
+
+			attStmts = append(attStmts, attStmt)
+		}
+	}
+
+	for _, attStmt := range attStmts {
+		object := AttestationObject{
+			Format:       attStmt.Format,
+			AttStatement: attStmt.AttStatement,
+			AuthData:     att.AuthData,
+			RawAuthData:  att.RawAuthData,
+		}
+
+		var cx5cs []any
+		if _, cx5cs, err = attestationRegistry[AttestationFormat(object.Format)](object, clientDataHash, mds); err != nil {
+			return "", nil, err
+		}
+
+		if mds == nil {
+			continue
+		}
+
+		if e := ValidateMetadata(context.Background(), mds, aaguid, attestationType, object.Format, cx5cs); e != nil {
+			return "", nil, ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", e)).WithDetails(e.DevInfo).WithError(e)
+		}
+	}
+
+	return string(AttestationFormatCompound), nil, nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_fido_u2f.go

@@ -0,0 +1,159 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/x509"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol/webauthncbor"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// attestationFormatValidationHandlerFIDOU2F is the handler for the FIDO U2F Attestation Statement Format.
+//
+// The syntax of a FIDO U2F attestation statement is defined as follows:
+//
+// $$attStmtType //= (
+//
+//	    fmt: "fido-u2f",
+//	    attStmt: u2fStmtFormat
+//	)
+//
+//	u2fStmtFormat = {
+//	                    x5c: [ attestnCert: bytes ],
+//	                    sig: bytes
+//	                }
+//
+// Specification: §8.6. FIDO U2F Attestation Statement Format
+//
+// See: https://www.w3.org/TR/webauthn/#sctn-fido-u2f-attestation
+func attestationFormatValidationHandlerFIDOU2F(att AttestationObject, clientDataHash []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	// Non-normative verification procedure of expected requirement.
+	if !bytes.Equal(att.AuthData.AttData.AAGUID, []byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}) {
+		return "", nil, ErrUnsupportedAlgorithm.WithDetails("U2F attestation format AAGUID not set to 0x00")
+	}
+
+	// Signing procedure. Non-normative verification procedure of expected requirement.
+	// If the credential public key of the attested credential is not of algorithm -7 ("ES256"), stop and return an error.
+	var key webauthncose.EC2PublicKeyData
+	if err = webauthncbor.Unmarshal(att.AuthData.AttData.CredentialPublicKey, &key); err != nil {
+		return "", nil, ErrAttestationCertificate.WithDetails("Error parsing public key").WithError(err)
+	}
+
+	if webauthncose.COSEAlgorithmIdentifier(key.Algorithm) != webauthncose.AlgES256 {
+		return "", nil, ErrUnsupportedAlgorithm.WithDetails("Non-ES256 Public Key algorithm used")
+	}
+
+	var (
+		sig []byte
+		raw []byte
+		x5c []any
+		ok  bool
+	)
+
+	// Step 1. Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it
+	// to extract the contained fields.
+
+	// Check for "x5c" which is a single element array containing the attestation certificate in X.509 format.
+	if x5c, ok = att.AttStatement[stmtX5C].([]any); !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Missing properly formatted x5c data")
+	}
+
+	// Note: Packed Attestation, FIDO U2F Attestation, and Assertion Signatures require ASN.1 DER sig values, but it is
+	// RECOMMENDED that any new attestation formats defined not use ASN.1 encodings, but instead represent signatures as
+	// equivalent fixed-length byte arrays without internal structure, using the same representations as used by COSE
+	// signatures as defined in [RFC9053](https://www.rfc-editor.org/rfc/rfc9053.html) and
+	// [RFC8230](https://www.rfc-editor.org/rfc/rfc8230.html).
+	// This is described in §6.5.5 https://www.w3.org/TR/webauthn-3/#sctn-signature-attestation-types.
+
+	// Check for "sig" which is The attestation signature. The signature was calculated over the (raw) U2F
+	// registration response message https://www.w3.org/TR/webauthn/#biblio-fido-u2f-message-formats]
+	// received by the client from the authenticator.
+	if sig, ok = att.AttStatement[stmtSignature].([]byte); !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Missing sig data")
+	}
+
+	// Step 2.
+	//	 1. Check that x5c has exactly one element and let attCert be that element.
+	//	 2. Let certificate public key be the public key conveyed by attCert.
+	//	 3. If certificate public key is not an Elliptic Curve (EC) public key over the P-256 curve, terminate this
+	//	    algorithm and return an appropriate error.
+
+	// Step 2.1.
+	if len(x5c) > 1 {
+		return "", nil, ErrAttestationFormat.WithDetails("Received more than one element in x5c values")
+	}
+
+	// Step 2.2.
+	if raw, ok = x5c[0].([]byte); !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Error decoding ASN.1 data from x5c")
+	}
+
+	attCert, err := x509.ParseCertificate(raw)
+	if err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Error parsing certificate from ASN.1 data into certificate").WithError(err)
+	}
+
+	// Step 2.3.
+	if attCert.PublicKeyAlgorithm != x509.ECDSA {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate public key algorithm is not ECDSA")
+	}
+
+	// Step 3. Extract the claimed rpIdHash from authenticatorData, and the claimed credentialId and credentialPublicKey
+	// from authenticatorData.attestedCredentialData.
+	rpIdHash := att.AuthData.RPIDHash
+	credentialID := att.AuthData.AttData.CredentialID
+
+	// Step 4. Convert the COSE_KEY formatted credentialPublicKey (see Section 7 of RFC8152 [https://www.w3.org/TR/webauthn/#biblio-rfc8152])
+	// to Raw ANSI X9.62 public key format (see ALG_KEY_ECC_X962_RAW in Section 3.6.2 Public Key
+	// Representation Formats of
+	// [FIDO-Registry](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#public-key-representation-formats)).
+
+	// Let x be the value corresponding to the "-2" key (representing x coordinate) in credentialPublicKey, and confirm
+	// its size to be of 32 bytes. If size differs or "-2" key is not found, terminate this algorithm and return an
+	// appropriate error.
+
+	// Let y be the value corresponding to the "-3" key (representing y coordinate) in credentialPublicKey, and confirm
+	// its size to be of 32 bytes. If size differs or "-3" key is not found, terminate this algorithm and return an
+	// appropriate error.
+	credentialPublicKey, ok := attCert.PublicKey.(*ecdsa.PublicKey)
+	if !ok || credentialPublicKey.Curve != elliptic.P256() {
+		return "", nil, ErrAttestationFormat.WithDetails("Attestation certificate does not contain a P-256 ECDSA public key")
+	}
+
+	if len(key.XCoord) > 32 || len(key.YCoord) > 32 {
+		return "", nil, ErrAttestation.WithDetails("X or Y Coordinate for key is invalid length")
+	}
+
+	// Let publicKeyU2F be the concatenation 0x04 || x || y.
+	publicKeyU2F := bytes.NewBuffer([]byte{0x04})
+	publicKeyU2F.Write(key.XCoord)
+	publicKeyU2F.Write(key.YCoord)
+
+	// Step 5. Let verificationData be the concatenation of (0x00 || rpIdHash || clientDataHash || credentialId || publicKeyU2F)
+	// (see Section 4.3 of [FIDO-U2F-Message-Formats](https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success)).
+	verificationData := bytes.NewBuffer([]byte{0x00})
+	verificationData.Write(rpIdHash)
+	verificationData.Write(clientDataHash)
+	verificationData.Write(credentialID)
+	verificationData.Write(publicKeyU2F.Bytes())
+
+	// Step 6. Verify the sig using verificationData and the certificate public key per section 4.1.4 of [SEC1] with
+	// SHA-256 as the hash function used in step two.
+	if err = attCert.CheckSignature(x509.ECDSAWithSHA256, verificationData.Bytes(), sig); err != nil {
+		return "", nil, err
+	}
+
+	// TODO: Step 7. Optionally, inspect x5c and consult externally provided knowledge to determine whether attStmt
+	//       conveys a Basic or AttCA attestation.
+
+	// Step 8. If successful, return implementation-specific values representing attestation type Basic, AttCA or
+	// uncertainty, and attestation trust path x5c.
+	return string(metadata.BasicFull), x5c, nil
+}
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatFIDOUniversalSecondFactor, attestationFormatValidationHandlerFIDOU2F)
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_packed.go

@@ -0,0 +1,255 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/asn1"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatPacked, attestationFormatValidationHandlerPacked)
+}
+
+// attestationFormatValidationHandlerPacked is the handler for the Packed Attestation Statement Format.
+//
+// The syntax of a Packed Attestation statement is defined by the following CDDL:
+//
+// $$attStmtType //= (
+//
+//	    fmt: "packed",
+//	    attStmt: packedStmtFormat
+//	)
+//
+//	packedStmtFormat = {
+//	                       alg: COSEAlgorithmIdentifier,
+//	                       sig: bytes,
+//	                       x5c: [ attestnCert: bytes, * (caCert: bytes) ]
+//	                   } //
+//	                   {
+//	                       alg: COSEAlgorithmIdentifier
+//	                       sig: bytes,
+//	                   }
+//
+// Specification: §8.2. Packed Attestation Statement Format
+//
+// See: https://www.w3.org/TR/webauthn/#sctn-packed-attestation
+func attestationFormatValidationHandlerPacked(att AttestationObject, clientDataHash []byte, mds metadata.Provider) (attestationType string, x5cs []any, err error) {
+	var (
+		alg int64
+		sig []byte
+		x5c []any
+		ok  bool
+	)
+
+	// Step 1. Verify that attStmt is valid CBOR conforming to the syntax defined
+	// above and perform CBOR decoding on it to extract the contained fields.
+	// Get the alg value - A COSEAlgorithmIdentifier containing the identifier of the algorithm
+	// used to generate the attestation signature.
+	if alg, ok = att.AttStatement[stmtAlgorithm].(int64); !ok {
+		return string(AttestationFormatPacked), nil, ErrAttestationFormat.WithDetails("Error retrieving alg value")
+	}
+
+	// Get the sig value - A byte string containing the attestation signature.
+	if sig, ok = att.AttStatement[stmtSignature].([]byte); !ok {
+		return string(AttestationFormatPacked), nil, ErrAttestationFormat.WithDetails("Error retrieving sig value")
+	}
+
+	// Step 2. If x5c is present, this indicates that the attestation type is not ECDAA.
+	if x5c, ok = att.AttStatement[stmtX5C].([]any); ok {
+		// Handle Basic Attestation steps for the x509 Certificate.
+		return handleBasicAttestation(sig, clientDataHash, att.RawAuthData, att.AuthData.AttData.AAGUID, alg, x5c, mds)
+	}
+
+	// Step 3. If ecdaaKeyId is present, then the attestation type is ECDAA.
+	// Also make sure the we did not have an x509.
+	ecdaaKeyID, ecdaaKeyPresent := att.AttStatement[stmtECDAAKID].([]byte)
+	if ecdaaKeyPresent {
+		// Handle ECDAA Attestation steps for the x509 Certificate.
+		return handleECDAAAttestation(sig, clientDataHash, ecdaaKeyID, mds)
+	}
+
+	// Step 4. If neither x5c nor ecdaaKeyId is present, self attestation is in use.
+	return handleSelfAttestation(alg, att.AuthData.AttData.CredentialPublicKey, att.RawAuthData, clientDataHash, sig, mds)
+}
+
+// Handle the attestation steps laid out in the basic format.
+func handleBasicAttestation(sig, clientDataHash, authData, aaguid []byte, alg int64, x5c []any, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	// Step 2.1. Verify that sig is a valid signature over the concatenation of authenticatorData
+	// and clientDataHash using the attestation public key in attestnCert with the algorithm specified in alg.
+	var attestnCert *x509.Certificate
+
+	for i, raw := range x5c {
+		rawByes, ok := raw.([]byte)
+		if !ok {
+			return "", x5c, ErrAttestation.WithDetails("Error getting certificate from x5c cert chain")
+		}
+
+		cert, err := x509.ParseCertificate(rawByes)
+		if err != nil {
+			return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)
+		}
+
+		if cert.NotBefore.After(time.Now()) || cert.NotAfter.Before(time.Now()) {
+			return "", x5c, ErrAttestationFormat.WithDetails("Cert in chain not time valid")
+		}
+
+		if i == 0 {
+			attestnCert = cert
+		}
+	}
+
+	if attestnCert == nil {
+		return "", x5c, ErrAttestation.WithDetails("Error getting certificate from x5c cert chain")
+	}
+
+	signatureData := append(authData, clientDataHash...) //nolint:gocritic // This is intentional.
+
+	if sigAlg := webauthncose.SigAlgFromCOSEAlg(webauthncose.COSEAlgorithmIdentifier(alg)); sigAlg == x509.UnknownSignatureAlgorithm {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Unsupported COSE alg: %d", alg))
+	} else if err = attestnCert.CheckSignature(sigAlg, signatureData, sig); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v", err)).WithError(err)
+	}
+
+	// Step 2.2 Verify that attestnCert meets the requirements in §8.2.1 Packed attestation statement certificate requirements.
+	// §8.2.1 can be found here https://www.w3.org/TR/webauthn/#packed-attestation-cert-requirements
+
+	// Step 2.2.1 (from §8.2.1) Version MUST be set to 3 (which is indicated by an ASN.1 INTEGER with value 2).
+	if attestnCert.Version != 3 {
+		return "", x5c, ErrAttestationCertificate.WithDetails("Attestation Certificate is incorrect version")
+	}
+
+	// Step 2.2.2 (from §8.2.1) Subject field MUST be set to:
+	// 	Subject-C
+	// 	ISO 3166 code specifying the country where the Authenticator vendor is incorporated (PrintableString).
+
+	//  TODO: Find a good, usable, country code library. For now, check stringy-ness
+	subjectString := strings.Join(attestnCert.Subject.Country, "")
+	if subjectString == "" {
+		return "", x5c, ErrAttestationCertificate.WithDetails("Attestation Certificate Country Code is invalid")
+	}
+
+	// 	Subject-O
+	// 	Legal name of the Authenticator vendor (UTF8String).
+	subjectString = strings.Join(attestnCert.Subject.Organization, "")
+	if subjectString == "" {
+		return "", x5c, ErrAttestationCertificate.WithDetails("Attestation Certificate Organization is invalid")
+	}
+
+	// Subject-OU
+	// Literal string “Authenticator Attestation” (UTF8String).
+	subjectString = strings.Join(attestnCert.Subject.OrganizationalUnit, " ")
+	if subjectString != "Authenticator Attestation" {
+		return "", x5c, ErrAttestationCertificate.WithDetails("Attestation Certificate Organizational Unit is invalid")
+	}
+
+	//  Subject-CN
+	//  A UTF8String of the vendor’s choosing.
+	subjectString = attestnCert.Subject.CommonName
+	if subjectString == "" {
+		return "", x5c, ErrAttestationCertificate.WithDetails("Attestation Certificate Common Name not set")
+	}
+
+	// Step 2.2.3 (from §8.2.1) If the related attestation root certificate is used for multiple authenticator models,
+	// the Extension OID 1.3.6.1.4.1.45724.1.1.4 (id-fido-gen-ce-aaguid) MUST be present, containing the
+	// AAGUID as a 16-byte OCTET STRING. The extension MUST NOT be marked as critical.
+	var foundAAGUID []byte
+
+	for _, extension := range attestnCert.Extensions {
+		if extension.Id.Equal(oidFIDOGenCeAAGUID) {
+			if extension.Critical {
+				return "", x5c, ErrInvalidAttestation.WithDetails("Attestation certificate FIDO extension marked as critical")
+			}
+
+			foundAAGUID = extension.Value
+		}
+	}
+
+	// We validate the AAGUID as mentioned above
+	// This is not well defined in§8.2.1 but mentioned in step 2.3: we validate the AAGUID if it is present within the certificate
+	// and make sure it matches the auth data AAGUID
+	// Note that an X.509 Extension encodes the DER-encoding of the value in an OCTET STRING. Thus, the
+	// AAGUID MUST be wrapped in two OCTET STRINGS to be valid.
+	if len(foundAAGUID) > 0 {
+		var unMarshalledAAGUID []byte
+
+		if _, err = asn1.Unmarshal(foundAAGUID, &unMarshalledAAGUID); err != nil {
+			return "", x5c, ErrInvalidAttestation.WithDetails("Error unmarshalling AAGUID from certificate")
+		}
+
+		if !bytes.Equal(aaguid, unMarshalledAAGUID) {
+			return "", x5c, ErrInvalidAttestation.WithDetails("Certificate AAGUID does not match Auth Data certificate")
+		}
+	}
+
+	// Step 2.2.4 The Basic Constraints extension MUST have the CA component set to false.
+	if attestnCert.IsCA {
+		return "", x5c, ErrInvalidAttestation.WithDetails("Attestation certificate's Basic Constraints marked as CA")
+	}
+
+	// Note for 2.2.5 An Authority Information Access (AIA) extension with entry id-ad-ocsp and a CRL
+	// Distribution Point extension [RFC5280](https://www.w3.org/TR/webauthn/#biblio-rfc5280) are
+	// both OPTIONAL as the status of many attestation certificates is available through authenticator
+	// metadata services. See, for example, the FIDO Metadata Service
+	// [FIDOMetadataService] (https://www.w3.org/TR/webauthn/#biblio-fidometadataservice)
+
+	// Step 2.4 If successful, return attestation type Basic and attestation trust path x5c.
+	// We don't handle trust paths yet but we're done.
+	return string(metadata.BasicFull), x5c, nil
+}
+
+func handleECDAAAttestation(sig, clientDataHash, ecdaaKeyID []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	return "Packed (ECDAA)", nil, ErrNotSpecImplemented
+}
+
+func handleSelfAttestation(alg int64, pubKey, authData, clientDataHash, sig []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	verificationData := append(authData, clientDataHash...) //nolint:gocritic // This is intentional.
+
+	var (
+		key   any
+		valid bool
+	)
+
+	if key, err = webauthncose.ParsePublicKey(pubKey); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing the public key: %+v", err))
+	}
+
+	// §4.1 Validate that alg matches the algorithm of the credentialPublicKey in authenticatorData.
+	switch k := key.(type) {
+	case webauthncose.OKPPublicKeyData:
+		err = verifyKeyAlgorithm(k.Algorithm, alg)
+	case webauthncose.EC2PublicKeyData:
+		err = verifyKeyAlgorithm(k.Algorithm, alg)
+	case webauthncose.RSAPublicKeyData:
+		err = verifyKeyAlgorithm(k.Algorithm, alg)
+	default:
+		return "", nil, ErrInvalidAttestation.WithDetails("Error verifying the public key data")
+	}
+
+	if err != nil {
+		return "", nil, err
+	}
+
+	// §4.2 Verify that sig is a valid signature over the concatenation of authenticatorData and
+	// clientDataHash using the credential public key with alg.
+	if valid, err = webauthncose.VerifySignature(key, verificationData, sig); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error verifying the signature: %+v", err)).WithError(err)
+	} else if !valid {
+		return "", nil, ErrInvalidAttestation.WithDetails("Unable to verify signature")
+	}
+
+	return string(metadata.BasicSurrogate), nil, err
+}
+
+func verifyKeyAlgorithm(keyAlgorithm, attestedAlgorithm int64) error {
+	if keyAlgorithm != attestedAlgorithm {
+		return ErrInvalidAttestation.WithDetails("Public key algorithm does not equal att statement algorithm")
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_safetynet.go

@@ -0,0 +1,185 @@
+package protocol
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/go-viper/mapstructure/v2"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/go-webauthn/webauthn/metadata"
+)
+
+// attestationFormatValidationHandlerAndroidSafetyNet is the handler for the Android SafetyNet Attestation Statement
+// Format.
+//
+// When the authenticator is a platform authenticator on certain Android platforms, the attestation statement may be
+// based on the SafetyNet API. In this case the authenticator data is completely controlled by the caller of the
+// SafetyNet API (typically an application running on the Android platform) and the attestation statement provides some
+// statements about the health of the platform and the identity of the calling application (see SafetyNet Documentation
+// for more details).
+//
+// The syntax of an Android Attestation statement is defined as follows:
+//
+//	$$attStmtType //= (
+//			fmt: "android-safetynet",
+//			attStmt: safetynetStmtFormat
+//	)
+//
+//	safetynetStmtFormat = {
+//			ver: text,
+//			response: bytes
+//	}
+//
+// Specification: §8.5. Android SafetyNet Attestation Statement Format
+//
+// See: https://www.w3.org/TR/webauthn/#sctn-android-safetynet-attestation
+func attestationFormatValidationHandlerAndroidSafetyNet(att AttestationObject, clientDataHash []byte, mds metadata.Provider) (attestationType string, x5cs []any, err error) {
+	// The syntax of an Android Attestation statement is defined as follows:
+	//     $$attStmtType //= (
+	//                           fmt: "android-safetynet",
+	//                           attStmt: safetynetStmtFormat
+	//                       )
+
+	//     safetynetStmtFormat = {
+	//                               ver: text,
+	//                               response: bytes
+	//                           }
+
+	// §8.5.1 Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it to extract
+	// the contained fields.
+
+	// We have done this
+	// §8.5.2 Verify that response is a valid SafetyNet response of version ver.
+	version, present := att.AttStatement[stmtVersion].(string)
+	if !present {
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to find the version of SafetyNet")
+	}
+
+	if version == "" {
+		return "", nil, ErrAttestationFormat.WithDetails("Not a proper version for SafetyNet")
+	}
+
+	// TODO: provide user the ability to designate their supported versions.
+
+	response, present := att.AttStatement["response"].([]byte)
+	if !present {
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to find the SafetyNet response")
+	}
+
+	var token *jwt.Token
+
+	if token, err = jwt.Parse(string(response), keyFuncSafetyNetJWT, jwt.WithValidMethods([]string{jwt.SigningMethodRS256.Alg()})); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
+	}
+
+	// marshall the JWT payload into the safetynet response json.
+	var safetyNetResponse SafetyNetResponse
+
+	if err = mapstructure.Decode(token.Claims, &safetyNetResponse); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing the SafetyNet response: %+v", err)).WithError(err)
+	}
+
+	// §8.5.3 Verify that the nonce in the response is identical to the Base64 encoding of the SHA-256 hash of the concatenation
+	// of authenticatorData and clientDataHash.
+	nonceBuffer := sha256.Sum256(append(att.RawAuthData, clientDataHash...))
+
+	nonceBytes, err := base64.StdEncoding.DecodeString(safetyNetResponse.Nonce)
+	if !bytes.Equal(nonceBuffer[:], nonceBytes) || err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails("Invalid nonce for in SafetyNet response").WithError(err)
+	}
+
+	// §8.5.4 Let attestationCert be the attestation certificate (https://www.w3.org/TR/webauthn/#attestation-certificate)
+	certChain := token.Header[stmtX5C].([]any)
+	l := make([]byte, base64.StdEncoding.DecodedLen(len(certChain[0].(string))))
+
+	n, err := base64.StdEncoding.Decode(l, []byte(certChain[0].(string)))
+	if err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
+	}
+
+	attestationCert, err := x509.ParseCertificate(l[:n])
+	if err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
+	}
+
+	// §8.5.5 Verify that attestationCert is issued to the hostname "attest.android.com".
+	if err = attestationCert.VerifyHostname(attStatementAndroidSafetyNetHostname); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
+	}
+
+	// §8.5.6 Verify that the ctsProfileMatch attribute in the payload of response is true.
+	if !safetyNetResponse.CtsProfileMatch {
+		return "", nil, ErrInvalidAttestation.WithDetails("ctsProfileMatch attribute of the JWT payload is false")
+	}
+
+	if t := time.Unix(safetyNetResponse.TimestampMs/1000, 0); t.After(time.Now()) {
+		// Zero tolerance for post-dated timestamps.
+		return "", nil, ErrInvalidAttestation.WithDetails("SafetyNet response with timestamp after current time")
+	} else if t.Before(time.Now().Add(-time.Minute)) {
+		// Small tolerance for pre-dated timestamps.
+		if mds != nil && mds.GetValidateEntry(context.Background()) {
+			return "", nil, ErrInvalidAttestation.WithDetails("SafetyNet response with timestamp before one minute ago")
+		}
+	}
+
+	// §8.5.7 If successful, return implementation-specific values representing attestation type Basic and attestation
+	// trust path attestationCert.
+	return string(metadata.BasicFull), nil, nil
+}
+
+func keyFuncSafetyNetJWT(token *jwt.Token) (key any, err error) {
+	var (
+		ok    bool
+		raw   any
+		chain []any
+		first string
+		der   []byte
+		cert  *x509.Certificate
+	)
+
+	if raw, ok = token.Header[stmtX5C]; !ok {
+		return nil, fmt.Errorf("jwt header missing x5c")
+	}
+
+	if chain, ok = raw.([]any); !ok || len(chain) == 0 {
+		return nil, fmt.Errorf("jwt header x5c is not a non-empty array")
+	}
+
+	if first, ok = chain[0].(string); !ok || first == "" {
+		return nil, fmt.Errorf("jwt header x5c[0] not a base64 string")
+	}
+
+	if der, err = base64.StdEncoding.DecodeString(first); err != nil {
+		return nil, fmt.Errorf("decode x5c leaf: %w", err)
+	}
+
+	if cert, err = x509.ParseCertificate(der); err != nil {
+		if cert != nil {
+			return cert.PublicKey, fmt.Errorf("parse x5c leaf: %w", err)
+		}
+
+		return nil, fmt.Errorf("parse x5c leaf: %w", err)
+	}
+
+	return cert.PublicKey, nil
+}
+
+type SafetyNetResponse struct {
+	Nonce                      string `json:"nonce"`
+	TimestampMs                int64  `json:"timestampMs"`
+	ApkPackageName             string `json:"apkPackageName"`
+	ApkDigestSha256            string `json:"apkDigestSha256"`
+	CtsProfileMatch            bool   `json:"ctsProfileMatch"`
+	ApkCertificateDigestSha256 []any  `json:"apkCertificateDigestSha256"`
+	BasicIntegrity             bool   `json:"basicIntegrity"`
+}
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatAndroidSafetyNet, attestationFormatValidationHandlerAndroidSafetyNet)
+}

vendor/github.com/go-webauthn/webauthn/protocol/attestation_tpm.go

@@ -0,0 +1,625 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/subtle"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/google/go-tpm/tpm2"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// attestationFormatValidationHandlerTPM is the handler for the TPM Attestation Statement Format.
+//
+// The syntax of a TPM Attestation statement is as follows:
+//
+// $$attStmtType // = (
+//
+//	    fmt: "tpm",
+//	    attStmt: tpmStmtFormat
+//	)
+//
+//	tpmStmtFormat = {
+//	                    ver: "2.0",
+//	                    (
+//	                        alg: COSEAlgorithmIdentifier,
+//	                        x5c: [ aikCert: bytes, * (caCert: bytes) ]
+//	                    )
+//	                    sig: bytes,
+//	                    certInfo: bytes,
+//	                    pubArea: bytes
+//	                }
+//
+// Specification: §8.3. TPM Attestation Statement Format
+//
+// See: https://www.w3.org/TR/webauthn/#sctn-tpm-attestation
+func attestationFormatValidationHandlerTPM(att AttestationObject, clientDataHash []byte, _ metadata.Provider) (attestationType string, x5cs []any, err error) {
+	var statement *tpm2AttStatement
+
+	if statement, err = newTPM2AttStatement(att.AttStatement); err != nil {
+		return "", nil, err
+	}
+
+	if statement.HasECDAAKeyID || statement.HasValidECDAAKeyID {
+		return "", nil, ErrNotImplemented
+	}
+
+	if !statement.HasX5C || !statement.HasValidX5C {
+		return "", nil, ErrNotImplemented
+	}
+
+	if statement.Version != versionTPM20 {
+		return "", nil, ErrAttestationFormat.WithDetails("WebAuthn only supports TPM 2.0 currently")
+	}
+
+	var (
+		pubArea *tpm2.TPMTPublic
+		key     any
+	)
+
+	if pubArea, err = tpm2.Unmarshal[tpm2.TPMTPublic](statement.PubArea); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to decode TPMT_PUBLIC in attestation statement").WithError(err)
+	}
+
+	if key, err = webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey); err != nil {
+		return "", nil, err
+	}
+
+	switch k := key.(type) {
+	case webauthncose.EC2PublicKeyData:
+		var (
+			params *tpm2.TPMSECCParms
+			point  *tpm2.TPMSECCPoint
+		)
+
+		if params, err = pubArea.Parameters.ECCDetail(); err != nil {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between ECCParameters in pubArea and credentialPublicKey")
+		}
+
+		if point, err = pubArea.Unique.ECC(); err != nil {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between ECCParameters in pubArea and credentialPublicKey")
+		}
+
+		if params.CurveID != k.TPMCurveID() {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between ECCParameters in pubArea and credentialPublicKey")
+		}
+
+		if !bytes.Equal(point.X.Buffer, k.XCoord) || !bytes.Equal(point.Y.Buffer, k.YCoord) {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between ECCParameters in pubArea and credentialPublicKey")
+		}
+	case webauthncose.RSAPublicKeyData:
+		var (
+			params  *tpm2.TPMSRSAParms
+			modulus *tpm2.TPM2BPublicKeyRSA
+		)
+
+		if params, err = pubArea.Parameters.RSADetail(); err != nil {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between RSAParameters in pubArea and credentialPublicKey")
+		}
+
+		if modulus, err = pubArea.Unique.RSA(); err != nil {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between RSAParameters in pubArea and credentialPublicKey")
+		}
+
+		if !bytes.Equal(modulus.Buffer, k.Modulus) {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between RSAParameters in pubArea and credentialPublicKey")
+		}
+
+		exp := uint32(k.Exponent[0]) + uint32(k.Exponent[1])<<8 + uint32(k.Exponent[2])<<16
+		if tpm2Exponent(params) != exp {
+			return "", nil, ErrAttestationFormat.WithDetails("Mismatch between RSAParameters in pubArea and credentialPublicKey")
+		}
+	default:
+		return "", nil, ErrUnsupportedKey
+	}
+
+	// Concatenate authenticatorData and clientDataHash to form attToBeSigned.
+	attToBeSigned := append(att.RawAuthData, clientDataHash...) //nolint:gocritic // This is intentional.
+
+	var certInfo *tpm2.TPMSAttest
+
+	// Validate that certInfo is valid:
+	// 1/4 Verify that magic is set to TPM_GENERATED_VALUE, handled here.
+	if certInfo, err = tpm2.Unmarshal[tpm2.TPMSAttest](statement.CertInfo); err != nil {
+		return "", nil, err
+	}
+
+	if err = certInfo.Magic.Check(); err != nil {
+		return "", nil, ErrInvalidAttestation.WithDetails("Magic is not set to TPM_GENERATED_VALUE")
+	}
+
+	// 2/4 Verify that type is set to TPM_ST_ATTEST_CERTIFY.
+	if certInfo.Type != tpm2.TPMSTAttestCertify {
+		return "", nil, ErrAttestationFormat.WithDetails("Type is not set to TPM_ST_ATTEST_CERTIFY")
+	}
+
+	// 3/4 Verify that extraData is set to the hash of attToBeSigned using the hash algorithm employed in "alg".
+	coseAlg := webauthncose.COSEAlgorithmIdentifier(statement.Algorithm)
+
+	h := webauthncose.HasherFromCOSEAlg(coseAlg)
+	h.Write(attToBeSigned)
+
+	if !bytes.Equal(certInfo.ExtraData.Buffer, h.Sum(nil)) {
+		return "", nil, ErrAttestationFormat.WithDetails("ExtraData is not set to hash of attToBeSigned")
+	}
+
+	// Note that the remaining fields in the "Standard Attestation Structure"
+	// [TPMv2-Part1] section 31.2, i.e., qualifiedSigner, clockInfo and firmwareVersion
+	// are ignored. These fields MAY be used as an input to risk engines.
+	var (
+		aikCert *x509.Certificate
+		raw     []byte
+		ok      bool
+	)
+
+	if len(statement.X5C) == 0 {
+		return "", nil, ErrAttestation.WithDetails("Error getting certificate from x5c cert chain")
+	}
+
+	// In this case:
+	// Verify the sig is a valid signature over certInfo using the attestation public key in aikCert with the algorithm specified in alg.
+	if raw, ok = statement.X5C[0].([]byte); !ok {
+		return "", nil, ErrAttestation.WithDetails("Error getting certificate from x5c cert chain")
+	}
+
+	if aikCert, err = x509.ParseCertificate(raw); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails("Error parsing certificate from ASN.1")
+	}
+
+	if sigAlg := webauthncose.SigAlgFromCOSEAlg(coseAlg); sigAlg == x509.UnknownSignatureAlgorithm {
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Unsupported COSE alg: %d", statement.Algorithm))
+	} else if err = aikCert.CheckSignature(sigAlg, statement.CertInfo, statement.Signature); err != nil {
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Signature validation error: %+v", err))
+	}
+
+	// Verify that aikCert meets the requirements in §8.3.1 TPM Attestation Statement Certificate Requirements.
+
+	// 1/6 Version MUST be set to 3.
+	if aikCert.Version != 3 {
+		return "", nil, ErrAttestationFormat.WithDetails("AIK certificate version must be 3")
+	}
+
+	// 2/6 Subject field MUST be set to empty.
+	if aikCert.Subject.String() != "" {
+		return "", nil, ErrAttestationFormat.WithDetails("AIK certificate subject must be empty")
+	}
+
+	var (
+		manufacturer, model, version string
+		ekuValid                     = false
+		eku                          []asn1.ObjectIdentifier
+		constraints                  tpmBasicConstraints
+		rest                         []byte
+	)
+
+	for _, ext := range aikCert.Extensions {
+		switch {
+		case ext.Id.Equal(oidExtensionSubjectAltName):
+			if manufacturer, model, version, err = parseSANExtension(ext.Value); err != nil {
+				return "", nil, err
+			}
+		case ext.Id.Equal(oidExtensionExtendedKeyUsage):
+			if rest, err = asn1.Unmarshal(ext.Value, &eku); err != nil {
+				return "", nil, ErrAttestationFormat.WithDetails("AIK certificate extended key usage malformed")
+			} else if len(rest) != 0 {
+				return "", nil, ErrAttestationFormat.WithDetails("AIK certificate extended key usage contains extra data")
+			}
+
+			found := false
+
+			for _, oid := range eku {
+				if oid.Equal(oidTCGKpAIKCertificate) {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				return "", nil, ErrAttestationFormat.WithDetails("AIK certificate extended key usage missing 2.23.133.8.3")
+			}
+
+			ekuValid = true
+		case ext.Id.Equal(oidExtensionBasicConstraints):
+			if rest, err = asn1.Unmarshal(ext.Value, &constraints); err != nil {
+				return "", nil, ErrAttestationFormat.WithDetails("AIK certificate basic constraints malformed")
+			} else if len(rest) != 0 {
+				return "", nil, ErrAttestationFormat.WithDetails("AIK certificate basic constraints contains extra data")
+			}
+		}
+	}
+
+	// 3/6 The Subject Alternative Name extension MUST be set as defined in [TPMv2-EK-Profile] section 3.2.9.
+	if manufacturer == "" || model == "" || version == "" {
+		return "", nil, ErrAttestationFormat.WithDetails("Invalid SAN data in AIK certificate")
+	}
+
+	if !isValidTPMManufacturer(manufacturer) {
+		return "", nil, ErrAttestationFormat.WithDetails("Invalid TPM manufacturer")
+	}
+
+	// 4/6 The Extended Key Usage extension MUST contain the "joint-iso-itu-t(2) internationalorganizations(23) 133 tcg-kp(8) tcg-kp-AIKCertificate(3)" OID.
+	if !ekuValid {
+		return "", nil, ErrAttestationFormat.WithDetails("AIK certificate missing EKU")
+	}
+
+	// 6/6 An Authority Information Access (AIA) extension with entry id-ad-ocsp and a CRL Distribution Point
+	// extension [RFC5280] are both OPTIONAL as the status of many attestation certificates is available
+	// through metadata services. See, for example, the FIDO Metadata Service.
+	if constraints.IsCA {
+		return "", nil, ErrAttestationFormat.WithDetails("AIK certificate basic constraints missing or CA is true")
+	}
+
+	// 4/4 Verify that attested contains a TPMS_CERTIFY_INFO structure as specified in
+	// [TPMv2-Part2] section 10.12.3, whose name field contains a valid Name for pubArea,
+	// as computed using the algorithm in the nameAlg field of pubArea
+	// using the procedure specified in [TPMv2-Part1] section 16.
+	//
+	// This needs to move after the x5c check as the QualifiedSigner only gets populated when it can be verified.
+	if ok, err = tpm2NameMatch(certInfo, pubArea); err != nil {
+		return "", nil, err
+	} else if !ok {
+		return "", nil, ErrAttestationFormat.WithDetails("Hash value mismatch attested and pubArea")
+	}
+
+	return string(metadata.AttCA), statement.X5C, err
+}
+
+func tpm2Exponent(params *tpm2.TPMSRSAParms) (exp uint32) {
+	if params.Exponent != 0 {
+		return params.Exponent
+	}
+
+	return 65537
+}
+
+func tpm2NameMatch(certInfo *tpm2.TPMSAttest, pubArea *tpm2.TPMTPublic) (match bool, err error) {
+	if certInfo == nil || pubArea == nil {
+		return false, nil
+	}
+
+	var (
+		certifyInfo *tpm2.TPMSCertifyInfo
+		name        *tpm2.TPM2BName
+	)
+
+	if certifyInfo, err = certInfo.Attested.Certify(); err != nil {
+		return false, err
+	}
+
+	if name, err = tpm2.ObjectName(pubArea); err != nil {
+		return false, err
+	}
+
+	if _, _, err = tpm2NameDigest(certInfo.QualifiedSigner); err != nil {
+		return false, fmt.Errorf("invalid name digest algorithm: %w", err)
+	}
+
+	return subtle.ConstantTimeCompare(certifyInfo.Name.Buffer, name.Buffer) == 1, nil
+}
+
+func tpm2NameDigest(name tpm2.TPM2BName) (alg tpm2.TPMIAlgHash, digest []byte, err error) {
+	buf := name.Buffer
+
+	if len(buf) < 3 {
+		return 0, nil, fmt.Errorf("name too short")
+	}
+
+	alg = tpm2.TPMIAlgHash(binary.BigEndian.Uint16(buf[:2]))
+
+	var hash crypto.Hash
+
+	if hash, err = alg.Hash(); err != nil {
+		return 0, nil, fmt.Errorf("invalid hash algorithm: %w", err)
+	}
+
+	digest = buf[2:]
+
+	if len(digest) == 0 {
+		return 0, nil, fmt.Errorf("name digest is empty")
+	}
+
+	if len(digest) != hash.Size() {
+		return 0, nil, fmt.Errorf("invalid name digest length: %d", len(digest))
+	}
+
+	return alg, digest, nil
+}
+
+type tpm2AttStatement struct {
+	Version   string
+	Algorithm int64
+	Signature []byte
+	CertInfo  []byte
+	PubArea   []byte
+
+	X5C         []any
+	HasX5C      bool
+	HasValidX5C bool
+
+	HasECDAAKeyID      bool
+	HasValidECDAAKeyID bool
+	ECDAAKeyID         []byte
+}
+
+func newTPM2AttStatement(raw map[string]any) (statement *tpm2AttStatement, err error) {
+	var ok bool
+
+	statement = &tpm2AttStatement{}
+
+	// Given the verification procedure inputs attStmt, authenticatorData
+	// and clientDataHash, the verification procedure is as follows.
+
+	// Verify that attStmt is valid CBOR conforming to the syntax defined
+	// above and perform CBOR decoding on it to extract the contained fields.
+	if statement.Version, ok = raw[stmtVersion].(string); !ok {
+		return nil, ErrAttestationFormat.WithDetails("Error retrieving ver value")
+	}
+
+	if statement.Algorithm, ok = raw[stmtAlgorithm].(int64); !ok {
+		return nil, ErrAttestationFormat.WithDetails("Error retrieving alg value")
+	}
+
+	if statement.Signature, ok = raw[stmtSignature].([]byte); !ok {
+		return nil, ErrAttestationFormat.WithDetails("Error retrieving sig value")
+	}
+
+	if statement.CertInfo, ok = raw[stmtCertInfo].([]byte); !ok {
+		return nil, ErrAttestationFormat.WithDetails("Error retrieving certInfo value")
+	}
+
+	if statement.PubArea, ok = raw[stmtPubArea].([]byte); !ok {
+		return nil, ErrAttestationFormat.WithDetails("Error retrieving pubArea value")
+	}
+
+	var rawX5C, rawECDAAKeyID any
+
+	rawX5C, statement.HasX5C = raw[stmtX5C]
+	statement.X5C, statement.HasValidX5C = rawX5C.([]any)
+
+	rawECDAAKeyID, statement.HasECDAAKeyID = raw[stmtECDAAKID]
+	statement.ECDAAKeyID, statement.HasValidECDAAKeyID = rawECDAAKeyID.([]byte)
+
+	return statement, nil
+}
+
+// forEachSAN loops through the TPM SAN extension.
+//
+// RFC 5280, 4.2.1.6
+// SubjectAltName ::= GeneralNames
+//
+// GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
+//
+//	GeneralName ::= CHOICE {
+//	     otherName                       [0]     OtherName,
+//	     rfc822Name                      [1]     IA5String,
+//	     dNSName                         [2]     IA5String,
+//	     x400Address                     [3]     ORAddress,
+//	     directoryName                   [4]     Name,
+//	     ediPartyName                    [5]     EDIPartyName,
+//	     uniformResourceIdentifier       [6]     IA5String,
+//	     iPAddress                       [7]     OCTET STRING,
+//	     registeredID                    [8]     OBJECT IDENTIFIER }
+func forEachSAN(extension []byte, callback func(tag int, data []byte) error) error {
+	var seq asn1.RawValue
+
+	rest, err := asn1.Unmarshal(extension, &seq)
+	if err != nil {
+		return err
+	} else if len(rest) != 0 {
+		return errors.New("x509: trailing data after X.509 extension")
+	}
+
+	if !seq.IsCompound || seq.Tag != 16 || seq.Class != 0 {
+		return asn1.StructuralError{Msg: "bad SAN sequence"}
+	}
+
+	rest = seq.Bytes
+
+	for len(rest) > 0 {
+		var v asn1.RawValue
+
+		rest, err = asn1.Unmarshal(rest, &v)
+		if err != nil {
+			return err
+		}
+
+		if err = callback(v.Tag, v.Bytes); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+const (
+	nameTypeDN = 4
+)
+
+func parseSANExtension(value []byte) (manufacturer string, model string, version string, err error) {
+	err = forEachSAN(value, func(tag int, data []byte) error {
+		if tag == nameTypeDN {
+			tpmDeviceAttributes := pkix.RDNSequence{}
+
+			if _, err = asn1.Unmarshal(data, &tpmDeviceAttributes); err != nil {
+				return err
+			}
+
+			for _, rdn := range tpmDeviceAttributes {
+				if len(rdn) == 0 {
+					continue
+				}
+
+				for _, atv := range rdn {
+					value, ok := atv.Value.(string)
+					if !ok {
+						continue
+					}
+
+					if atv.Type.Equal(oidTCGAtTpmManufacturer) {
+						manufacturer = strings.TrimPrefix(value, "id:")
+					}
+
+					if atv.Type.Equal(oidTCGAtTpmModel) {
+						model = value
+					}
+
+					if atv.Type.Equal(oidTCGAtTPMVersion) {
+						version = strings.TrimPrefix(value, "id:")
+					}
+				}
+			}
+		}
+
+		return nil
+	})
+
+	return
+}
+
+// See https://trustedcomputinggroup.org/resource/vendor-id-registry/ for registry contents.
+var tpmManufacturers = []struct {
+	id   string
+	name string
+	code string
+}{
+	{"414D4400", "AMD", "AMD"},
+	{"414E5400", "Ant Group", "ANT"},
+	{"41544D4C", "Atmel", "ATML"},
+	{"4252434D", "Broadcom", "BRCM"},
+	{"4353434F", "Cisco", "CSCO"},
+	{"464C5953", "Flyslice Technologies", "FLYS"},
+	{"524F4343", "Fuzhou Rockchip", "ROCC"},
+	{"474F4F47", "Google", "GOOG"},
+	{"48504900", "HPI", "HPI"},
+	{"48504500", "HPE", "HPE"},
+	{"48495349", "Huawei", "HISI"},
+	{"49424d00", "IBM", "IBM"},
+	{"49424D00", "IBM", "IBM"},
+	{"49465800", "Infineon", "IFX"},
+	{"494E5443", "Intel", "INTC"},
+	{"4C454E00", "Lenovo", "LEN"},
+	{"4D534654", "Microsoft", "MSFT"},
+	{"4E534D20", "National Semiconductor", "NSM"},
+	{"4E545A00", "Nationz", "NTZ"},
+	{"4E534700", "NSING", "NSG"},
+	{"4E544300", "Nuvoton Technology", "NTC"},
+	{"51434F4D", "Qualcomm", "QCOM"},
+	{"534D534E", "Samsung", "SECE"},
+	{"53454345", "SecEdge", "SecEdge"},
+	{"534E5300", "Sinosun", "SNS"},
+	{"534D5343", "SMSC", "SMSC"},
+	{"53544D20", "ST Microelectronics", "STM"},
+	{"54584E00", "Texas Instruments", "TXN"},
+	{"57454300", "Winbond", "WEC"},
+	{"5345414C", "Wisekey", "SEAL"},
+	{"FFFFF1D0", "FIDO Alliance Conformance Testing", "FIDO"},
+}
+
+func isValidTPMManufacturer(id string) bool {
+	for _, m := range tpmManufacturers {
+		if m.id == id {
+			return true
+		}
+	}
+
+	return false
+}
+
+func tpmParseAIKAttCA(x5c *x509.Certificate, x5cis []*x509.Certificate) (err *Error) {
+	if err = tpmParseSANExtension(x5c); err != nil {
+		return err
+	}
+
+	if err = tpmRemoveEKU(x5c); err != nil {
+		return err
+	}
+
+	for _, parent := range x5cis {
+		if err = tpmRemoveEKU(parent); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func tpmParseSANExtension(attestation *x509.Certificate) (protoErr *Error) {
+	var (
+		manufacturer, model, version string
+		err                          error
+	)
+
+	for _, ext := range attestation.Extensions {
+		if ext.Id.Equal(oidExtensionSubjectAltName) {
+			if manufacturer, model, version, err = parseSANExtension(ext.Value); err != nil {
+				return ErrInvalidAttestation.WithDetails("Authenticator with invalid Authenticator Identity Key SAN data encountered during attestation validation.").WithInfo(fmt.Sprintf("Error occurred parsing SAN extension: %s", err.Error())).WithError(err)
+			}
+		}
+	}
+
+	if manufacturer == "" || model == "" || version == "" {
+		return ErrAttestationFormat.WithDetails("Invalid SAN data in AIK certificate.")
+	}
+
+	var unhandled []asn1.ObjectIdentifier //nolint:prealloc
+
+	for _, uce := range attestation.UnhandledCriticalExtensions {
+		if uce.Equal(oidExtensionSubjectAltName) {
+			continue
+		}
+
+		unhandled = append(unhandled, uce)
+	}
+
+	attestation.UnhandledCriticalExtensions = unhandled
+
+	return nil
+}
+
+type tpmBasicConstraints struct {
+	IsCA       bool `asn1:"optional"`
+	MaxPathLen int  `asn1:"optional,default:-1"`
+}
+
+// Remove extension key usage to avoid ExtKeyUsage check failure.
+func tpmRemoveEKU(x5c *x509.Certificate) *Error {
+	var (
+		unknown []asn1.ObjectIdentifier
+		hasAiK  bool
+	)
+
+	for _, eku := range x5c.UnknownExtKeyUsage {
+		if eku.Equal(oidTCGKpAIKCertificate) {
+			hasAiK = true
+
+			continue
+		}
+
+		if eku.Equal(oidMicrosoftKpPrivacyCA) {
+			continue
+		}
+
+		unknown = append(unknown, eku)
+	}
+
+	if !hasAiK {
+		return ErrAttestationFormat.WithDetails("Attestation Identity Key certificate missing required Extended Key Usage.")
+	}
+
+	x5c.UnknownExtKeyUsage = unknown
+
+	return nil
+}
+
+func init() {
+	RegisterAttestationFormat(AttestationFormatTPM, attestationFormatValidationHandlerTPM)
+}

vendor/github.com/go-webauthn/webauthn/protocol/authenticator.go

@@ -0,0 +1,426 @@
+package protocol
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncbor"
+)
+
+const (
+	minAuthDataLength     = 37
+	minAttestedAuthLength = 55
+	maxCredentialIDLength = 1023
+)
+
+// AuthenticatorResponse represents the IDL with the same name.
+//
+// Authenticators respond to Relying Party requests by returning an object derived from the AuthenticatorResponse
+// interface
+//
+// Specification: §5.2. Authenticator Responses (https://www.w3.org/TR/webauthn/#iface-authenticatorresponse)
+type AuthenticatorResponse struct {
+	// From the spec https://www.w3.org/TR/webauthn/#dom-authenticatorresponse-clientdatajson
+	// This attribute contains a JSON serialization of the client data passed to the authenticator
+	// by the client in its call to either create() or get().
+	ClientDataJSON URLEncodedBase64 `json:"clientDataJSON"`
+}
+
+// AuthenticatorData represents the IDL with the same name.
+//
+// The authenticator data structure encodes contextual bindings made by the authenticator. These bindings are controlled
+// by the authenticator itself, and derive their trust from the WebAuthn Relying Party's assessment of the security
+// properties of the authenticator. In one extreme case, the authenticator may be embedded in the client, and its
+// bindings may be no more trustworthy than the client data. At the other extreme, the authenticator may be a discrete
+// entity with high-security hardware and software, connected to the client over a secure channel. In both cases, the
+// Relying Party receives the authenticator data in the same format, and uses its knowledge of the authenticator to make
+// trust decisions.
+//
+// The authenticator data has a compact but extensible encoding. This is desired since authenticators can be devices
+// with limited capabilities and low power requirements, with much simpler software stacks than the client platform.
+//
+// Specification: §6.1. Authenticator Data (https://www.w3.org/TR/webauthn/#sctn-authenticator-data)
+type AuthenticatorData struct {
+	RPIDHash []byte                 `json:"rpid"`
+	Flags    AuthenticatorFlags     `json:"flags"`
+	Counter  uint32                 `json:"sign_count"`
+	AttData  AttestedCredentialData `json:"att_data"`
+	ExtData  []byte                 `json:"ext_data"`
+}
+
+type AttestedCredentialData struct {
+	AAGUID       []byte `json:"aaguid"`
+	CredentialID []byte `json:"credential_id"`
+
+	// The raw credential public key bytes received from the attestation data. This is the CBOR representation of the
+	// credentials public key.
+	CredentialPublicKey []byte `json:"public_key"`
+}
+
+// CredentialMediationRequirement represents mediation requirements for clients. When making a request via get(options)
+// or create(options), developers can set a case-by-case requirement for user mediation by choosing the appropriate
+// CredentialMediationRequirement enum value.
+//
+// See https://www.w3.org/TR/credential-management-1/#mediation-requirements
+type CredentialMediationRequirement string
+
+const (
+	// MediationDefault lets the browser choose the mediation flow completely as if it wasn't specified at all.
+	MediationDefault CredentialMediationRequirement = ""
+
+	// MediationSilent indicates user mediation is suppressed for the given operation. If the operation can be performed
+	// without user involvement, wonderful. If user involvement is necessary, then the operation will return null rather
+	// than involving the user.
+	MediationSilent CredentialMediationRequirement = "silent"
+
+	// MediationOptional indicates if credentials can be handed over for a given operation without user mediation, they
+	// will be. If user mediation is required, then the user agent will involve the user in the decision.
+	MediationOptional CredentialMediationRequirement = "optional"
+
+	// MediationConditional indicates for get(), discovered credentials are presented to the user in a non-modal dialog
+	// along with an indication of the origin which is requesting credentials. If the user makes a gesture outside of
+	// the dialog, the dialog closes without resolving or rejecting the Promise returned by the get() method and without
+	// causing a user-visible error condition. If the user makes a gesture that selects a credential, that credential is
+	// returned to the caller. The prevent silent access flag is treated as being true regardless of its actual value:
+	// the conditional behavior always involves user mediation of some sort if applicable credentials are discovered.
+	MediationConditional CredentialMediationRequirement = "conditional"
+
+	// MediationRequired indicates the user agent will not hand over credentials without user mediation, even if the
+	// prevent silent access flag is unset for an origin.
+	MediationRequired CredentialMediationRequirement = "required"
+)
+
+// AuthenticatorAttachment represents the IDL enum of the same name, and is used as part of the Authenticator Selection
+// Criteria.
+//
+// This enumeration’s values describe authenticators' attachment modalities. Relying Parties use this to express a
+// preferred authenticator attachment modality when calling navigator.credentials.create() to create a credential.
+//
+// If this member is present, eligible authenticators are filtered to only authenticators attached with the specified
+// §5.4.5 Authenticator Attachment Enumeration (enum AuthenticatorAttachment). The value SHOULD be a member of
+// AuthenticatorAttachment but client platforms MUST ignore unknown values, treating an unknown value as if the member
+// does not exist.
+//
+// Specification: §5.4.4. Authenticator Selection Criteria (https://www.w3.org/TR/webauthn/#dom-authenticatorselectioncriteria-authenticatorattachment)
+//
+// Specification: §5.4.5. Authenticator Attachment Enumeration (https://www.w3.org/TR/webauthn/#enum-attachment)
+type AuthenticatorAttachment string
+
+const (
+	// Platform represents a platform authenticator is attached using a client device-specific transport, called
+	// platform attachment, and is usually not removable from the client device. A public key credential bound to a
+	// platform authenticator is called a platform credential.
+	Platform AuthenticatorAttachment = "platform"
+
+	// CrossPlatform represents a roaming authenticator is attached using cross-platform transports, called
+	// cross-platform attachment. Authenticators of this class are removable from, and can "roam" among, client devices.
+	// A public key credential bound to a roaming authenticator is called a roaming credential.
+	CrossPlatform AuthenticatorAttachment = "cross-platform"
+)
+
+// ResidentKeyRequirement represents the IDL of the same name.
+//
+// This enumeration’s values describe the Relying Party's requirements for client-side discoverable credentials
+// (formerly known as resident credentials or resident keys).
+//
+// Specifies the extent to which the Relying Party desires to create a client-side discoverable credential. For
+// historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of
+// ResidentKeyRequirement but client platforms MUST ignore unknown values, treating an unknown value as if the member
+// does not exist. If no value is given then the effective value is required if requireResidentKey is true or
+// discouraged if it is false or absent.
+//
+// Specification: §5.4.4. Authenticator Selection Criteria (https://www.w3.org/TR/webauthn/#dom-authenticatorselectioncriteria-residentkey)
+//
+// Specification: §5.4.6. Resident Key Requirement Enumeration (https://www.w3.org/TR/webauthn/#enumdef-residentkeyrequirement)
+type ResidentKeyRequirement string
+
+const (
+	// ResidentKeyRequirementDiscouraged indicates the Relying Party prefers creating a server-side credential, but will
+	// accept a client-side discoverable credential. This is the default.
+	ResidentKeyRequirementDiscouraged ResidentKeyRequirement = "discouraged"
+
+	// ResidentKeyRequirementPreferred indicates to the client we would prefer a discoverable credential.
+	ResidentKeyRequirementPreferred ResidentKeyRequirement = "preferred"
+
+	// ResidentKeyRequirementRequired indicates the Relying Party requires a client-side discoverable credential, and is
+	// prepared to receive an error if a client-side discoverable credential cannot be created.
+	ResidentKeyRequirementRequired ResidentKeyRequirement = "required"
+)
+
+// AuthenticatorTransport represents the IDL enum with the same name.
+//
+// Authenticators may implement various transports for communicating with clients. This enumeration defines hints as to
+// how clients might communicate with a particular authenticator in order to obtain an assertion for a specific
+// credential. Note that these hints represent the WebAuthn Relying Party's best belief as to how an authenticator may
+// be reached. A Relying Party will typically learn of the supported transports for a public key credential via
+// getTransports().
+//
+// Specification: §5.8.4. Authenticator Transport Enumeration (https://www.w3.org/TR/webauthn/#enumdef-authenticatortransport)
+type AuthenticatorTransport string
+
+const (
+	// USB indicates the respective authenticator can be contacted over removable USB.
+	USB AuthenticatorTransport = "usb"
+
+	// NFC indicates the respective authenticator can be contacted over Near Field Communication (NFC).
+	NFC AuthenticatorTransport = "nfc"
+
+	// BLE indicates the respective authenticator can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).
+	BLE AuthenticatorTransport = "ble"
+
+	// SmartCard indicates the respective authenticator can be contacted over ISO/IEC 7816 smart card with contacts.
+	//
+	// WebAuthn Level 3.
+	SmartCard AuthenticatorTransport = "smart-card"
+
+	// Hybrid indicates the respective authenticator can be contacted using a combination of (often separate)
+	// data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using
+	// a smartphone.
+	//
+	// WebAuthn Level 3.
+	Hybrid AuthenticatorTransport = "hybrid"
+
+	// Internal indicates the respective authenticator is contacted using a client device-specific transport, i.e., it
+	// is a platform authenticator. These authenticators are not removable from the client device.
+	Internal AuthenticatorTransport = "internal"
+)
+
+// UserVerificationRequirement is a representation of the UserVerificationRequirement IDL enum.
+//
+// A WebAuthn Relying Party may require user verification for some of its operations but not for others,
+// and may use this type to express its needs.
+//
+// Specification: §5.8.6. User Verification Requirement Enumeration (https://www.w3.org/TR/webauthn/#enum-userVerificationRequirement)
+type UserVerificationRequirement string
+
+const (
+	// VerificationRequired User verification is required to create/release a credential.
+	VerificationRequired UserVerificationRequirement = "required"
+
+	// VerificationPreferred User verification is preferred to create/release a credential.
+	VerificationPreferred UserVerificationRequirement = "preferred" // This is the default.
+
+	// VerificationDiscouraged The authenticator should not verify the user for the credential.
+	VerificationDiscouraged UserVerificationRequirement = "discouraged"
+)
+
+// AuthenticatorFlags A byte of information returned during during ceremonies in the
+// authenticatorData that contains bits that give us information about the
+// whether the user was present and/or verified during authentication, and whether
+// there is attestation or extension data present. Bit 0 is the least significant bit.
+//
+// Specification: §6.1. Authenticator Data - Flags (https://www.w3.org/TR/webauthn/#flags)
+type AuthenticatorFlags byte
+
+// The bits that do not have flags are reserved for future use.
+const (
+	// FlagUserPresent Bit 00000001 in the byte sequence. Tells us if user is present. Also referred to as the UP flag.
+	FlagUserPresent AuthenticatorFlags = 1 << iota // Referred to as UP.
+
+	// FlagRFU1 is a reserved for future use flag.
+	FlagRFU1
+
+	// FlagUserVerified Bit 00000100 in the byte sequence. Tells us if user is verified
+	// by the authenticator using a biometric or PIN. Also referred to as the UV flag.
+	FlagUserVerified
+
+	// FlagBackupEligible Bit 00001000 in the byte sequence. Tells us if a backup is eligible for device. Also referred
+	// to as the BE flag.
+	FlagBackupEligible // Referred to as BE.
+
+	// FlagBackupState Bit 00010000 in the byte sequence. Tells us if a backup state for device. Also referred to as the
+	// BS flag.
+	FlagBackupState
+
+	// FlagRFU2 is a reserved for future use flag.
+	FlagRFU2
+
+	// FlagAttestedCredentialData Bit 01000000 in the byte sequence. Indicates whether
+	// the authenticator added attested credential data. Also referred to as the AT flag.
+	FlagAttestedCredentialData
+
+	// FlagHasExtensions Bit 10000000 in the byte sequence. Indicates if the authenticator data has extensions. Also
+	// referred to as the ED flag.
+	FlagHasExtensions
+)
+
+// UserPresent returns if the UP flag was set.
+func (flag AuthenticatorFlags) UserPresent() bool {
+	return flag.HasUserPresent()
+}
+
+// UserVerified returns if the UV flag was set.
+func (flag AuthenticatorFlags) UserVerified() bool {
+	return flag.HasUserVerified()
+}
+
+// HasUserPresent returns if the UP flag was set.
+func (flag AuthenticatorFlags) HasUserPresent() bool {
+	return (flag & FlagUserPresent) == FlagUserPresent
+}
+
+// HasUserVerified returns if the UV flag was set.
+func (flag AuthenticatorFlags) HasUserVerified() bool {
+	return (flag & FlagUserVerified) == FlagUserVerified
+}
+
+// HasAttestedCredentialData returns if the AT flag was set.
+func (flag AuthenticatorFlags) HasAttestedCredentialData() bool {
+	return (flag & FlagAttestedCredentialData) == FlagAttestedCredentialData
+}
+
+// HasExtensions returns if the ED flag was set.
+func (flag AuthenticatorFlags) HasExtensions() bool {
+	return (flag & FlagHasExtensions) == FlagHasExtensions
+}
+
+// HasBackupEligible returns if the BE flag was set.
+func (flag AuthenticatorFlags) HasBackupEligible() bool {
+	return (flag & FlagBackupEligible) == FlagBackupEligible
+}
+
+// HasBackupState returns if the BS flag was set.
+func (flag AuthenticatorFlags) HasBackupState() bool {
+	return (flag & FlagBackupState) == FlagBackupState
+}
+
+// Unmarshal will take the raw Authenticator Data and marshals it into AuthenticatorData for further validation.
+// The authenticator data has a compact but extensible encoding. This is desired since authenticators can be
+// devices with limited capabilities and low power requirements, with much simpler software stacks than the client platform.
+// The authenticator data structure is a byte array of 37 bytes or more, and is laid out in this table:
+// https://www.w3.org/TR/webauthn/#table-authData
+func (a *AuthenticatorData) Unmarshal(rawAuthData []byte) (err error) {
+	if minAuthDataLength > len(rawAuthData) {
+		return ErrBadRequest.
+			WithDetails("Authenticator data length too short").
+			WithInfo(fmt.Sprintf("Expected data greater than %d bytes. Got %d bytes", minAuthDataLength, len(rawAuthData)))
+	}
+
+	a.RPIDHash = rawAuthData[:32]
+	a.Flags = AuthenticatorFlags(rawAuthData[32])
+	a.Counter = binary.BigEndian.Uint32(rawAuthData[33:37])
+
+	remaining := len(rawAuthData) - minAuthDataLength
+
+	if a.Flags.HasAttestedCredentialData() {
+		if len(rawAuthData) > minAttestedAuthLength {
+			if err = a.unmarshalAttestedData(rawAuthData); err != nil {
+				return err
+			}
+
+			attDataLen := len(a.AttData.AAGUID) + 2 + len(a.AttData.CredentialID) + len(a.AttData.CredentialPublicKey)
+			remaining -= attDataLen
+		} else {
+			return ErrBadRequest.WithDetails("Attested credential flag set but data is missing")
+		}
+	} else {
+		if !a.Flags.HasExtensions() && len(rawAuthData) != 37 {
+			return ErrBadRequest.WithDetails("Attested credential flag not set")
+		}
+	}
+
+	if a.Flags.HasExtensions() {
+		if remaining != 0 {
+			a.ExtData = rawAuthData[len(rawAuthData)-remaining:]
+			remaining -= len(a.ExtData)
+		} else {
+			return ErrBadRequest.WithDetails("Extensions flag set but extensions data is missing")
+		}
+	}
+
+	if remaining != 0 {
+		return ErrBadRequest.WithDetails("Leftover bytes decoding AuthenticatorData")
+	}
+
+	return nil
+}
+
+// If Attestation Data is present, unmarshall that into the appropriate public key structure.
+func (a *AuthenticatorData) unmarshalAttestedData(rawAuthData []byte) (err error) {
+	a.AttData.AAGUID = rawAuthData[37:53]
+
+	idLength := binary.BigEndian.Uint16(rawAuthData[53:55])
+	if len(rawAuthData) < int(55+idLength) {
+		return ErrBadRequest.WithDetails("Authenticator attestation data length too short")
+	}
+
+	if idLength > maxCredentialIDLength {
+		return ErrBadRequest.WithDetails("Authenticator attestation data credential id length too long")
+	}
+
+	a.AttData.CredentialID = rawAuthData[55 : 55+idLength]
+
+	a.AttData.CredentialPublicKey, err = unmarshalCredentialPublicKey(rawAuthData[55+idLength:])
+	if err != nil {
+		return ErrBadRequest.WithDetails(fmt.Sprintf("Could not unmarshal Credential Public Key: %v", err)).WithError(err)
+	}
+
+	return nil
+}
+
+// Unmarshall the credential's Public Key into CBOR encoding.
+func unmarshalCredentialPublicKey(keyBytes []byte) (rawBytes []byte, err error) {
+	var m any
+
+	if err = webauthncbor.Unmarshal(keyBytes, &m); err != nil {
+		return nil, err
+	}
+
+	if rawBytes, err = webauthncbor.Marshal(m); err != nil {
+		return nil, err
+	}
+
+	return rawBytes, nil
+}
+
+// ResidentKeyRequired - Require that the key be private key resident to the client device.
+func ResidentKeyRequired() *bool {
+	required := true
+
+	return &required
+}
+
+// ResidentKeyNotRequired - Do not require that the private key be resident to the client device.
+func ResidentKeyNotRequired() *bool {
+	required := false
+	return &required
+}
+
+// Verify on AuthenticatorData handles Steps 13 through 15 & 17 for Registration
+// and Steps 15 through 18 for Assertion.
+func (a *AuthenticatorData) Verify(rpIdHash []byte, appIDHash []byte, userVerificationRequired bool, userPresenceRequired bool) (err error) {
+	// Registration Step 13 & Assertion Step 15
+	// Verify that the RP ID hash in authData is indeed the SHA-256
+	// hash of the RP ID expected by the RP.
+	if !bytes.Equal(a.RPIDHash, rpIdHash) && !bytes.Equal(a.RPIDHash, appIDHash) {
+		return ErrVerification.WithInfo(fmt.Sprintf("RP Hash mismatch. Expected %x and Received %x", a.RPIDHash, rpIdHash))
+	}
+
+	// Registration Step 15 & Assertion Step 16
+	// Verify that the User Present bit of the flags in authData is set.
+	if userPresenceRequired && !a.Flags.UserPresent() {
+		return ErrVerification.WithInfo("User presence required but flag not set by authenticator")
+	}
+
+	// Registration Step 15 & Assertion Step 17
+	// If user verification is required for this assertion, verify that
+	// the User Verified bit of the flags in authData is set.
+	if userVerificationRequired && !a.Flags.UserVerified() {
+		return ErrVerification.WithInfo("User verification required but flag not set by authenticator")
+	}
+
+	// Registration Step 17 & Assertion Step 18
+	// Verify that the values of the client extension outputs in clientExtensionResults
+	// and the authenticator extension outputs in the extensions in authData are as
+	// expected, considering the client extension input values that were given as the
+	// extensions option in the create() call. In particular, any extension identifier
+	// values in the clientExtensionResults and the extensions in authData MUST be also be
+	// present as extension identifier values in the extensions member of options, i.e., no
+	// extensions are present that were not requested. In the general case, the meaning
+	// of "are as expected" is specific to the Relying Party and which extensions are in use.
+
+	// This is not yet fully implemented by the spec or by browsers.
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/base64.go

@@ -0,0 +1,52 @@
+package protocol
+
+import (
+	"bytes"
+	"encoding/base64"
+	"reflect"
+)
+
+// URLEncodedBase64 represents a byte slice holding URL-encoded base64 data.
+// When fields of this type are unmarshalled from JSON, the data is base64
+// decoded into a byte slice.
+type URLEncodedBase64 []byte
+
+func (e URLEncodedBase64) String() string {
+	return base64.RawURLEncoding.EncodeToString(e)
+}
+
+// UnmarshalJSON base64 decodes a URL-encoded value, storing the result in the
+// provided byte slice.
+func (e *URLEncodedBase64) UnmarshalJSON(data []byte) error {
+	if bytes.Equal(data, []byte("null")) {
+		return nil
+	}
+
+	// Trim the leading and trailing quotes from raw JSON data (the whole value part).
+	data = bytes.Trim(data, `"`)
+
+	// Trim the trailing equal characters.
+	data = bytes.TrimRight(data, "=")
+
+	out := make([]byte, base64.RawURLEncoding.DecodedLen(len(data)))
+
+	n, err := base64.RawURLEncoding.Decode(out, data)
+	if err != nil {
+		return err
+	}
+
+	v := reflect.ValueOf(e).Elem()
+	v.SetBytes(out[:n])
+
+	return nil
+}
+
+// MarshalJSON base64 encodes a non URL-encoded value, storing the result in the
+// provided byte slice.
+func (e URLEncodedBase64) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+
+	return []byte(`"` + base64.RawURLEncoding.EncodeToString(e) + `"`), nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/challenge.go

@@ -0,0 +1,20 @@
+package protocol
+
+import (
+	"crypto/rand"
+)
+
+// ChallengeLength - Length of bytes to generate for a challenge.
+const ChallengeLength = 32
+
+// CreateChallenge creates a new challenge that should be signed and returned by the authenticator. The spec recommends
+// using at least 16 bytes with 100 bits of entropy. We use 32 bytes.
+func CreateChallenge() (challenge URLEncodedBase64, err error) {
+	challenge = make([]byte, ChallengeLength)
+
+	if _, err = rand.Read(challenge); err != nil {
+		return nil, err
+	}
+
+	return challenge, nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/client.go

@@ -0,0 +1,285 @@
+package protocol
+
+import (
+	"crypto/subtle"
+	"fmt"
+	"net/url"
+	"strings"
+)
+
+// CollectedClientData represents the contextual bindings of both the WebAuthn Relying Party
+// and the client. It is a key-value mapping whose keys are strings. Values can be any type
+// that has a valid encoding in JSON. Its structure is defined by the following Web IDL.
+//
+// Specification: §5.8.1. Client Data Used in WebAuthn Signatures (https://www.w3.org/TR/webauthn/#dictdef-collectedclientdata)
+type CollectedClientData struct {
+	// Type the string "webauthn.create" when creating new credentials,
+	// and "webauthn.get" when getting an assertion from an existing credential. The
+	// purpose of this member is to prevent certain types of signature confusion attacks
+	// (where an attacker substitutes one legitimate signature for another).
+	Type         CeremonyType  `json:"type"`
+	Challenge    string        `json:"challenge"`
+	Origin       string        `json:"origin"`
+	TopOrigin    string        `json:"topOrigin,omitempty"`
+	CrossOrigin  bool          `json:"crossOrigin,omitempty"`
+	TokenBinding *TokenBinding `json:"tokenBinding,omitempty"`
+
+	// Chromium (Chrome) returns a hint sometimes about how to handle clientDataJSON in a safe manner.
+	Hint string `json:"new_keys_may_be_added_here,omitempty"`
+}
+
+type CeremonyType string
+
+const (
+	CreateCeremony CeremonyType = "webauthn.create"
+	AssertCeremony CeremonyType = "webauthn.get"
+)
+
+type TokenBinding struct {
+	Status TokenBindingStatus `json:"status"`
+	ID     string             `json:"id,omitempty"`
+}
+
+type TokenBindingStatus string
+
+const (
+	// Present indicates token binding was used when communicating with the
+	// Relying Party. In this case, the id member MUST be present.
+	Present TokenBindingStatus = "present"
+
+	// Supported indicates token binding was used when communicating with the
+	// negotiated when communicating with the Relying Party.
+	Supported TokenBindingStatus = "supported"
+
+	// NotSupported indicates token binding not supported
+	// when communicating with the Relying Party.
+	NotSupported TokenBindingStatus = "not-supported"
+)
+
+// FullyQualifiedOrigin returns the origin per the HTML spec: (scheme)://(host)[:(port)].
+func FullyQualifiedOrigin(rawOrigin string) (fqOrigin string, err error) {
+	if strings.HasPrefix(rawOrigin, "android:apk-key-hash:") {
+		return rawOrigin, nil
+	}
+
+	var origin *url.URL
+
+	if origin, err = url.ParseRequestURI(rawOrigin); err != nil {
+		return "", err
+	}
+
+	if origin.Host == "" {
+		return "", fmt.Errorf("url '%s' does not have a host", rawOrigin)
+	}
+
+	origin.Path, origin.RawPath, origin.RawQuery, origin.User = "", "", "", nil
+
+	return origin.String(), nil
+}
+
+// Verify handles steps 3 through 6 of verifying the registering client data of a
+// new credential and steps 7 through 10 of verifying an authentication assertion
+// See https://www.w3.org/TR/webauthn/#registering-a-new-credential
+// and https://www.w3.org/TR/webauthn/#verifying-assertion
+//
+// Note: the rpTopOriginsVerify parameter does not accept the TopOriginVerificationMode value of
+// TopOriginDefaultVerificationMode as it's expected this value is updated by the config validation process.
+func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyType, rpOrigins, rpTopOrigins []string, rpTopOriginsVerify TopOriginVerificationMode) (err error) {
+	// Registration Step 3. Verify that the value of C.type is webauthn.create.
+
+	// Assertion Step 7. Verify that the value of C.type is the string webauthn.get.
+	if c.Type != ceremony {
+		return ErrVerification.WithDetails("Error validating ceremony type").WithInfo(fmt.Sprintf("Expected Value: %s, Received: %s", ceremony, c.Type))
+	}
+
+	// Registration Step 4. Verify that the value of C.challenge matches the challenge
+	// that was sent to the authenticator in the create() call.
+
+	// Assertion Step 8. Verify that the value of C.challenge matches the challenge
+	// that was sent to the authenticator in the PublicKeyCredentialRequestOptions
+	// passed to the get() call.
+
+	challenge := c.Challenge
+	if subtle.ConstantTimeCompare([]byte(storedChallenge), []byte(challenge)) != 1 {
+		return ErrVerification.
+			WithDetails("Error validating challenge").
+			WithInfo(fmt.Sprintf("Expected b Value: %#v\nReceived b: %#v\n", storedChallenge, challenge))
+	}
+
+	// Registration Step 5 & Assertion Step 9. Verify that the value of C.origin matches
+	// the Relying Party's origin.
+
+	if !IsOriginInHaystack(c.Origin, rpOrigins) {
+		return ErrVerification.
+			WithDetails("Error validating origin").
+			WithInfo(fmt.Sprintf("Expected Values: %s, Received: %s", rpOrigins, c.Origin))
+	}
+
+	if rpTopOriginsVerify != TopOriginIgnoreVerificationMode {
+		switch len(c.TopOrigin) {
+		case 0:
+			break
+		default:
+			if !c.CrossOrigin {
+				return ErrVerification.
+					WithDetails("Error validating topOrigin").
+					WithInfo("The topOrigin can't have values unless crossOrigin is true.")
+			}
+
+			var (
+				fqTopOrigin        string
+				possibleTopOrigins []string
+			)
+
+			switch rpTopOriginsVerify {
+			case TopOriginExplicitVerificationMode:
+				possibleTopOrigins = rpTopOrigins
+			case TopOriginAutoVerificationMode:
+				possibleTopOrigins = append(rpTopOrigins, rpOrigins...) //nolint:gocritic // This is intentional.
+			case TopOriginImplicitVerificationMode:
+				possibleTopOrigins = rpOrigins
+			default:
+				return ErrNotImplemented.WithDetails("Error handling unknown Top Origin verification mode")
+			}
+
+			if !IsOriginInHaystack(c.TopOrigin, possibleTopOrigins) {
+				return ErrVerification.
+					WithDetails("Error validating top origin").
+					WithInfo(fmt.Sprintf("Expected Values: %s, Received: %s", possibleTopOrigins, fqTopOrigin))
+			}
+		}
+	}
+
+	// Registration Step 6 and Assertion Step 10. Verify that the value of C.tokenBinding.status
+	// matches the state of Token Binding for the TLS connection over which the assertion was
+	// obtained. If Token Binding was used on that TLS connection, also verify that C.tokenBinding.id
+	// matches the base64url encoding of the Token Binding ID for the connection.
+	if c.TokenBinding != nil {
+		if c.TokenBinding.Status == "" {
+			return ErrParsingData.WithDetails("Error decoding clientData, token binding present without status")
+		}
+
+		if c.TokenBinding.Status != Present && c.TokenBinding.Status != Supported && c.TokenBinding.Status != NotSupported {
+			return ErrParsingData.
+				WithDetails("Error decoding clientData, token binding present with invalid status").
+				WithInfo(fmt.Sprintf("Got: %s", c.TokenBinding.Status))
+		}
+	}
+	// Not yet fully implemented by the spec, browsers, and me.
+
+	return nil
+}
+
+type TopOriginVerificationMode int
+
+const (
+	// TopOriginDefaultVerificationMode represents the default verification mode for the Top Origin. At this time this
+	// mode is the same as TopOriginIgnoreVerificationMode until such a time as the specification becomes stable. This
+	// value is intended as a fallback value and implementers should very intentionally pick another option if they want
+	// stability.
+	TopOriginDefaultVerificationMode TopOriginVerificationMode = iota
+
+	// TopOriginIgnoreVerificationMode ignores verification entirely.
+	TopOriginIgnoreVerificationMode
+
+	// TopOriginAutoVerificationMode represents the automatic verification mode for the Top Origin. In this mode the
+	// If the Top Origins parameter has values it checks against this, otherwise it checks against the Origins parameter.
+	TopOriginAutoVerificationMode
+
+	// TopOriginImplicitVerificationMode represents the implicit verification mode for the Top Origin. In this mode the
+	// Top Origin is verified against the allowed Origins values.
+	TopOriginImplicitVerificationMode
+
+	// TopOriginExplicitVerificationMode represents the explicit verification mode for the Top Origin. In this mode the
+	// Top Origin is verified against the allowed Top Origins values.
+	TopOriginExplicitVerificationMode
+)
+
+// IsOriginInHaystack checks if the needle is in the haystack using the mechanism to determine origin equality defined
+// in HTML5 Section 5.3 and RFC3986 Section 6.2.1.
+//
+// Specifically if the needle value has the 'http://' or 'https://' prefix (case-insensitive) and can be parsed as a
+// URL; we check each item in the haystack to see if it matches the same rules, and then if the scheme and host (with
+// a normalized port) components match case-insensitively then they're considered a match.
+//
+// If the needle value does not have the 'http://' or 'https://' prefix (case-insensitive) or can't be parsed as a URL
+// equality is determined using simple string comparison.
+//
+// It is important to note that this function completely ignores Apple Associated Domains entirely as Apple is using
+// an unassigned Well-Known URI in breech of Well-Known Uniform Resource Identifiers (RFC8615).
+//
+// See (Origin Definition): https://www.w3.org/TR/2011/WD-html5-20110525/origin-0.html
+//
+// See (Simple String Comparison Definition): https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.1
+//
+// See (Apple Associated Domains): https://developer.apple.com/documentation/xcode/supporting-associated-domains
+//
+// See (IANA Well Known URI Assignments): https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml
+//
+// See (Well-Known Uniform Resource Identifiers): https://datatracker.ietf.org/doc/html/rfc8615
+func IsOriginInHaystack(needle string, haystack []string) bool {
+	needleURI := parseOriginURI(needle)
+
+	if needleURI != nil {
+		for _, hay := range haystack {
+			if hayURI := parseOriginURI(hay); hayURI != nil {
+				if isOriginEqual(needleURI, hayURI) {
+					return true
+				}
+			}
+		}
+	} else {
+		for _, hay := range haystack {
+			if needle == hay {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+func isOriginEqual(a *url.URL, b *url.URL) bool {
+	if !strings.EqualFold(a.Scheme, b.Scheme) {
+		return false
+	}
+
+	if !strings.EqualFold(a.Host, b.Host) {
+		return false
+	}
+
+	return true
+}
+
+func parseOriginURI(raw string) *url.URL {
+	if !isPossibleFQDN(raw) {
+		return nil
+	}
+
+	// We can ignore the error here because it's effectively not a FQDN if this fails.
+	uri, _ := url.Parse(raw)
+
+	if uri == nil {
+		return nil
+	}
+
+	// Normalize the port if necessary.
+	switch uri.Scheme {
+	case "http":
+		if uri.Port() == "80" {
+			uri.Host = uri.Hostname()
+		}
+	case "https":
+		if uri.Port() == "443" {
+			uri.Host = uri.Hostname()
+		}
+	}
+
+	return uri
+}
+
+func isPossibleFQDN(raw string) bool {
+	normalized := strings.ToLower(raw)
+
+	return strings.HasPrefix(normalized, "http://") || strings.HasPrefix(normalized, "https://")
+}

vendor/github.com/go-webauthn/webauthn/protocol/const.go

@@ -0,0 +1,226 @@
+package protocol
+
+import "encoding/asn1"
+
+const (
+	stmtAttStmt   = "attStmt"
+	stmtFmt       = "fmt"
+	stmtX5C       = "x5c"
+	stmtSignature = "sig"
+	stmtAlgorithm = "alg"
+	stmtVersion   = "ver"
+	stmtECDAAKID  = "ecdaaKeyId"
+	stmtCertInfo  = "certInfo"
+	stmtPubArea   = "pubArea"
+)
+
+const (
+	versionTPM20 = "2.0"
+)
+
+const (
+	attStatementAndroidSafetyNetHostname = "attest.android.com"
+)
+
+var (
+	// internalRemappedAuthenticatorTransport handles remapping of AuthenticatorTransport values. Specifically it is
+	// intentional on remapping only transports that never made recommendation but are being used in the wild. It
+	// should not be used to handle transports that were ratified.
+	internalRemappedAuthenticatorTransport = map[string]AuthenticatorTransport{
+		// The Authenticator Transport 'hybrid' was previously named 'cable'; even if it was for a short period.
+		"cable": Hybrid,
+	}
+)
+
+const (
+	/*
+		Apple Anonymous Attestation Root 1 in PEM form.
+
+		Source: https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem
+		SHA256 Fingerprints:
+			Root 1: 09:15:DD:5C:07:A2:8D:B5:49:D1:F6:77:BB:5A:75:D4:BF:BE:95:61:A7:73:42:43:27:76:2E:9E:02:F9:BB:29
+	*/
+
+	certificateAppleRoot1 = `-----BEGIN CERTIFICATE-----
+MIICEjCCAZmgAwIBAgIQaB0BbHo84wIlpQGUKEdXcTAKBggqhkjOPQQDAzBLMR8w
+HQYDVQQDDBZBcHBsZSBXZWJBdXRobiBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJ
+bmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTIwMDMxODE4MjEzMloXDTQ1MDMx
+NTAwMDAwMFowSzEfMB0GA1UEAwwWQXBwbGUgV2ViQXV0aG4gUm9vdCBDQTETMBEG
+A1UECgwKQXBwbGUgSW5jLjETMBEGA1UECAwKQ2FsaWZvcm5pYTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABCJCQ2pTVhzjl4Wo6IhHtMSAzO2cv+H9DQKev3//fG59G11k
+xu9eI0/7o6V5uShBpe1u6l6mS19S1FEh6yGljnZAJ+2GNP1mi/YK2kSXIuTHjxA/
+pcoRf7XkOtO4o1qlcaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJtdk
+2cV4wlpn0afeaxLQG2PxxtcwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2cA
+MGQCMFrZ+9DsJ1PW9hfNdBywZDsWDbWFp28it1d/5w2RPkRX3Bbn/UbDTNLx7Jr3
+jAGGiQIwHFj+dJZYUJR786osByBelJYsVZd2GbHQu209b5RCmGQ21gpSAk9QZW4B
+1bWeT0vT
+-----END CERTIFICATE-----`
+)
+
+const (
+	/*
+		Google Hardware Attestation Root 1 through Root 5 in PEM form.
+
+		Source: https://developer.android.com/training/articles/security-key-attestation#root_certificate
+		SHA256 Fingerprints:
+			Root 1: CE:DB:1C:B6:DC:89:6A:E5:EC:79:73:48:BC:E9:28:67:53:C2:B3:8E:E7:1C:E0:FB:E3:4A:9A:12:48:80:0D:FC
+			Root 2: 6D:9D:B4:CE:6C:5C:0B:29:31:66:D0:89:86:E0:57:74:A8:77:6C:EB:52:5D:9E:43:29:52:0D:E1:2B:A4:BC:C0
+			Root 3: C1:98:4A:3E:F4:5C:1E:2A:91:85:51:DE:10:60:3C:86:F7:05:1B:22:49:C4:89:1C:AE:32:30:EA:BD:0C:97:D5
+			Root 4: 1E:F1:A0:4B:8B:A5:8A:B9:45:89:AC:49:8C:89:82:A7:83:F2:4E:A7:30:7E:01:59:A0:C3:A7:3B:37:7D:87:CC
+			Root 5: AB:66:41:17:8A:36:E1:79:AA:0C:1C:DD:DF:9A:16:EB:45:FA:20:94:3E:2B:8C:D7:C7:C0:5C:26:CF:8B:48:7A
+	*/
+
+	certificateAndroidKeyRoot1 = `-----BEGIN CERTIFICATE-----
+MIIFHDCCAwSgAwIBAgIJAPHBcqaZ6vUdMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
+BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMjIwMzIwMTgwNzQ4WhcNNDIwMzE1MTgw
+NzQ4WjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS
+Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7
+tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj
+nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq
+C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ
+oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O
+JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg
+sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi
+igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M
+RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E
+aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um
+AGMCAwEAAaNjMGEwHQYDVR0OBBYEFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMB8GA1Ud
+IwQYMBaAFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMA8GA1UdEwEB/wQFMAMBAf8wDgYD
+VR0PAQH/BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4ICAQB8cMqTllHc8U+qCrOlg3H7
+174lmaCsbo/bJ0C17JEgMLb4kvrqsXZs01U3mB/qABg/1t5Pd5AORHARs1hhqGIC
+W/nKMav574f9rZN4PC2ZlufGXb7sIdJpGiO9ctRhiLuYuly10JccUZGEHpHSYM2G
+tkgYbZba6lsCPYAAP83cyDV+1aOkTf1RCp/lM0PKvmxYN10RYsK631jrleGdcdkx
+oSK//mSQbgcWnmAEZrzHoF1/0gso1HZgIn0YLzVhLSA/iXCX4QT2h3J5z3znluKG
+1nv8NQdxei2DIIhASWfu804CA96cQKTTlaae2fweqXjdN1/v2nqOhngNyz1361mF
+mr4XmaKH/ItTwOe72NI9ZcwS1lVaCvsIkTDCEXdm9rCNPAY10iTunIHFXRh+7KPz
+lHGewCq/8TOohBRn0/NNfh7uRslOSZ/xKbN9tMBtw37Z8d2vvnXq/YWdsm1+JLVw
+n6yYD/yacNJBlwpddla8eaVMjsF6nBnIgQOf9zKSe06nSTqvgwUHosgOECZJZ1Eu
+zbH4yswbt02tKtKEFhx+v+OTge/06V+jGsqTWLsfrOCNLuA8H++z+pUENmpqnnHo
+vaI47gC+TNpkgYGkkBT6B/m/U01BuOBBTzhIlMEZq9qkDWuM2cA5kW5V3FJUcfHn
+w1IdYIg2Wxg7yHcQZemFQg==
+-----END CERTIFICATE-----`
+
+	certificateAndroidKeyRoot2 = `-----BEGIN CERTIFICATE-----
+MIICIjCCAaigAwIBAgIRAISp0Cl7DrWK5/8OgN52BgUwCgYIKoZIzj0EAwMwUjEc
+MBoGA1UEAwwTS2V5IEF0dGVzdGF0aW9uIENBMTEQMA4GA1UECwwHQW5kcm9pZDET
+MBEGA1UECgwKR29vZ2xlIExMQzELMAkGA1UEBhMCVVMwHhcNMjUwNzE3MjIzMjE4
+WhcNMzUwNzE1MjIzMjE4WjBSMRwwGgYDVQQDDBNLZXkgQXR0ZXN0YXRpb24gQ0Ex
+MRAwDgYDVQQLDAdBbmRyb2lkMRMwEQYDVQQKDApHb29nbGUgTExDMQswCQYDVQQG
+EwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABCPaI3FO3z5bBQo8cuiEas4HjqCt
+G/mLFfRT0MsIssPBEEU5Cfbt6sH5yOAxqEi5QagpU1yX4HwnGb7OtBYpDTB57uH5
+Eczm34A5FNijV3s0/f0UPl7zbJcTx6xwqMIRq6NCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFIyuyz7RkOb3NaBqQ5lZuA0QepA
+MAoGCCqGSM49BAMDA2gAMGUCMETfjPO/HwqReR2CS7p0ZWoD/LHs6hDi422opifH
+EUaYLxwGlT9SLdjkVpz0UUOR5wIxAIoGyxGKRHVTpqpGRFiJtQEOOTp/+s1GcxeY
+uR2zh/80lQyu9vAFCj6E4AXc+osmRg==
+-----END CERTIFICATE-----`
+
+	certificateAndroidKeyRoot3 = `-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIJAOj6GWMU0voYMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
+BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMTYwNTI2MTYyODUyWhcNMjYwNTI0MTYy
+ODUyWjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS
+Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7
+tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj
+nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq
+C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ
+oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O
+JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg
+sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi
+igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M
+RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E
+aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um
+AGMCAwEAAaOBpjCBozAdBgNVHQ4EFgQUNmHhAHyIBQlRi0RsR/8aTMnqTxIwHwYD
+VR0jBBgwFoAUNmHhAHyIBQlRi0RsR/8aTMnqTxIwDwYDVR0TAQH/BAUwAwEB/zAO
+BgNVHQ8BAf8EBAMCAYYwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cHM6Ly9hbmRyb2lk
+Lmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2NybC8wDQYJKoZIhvcNAQELBQAD
+ggIBACDIw41L3KlXG0aMiS//cqrG+EShHUGo8HNsw30W1kJtjn6UBwRM6jnmiwfB
+Pb8VA91chb2vssAtX2zbTvqBJ9+LBPGCdw/E53Rbf86qhxKaiAHOjpvAy5Y3m00m
+qC0w/Zwvju1twb4vhLaJ5NkUJYsUS7rmJKHHBnETLi8GFqiEsqTWpG/6ibYCv7rY
+DBJDcR9W62BW9jfIoBQcxUCUJouMPH25lLNcDc1ssqvC2v7iUgI9LeoM1sNovqPm
+QUiG9rHli1vXxzCyaMTjwftkJLkf6724DFhuKug2jITV0QkXvaJWF4nUaHOTNA4u
+JU9WDvZLI1j83A+/xnAJUucIv/zGJ1AMH2boHqF8CY16LpsYgBt6tKxxWH00XcyD
+CdW2KlBCeqbQPcsFmWyWugxdcekhYsAWyoSf818NUsZdBWBaR/OukXrNLfkQ79Iy
+ZohZbvabO/X+MVT3rriAoKc8oE2Uws6DF+60PV7/WIPjNvXySdqspImSN78mflxD
+qwLqRBYkA3I75qppLGG9rp7UCdRjxMl8ZDBld+7yvHVgt1cVzJx9xnyGCC23Uaic
+MDSXYrB4I4WHXPGjxhZuCuPBLTdOLU8YRvMYdEvYebWHMpvwGCF6bAx3JBpIeOQ1
+wDB5y0USicV3YgYGmi+NZfhA4URSh77Yd6uuJOJENRaNVTzk
+-----END CERTIFICATE-----`
+
+	certificateAndroidKeyRoot4 = `-----BEGIN CERTIFICATE-----
+MIIFHDCCAwSgAwIBAgIJANUP8luj8tazMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
+BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMTkxMTIyMjAzNzU4WhcNMzQxMTE4MjAz
+NzU4WjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS
+Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7
+tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj
+nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq
+C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ
+oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O
+JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg
+sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi
+igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M
+RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E
+aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um
+AGMCAwEAAaNjMGEwHQYDVR0OBBYEFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMB8GA1Ud
+IwQYMBaAFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMA8GA1UdEwEB/wQFMAMBAf8wDgYD
+VR0PAQH/BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4ICAQBOMaBc8oumXb2voc7XCWnu
+XKhBBK3e2KMGz39t7lA3XXRe2ZLLAkLM5y3J7tURkf5a1SutfdOyXAmeE6SRo83U
+h6WszodmMkxK5GM4JGrnt4pBisu5igXEydaW7qq2CdC6DOGjG+mEkN8/TA6p3cno
+L/sPyz6evdjLlSeJ8rFBH6xWyIZCbrcpYEJzXaUOEaxxXxgYz5/cTiVKN2M1G2ok
+QBUIYSY6bjEL4aUN5cfo7ogP3UvliEo3Eo0YgwuzR2v0KR6C1cZqZJSTnghIC/vA
+D32KdNQ+c3N+vl2OTsUVMC1GiWkngNx1OO1+kXW+YTnnTUOtOIswUP/Vqd5SYgAI
+mMAfY8U9/iIgkQj6T2W6FsScy94IN9fFhE1UtzmLoBIuUFsVXJMTz+Jucth+IqoW
+Fua9v1R93/k98p41pjtFX+H8DslVgfP097vju4KDlqN64xV1grw3ZLl4CiOe/A91
+oeLm2UHOq6wn3esB4r2EIQKb6jTVGu5sYCcdWpXr0AUVqcABPdgL+H7qJguBw09o
+jm6xNIrw2OocrDKsudk/okr/AwqEyPKw9WnMlQgLIKw1rODG2NvU9oR3GVGdMkUB
+ZutL8VuFkERQGt6vQ2OCw0sV47VMkuYbacK/xyZFiRcrPJPb41zgbQj9XAEyLKCH
+ex0SdDrx+tWUDqG8At2JHA==
+-----END CERTIFICATE-----`
+
+	certificateAndroidKeyRoot5 = `-----BEGIN CERTIFICATE-----
+MIIFHDCCAwSgAwIBAgIJAMNrfES5rhgxMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV
+BAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMjExMTE3MjMxMDQyWhcNMzYxMTEzMjMx
+MDQyWjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdS
+Sxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7
+tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggj
+nar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGq
+C4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQ
+oVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+O
+JtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/Eg
+sTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRi
+igHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+M
+RPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9E
+aDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5Um
+AGMCAwEAAaNjMGEwHQYDVR0OBBYEFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMB8GA1Ud
+IwQYMBaAFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMA8GA1UdEwEB/wQFMAMBAf8wDgYD
+VR0PAQH/BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4ICAQBTNNZe5cuf8oiq+jV0itTG
+zWVhSTjOBEk2FQvh11J3o3lna0o7rd8RFHnN00q4hi6TapFhh4qaw/iG6Xg+xOan
+63niLWIC5GOPFgPeYXM9+nBb3zZzC8ABypYuCusWCmt6Tn3+Pjbz3MTVhRGXuT/T
+QH4KGFY4PhvzAyXwdjTOCXID+aHud4RLcSySr0Fq/L+R8TWalvM1wJJPhyRjqRCJ
+erGtfBagiALzvhnmY7U1qFcS0NCnKjoO7oFedKdWlZz0YAfu3aGCJd4KHT0MsGiL
+Zez9WP81xYSrKMNEsDK+zK5fVzw6jA7cxmpXcARTnmAuGUeI7VVDhDzKeVOctf3a
+0qQLwC+d0+xrETZ4r2fRGNw2YEs2W8Qj6oDcfPvq9JySe7pJ6wcHnl5EZ0lwc4xH
+7Y4Dx9RA1JlfooLMw3tOdJZH0enxPXaydfAD3YifeZpFaUzicHeLzVJLt9dvGB0b
+HQLE4+EqKFgOZv2EoP686DQqbVS1u+9k0p2xbMA105TBIk7npraa8VM0fnrRKi7w
+lZKwdH+aNAyhbXRW9xsnODJ+g8eF452zvbiKKngEKirK5LGieoXBX7tZ9D1GNBH2
+Ob3bKOwwIWdEFle/YF/h6zWgdeoaNGDqVBrLr2+0DtWoiB1aDEjLWl9FmyIUyUm7
+mD/vFDkzF+wm7cyWpQpCVQ==
+-----END CERTIFICATE-----`
+)
+
+var (
+	oidExtensionAppleAnonymousAttestation = asn1.ObjectIdentifier{1, 2, 840, 113635, 100, 8, 2}
+	oidExtensionAndroidKeystore           = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 1, 17}
+	oidExtensionSubjectAltName            = asn1.ObjectIdentifier{2, 5, 29, 17}
+	oidExtensionExtendedKeyUsage          = asn1.ObjectIdentifier{2, 5, 29, 37}
+	oidExtensionBasicConstraints          = asn1.ObjectIdentifier{2, 5, 29, 19}
+	oidFIDOGenCeAAGUID                    = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 45724, 1, 1, 4}
+	oidMicrosoftKpPrivacyCA               = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 21, 36}
+	oidTCGKpAIKCertificate                = asn1.ObjectIdentifier{2, 23, 133, 8, 3}
+	oidTCGAtTpmManufacturer               = asn1.ObjectIdentifier{2, 23, 133, 2, 1}
+	oidTCGAtTpmModel                      = asn1.ObjectIdentifier{2, 23, 133, 2, 2}
+	oidTCGAtTPMVersion                    = asn1.ObjectIdentifier{2, 23, 133, 2, 3}
+)

vendor/github.com/go-webauthn/webauthn/protocol/credential.go

@@ -0,0 +1,265 @@
+package protocol
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"io"
+	"net/http"
+
+	"github.com/go-webauthn/webauthn/metadata"
+)
+
+// Credential is the basic credential type from the Credential Management specification that is inherited by WebAuthn's
+// PublicKeyCredential type.
+//
+// Specification: Credential Management §2.2. The Credential Interface (https://www.w3.org/TR/credential-management/#credential)
+type Credential struct {
+	// ID is The credential’s identifier. The requirements for the
+	// identifier are distinct for each type of credential. It might
+	// represent a username for username/password tuples, for example.
+	ID string `json:"id"`
+	// Type is the value of the object’s interface object's [[type]] slot,
+	// which specifies the credential type represented by this object.
+	// This should be type "public-key" for Webauthn credentials.
+	Type string `json:"type"`
+}
+
+// ParsedCredential is the parsed PublicKeyCredential interface, inherits from Credential, and contains
+// the attributes that are returned to the caller when a new credential is created, or a new assertion is requested.
+type ParsedCredential struct {
+	ID   string `cbor:"id"`
+	Type string `cbor:"type"`
+}
+
+type PublicKeyCredential struct {
+	Credential
+
+	RawID                   URLEncodedBase64                      `json:"rawId"`
+	ClientExtensionResults  AuthenticationExtensionsClientOutputs `json:"clientExtensionResults,omitempty"`
+	AuthenticatorAttachment string                                `json:"authenticatorAttachment,omitempty"`
+}
+
+type ParsedPublicKeyCredential struct {
+	ParsedCredential
+
+	RawID                   []byte                                `json:"rawId"`
+	ClientExtensionResults  AuthenticationExtensionsClientOutputs `json:"clientExtensionResults,omitempty"`
+	AuthenticatorAttachment AuthenticatorAttachment               `json:"authenticatorAttachment,omitempty"`
+}
+
+type CredentialCreationResponse struct {
+	PublicKeyCredential
+
+	AttestationResponse AuthenticatorAttestationResponse `json:"response"`
+}
+
+type ParsedCredentialCreationData struct {
+	ParsedPublicKeyCredential
+
+	Response ParsedAttestationResponse
+	Raw      CredentialCreationResponse
+}
+
+// ParseCredentialCreationResponse is a non-agnostic function for parsing a registration response from the http library
+// from stdlib. It handles some standard cleanup operations.
+func ParseCredentialCreationResponse(request *http.Request) (*ParsedCredentialCreationData, error) {
+	if request == nil || request.Body == nil {
+		return nil, ErrBadRequest.WithDetails("No response given")
+	}
+
+	defer func() {
+		_, _ = io.Copy(io.Discard, request.Body)
+		_ = request.Body.Close()
+	}()
+
+	return ParseCredentialCreationResponseBody(request.Body)
+}
+
+// ParseCredentialCreationResponseBody is an agnostic version of ParseCredentialCreationResponse. Implementers are
+// therefore responsible for managing cleanup.
+func ParseCredentialCreationResponseBody(body io.Reader) (pcc *ParsedCredentialCreationData, err error) {
+	var ccr CredentialCreationResponse
+
+	if err = decodeBody(body, &ccr); err != nil {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error()).WithError(err)
+	}
+
+	return ccr.Parse()
+}
+
+// ParseCredentialCreationResponseBytes is an alternative version of ParseCredentialCreationResponseBody that just takes
+// a byte slice.
+func ParseCredentialCreationResponseBytes(data []byte) (pcc *ParsedCredentialCreationData, err error) {
+	var ccr CredentialCreationResponse
+
+	if err = decodeBytes(data, &ccr); err != nil {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error()).WithError(err)
+	}
+
+	return ccr.Parse()
+}
+
+// Parse validates and parses the CredentialCreationResponse into a ParsedCredentialCreationData. This receiver
+// is unlikely to be expressly guaranteed under the versioning policy. Users looking for this guarantee should see
+// ParseCredentialCreationResponseBody instead, and this receiver should only be used if that function is inadequate
+// for their use case.
+func (ccr CredentialCreationResponse) Parse() (pcc *ParsedCredentialCreationData, err error) {
+	if ccr.ID == "" {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo("Missing ID")
+	}
+
+	testB64, err := base64.RawURLEncoding.DecodeString(ccr.ID)
+	if err != nil || len(testB64) == 0 {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo("ID not base64.RawURLEncoded")
+	}
+
+	if ccr.Type == "" {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo("Missing type")
+	}
+
+	if ccr.Type != string(PublicKeyCredentialType) {
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo("Type not public-key")
+	}
+
+	response, err := ccr.AttestationResponse.Parse()
+	if err != nil {
+		return nil, ErrParsingData.WithDetails("Error parsing attestation response")
+	}
+
+	var attachment AuthenticatorAttachment
+
+	switch ccr.AuthenticatorAttachment {
+	case "platform":
+		attachment = Platform
+	case "cross-platform":
+		attachment = CrossPlatform
+	}
+
+	return &ParsedCredentialCreationData{
+		ParsedPublicKeyCredential{
+			ParsedCredential{ccr.ID, ccr.Type}, ccr.RawID, ccr.ClientExtensionResults, attachment,
+		},
+		*response,
+		ccr,
+	}, nil
+}
+
+// Verify the Client and Attestation data.
+//
+// Specification: §7.1. Registering a New Credential (https://www.w3.org/TR/webauthn/#sctn-registering-a-new-credential)
+func (pcc *ParsedCredentialCreationData) Verify(storedChallenge string, verifyUser bool, verifyUserPresence bool, relyingPartyID string, rpOrigins, rpTopOrigins []string, rpTopOriginsVerify TopOriginVerificationMode, mds metadata.Provider, credParams []CredentialParameter) (clientDataHash []byte, err error) {
+	// Handles steps 3 through 6 - Verifying the Client Data against the Relying Party's stored data.
+	if err = pcc.Response.CollectedClientData.Verify(storedChallenge, CreateCeremony, rpOrigins, rpTopOrigins, rpTopOriginsVerify); err != nil {
+		return nil, err
+	}
+
+	// Step 7. Compute the hash of response.clientDataJSON using SHA-256.
+	sum := sha256.Sum256(pcc.Raw.AttestationResponse.ClientDataJSON)
+	clientDataHash = sum[:]
+
+	// Step 8. Perform CBOR decoding on the attestationObject field of the AuthenticatorAttestationResponse
+	// structure to obtain the attestation statement format fmt, the authenticator data authData, and the
+	// attestation statement attStmt.
+
+	// We do the above step while parsing and decoding the CredentialCreationResponse
+	// Handle steps 9 through 14 - This verifies the attestation object.
+	if err = pcc.Response.AttestationObject.Verify(relyingPartyID, clientDataHash, verifyUser, verifyUserPresence, mds, credParams); err != nil {
+		return clientDataHash, err
+	}
+
+	// Step 15. If validation is successful, obtain a list of acceptable trust anchors (attestation root
+	// certificates or ECDAA-Issuer public keys) for that attestation type and attestation statement
+	// format fmt, from a trusted source or from policy. For example, the FIDO Metadata Service provides
+	// one way to obtain such information, using the AAGUID in the attestedCredentialData in authData.
+	// [https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-metadata-service-v2.0-id-20180227.html]
+
+	// TODO: There are no valid AAGUIDs yet or trust sources supported. We could implement policy for the RP in
+	// the future, however.
+
+	// Step 16. Assess the attestation trustworthiness using outputs of the verification procedure in step 14, as follows:
+	// - If self attestation was used, check if self attestation is acceptable under Relying Party policy.
+	// - If ECDAA was used, verify that the identifier of the ECDAA-Issuer public key used is included in
+	//   the set of acceptable trust anchors obtained in step 15.
+	// - Otherwise, use the X.509 certificates returned by the verification procedure to verify that the
+	//   attestation public key correctly chains up to an acceptable root certificate.
+
+	// TODO: We're not supporting trust anchors, self-attestation policy, or acceptable root certs yet.
+
+	// Step 17. Check that the credentialId is not yet registered to any other user. If registration is
+	// requested for a credential that is already registered to a different user, the Relying Party SHOULD
+	// fail this registration ceremony, or it MAY decide to accept the registration, e.g. while deleting
+	// the older registration.
+
+	// TODO: We can't support this in the code's current form, the Relying Party would need to check for this
+	// against their database.
+
+	// Step 18 If the attestation statement attStmt verified successfully and is found to be trustworthy, then
+	// register the new credential with the account that was denoted in the options.user passed to create(), by
+	// associating it with the credentialId and credentialPublicKey in the attestedCredentialData in authData, as
+	// appropriate for the Relying Party's system.
+
+	// Step 19. If the attestation statement attStmt successfully verified but is not trustworthy per step 16 above,
+	// the Relying Party SHOULD fail the registration ceremony.
+
+	// TODO: Not implemented for the reasons mentioned under Step 16.
+
+	return clientDataHash, nil
+}
+
+// GetAppID takes a AuthenticationExtensions object or nil. It then performs the following checks in order:
+//
+// 1. Check that the Session Data's AuthenticationExtensions has been provided and if it hasn't return an error.
+// 2. Check that the AuthenticationExtensionsClientOutputs contains the extensions output and return an empty string if it doesn't.
+// 3. Check that the Credential AttestationType is `fido-u2f` and return an empty string if it isn't.
+// 4. Check that the AuthenticationExtensionsClientOutputs contains the appid key and if it doesn't return an empty string.
+// 5. Check that the AuthenticationExtensionsClientOutputs appid is a bool and if it isn't return an error.
+// 6. Check that the appid output is true and if it isn't return an empty string.
+// 7. Check that the Session Data has an appid extension defined and if it doesn't return an error.
+// 8. Check that the appid extension in Session Data is a string and if it isn't return an error.
+// 9. Return the appid extension value from the Session data.
+func (ppkc ParsedPublicKeyCredential) GetAppID(authExt AuthenticationExtensions, credentialAttestationType string) (appID string, err error) {
+	var (
+		value, clientValue interface{}
+		enableAppID, ok    bool
+	)
+
+	if authExt == nil {
+		return "", nil
+	}
+
+	if ppkc.ClientExtensionResults == nil {
+		return "", nil
+	}
+
+	// If the credential does not have the correct attestation type it is assumed to NOT be a fido-u2f credential.
+	// https://www.w3.org/TR/webauthn/#sctn-fido-u2f-attestation
+	if credentialAttestationType != CredentialTypeFIDOU2F {
+		return "", nil
+	}
+
+	if clientValue, ok = ppkc.ClientExtensionResults[ExtensionAppID]; !ok {
+		return "", nil
+	}
+
+	if enableAppID, ok = clientValue.(bool); !ok {
+		return "", ErrBadRequest.WithDetails("Client Output appid did not have the expected type")
+	}
+
+	if !enableAppID {
+		return "", nil
+	}
+
+	if value, ok = authExt[ExtensionAppID]; !ok {
+		return "", ErrBadRequest.WithDetails("Session Data does not have an appid but Client Output indicates it should be set")
+	}
+
+	if appID, ok = value.(string); !ok {
+		return "", ErrBadRequest.WithDetails("Session Data appid did not have the expected type")
+	}
+
+	return appID, nil
+}
+
+const (
+	CredentialTypeFIDOU2F = "fido-u2f"
+)

vendor/github.com/go-webauthn/webauthn/protocol/decoder.go

@@ -0,0 +1,40 @@
+package protocol
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+)
+
+func decodeBody(body io.Reader, v any) (err error) {
+	decoder := json.NewDecoder(body)
+
+	if err = decoder.Decode(v); err != nil {
+		return err
+	}
+
+	_, err = decoder.Token()
+
+	if !errors.Is(err, io.EOF) {
+		return errors.New("body contains trailing data")
+	}
+
+	return nil
+}
+
+func decodeBytes(data []byte, v any) (err error) {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+
+	if err = decoder.Decode(v); err != nil {
+		return err
+	}
+
+	_, err = decoder.Token()
+
+	if !errors.Is(err, io.EOF) {
+		return errors.New("body contains trailing data")
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/doc.go

@@ -0,0 +1,8 @@
+// Package protocol contains data structures and validation functionality
+// outlined in the Web Authentication specification (https://www.w3.org/TR/webauthn).
+// The data structures here attempt to conform as much as possible to their definitions,
+// but some structs (like those that are used as part of validation steps) contain
+// additional fields that help us unpack and validate the data we unmarshall.
+// When implementing this library, most developers will primarily be using the API
+// outlined in the webauthn package.
+package protocol

vendor/github.com/go-webauthn/webauthn/protocol/entities.go

@@ -0,0 +1,46 @@
+package protocol
+
+// CredentialEntity represents the PublicKeyCredentialEntity IDL and it describes a user account, or a WebAuthn Relying
+// Party with which a public key credential is associated.
+//
+// Specification: §5.4.1. Public Key Entity Description (https://www.w3.org/TR/webauthn/#dictionary-pkcredentialentity)
+type CredentialEntity struct {
+	// A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents:
+	//
+	// When inherited by PublicKeyCredentialRpEntity it is a human-palatable identifier for the Relying Party,
+	// intended only for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".
+	//
+	// When inherited by PublicKeyCredentialUserEntity, it is a human-palatable identifier for a user account. It is
+	// intended only for display, i.e., aiding the user in determining the difference between user accounts with similar
+	// displayNames. For example, "alexm", "alex.p.mueller@example.com" or "+14255551234".
+	Name string `json:"name"`
+}
+
+// The RelyingPartyEntity represents the PublicKeyCredentialRpEntity IDL and is used to supply additional Relying Party
+// attributes when creating a new credential.
+//
+// Specification: §5.4.2. Relying Party Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dictionary-rp-credential-params)
+type RelyingPartyEntity struct {
+	CredentialEntity
+
+	// A unique identifier for the Relying Party entity, which sets the RP ID.
+	ID string `json:"id"`
+}
+
+// The UserEntity represents the PublicKeyCredentialUserEntity IDL and is used to supply additional user account
+// attributes when creating a new credential.
+//
+// Specification: §5.4.3 User Account Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialuserentity)
+type UserEntity struct {
+	CredentialEntity
+	// A human-palatable name for the user account, intended only for display.
+	// For example, "Alex P. Müller" or "田中 倫". The Relying Party SHOULD let
+	// the user choose this, and SHOULD NOT restrict the choice more than necessary.
+	DisplayName string `json:"displayName"`
+
+	// ID is the user handle of the user account entity. To ensure secure operation,
+	// authentication and authorization decisions MUST be made on the basis of this id
+	// member, not the displayName nor name members. See Section 6.1 of
+	// [RFC8266](https://www.w3.org/TR/webauthn/#biblio-rfc8266).
+	ID any `json:"id"`
+}

vendor/github.com/go-webauthn/webauthn/protocol/errors.go

@@ -0,0 +1,150 @@
+package protocol
+
+// Error is a struct that describes specific error conditions in a structured format.
+type Error struct {
+	// Short name for the type of error that has occurred.
+	Type string `json:"type"`
+
+	// Additional details about the error.
+	Details string `json:"error"`
+
+	// Information to help debug the error.
+	DevInfo string `json:"debug"`
+
+	// Inner error.
+	Err error `json:"-"`
+}
+
+func (e *Error) Error() string {
+	return e.Details
+}
+
+func (e *Error) Unwrap() error {
+	return e.Err
+}
+
+func (e *Error) WithDetails(details string) *Error {
+	err := *e
+	err.Details = details
+
+	return &err
+}
+
+func (e *Error) WithInfo(info string) *Error {
+	err := *e
+	err.DevInfo = info
+
+	return &err
+}
+
+func (e *Error) WithError(err error) *Error {
+	errCopy := *e
+	errCopy.Err = err
+
+	return &errCopy
+}
+
+// ErrorUnknownCredential is a special Error which signals the fact the provided credential is unknown. The reason this
+// specific error type is useful is so that the relying-party can send a signal to the Authenticator that the
+// credential has been removed.
+type ErrorUnknownCredential struct {
+	Err *Error
+}
+
+func (e *ErrorUnknownCredential) Error() string {
+	return e.Err.Error()
+}
+
+func (e *ErrorUnknownCredential) Unwrap() error {
+	return e.Err
+}
+
+func (e *ErrorUnknownCredential) copy() ErrorUnknownCredential {
+	err := *e.Err
+
+	return ErrorUnknownCredential{Err: &err}
+}
+
+func (e *ErrorUnknownCredential) WithDetails(details string) *ErrorUnknownCredential {
+	err := e.copy()
+	err.Err.Details = details
+
+	return &err
+}
+
+func (e *ErrorUnknownCredential) WithInfo(info string) *ErrorUnknownCredential {
+	err := e.copy()
+	err.Err.DevInfo = info
+
+	return &err
+}
+
+func (e *ErrorUnknownCredential) WithError(err error) *ErrorUnknownCredential {
+	errCopy := e.copy()
+	errCopy.Err.Err = err
+
+	return &errCopy
+}
+
+var (
+	ErrBadRequest = &Error{
+		Type:    "invalid_request",
+		Details: "Error reading the request data",
+	}
+	ErrChallengeMismatch = &Error{
+		Type:    "challenge_mismatch",
+		Details: "Stored challenge and received challenge do not match",
+	}
+	ErrParsingData = &Error{
+		Type:    "parse_error",
+		Details: "Error parsing the authenticator response",
+	}
+	ErrAuthData = &Error{
+		Type:    "auth_data",
+		Details: "Error verifying the authenticator data",
+	}
+	ErrVerification = &Error{
+		Type:    "verification_error",
+		Details: "Error validating the authenticator response",
+	}
+	ErrAttestation = &Error{
+		Type:    "attestation_error",
+		Details: "Error validating the attestation data provided",
+	}
+	ErrInvalidAttestation = &Error{
+		Type:    "invalid_attestation",
+		Details: "Invalid attestation data",
+	}
+	ErrMetadata = &Error{
+		Type:    "invalid_metadata",
+		Details: "",
+	}
+	ErrAttestationFormat = &Error{
+		Type:    "invalid_attestation",
+		Details: "Invalid attestation format",
+	}
+	ErrAttestationCertificate = &Error{
+		Type:    "invalid_certificate",
+		Details: "Invalid attestation certificate",
+	}
+	ErrAssertionSignature = &Error{
+		Type:    "invalid_signature",
+		Details: "Assertion Signature against auth data and client hash is not valid",
+	}
+	ErrUnsupportedKey = &Error{
+		Type:    "invalid_key_type",
+		Details: "Unsupported Public Key Type",
+	}
+	ErrUnsupportedAlgorithm = &Error{
+		Type:    "unsupported_key_algorithm",
+		Details: "Unsupported public key algorithm",
+	}
+	ErrNotSpecImplemented = &Error{
+		Type:    "spec_unimplemented",
+		Details: "This field is not yet supported by the WebAuthn spec",
+	}
+	ErrNotImplemented = &Error{
+		Type:    "not_implemented",
+		Details: "This field is not yet supported by this library",
+	}
+)

vendor/github.com/go-webauthn/webauthn/protocol/extensions.go

@@ -0,0 +1,13 @@
+package protocol
+
+// Extensions are discussed in §9. WebAuthn Extensions (https://www.w3.org/TR/webauthn/#extensions).
+
+// For a list of commonly supported extensions, see §10. Defined Extensions
+// (https://www.w3.org/TR/webauthn/#sctn-defined-extensions).
+
+type AuthenticationExtensionsClientOutputs map[string]any
+
+const (
+	ExtensionAppID        = "appid"
+	ExtensionAppIDExclude = "appidExclude"
+)

vendor/github.com/go-webauthn/webauthn/protocol/init.go

@@ -0,0 +1,30 @@
+package protocol
+
+import (
+	"crypto/x509"
+)
+
+func init() {
+	initAndroidKeyHardwareRoots()
+	initAppleHardwareRoots()
+}
+
+func initAndroidKeyHardwareRoots() {
+	if attAndroidKeyHardwareRootsCertPool == nil {
+		attAndroidKeyHardwareRootsCertPool = x509.NewCertPool()
+	}
+
+	attAndroidKeyHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAndroidKeyRoot1)))
+	attAndroidKeyHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAndroidKeyRoot2)))
+	attAndroidKeyHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAndroidKeyRoot3)))
+	attAndroidKeyHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAndroidKeyRoot4)))
+	attAndroidKeyHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAndroidKeyRoot5)))
+}
+
+func initAppleHardwareRoots() {
+	if attAppleHardwareRootsCertPool == nil {
+		attAppleHardwareRootsCertPool = x509.NewCertPool()
+	}
+
+	attAppleHardwareRootsCertPool.AddCert(mustParseX509CertificatePEM([]byte(certificateAppleRoot1)))
+}

vendor/github.com/go-webauthn/webauthn/protocol/metadata.go

@@ -0,0 +1,129 @@
+package protocol
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/go-webauthn/webauthn/metadata"
+)
+
+func ValidateMetadata(ctx context.Context, mds metadata.Provider, aaguid uuid.UUID, attestationType, attestationFormat string, x5cs []any) (protoErr *Error) {
+	if mds == nil {
+		return nil
+	}
+
+	if AttestationFormat(attestationFormat) == AttestationFormatNone {
+		return nil
+	}
+
+	var (
+		entry *metadata.Entry
+		err   error
+	)
+	if entry, err = mds.GetEntry(ctx, aaguid); err != nil {
+		return ErrMetadata.WithInfo(fmt.Sprintf("Failed to validate authenticator metadata for Authenticator Attestation GUID '%s'. Error occurred retreiving the metadata entry: %+v", aaguid, err))
+	}
+
+	if entry == nil {
+		if aaguid == uuid.Nil && mds.GetValidateEntryPermitZeroAAGUID(ctx) {
+			return nil
+		}
+
+		if mds.GetValidateEntry(ctx) {
+			return ErrMetadata.WithInfo(fmt.Sprintf("Failed to validate authenticator metadata for Authenticator Attestation GUID '%s'. The authenticator has no registered metadata.", aaguid))
+		}
+
+		return nil
+	}
+
+	if attestationType != "" && mds.GetValidateAttestationTypes(ctx) {
+		found := false
+
+		for _, atype := range entry.MetadataStatement.AttestationTypes {
+			if string(atype) == attestationType {
+				found = true
+
+				break
+			}
+		}
+
+		if !found {
+			return ErrMetadata.WithInfo(fmt.Sprintf("Failed to validate authenticator metadata for Authenticator Attestation GUID '%s'. The attestation type '%s' is not known to be used by this authenticator.", aaguid.String(), attestationType))
+		}
+	}
+
+	if mds.GetValidateStatus(ctx) {
+		if err = mds.ValidateStatusReports(ctx, entry.StatusReports); err != nil {
+			return ErrMetadata.WithInfo(fmt.Sprintf("Failed to validate authenticator metadata for Authenticator Attestation GUID '%s'. Error occurred validating the authenticator status: %+v", aaguid, err))
+		}
+	}
+
+	if mds.GetValidateTrustAnchor(ctx) {
+		if len(x5cs) == 0 {
+			return nil
+		}
+
+		var (
+			x5c, parsed *x509.Certificate
+			x5cis       []*x509.Certificate
+			raw         []byte
+			ok          bool
+		)
+
+		for i, x5cAny := range x5cs {
+			if raw, ok = x5cAny.([]byte); !ok {
+				return ErrMetadata.WithDetails(fmt.Sprintf("Failed to parse attestation certificate from x5c during attestation validation for Authenticator Attestation GUID '%s'.", aaguid)).WithInfo(fmt.Sprintf("The %s certificate in the attestation was type '%T' but '[]byte' was expected", loopOrdinalNumber(i), x5cAny))
+			}
+
+			if parsed, err = x509.ParseCertificate(raw); err != nil {
+				return ErrMetadata.WithDetails(fmt.Sprintf("Failed to parse attestation certificate from x5c during attestation validation for Authenticator Attestation GUID '%s'.", aaguid)).WithInfo(fmt.Sprintf("Error returned from x509.ParseCertificate: %+v", err)).WithError(err)
+			}
+
+			if x5c == nil {
+				x5c = parsed
+			} else {
+				x5cis = append(x5cis, parsed)
+			}
+		}
+
+		if attestationType == string(metadata.AttCA) {
+			if protoErr = tpmParseAIKAttCA(x5c, x5cis); protoErr != nil {
+				return ErrMetadata.WithDetails(protoErr.Details).WithInfo(protoErr.DevInfo).WithError(protoErr)
+			}
+		}
+
+		if x5c != nil && x5c.Subject.CommonName != x5c.Issuer.CommonName {
+			if !entry.MetadataStatement.AttestationTypes.HasBasicFull() {
+				return ErrMetadata.WithDetails(fmt.Sprintf("Failed to validate attestation statement signature during attestation validation for Authenticator Attestation GUID '%s'. Attestation was provided in the full format but the authenticator doesn't support the full attestation format.", aaguid))
+			}
+
+			if _, err = x5c.Verify(entry.MetadataStatement.Verifier(x5cis)); err != nil {
+				return ErrMetadata.WithDetails(fmt.Sprintf("Failed to validate attestation statement signature during attestation validation for Authenticator Attestation GUID '%s'. The attestation certificate could not be verified due to an error validating the trust chain against the Metadata Service.", aaguid)).WithError(err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func loopOrdinalNumber(n int) string {
+	n++
+
+	if n > 9 && n < 20 {
+		return fmt.Sprintf("%dth", n)
+	}
+
+	switch n % 10 {
+	case 1:
+		return fmt.Sprintf("%dst", n)
+	case 2:
+		return fmt.Sprintf("%dnd", n)
+	case 3:
+		return fmt.Sprintf("%drd", n)
+	default:
+		return fmt.Sprintf("%dth", n)
+	}
+}

vendor/github.com/go-webauthn/webauthn/protocol/options.go

@@ -0,0 +1,288 @@
+package protocol
+
+import (
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+type CredentialCreation struct {
+	Response  PublicKeyCredentialCreationOptions `json:"publicKey"`
+	Mediation CredentialMediationRequirement     `json:"mediation,omitempty"`
+}
+
+type CredentialAssertion struct {
+	Response  PublicKeyCredentialRequestOptions `json:"publicKey"`
+	Mediation CredentialMediationRequirement    `json:"mediation,omitempty"`
+}
+
+// PublicKeyCredentialCreationOptions represents the IDL of the same name.
+//
+// In order to create a Credential via create(), the caller specifies a few parameters in a
+// PublicKeyCredentialCreationOptions object.
+//
+// WebAuthn Level 3: hints,attestationFormats.
+//
+// Specification: §5.4. Options for Credential Creation (https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions)
+type PublicKeyCredentialCreationOptions struct {
+	RelyingParty           RelyingPartyEntity         `json:"rp"`
+	User                   UserEntity                 `json:"user"`
+	Challenge              URLEncodedBase64           `json:"challenge"`
+	Parameters             []CredentialParameter      `json:"pubKeyCredParams,omitempty"`
+	Timeout                int                        `json:"timeout,omitempty"`
+	CredentialExcludeList  []CredentialDescriptor     `json:"excludeCredentials,omitempty"`
+	AuthenticatorSelection AuthenticatorSelection     `json:"authenticatorSelection,omitempty"`
+	Hints                  []PublicKeyCredentialHints `json:"hints,omitempty"`
+	Attestation            ConveyancePreference       `json:"attestation,omitempty"`
+	AttestationFormats     []AttestationFormat        `json:"attestationFormats,omitempty"`
+	Extensions             AuthenticationExtensions   `json:"extensions,omitempty"`
+}
+
+// The PublicKeyCredentialRequestOptions dictionary supplies get() with the data it needs to generate an assertion.
+// Its challenge member MUST be present, while its other members are OPTIONAL.
+//
+// WebAuthn Level 3: hints.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dictionary-assertion-options)
+type PublicKeyCredentialRequestOptions struct {
+	Challenge          URLEncodedBase64            `json:"challenge"`
+	Timeout            int                         `json:"timeout,omitempty"`
+	RelyingPartyID     string                      `json:"rpId,omitempty"`
+	AllowedCredentials []CredentialDescriptor      `json:"allowCredentials,omitempty"`
+	UserVerification   UserVerificationRequirement `json:"userVerification,omitempty"`
+	Hints              []PublicKeyCredentialHints  `json:"hints,omitempty"`
+	Extensions         AuthenticationExtensions    `json:"extensions,omitempty"`
+}
+
+// CredentialDescriptor represents the PublicKeyCredentialDescriptor IDL.
+//
+// This dictionary contains the attributes that are specified by a caller when referring to a public key credential as
+// an input parameter to the create() or get() methods. It mirrors the fields of the PublicKeyCredential object returned
+// by the latter methods.
+//
+// Specification: §5.10.3. Credential Descriptor (https://www.w3.org/TR/webauthn/#credential-dictionary)
+type CredentialDescriptor struct {
+	// The valid credential types.
+	Type CredentialType `json:"type"`
+
+	// CredentialID The ID of a credential to allow/disallow.
+	CredentialID URLEncodedBase64 `json:"id"`
+
+	// The authenticator transports that can be used.
+	Transport []AuthenticatorTransport `json:"transports,omitempty"`
+
+	// The AttestationType from the Credential. Used internally only.
+	AttestationType string `json:"-"`
+}
+
+func (c CredentialDescriptor) SignalUnknownCredential(rpid string) *SignalUnknownCredential {
+	return &SignalUnknownCredential{
+		CredentialID: c.CredentialID,
+		RPID:         rpid,
+	}
+}
+
+// CredentialParameter is the credential type and algorithm
+// that the relying party wants the authenticator to create.
+type CredentialParameter struct {
+	Type      CredentialType                       `json:"type"`
+	Algorithm webauthncose.COSEAlgorithmIdentifier `json:"alg"`
+}
+
+// CredentialType represents the PublicKeyCredentialType IDL and is used with the CredentialDescriptor IDL.
+//
+// This enumeration defines the valid credential types. It is an extension point; values can be added to it in the
+// future, as more credential types are defined. The values of this enumeration are used for versioning the
+// Authentication Assertion and attestation structures according to the type of the authenticator.
+//
+// Currently one credential type is defined, namely "public-key".
+//
+// Specification: §5.8.2. Credential Type Enumeration (https://www.w3.org/TR/webauthn/#enumdef-publickeycredentialtype)
+//
+// Specification: §5.8.3. Credential Descriptor (https://www.w3.org/TR/webauthn/#dictionary-credential-descriptor)
+type CredentialType string
+
+const (
+	// PublicKeyCredentialType - Currently one credential type is defined, namely "public-key".
+	PublicKeyCredentialType CredentialType = "public-key"
+)
+
+// AuthenticationExtensions represents the AuthenticationExtensionsClientInputs IDL. This member contains additional
+// parameters requesting additional processing by the client and authenticator.
+//
+// Specification: §5.7.1. Authentication Extensions Client Inputs (https://www.w3.org/TR/webauthn/#iface-authentication-extensions-client-inputs)
+type AuthenticationExtensions map[string]any
+
+// AuthenticatorSelection represents the AuthenticatorSelectionCriteria IDL.
+//
+// WebAuthn Relying Parties may use the AuthenticatorSelectionCriteria dictionary to specify their requirements
+// regarding authenticator attributes.
+//
+// Specification: §5.4.4. Authenticator Selection Criteria (https://www.w3.org/TR/webauthn/#dictionary-authenticatorSelection)
+type AuthenticatorSelection struct {
+	// AuthenticatorAttachment If this member is present, eligible authenticators are filtered to only
+	// authenticators attached with the specified AuthenticatorAttachment enum.
+	AuthenticatorAttachment AuthenticatorAttachment `json:"authenticatorAttachment,omitempty"`
+
+	// RequireResidentKey this member describes the Relying Party's requirements regarding resident
+	// credentials. If the parameter is set to true, the authenticator MUST create a client-side-resident
+	// public key credential source when creating a public key credential.
+	RequireResidentKey *bool `json:"requireResidentKey,omitempty"`
+
+	// ResidentKey this member describes the Relying Party's requirements regarding resident
+	// credentials per Webauthn Level 2.
+	ResidentKey ResidentKeyRequirement `json:"residentKey,omitempty"`
+
+	// UserVerification This member describes the Relying Party's requirements regarding user verification for
+	// the create() operation. Eligible authenticators are filtered to only those capable of satisfying this
+	// requirement.
+	UserVerification UserVerificationRequirement `json:"userVerification,omitempty"`
+}
+
+// ConveyancePreference is the type representing the AttestationConveyancePreference IDL.
+//
+// WebAuthn Relying Parties may use AttestationConveyancePreference to specify their preference regarding attestation
+// conveyance during credential generation.
+//
+// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#enum-attestation-convey)
+type ConveyancePreference string
+
+const (
+	// PreferNoAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party is not interested in authenticator attestation. For example, in order
+	// to potentially avoid having to obtain user consent to relay identifying information to the Relying Party, or to
+	// save a round trip to an Attestation CA or Anonymization CA.
+	//
+	// This is the default value.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-none)
+	PreferNoAttestation ConveyancePreference = "none"
+
+	// PreferIndirectAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party prefers an attestation conveyance yielding verifiable attestation
+	// statements, but allows the client to decide how to obtain such attestation statements. The client MAY replace the
+	// authenticator-generated attestation statements with attestation statements generated by an Anonymization CA, in
+	// order to protect the user’s privacy, or to assist Relying Parties with attestation verification in a
+	// heterogeneous ecosystem.
+	//
+	// Note: There is no guarantee that the Relying Party will obtain a verifiable attestation statement in this case.
+	// For example, in the case that the authenticator employs self attestation.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-indirect)
+	PreferIndirectAttestation ConveyancePreference = "indirect"
+
+	// PreferDirectAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party wants to receive the attestation statement as generated by the
+	// authenticator.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-direct)
+	PreferDirectAttestation ConveyancePreference = "direct"
+
+	// PreferEnterpriseAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party wants to receive an attestation statement that may include uniquely
+	// identifying information. This is intended for controlled deployments within an enterprise where the organization
+	// wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless
+	// the user agent or authenticator configuration permits it for the requested RP ID.
+	//
+	// If permitted, the user agent SHOULD signal to the authenticator (at invocation time) that enterprise
+	// attestation is requested, and convey the resulting AAGUID and attestation statement, unaltered, to the Relying
+	// Party.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-enterprise)
+	PreferEnterpriseAttestation ConveyancePreference = "enterprise"
+)
+
+// AttestationFormat is an internal representation of the relevant inputs for registration.
+//
+// Specification: §5.4 Options for Credential Creation (https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-attestationformats)
+// Registry: https://www.iana.org/assignments/webauthn/webauthn.xhtml
+type AttestationFormat string
+
+const (
+	// AttestationFormatPacked is the "packed" attestation statement format is a WebAuthn-optimized format for
+	// attestation. It uses a very compact but still extensible encoding method. This format is implementable by
+	// authenticators with limited resources (e.g., secure elements).
+	AttestationFormatPacked AttestationFormat = "packed"
+
+	// AttestationFormatTPM is the TPM attestation statement format returns an attestation statement in the same format
+	// as the packed attestation statement format, although the rawData and signature fields are computed differently.
+	AttestationFormatTPM AttestationFormat = "tpm"
+
+	// AttestationFormatAndroidKey is the attestation statement format for platform authenticators on versions "N", and
+	// later, which may provide this proprietary "hardware attestation" statement.
+	AttestationFormatAndroidKey AttestationFormat = "android-key"
+
+	// AttestationFormatAndroidSafetyNet is the attestation statement format that Android-based platform authenticators
+	// MAY produce an attestation statement based on the Android SafetyNet API.
+	AttestationFormatAndroidSafetyNet AttestationFormat = "android-safetynet"
+
+	// AttestationFormatFIDOUniversalSecondFactor is the attestation statement format that is used with FIDO U2F
+	// authenticators.
+	AttestationFormatFIDOUniversalSecondFactor AttestationFormat = "fido-u2f"
+
+	// AttestationFormatApple is the attestation statement format that is used with Apple devices' platform
+	// authenticators.
+	AttestationFormatApple AttestationFormat = "apple"
+
+	// AttestationFormatCompound is used to pass multiple, self-contained attestation statements in a single ceremony.
+	AttestationFormatCompound AttestationFormat = "compound"
+
+	// AttestationFormatNone is the attestation statement format that is used to replace any authenticator-provided
+	// attestation statement when a WebAuthn Relying Party indicates it does not wish to receive attestation information.
+	AttestationFormatNone AttestationFormat = "none"
+)
+
+type PublicKeyCredentialHints string
+
+const (
+	// PublicKeyCredentialHintSecurityKey is a PublicKeyCredentialHint that indicates that the Relying Party believes
+	// that users will satisfy this request with a physical security key. For example, an enterprise Relying Party may
+	// set this hint if they have issued security keys to their employees and will only accept those authenticators for
+	// registration and authentication.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to cross-platform.
+	PublicKeyCredentialHintSecurityKey PublicKeyCredentialHints = "security-key"
+
+	// PublicKeyCredentialHintClientDevice is a PublicKeyCredentialHint that indicates that the Relying Party believes
+	// that users will satisfy this request with a platform authenticator attached to the client device.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to platform.
+	PublicKeyCredentialHintClientDevice PublicKeyCredentialHints = "client-device"
+
+	// PublicKeyCredentialHintHybrid is a PublicKeyCredentialHint that indicates that the Relying Party believes that
+	// users will satisfy this request with general-purpose authenticators such as smartphones. For example, a consumer
+	// Relying Party may believe that only a small fraction of their customers possesses dedicated security keys. This
+	// option also implies that the local platform authenticator should not be promoted in the UI.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to cross-platform.
+	PublicKeyCredentialHintHybrid PublicKeyCredentialHints = "hybrid"
+)
+
+func (a *PublicKeyCredentialRequestOptions) GetAllowedCredentialIDs() [][]byte {
+	var allowedCredentialIDs = make([][]byte, len(a.AllowedCredentials))
+
+	for i, credential := range a.AllowedCredentials {
+		allowedCredentialIDs[i] = credential.CredentialID
+	}
+
+	return allowedCredentialIDs
+}
+
+type Extensions any
+
+type ServerResponse struct {
+	Status  ServerResponseStatus `json:"status"`
+	Message string               `json:"errorMessage"`
+}
+
+type ServerResponseStatus string
+
+const (
+	StatusOk     ServerResponseStatus = "ok"
+	StatusFailed ServerResponseStatus = "failed"
+)

vendor/github.com/go-webauthn/webauthn/protocol/signals.go

@@ -0,0 +1,51 @@
+package protocol
+
+// NewSignalAllAcceptedCredentials creates a new SignalAllAcceptedCredentials struct that can simply be encoded with
+// json.Marshal.
+func NewSignalAllAcceptedCredentials(rpid string, user AllAcceptedCredentialsUser) *SignalAllAcceptedCredentials {
+	if user == nil {
+		return nil
+	}
+
+	credentials := user.WebAuthnCredentialIDs()
+
+	ids := make([]URLEncodedBase64, len(credentials))
+
+	for i, id := range credentials {
+		ids[i] = id
+	}
+
+	return &SignalAllAcceptedCredentials{
+		AllAcceptedCredentialIDs: ids,
+		RPID:                     rpid,
+		UserID:                   user.WebAuthnID(),
+	}
+}
+
+// SignalAllAcceptedCredentials is a struct which represents the CDDL of the same name.
+type SignalAllAcceptedCredentials struct {
+	AllAcceptedCredentialIDs []URLEncodedBase64 `json:"allAcceptedCredentialIds"`
+	RPID                     string             `json:"rpId"`
+	UserID                   URLEncodedBase64   `json:"userId"`
+}
+
+// SignalCurrentUserDetails is a struct which represents the CDDL of the same name.
+type SignalCurrentUserDetails struct {
+	DisplayName string           `json:"displayName"`
+	Name        string           `json:"name"`
+	RPID        string           `json:"rpId"`
+	UserID      URLEncodedBase64 `json:"userId"`
+}
+
+// SignalUnknownCredential is a struct which represents the CDDL of the same name.
+type SignalUnknownCredential struct {
+	CredentialID URLEncodedBase64 `json:"credentialId"`
+	RPID         string           `json:"rpId"`
+}
+
+// AllAcceptedCredentialsUser is an interface that can be implemented by a user to provide information about their
+// accepted credentials.
+type AllAcceptedCredentialsUser interface {
+	WebAuthnID() []byte
+	WebAuthnCredentialIDs() [][]byte
+}

vendor/github.com/go-webauthn/webauthn/protocol/utils.go

@@ -0,0 +1,264 @@
+package protocol
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+func mustParseX509Certificate(der []byte) *x509.Certificate {
+	cert, err := x509.ParseCertificate(der)
+	if err != nil {
+		panic(err)
+	}
+
+	return cert
+}
+
+func mustParseX509CertificatePEM(raw []byte) *x509.Certificate {
+	block, rest := pem.Decode(raw)
+	if len(rest) > 0 || block == nil || block.Type != "CERTIFICATE" {
+		panic("Invalid PEM Certificate")
+	}
+
+	return mustParseX509Certificate(block.Bytes)
+}
+
+func attStatementParseX5CS(attStatement map[string]any, key string) (x5c []any, x5cs []*x509.Certificate, err error) {
+	var ok bool
+	if x5c, ok = attStatement[key].([]any); !ok {
+		return nil, nil, ErrAttestationFormat.WithDetails("Error retrieving x5c value")
+	}
+
+	if len(x5c) == 0 {
+		return nil, nil, ErrAttestationFormat.WithDetails("Error retrieving x5c value: empty array")
+	}
+
+	if x5cs, err = parseX5C(x5c); err != nil {
+		return nil, nil, ErrAttestationFormat.WithDetails("Error retrieving x5c value: error occurred parsing values").WithError(err)
+	}
+
+	return x5c, x5cs, nil
+}
+
+func parseX5C(x5c []any) (x5cs []*x509.Certificate, err error) {
+	x5cs = make([]*x509.Certificate, len(x5c))
+
+	var (
+		raw []byte
+		ok  bool
+	)
+
+	for i, t := range x5c {
+		if raw, ok = t.([]byte); !ok {
+			return nil, fmt.Errorf("x5c[%d] is not a byte array", i)
+		}
+
+		if x5cs[i], err = x509.ParseCertificate(raw); err != nil {
+			return nil, fmt.Errorf("x5c[%d] is not a valid certificate: %w", i, err)
+		}
+	}
+
+	return x5cs, nil
+}
+
+// attStatementCertChainVerify allows verifying an attestation statement certificate chain and optionally allows
+// mangling the not after value for purpose of just validating the attestation lineage. If you set mangleNotAfter to
+// true this function should only be considered safe for determining lineage, and not hte validity of a chain in
+// general.
+//
+// WARNING: Setting mangleNotAfter=true weakens security by accepting expired certificates.
+func attStatementCertChainVerify(certs []*x509.Certificate, roots *x509.CertPool, mangleNotAfter bool, mangleNotAfterSafeTime time.Time) (chains [][]*x509.Certificate, err error) {
+	if len(certs) == 0 {
+		return nil, errors.New("empty chain")
+	}
+
+	leaf := certs[0]
+
+	for _, cert := range certs {
+		if !cert.IsCA {
+			leaf = certInsecureConditionalNotAfterMangle(cert, mangleNotAfter, mangleNotAfterSafeTime)
+
+			break
+		}
+	}
+
+	var (
+		intermediates *x509.CertPool
+	)
+
+	staticRoots := roots != nil
+
+	intermediates = x509.NewCertPool()
+
+	if roots == nil {
+		if roots, err = x509.SystemCertPool(); err != nil || roots == nil {
+			roots = x509.NewCertPool()
+		}
+	}
+
+	for _, cert := range certs {
+		if cert == leaf {
+			continue
+		}
+
+		if isSelfSigned(cert) && !staticRoots {
+			roots.AddCert(certInsecureConditionalNotAfterMangle(cert, mangleNotAfter, mangleNotAfterSafeTime))
+		} else {
+			intermediates.AddCert(certInsecureConditionalNotAfterMangle(cert, mangleNotAfter, mangleNotAfterSafeTime))
+		}
+	}
+
+	opts := x509.VerifyOptions{
+		Roots:         roots,
+		Intermediates: intermediates,
+	}
+
+	return leaf.Verify(opts)
+}
+
+func isSelfSigned(c *x509.Certificate) bool {
+	if !c.IsCA {
+		return false
+	}
+
+	return c.CheckSignatureFrom(c) == nil
+}
+
+// This function is used to intentionally but conditionally mangle the certificate not after value to exclude it from
+// the verification process. This should only be used in instances where all you care about is which certificates
+// performed the signing.
+//
+// WARNING: Setting mangle=true weakens security by accepting expired certificates.
+func certInsecureConditionalNotAfterMangle(cert *x509.Certificate, mangle bool, safe time.Time) (out *x509.Certificate) {
+	if !mangle || cert.NotAfter.After(safe) {
+		return cert
+	}
+
+	out = &x509.Certificate{}
+
+	*out = *cert
+
+	out.NotAfter = safe
+
+	return out
+}
+
+// This function is used to intentionally mangle the certificate not after value to exclude it from
+// the verification process. This should only be used in instances where all you care about is which certificates
+// performed the signing.
+func certInsecureNotAfterMangle(cert *x509.Certificate, safe time.Time) (out *x509.Certificate) {
+	c := *cert
+
+	out = &c
+
+	if out.NotAfter.Before(safe) {
+		out.NotAfter = safe
+	}
+
+	return out
+}
+
+func verifyAttestationECDSAPublicKeyMatch(att AttestationObject, cert *x509.Certificate) (attPublicKeyData webauthncose.EC2PublicKeyData, err error) {
+	var (
+		key any
+		ok  bool
+
+		publicKey, attPublicKey *ecdsa.PublicKey
+	)
+
+	if key, err = webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey); err != nil {
+		return attPublicKeyData, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v", err)).WithError(err)
+	}
+
+	if attPublicKeyData, ok = key.(webauthncose.EC2PublicKeyData); !ok {
+		return attPublicKeyData, ErrInvalidAttestation.WithDetails("Attestation public key is not ECDSA")
+	}
+
+	if publicKey, ok = cert.PublicKey.(*ecdsa.PublicKey); !ok {
+		return attPublicKeyData, ErrInvalidAttestation.WithDetails("Credential public key is not ECDSA")
+	}
+
+	if attPublicKey, err = attPublicKeyData.ToECDSA(); err != nil {
+		return attPublicKeyData, ErrInvalidAttestation.WithDetails("Error converting public key to ECDSA").WithError(err)
+	}
+
+	if !attPublicKey.Equal(publicKey) {
+		return attPublicKeyData, ErrInvalidAttestation.WithDetails("Certificate public key does not match public key in authData")
+	}
+
+	return attPublicKeyData, nil
+}
+
+// ValidateRPID performs non-exhaustive checks to ensure the string is most likely a domain string as
+// relying-party ID's are required to be. Effectively this can be an IP, localhost, or a string that contains a period.
+// The relying-party ID must not contain scheme, port, path, query, or fragment components.
+//
+// See: https://www.w3.org/TR/webauthn/#rp-id
+func ValidateRPID(value string) (err error) {
+	if len(value) == 0 {
+		return errors.New("empty value provided")
+	}
+
+	if ip := net.ParseIP(value); ip != nil {
+		return nil
+	}
+
+	var rpid *url.URL
+
+	if rpid, err = url.Parse(value); err != nil {
+		return err
+	}
+
+	if rpid.Scheme != "" && rpid.Opaque != "" && rpid.Path == "" {
+		return errors.New("the port component must be empty")
+	}
+
+	if rpid.Scheme != "" {
+		if rpid.Host != "" && rpid.Path != "" {
+			return errors.New("the path component must be empty")
+		}
+
+		if rpid.Host != "" && rpid.RawQuery != "" {
+			return errors.New("the query component must be empty")
+		}
+
+		if rpid.Host != "" && rpid.Fragment != "" {
+			return errors.New("the fragment component must be empty")
+		}
+
+		if rpid.Host != "" && rpid.Port() != "" {
+			return errors.New("the port component must be empty")
+		}
+
+		return errors.New("the scheme component must be empty")
+	}
+
+	if rpid.RawQuery != "" {
+		return errors.New("the query component must be empty")
+	}
+
+	if rpid.RawFragment != "" || rpid.Fragment != "" {
+		return errors.New("the fragment component must be empty")
+	}
+
+	if rpid.Host == "" {
+		if strings.Contains(rpid.Path, "/") {
+			return errors.New("the path component must be empty")
+		}
+	}
+
+	if value != "localhost" && !strings.Contains(rpid.Path, ".") {
+		return errors.New("the domain component must actually be a domain")
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/protocol/webauthncbor/webauthncbor.go

@@ -0,0 +1,33 @@
+package webauthncbor
+
+import "github.com/fxamacker/cbor/v2"
+
+const nestedLevelsAllowed = 4
+
+// ctap2CBORDecMode is the cbor.DecMode following the CTAP2 canonical CBOR encoding form
+// (https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#message-encoding)
+var ctap2CBORDecMode, _ = cbor.DecOptions{
+	DupMapKey:       cbor.DupMapKeyEnforcedAPF,
+	MaxNestedLevels: nestedLevelsAllowed,
+	IndefLength:     cbor.IndefLengthForbidden,
+	TagsMd:          cbor.TagsForbidden,
+}.DecMode()
+
+var ctap2CBOREncMode, _ = cbor.CTAP2EncOptions().EncMode()
+
+// Unmarshal parses the CBOR-encoded data into the value pointed to by v
+// following the CTAP2 canonical CBOR encoding form.
+// (https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#message-encoding)
+func Unmarshal(data []byte, v any) error {
+	// TODO (james-d-elliott): investigate the specific use case for Unmarshal vs UnmarshalFirst to determine the edge cases where this may be useful.
+	_, err := ctap2CBORDecMode.UnmarshalFirst(data, v)
+
+	return err
+}
+
+// Marshal encodes the value pointed to by v
+// following the CTAP2 canonical CBOR encoding form.
+// (https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#message-encoding)
+func Marshal(v any) ([]byte, error) {
+	return ctap2CBOREncMode.Marshal(v)
+}

vendor/github.com/go-webauthn/webauthn/protocol/webauthncose/const.go

@@ -0,0 +1,5 @@
+package webauthncose
+
+const (
+	keyCannotDisplay = "Cannot display key"
+)

vendor/github.com/go-webauthn/webauthn/protocol/webauthncose/ed25519.go

@@ -0,0 +1,10 @@
+package webauthncose
+
+import (
+	"crypto/ed25519"
+	"crypto/x509"
+)
+
+func marshalEd25519PublicKey(pub ed25519.PublicKey) ([]byte, error) {
+	return x509.MarshalPKIXPublicKey(pub)
+}

vendor/github.com/go-webauthn/webauthn/protocol/webauthncose/types.go

@@ -0,0 +1,7 @@
+package webauthncose
+
+import "math/big"
+
+type ECDSASignature struct {
+	R, S *big.Int
+}

vendor/github.com/go-webauthn/webauthn/protocol/webauthncose/var.go

@@ -0,0 +1,13 @@
+package webauthncose
+
+import "sync/atomic"
+
+var allowBERIntegers atomic.Bool
+
+// SetExperimentalInsecureAllowBERIntegers allows credentials which have BER integer encoding for their signatures
+// which do not conform to the specification. This is an experimental option that may be removed without any notice
+// and could potentially lead to zero-day exploits due to the ambiguity of encoding practices. This is not a recommended
+// option.
+func SetExperimentalInsecureAllowBERIntegers(value bool) {
+	allowBERIntegers.Store(value)
+}

vendor/github.com/go-webauthn/webauthn/protocol/webauthncose/webauthncose.go

@@ -0,0 +1,589 @@
+package webauthncose
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"hash"
+	"math"
+	"math/big"
+
+	"github.com/go-webauthn/x/encoding/asn1"
+
+	"github.com/google/go-tpm/tpm2"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncbor"
+)
+
+// PublicKeyData The public key portion of a Relying Party-specific credential key pair, generated
+// by an authenticator and returned to a Relying Party at registration time. We unpack this object
+// using fxamacker's cbor library ("github.com/fxamacker/cbor/v2") which is why there are cbor tags
+// included. The tag field values correspond to the IANA COSE keys that give their respective
+// values.
+//
+// Specification: §6.4.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format (https://www.w3.org/TR/webauthn/#sctn-encoded-credPubKey-examples)
+type PublicKeyData struct {
+	// Decode the results to int by default.
+	_struct bool `cbor:",keyasint" json:"public_key"` //nolint:govet
+
+	// The type of key created. Should be OKP, EC2, or RSA.
+	KeyType int64 `cbor:"1,keyasint" json:"kty"`
+
+	// A COSEAlgorithmIdentifier for the algorithm used to derive the key signature.
+	Algorithm int64 `cbor:"3,keyasint" json:"alg"`
+}
+
+const ecCoordSize = 32
+
+type EC2PublicKeyData struct {
+	PublicKeyData
+
+	// If the key type is EC2, the curve on which we derive the signature from.
+	Curve int64 `cbor:"-1,keyasint,omitempty" json:"crv"`
+
+	// A byte string 32 bytes in length that holds the x coordinate of the key.
+	XCoord []byte `cbor:"-2,keyasint,omitempty" json:"x"`
+
+	// A byte string 32 bytes in length that holds the y coordinate of the key.
+	YCoord []byte `cbor:"-3,keyasint,omitempty" json:"y"`
+}
+
+type RSAPublicKeyData struct {
+	PublicKeyData
+
+	// Represents the modulus parameter for the RSA algorithm.
+	Modulus []byte `cbor:"-1,keyasint,omitempty" json:"n"`
+
+	// Represents the exponent parameter for the RSA algorithm.
+	Exponent []byte `cbor:"-2,keyasint,omitempty" json:"e"`
+}
+
+type OKPPublicKeyData struct {
+	PublicKeyData
+
+	Curve int64
+
+	// A byte string that holds the x coordinate of the key.
+	XCoord []byte `cbor:"-2,keyasint,omitempty" json:"x"`
+}
+
+// Verify Octet Key Pair (OKP) Public Key Signature.
+func (k *OKPPublicKeyData) Verify(data []byte, sig []byte) (bool, error) {
+	if err := validateOKPPublicKey(k); err != nil {
+		return false, err
+	}
+
+	var key ed25519.PublicKey = make([]byte, ed25519.PublicKeySize)
+
+	copy(key, k.XCoord)
+
+	return ed25519.Verify(key, data, sig), nil
+}
+
+// Verify Elliptic Curve Public Key Signature.
+func (k *EC2PublicKeyData) Verify(data []byte, sig []byte) (valid bool, err error) {
+	if err = validateEC2PublicKey(k); err != nil {
+		return false, err
+	}
+
+	pubkey := &ecdsa.PublicKey{
+		Curve: ec2AlgCurve(k.Algorithm),
+		X:     big.NewInt(0).SetBytes(k.XCoord),
+		Y:     big.NewInt(0).SetBytes(k.YCoord),
+	}
+
+	h := HasherFromCOSEAlg(COSEAlgorithmIdentifier(k.Algorithm))
+	h.Write(data)
+
+	e := &ECDSASignature{}
+
+	var opts []asn1.UnmarshalOpt
+
+	if allowBERIntegers.Load() {
+		opts = append(opts, asn1.WithUnmarshalAllowBERIntegers(true))
+	}
+
+	if _, err = asn1.Unmarshal(sig, e, opts...); err != nil {
+		return false, ErrSigNotProvidedOrInvalid
+	}
+
+	return ecdsa.Verify(pubkey, h.Sum(nil), e.R, e.S), nil
+}
+
+// ToECDSA converts the EC2PublicKeyData to an ecdsa.PublicKey.
+func (k *EC2PublicKeyData) ToECDSA() (key *ecdsa.PublicKey, err error) {
+	if err = validateEC2PublicKey(k); err != nil {
+		return nil, err
+	}
+
+	return &ecdsa.PublicKey{
+		Curve: ec2AlgCurve(k.Algorithm),
+		X:     big.NewInt(0).SetBytes(k.XCoord),
+		Y:     big.NewInt(0).SetBytes(k.YCoord),
+	}, nil
+}
+
+// Verify RSA Public Key Signature.
+func (k *RSAPublicKeyData) Verify(data []byte, sig []byte) (valid bool, err error) {
+	if err = validateRSAPublicKey(k); err != nil {
+		return false, err
+	}
+
+	e, _ := parseRSAPublicKeyDataExponent(k)
+
+	pubkey := &rsa.PublicKey{
+		N: big.NewInt(0).SetBytes(k.Modulus),
+		E: e,
+	}
+
+	coseAlg := COSEAlgorithmIdentifier(k.Algorithm)
+
+	algDetail, ok := COSESignatureAlgorithmDetails[coseAlg]
+	if !ok {
+		return false, ErrUnsupportedAlgorithm
+	}
+
+	hash := algDetail.hash
+	h := hash.New()
+	h.Write(data)
+
+	switch coseAlg {
+	case AlgPS256, AlgPS384, AlgPS512:
+		err = rsa.VerifyPSS(pubkey, hash, h.Sum(nil), sig, nil)
+
+		return err == nil, err
+	case AlgRS1, AlgRS256, AlgRS384, AlgRS512:
+		err = rsa.VerifyPKCS1v15(pubkey, hash, h.Sum(nil), sig)
+
+		return err == nil, err
+	default:
+		return false, ErrUnsupportedAlgorithm
+	}
+}
+
+// ParsePublicKey figures out what kind of COSE material was provided and create the data for the new key.
+func ParsePublicKey(keyBytes []byte) (publicKey any, err error) {
+	pk := PublicKeyData{}
+
+	if err = webauthncbor.Unmarshal(keyBytes, &pk); err != nil {
+		return nil, ErrUnsupportedKey
+	}
+
+	switch COSEKeyType(pk.KeyType) {
+	case OctetKey:
+		var o OKPPublicKeyData
+
+		if err = webauthncbor.Unmarshal(keyBytes, &o); err != nil {
+			return nil, err
+		}
+
+		o.PublicKeyData = pk
+
+		if err = validateOKPPublicKey(&o); err != nil {
+			return nil, err
+		}
+
+		return o, nil
+	case EllipticKey:
+		var e EC2PublicKeyData
+
+		if err = webauthncbor.Unmarshal(keyBytes, &e); err != nil {
+			return nil, err
+		}
+
+		e.PublicKeyData = pk
+
+		if err = validateEC2PublicKey(&e); err != nil {
+			return nil, err
+		}
+
+		return e, nil
+	case RSAKey:
+		var r RSAPublicKeyData
+
+		if err = webauthncbor.Unmarshal(keyBytes, &r); err != nil {
+			return nil, err
+		}
+
+		r.PublicKeyData = pk
+
+		if err = validateRSAPublicKey(&r); err != nil {
+			return nil, err
+		}
+
+		return r, nil
+	default:
+		return nil, ErrUnsupportedKey
+	}
+}
+
+// ParseFIDOPublicKey is only used when the appID extension is configured by the assertion response.
+func ParseFIDOPublicKey(keyBytes []byte) (data EC2PublicKeyData, err error) {
+	x, y := elliptic.Unmarshal(elliptic.P256(), keyBytes)
+
+	if x == nil || y == nil {
+		return data, fmt.Errorf("elliptic unmarshall returned a nil value")
+	}
+
+	return EC2PublicKeyData{
+		PublicKeyData: PublicKeyData{
+			KeyType:   int64(EllipticKey),
+			Algorithm: int64(AlgES256),
+		},
+		Curve:  int64(P256),
+		XCoord: x.FillBytes(make([]byte, ecCoordSize)),
+		YCoord: y.FillBytes(make([]byte, ecCoordSize)),
+	}, nil
+}
+
+func VerifySignature(key any, data []byte, sig []byte) (bool, error) {
+	switch k := key.(type) {
+	case OKPPublicKeyData:
+		return k.Verify(data, sig)
+	case EC2PublicKeyData:
+		return k.Verify(data, sig)
+	case RSAPublicKeyData:
+		return k.Verify(data, sig)
+	default:
+		return false, ErrUnsupportedKey
+	}
+}
+
+func DisplayPublicKey(cpk []byte) string {
+	parsedKey, err := ParsePublicKey(cpk)
+	if err != nil {
+		return keyCannotDisplay
+	}
+
+	var data []byte
+
+	switch k := parsedKey.(type) {
+	case RSAPublicKeyData:
+		var e int
+
+		if e, err = parseRSAPublicKeyDataExponent(&k); err != nil {
+			return keyCannotDisplay
+		}
+
+		rKey := &rsa.PublicKey{
+			N: big.NewInt(0).SetBytes(k.Modulus),
+			E: e,
+		}
+
+		if data, err = x509.MarshalPKIXPublicKey(rKey); err != nil {
+			return keyCannotDisplay
+		}
+	case EC2PublicKeyData:
+		curve := ec2AlgCurve(k.Algorithm)
+		if curve == nil {
+			return keyCannotDisplay
+		}
+
+		eKey := &ecdsa.PublicKey{
+			Curve: curve,
+			X:     big.NewInt(0).SetBytes(k.XCoord),
+			Y:     big.NewInt(0).SetBytes(k.YCoord),
+		}
+
+		if data, err = x509.MarshalPKIXPublicKey(eKey); err != nil {
+			return keyCannotDisplay
+		}
+	case OKPPublicKeyData:
+		if len(k.XCoord) != ed25519.PublicKeySize {
+			return keyCannotDisplay
+		}
+
+		var oKey ed25519.PublicKey = make([]byte, ed25519.PublicKeySize)
+
+		copy(oKey, k.XCoord)
+
+		if data, err = marshalEd25519PublicKey(oKey); err != nil {
+			return keyCannotDisplay
+		}
+	default:
+		return "Cannot display key of this type"
+	}
+
+	pemBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: data,
+	})
+
+	return string(pemBytes)
+}
+
+// COSEAlgorithmIdentifier is a number identifying a cryptographic algorithm. The algorithm identifiers SHOULD be values
+// registered in the IANA COSE Algorithms registry [https://www.w3.org/TR/webauthn/#biblio-iana-cose-algs-reg], for
+// instance, -7 for "ES256" and -257 for "RS256".
+//
+// Specification: §5.8.5. Cryptographic Algorithm Identifier (https://www.w3.org/TR/webauthn/#sctn-alg-identifier)
+type COSEAlgorithmIdentifier int
+
+const (
+	// AlgES256 ECDSA with SHA-256.
+	AlgES256 COSEAlgorithmIdentifier = -7
+
+	// AlgEdDSA EdDSA.
+	AlgEdDSA COSEAlgorithmIdentifier = -8
+
+	// AlgES384 ECDSA with SHA-384.
+	AlgES384 COSEAlgorithmIdentifier = -35
+
+	// AlgES512 ECDSA with SHA-512.
+	AlgES512 COSEAlgorithmIdentifier = -36
+
+	// AlgPS256 RSASSA-PSS with SHA-256.
+	AlgPS256 COSEAlgorithmIdentifier = -37
+
+	// AlgPS384 RSASSA-PSS with SHA-384.
+	AlgPS384 COSEAlgorithmIdentifier = -38
+
+	// AlgPS512 RSASSA-PSS with SHA-512.
+	AlgPS512 COSEAlgorithmIdentifier = -39
+
+	// AlgES256K is ECDSA using secp256k1 curve and SHA-256.
+	AlgES256K COSEAlgorithmIdentifier = -47
+
+	// AlgRS256 RSASSA-PKCS1-v1_5 with SHA-256.
+	AlgRS256 COSEAlgorithmIdentifier = -257
+
+	// AlgRS384 RSASSA-PKCS1-v1_5 with SHA-384.
+	AlgRS384 COSEAlgorithmIdentifier = -258
+
+	// AlgRS512 RSASSA-PKCS1-v1_5 with SHA-512.
+	AlgRS512 COSEAlgorithmIdentifier = -259
+
+	// AlgRS1 RSASSA-PKCS1-v1_5 with SHA-1.
+	AlgRS1 COSEAlgorithmIdentifier = -65535
+)
+
+// COSEKeyType is The Key type derived from the IANA COSE AuthData.
+type COSEKeyType int
+
+const (
+	// KeyTypeReserved is a reserved value.
+	KeyTypeReserved COSEKeyType = iota
+
+	// OctetKey is an Octet Key.
+	OctetKey
+
+	// EllipticKey is an Elliptic Curve Public Key.
+	EllipticKey
+
+	// RSAKey is an RSA Public Key.
+	RSAKey
+
+	// Symmetric Keys.
+	Symmetric
+
+	// HSSLMS is the public key for HSS/LMS hash-based digital signature.
+	HSSLMS
+)
+
+// COSEEllipticCurve is an enumerator that represents the COSE Elliptic Curves.
+//
+// Specification: https://www.iana.org/assignments/cose/cose.xhtml#elliptic-curves
+type COSEEllipticCurve int
+
+const (
+	// EllipticCurveReserved is the COSE EC Reserved value.
+	EllipticCurveReserved COSEEllipticCurve = iota
+
+	// P256 represents NIST P-256 also known as secp256r1.
+	P256
+
+	// P384 represents NIST P-384 also known as secp384r1.
+	P384
+
+	// P521 represents NIST P-521 also known as secp521r1.
+	P521
+
+	// X25519 for use w/ ECDH only.
+	X25519
+
+	// X448 for use w/ ECDH only.
+	X448
+
+	// Ed25519 for use w/ EdDSA only.
+	Ed25519
+
+	// Ed448 for use w/ EdDSA only.
+	Ed448
+
+	// Secp256k1 is the SECG secp256k1 curve.
+	Secp256k1
+)
+
+func (k *EC2PublicKeyData) TPMCurveID() tpm2.TPMECCCurve {
+	switch COSEEllipticCurve(k.Curve) {
+	case P256:
+		return tpm2.TPMECCNistP256 // TPM_ECC_NIST_P256.
+	case P384:
+		return tpm2.TPMECCNistP384 // TPM_ECC_NIST_P384.
+	case P521:
+		return tpm2.TPMECCNistP521 // TPM_ECC_NIST_P521.
+	default:
+		return tpm2.TPMECCNone // TPM_ECC_NONE.
+	}
+}
+
+func ec2AlgCurve(coseAlg int64) elliptic.Curve {
+	switch COSEAlgorithmIdentifier(coseAlg) {
+	case AlgES512: // IANA COSE code for ECDSA w/ SHA-512.
+		return elliptic.P521()
+	case AlgES384: // IANA COSE code for ECDSA w/ SHA-384.
+		return elliptic.P384()
+	case AlgES256: // IANA COSE code for ECDSA w/ SHA-256.
+		return elliptic.P256()
+	default:
+		return nil
+	}
+}
+
+// SigAlgFromCOSEAlg return which signature algorithm is being used from the COSE Key.
+func SigAlgFromCOSEAlg(coseAlg COSEAlgorithmIdentifier) x509.SignatureAlgorithm {
+	d, ok := COSESignatureAlgorithmDetails[coseAlg]
+	if !ok {
+		return x509.UnknownSignatureAlgorithm
+	}
+
+	return d.sigAlg
+}
+
+// HasherFromCOSEAlg returns the Hashing interface to be used for a given COSE Algorithm.
+func HasherFromCOSEAlg(coseAlg COSEAlgorithmIdentifier) hash.Hash {
+	d, ok := COSESignatureAlgorithmDetails[coseAlg]
+	if !ok {
+		// default to SHA256?  Why not.
+		return crypto.SHA256.New()
+	}
+
+	return d.hash.New()
+}
+
+var COSESignatureAlgorithmDetails = map[COSEAlgorithmIdentifier]struct {
+	name   string
+	hash   crypto.Hash
+	sigAlg x509.SignatureAlgorithm
+}{
+	AlgRS1:   {"SHA1-RSA", crypto.SHA1, x509.SHA1WithRSA},
+	AlgRS256: {"SHA256-RSA", crypto.SHA256, x509.SHA256WithRSA},
+	AlgRS384: {"SHA384-RSA", crypto.SHA384, x509.SHA384WithRSA},
+	AlgRS512: {"SHA512-RSA", crypto.SHA512, x509.SHA512WithRSA},
+	AlgPS256: {"SHA256-RSAPSS", crypto.SHA256, x509.SHA256WithRSAPSS},
+	AlgPS384: {"SHA384-RSAPSS", crypto.SHA384, x509.SHA384WithRSAPSS},
+	AlgPS512: {"SHA512-RSAPSS", crypto.SHA512, x509.SHA512WithRSAPSS},
+	AlgES256: {"ECDSA-SHA256", crypto.SHA256, x509.ECDSAWithSHA256},
+	AlgES384: {"ECDSA-SHA384", crypto.SHA384, x509.ECDSAWithSHA384},
+	AlgES512: {"ECDSA-SHA512", crypto.SHA512, x509.ECDSAWithSHA512},
+	AlgEdDSA: {"EdDSA", crypto.SHA512, x509.PureEd25519},
+}
+
+type Error struct {
+	// Short name for the type of error that has occurred.
+	Type string `json:"type"`
+
+	// Additional details about the error.
+	Details string `json:"error"`
+
+	// Information to help debug the error.
+	DevInfo string `json:"debug"`
+}
+
+var (
+	ErrUnsupportedKey = &Error{
+		Type:    "invalid_key_type",
+		Details: "Unsupported Public Key Type",
+	}
+	ErrUnsupportedAlgorithm = &Error{
+		Type:    "unsupported_key_algorithm",
+		Details: "Unsupported public key algorithm",
+	}
+	ErrSigNotProvidedOrInvalid = &Error{
+		Type:    "signature_not_provided_or_invalid",
+		Details: "Signature invalid or not provided",
+	}
+)
+
+func (err *Error) Error() string {
+	return err.Details
+}
+
+func (passedError *Error) WithDetails(details string) *Error {
+	err := *passedError
+	err.Details = details
+
+	return &err
+}
+
+func validateOKPPublicKey(k *OKPPublicKeyData) error {
+	if len(k.XCoord) != ed25519.PublicKeySize {
+		return ErrUnsupportedKey.WithDetails(fmt.Sprintf("OKP key x coordinate has invalid length %d, expected %d", len(k.XCoord), ed25519.PublicKeySize))
+	}
+
+	return nil
+}
+
+func validateEC2PublicKey(k *EC2PublicKeyData) error {
+	curve := ec2AlgCurve(k.Algorithm)
+	if curve == nil {
+		return ErrUnsupportedAlgorithm.WithDetails("Unsupported EC2 algorithm")
+	}
+
+	byteLen := (curve.Params().BitSize + 7) / 8
+
+	if len(k.XCoord) != byteLen || len(k.YCoord) != byteLen {
+		return ErrUnsupportedKey.WithDetails("EC2 key x or y coordinate has invalid length")
+	}
+
+	x := new(big.Int).SetBytes(k.XCoord)
+	y := new(big.Int).SetBytes(k.YCoord)
+
+	if !curve.IsOnCurve(x, y) {
+		return ErrUnsupportedKey.WithDetails("EC2 key point is not on curve")
+	}
+
+	return nil
+}
+
+func validateRSAPublicKey(k *RSAPublicKeyData) error {
+	n := new(big.Int).SetBytes(k.Modulus)
+	if n.Sign() <= 0 {
+		return ErrUnsupportedKey.WithDetails("RSA key contains zero or empty modulus")
+	}
+
+	if _, err := parseRSAPublicKeyDataExponent(k); err != nil {
+		return ErrUnsupportedKey.WithDetails(fmt.Sprintf("RSA key contains invalid exponent: %v", err))
+	}
+
+	return nil
+}
+
+func parseRSAPublicKeyDataExponent(k *RSAPublicKeyData) (exp int, err error) {
+	if k == nil {
+		return 0, fmt.Errorf("invalid key")
+	}
+
+	if len(k.Exponent) == 0 {
+		return 0, fmt.Errorf("invalid exponent length")
+	}
+
+	for _, b := range k.Exponent {
+		if exp > (math.MaxInt >> 8) {
+			return 0, ErrUnsupportedKey
+		}
+
+		exp = (exp << 8) | int(b)
+	}
+
+	if exp <= 0 {
+		return 0, ErrUnsupportedKey
+	}
+
+	return exp, nil
+}

vendor/github.com/go-webauthn/webauthn/webauthn/authenticator.go

@@ -0,0 +1,60 @@
+package webauthn
+
+import (
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// Authenticator represents a specific authenticator in the context of a [Credential].
+type Authenticator struct {
+	// The AAGUID of the authenticator. An AAGUID is defined as an array containing the globally unique
+	// identifier of the authenticator model being sought.
+	AAGUID []byte `json:"AAGUID"`
+
+	// SignCount is a representation of the number of times the Authenticator or Credential have been used to login.
+	// Upon a new login operation, the Relying Party compares the stored signature counter value with the new SignCount
+	// value returned in the assertion’s authenticator data. If this new SignCount value is less than or equal to the
+	// stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.
+	SignCount uint32 `json:"signCount"`
+
+	// CloneWarning is a signal that the authenticator may be cloned, i.e. at least two copies of the
+	// credential private key may exist and are being used in parallel. Relying Parties should incorporate
+	// this information into their risk scoring. Whether the Relying Party updates the stored signature
+	// counter value in this case, or not, or fails the authentication ceremony or not, is Relying Party-specific.
+	CloneWarning bool `json:"cloneWarning"`
+
+	// Attachment is the authenticatorAttachment value returned by the request.
+	Attachment protocol.AuthenticatorAttachment `json:"attachment"`
+}
+
+// SelectAuthenticator allow for easy marshaling of authenticator options that are provided to the user.
+func SelectAuthenticator(att string, rrk *bool, uv string) protocol.AuthenticatorSelection {
+	return protocol.AuthenticatorSelection{
+		AuthenticatorAttachment: protocol.AuthenticatorAttachment(att),
+		RequireResidentKey:      rrk,
+		UserVerification:        protocol.UserVerificationRequirement(uv),
+	}
+}
+
+// UpdateCounter updates the authenticator and either sets the clone warning value or the sign count.
+//
+// Step 17 of §7.2. about verifying attestation. If the signature counter value authData.signCount
+// is nonzero or the value stored in conjunction with credential’s id attribute is nonzero, then
+// run the following sub-step:
+//
+//	If the signature counter value authData.signCount is
+//
+//	→ Greater than the signature counter value stored in conjunction with credential’s id attribute.
+//	Update the stored signature counter value, associated with credential’s id attribute, to be the value of
+//	authData.signCount.
+//
+//	→ Less than or equal to the signature counter value stored in conjunction with credential’s id attribute.
+//	This is a signal that the authenticator may be cloned, see CloneWarning above for more information.
+func (a *Authenticator) UpdateCounter(authDataCount uint32) {
+	if authDataCount <= a.SignCount && (authDataCount != 0 || a.SignCount != 0) {
+		a.CloneWarning = true
+
+		return
+	}
+
+	a.SignCount = authDataCount
+}

vendor/github.com/go-webauthn/webauthn/webauthn/const.go

@@ -0,0 +1,15 @@
+package webauthn
+
+import (
+	"time"
+)
+
+const (
+	errFmtFieldNotValidDomainString = "field '%s' is not a valid domain string: %w"
+	errFmtConfigValidate            = "error occurred validating the configuration: %w"
+)
+
+const (
+	defaultTimeoutUVD = time.Millisecond * 120000
+	defaultTimeout    = time.Millisecond * 300000
+)

vendor/github.com/go-webauthn/webauthn/webauthn/credential.go

@@ -0,0 +1,195 @@
+package webauthn
+
+import (
+	"crypto/sha256"
+	"fmt"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// Credential contains all needed information about a WebAuthn credential for storage. This struct is effectively the
+// Credential Record as described in the specification.
+//
+// Providing this data structure is preserved properly this Credential can be properly verified using the
+// [Credential.Verify] function when provided a [metadata.Provider].
+//
+// It is strongly recommended for the best security that a [Credential] is encrypted at rest with the exception of the
+// ID and the value you use to lookup the user. This prevents a person with access to the database being able to
+// compromise privacy by being able to view this data, as well as prevents them being able to compromise security by
+// adding or modifying a Credential without them also having access to the encryption key.
+//
+// See: §4. Terminology: Credential Record (https://www.w3.org/TR/webauthn-3/#credential-record)
+type Credential struct {
+	// The ID is the ID of the public key credential source. Described by the Credential Record 'id' field.
+	ID []byte `json:"id"`
+
+	// The credential public key of the public key credential source. Described by the Credential Record 'publicKey'
+	// field.
+	PublicKey []byte `json:"publicKey"`
+
+	// The AttestationType stores the attestation format used (if any) by the authenticator when creating the
+	// Credential.
+	//
+	// Important Note: This field is named attestationType but this is actually the attestation format.
+	AttestationType string `json:"attestationType"`
+
+	// Transport types the authenticator supports. Described by the Credential Record 'transports' field.
+	Transport []protocol.AuthenticatorTransport `json:"transport"`
+
+	// Flags represent the commonly stored flags.
+	Flags CredentialFlags `json:"flags"`
+
+	// The Authenticator information for a given Credential.
+	Authenticator Authenticator `json:"authenticator"`
+
+	// The attestation values that can be used to validate this Credential via the MDS3 at a later date.
+	Attestation CredentialAttestation `json:"attestation"`
+}
+
+// SignalUnknownCredential creates a struct that can easily be marshaled to JSON which indicates this is an unknown
+// Credential.
+func (c Credential) SignalUnknownCredential(rpid string) *protocol.SignalUnknownCredential {
+	return c.Descriptor().SignalUnknownCredential(rpid)
+}
+
+// Credentials is a decorator type which allows easily converting a [Credential] slice into a
+// [protocol.CredentialDescriptor] slice by utilizing the [Credentials.CredentialDescriptors] method. This will be the
+// type used globally for the library in a future release.
+type Credentials []Credential
+
+// CredentialDescriptors returns the [protocol.CredentialDescriptor] slice for this [Credentials] type.
+func (c Credentials) CredentialDescriptors() (descriptors []protocol.CredentialDescriptor) {
+	descriptors = make([]protocol.CredentialDescriptor, len(c))
+
+	for i, credential := range c {
+		descriptors[i] = credential.Descriptor()
+	}
+
+	return descriptors
+}
+
+// NewCredentialFlags is a utility function that is used to derive the [Credential]'s Flags field given a
+// [protocol.AuthenticatorFlags]. This allows implementers to solely save the Raw field of the [CredentialFlags] to
+// restore them appropriately for appropriate processing without concern that changes forced upon implementers by the
+// W3C will introduce breaking changes.
+func NewCredentialFlags(flags protocol.AuthenticatorFlags) CredentialFlags {
+	return CredentialFlags{
+		UserPresent:    flags.HasUserPresent(),
+		UserVerified:   flags.HasUserVerified(),
+		BackupEligible: flags.HasBackupEligible(),
+		BackupState:    flags.HasBackupState(),
+		raw:            flags,
+	}
+}
+
+// CredentialFlags is a JSON representation of the flags.
+type CredentialFlags struct {
+	// Flag UP indicates the users presence.
+	UserPresent bool `json:"userPresent"`
+
+	// Flag UV indicates the user performed verification.
+	UserVerified bool `json:"userVerified"`
+
+	// Flag BE indicates the credential is able to be backed up and/or sync'd between devices. This should NEVER change.
+	BackupEligible bool `json:"backupEligible"`
+
+	// Flag BS indicates the credential has been backed up and/or sync'd. This value can change but it's recommended
+	// that RP's keep track of this value.
+	BackupState bool `json:"backupState"`
+
+	raw protocol.AuthenticatorFlags
+}
+
+// ProtocolValue returns the underlying [protocol.AuthenticatorFlags] provided this [CredentialFlags] was created using
+// NewCredentialFlags.
+func (f CredentialFlags) ProtocolValue() protocol.AuthenticatorFlags {
+	return f.raw
+}
+
+// CredentialAttestation is a decoded representation of the [protocol.AuthenticatorAttestationResponse] in a format that
+// can easily be serialized.
+type CredentialAttestation struct {
+	ClientDataJSON     []byte `json:"clientDataJSON"`
+	ClientDataHash     []byte `json:"clientDataHash"`
+	AuthenticatorData  []byte `json:"authenticatorData"`
+	PublicKeyAlgorithm int64  `json:"publicKeyAlgorithm"`
+	Object             []byte `json:"object"`
+}
+
+// Descriptor converts a [Credential] into a [protocol.CredentialDescriptor].
+func (c Credential) Descriptor() (descriptor protocol.CredentialDescriptor) {
+	return protocol.CredentialDescriptor{
+		Type:            protocol.PublicKeyCredentialType,
+		CredentialID:    c.ID,
+		Transport:       c.Transport,
+		AttestationType: c.AttestationType,
+	}
+}
+
+// NewCredential will return a credential pointer on successful validation of a registration response.
+func NewCredential(clientDataHash []byte, c *protocol.ParsedCredentialCreationData) (credential *Credential, err error) {
+	credential = &Credential{
+		ID:              c.Response.AttestationObject.AuthData.AttData.CredentialID,
+		PublicKey:       c.Response.AttestationObject.AuthData.AttData.CredentialPublicKey,
+		AttestationType: c.Response.AttestationObject.Format,
+		Transport:       c.Response.Transports,
+		Flags:           NewCredentialFlags(c.Response.AttestationObject.AuthData.Flags),
+		Authenticator: Authenticator{
+			AAGUID:     c.Response.AttestationObject.AuthData.AttData.AAGUID,
+			SignCount:  c.Response.AttestationObject.AuthData.Counter,
+			Attachment: c.AuthenticatorAttachment,
+		},
+		Attestation: CredentialAttestation{
+			ClientDataJSON:     c.Raw.AttestationResponse.ClientDataJSON,
+			ClientDataHash:     clientDataHash,
+			AuthenticatorData:  c.Raw.AttestationResponse.AuthenticatorData,
+			PublicKeyAlgorithm: c.Raw.AttestationResponse.PublicKeyAlgorithm,
+			Object:             c.Raw.AttestationResponse.AttestationObject,
+		},
+	}
+
+	return credential, nil
+}
+
+// Verify this credentials against the metadata.Provider given.
+func (c Credential) Verify(mds metadata.Provider) (err error) {
+	if mds == nil {
+		return fmt.Errorf("error verifying credential: the metadata provider must be provided but it's nil")
+	}
+
+	raw := &protocol.AuthenticatorAttestationResponse{
+		AuthenticatorResponse: protocol.AuthenticatorResponse{
+			ClientDataJSON: c.Attestation.ClientDataJSON,
+		},
+		Transports:         make([]string, len(c.Transport)),
+		AuthenticatorData:  c.Attestation.AuthenticatorData,
+		PublicKey:          c.PublicKey,
+		PublicKeyAlgorithm: c.Attestation.PublicKeyAlgorithm,
+		AttestationObject:  c.Attestation.Object,
+	}
+
+	for i, transport := range c.Transport {
+		raw.Transports[i] = string(transport)
+	}
+
+	var attestation *protocol.ParsedAttestationResponse
+
+	if attestation, err = raw.Parse(); err != nil {
+		return fmt.Errorf("error verifying credential: error parsing attestation: %w", err)
+	}
+
+	clientDataHash := c.Attestation.ClientDataHash
+
+	if len(clientDataHash) == 0 {
+		sum := sha256.Sum256(c.Attestation.ClientDataJSON)
+
+		clientDataHash = sum[:]
+	}
+
+	if err = attestation.AttestationObject.VerifyAttestation(clientDataHash, mds); err != nil {
+		return fmt.Errorf("error verifying credential: error verifying attestation: %w", err)
+	}
+
+	return nil
+}

vendor/github.com/go-webauthn/webauthn/webauthn/doc.go

@@ -0,0 +1,50 @@
+// Package webauthn contains the API functionality of the library. After creating and configuring a webauthn object,
+// users can call the object to create and validate web authentication credentials.
+//
+// This documentation section highlights key functions within the library which are recommended and often have
+// examples attached. Functions which are discouraged due to their lack of functionality are expressly not documented
+// here, and you're on your own with these functions. Generally speaking, if the function is not documented here, it is
+// either used by another function documented here, and it hides one of the arguments or return values, or it is lower
+// level logic only intended for advanced use cases.
+//
+// The [New] function is a key function in creating a new instance of a WebAuthn Relying Party which is required to
+// perform most actions.
+//
+// To start the credential creation ceremony, the [WebAuthn.BeginMediatedRegistration] or [WebAuthn.BeginRegistration]
+// functions are used which returns [*SessionData] and a [*protocol.CredentialCreation] struct which can be easily
+// serialized as JSON for the frontend library/logic. The [*SessionData] must be saved in a way which allows the
+// implementer to restore it later. This [*SessionData] should be safely anchored to a user agent without allowing the
+// user agent to modify the contents (i.e. opaque session cookie).
+//
+// To finish the credential creation ceremony, the [WebAuthn.FinishRegistration] function can be used. This function
+// requires a [*http.Request] and performs all the necessary and requested validations. If you have other requirements,
+// you can use [protocol.ParseCredentialCreationResponseBody] or [protocol.ParseCredentialCreationResponseBytes] which
+// require an [io.Reader] or byte array respectively, then use [WebAuthn.CreateCredential] to
+// perform validations against the [*protocol.ParsedCredentialCreationData] and saved [*SessionData] and finalize the
+// process. For complete customizability, just produce the [*protocol.ParsedCredentialCreationData] with a custom parser
+// and provide it to [WebAuthn.CreateCredential].
+//
+// To start a Passkey login ceremony, the [WebAuthn.BeginDiscoverableMediatedLogin] or [WebAuthn.BeginDiscoverableLogin]
+// functions are used which returns [*SessionData] and a [*protocol.CredentialAssertion] struct which can easily be
+// serialized as JSON for the frontend library/logic. The [*SessionData] should be safely handled as previously described.
+//
+// To finish a Passkey login ceremony, the [WebAuthn.FinishPasskeyLogin] function can be used. This function requires a
+// [*http.Request] and performs all the necessary validations. If you have other requirements, you can use the
+// [protocol.ParseCredentialRequestResponseBody] or [protocol.ParseCredentialRequestResponseBytes] which require an
+// [io.Reader] or byte array respectively, then use [WebAuthn.ValidatePasskeyLogin] to perform validations against the
+// [*protocol.ParsedCredentialAssertionData] and saved [*SessionData] and finalize the process. For complete customizabilty,
+// just produce the [protocol.ParsedCredentialAssertionData] with a custom parser and provide it to
+// [WebAuthn.ValidatePasskeyLogin].
+//
+// To start a Multi-Factor login ceremony, the [WebAuthn.BeginMediatedLogin] or [WebAuthn.BeginLogin]
+// functions are used which returns [SessionData] and a [*protocol.CredentialAssertion] struct which can easily be
+// serialized as JSON for the frontend library/logic. The [*SessionData] should be safely handled as previously described.
+//
+// To finish a Multi-Factor login ceremony, the [WebAuthn.FinishLogin] function can be used. This function requires a
+// [*http.Request] and performs all the necessary validations. If you have other requirements, you can use the
+// [protocol.ParseCredentialRequestResponseBody] or [protocol.ParseCredentialRequestResponseBytes] which require an
+// [io.Reader] or byte array respectively, then use [WebAuthn.ValidateLogin] to perform validations against the
+// [*protocol.ParsedCredentialAssertionData] and saved [*SessionData] and finalize the process. For complete customizabilty,
+// just produce the [protocol.ParsedCredentialAssertionData] with a custom parser and provide it to
+// [WebAuthn.ValidateLogin].
+package webauthn

vendor/github.com/go-webauthn/webauthn/webauthn/login.go

@@ -0,0 +1,384 @@
+package webauthn
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// LoginOption is used to provide parameters that modify the default [Credential] Assertion Payload that is sent to the user.
+type LoginOption func(*protocol.PublicKeyCredentialRequestOptions)
+
+// DiscoverableUserHandler returns a [*User] given the provided userHandle.
+type DiscoverableUserHandler func(rawID, userHandle []byte) (user User, err error)
+
+// BeginLogin creates the [*protocol.CredentialAssertion] data payload that should be sent to the user agent for beginning
+// the login/assertion process. This function is used to perform a login when the identity of the user is known such as
+// multifactor authentications, to specify a conditional mediation requirement use [WebAuthn.BeginMediatedLogin], to
+// perform a login when the identity of the user is not known see [WebAuthn.BeginDiscoverableLogin] and
+// [WebAuthn.BeginDiscoverableMediatedLogin] instead. The format of this data can be seen in §5.5 of the WebAuthn
+// specification. These default values can be amended by providing additional [LoginOption] parameters. This function
+// also returns [SessionData], that must be stored by the RP in a secure manner and then provided to the
+// [WebAuthn.FinishLogin] function. This data helps us verify the ownership of the credential being retrieved.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dictionary-assertion-options)
+func (webauthn *WebAuthn) BeginLogin(user User, opts ...LoginOption) (*protocol.CredentialAssertion, *SessionData, error) {
+	return webauthn.BeginMediatedLogin(user, protocol.MediationDefault, opts...)
+}
+
+// BeginDiscoverableLogin creates the [*protocol.CredentialAssertion] data payload that should be sent to the user agent
+// for beginning the login/assertion process. This function is used to perform a client-side discoverable login when the
+// identity of the user is not known such as passwordless or usernameless authentication, to specify a conditional
+// mediation requirement use [WebAuthn.BeginDiscoverableMediatedLogin], to perform logins where the identity of the user
+// is known such as multifactor authentication see [WebAuthn.BeginLogin] and [WebAuthn.BeginMediatedLogin] instead.
+// The format of this data can be seen in §5.5 of the WebAuthn specification. These default values can be amended by
+// providing additional [LoginOption] parameters. This function also returns [SessionData], that
+// must be stored by the RP in a secure manner and then provided to the [WebAuthn.FinishLogin] function. This data helps
+// us verify the ownership of the credential being retrieved.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dictionary-assertion-options)
+func (webauthn *WebAuthn) BeginDiscoverableLogin(opts ...LoginOption) (*protocol.CredentialAssertion, *SessionData, error) {
+	return webauthn.beginLogin(nil, nil, protocol.MediationDefault, opts...)
+}
+
+// BeginMediatedLogin is similar to [WebAuthn.BeginLogin] however it also allows specifying a credential mediation
+// requirement.
+func (webauthn *WebAuthn) BeginMediatedLogin(user User, mediation protocol.CredentialMediationRequirement, opts ...LoginOption) (*protocol.CredentialAssertion, *SessionData, error) {
+	credentials := user.WebAuthnCredentials()
+
+	if len(credentials) == 0 { // If the user does not have any credentials, we cannot perform an assertion.
+		return nil, nil, protocol.ErrBadRequest.WithDetails("Found no credentials for user")
+	}
+
+	var allowedCredentials = make([]protocol.CredentialDescriptor, len(credentials))
+
+	for i, credential := range credentials {
+		allowedCredentials[i] = credential.Descriptor()
+	}
+
+	return webauthn.beginLogin(user.WebAuthnID(), allowedCredentials, mediation, opts...)
+}
+
+// BeginDiscoverableMediatedLogin is similar to [WebAuthn.BeginDiscoverableLogin] however it also allows specifying a
+// credential mediation requirement.
+func (webauthn *WebAuthn) BeginDiscoverableMediatedLogin(mediation protocol.CredentialMediationRequirement, opts ...LoginOption) (*protocol.CredentialAssertion, *SessionData, error) {
+	return webauthn.beginLogin(nil, nil, mediation, opts...)
+}
+
+func (webauthn *WebAuthn) beginLogin(userID []byte, allowedCredentials []protocol.CredentialDescriptor, mediation protocol.CredentialMediationRequirement, opts ...LoginOption) (assertion *protocol.CredentialAssertion, session *SessionData, err error) {
+	if err = webauthn.Config.validate(); err != nil {
+		return nil, nil, fmt.Errorf(errFmtConfigValidate, err)
+	}
+
+	assertion = &protocol.CredentialAssertion{
+		Response: protocol.PublicKeyCredentialRequestOptions{
+			RelyingPartyID:     webauthn.Config.RPID,
+			UserVerification:   webauthn.Config.AuthenticatorSelection.UserVerification,
+			AllowedCredentials: allowedCredentials,
+		},
+		Mediation: mediation,
+	}
+
+	for _, opt := range opts {
+		opt(&assertion.Response)
+	}
+
+	if len(assertion.Response.Challenge) == 0 {
+		var challenge protocol.URLEncodedBase64
+		if challenge, err = protocol.CreateChallenge(); err != nil {
+			return nil, nil, err
+		}
+
+		assertion.Response.Challenge = challenge
+	}
+
+	if len(assertion.Response.Challenge) < 16 {
+		return nil, nil, fmt.Errorf("error generating assertion: the challenge must be at least 16 bytes")
+	}
+
+	if len(assertion.Response.RelyingPartyID) == 0 {
+		return nil, nil, fmt.Errorf("error generating assertion: the relying party id must be provided via the configuration or a functional option for a login")
+	} else if err = protocol.ValidateRPID(assertion.Response.RelyingPartyID); err != nil {
+		return nil, nil, fmt.Errorf("error generating assertion: the relying party id failed to validate as it's not a valid domain string with error: %w", err)
+	}
+
+	if assertion.Response.Timeout == 0 {
+		switch assertion.Response.UserVerification {
+		case protocol.VerificationDiscouraged:
+			assertion.Response.Timeout = int(webauthn.Config.Timeouts.Login.TimeoutUVD.Milliseconds())
+		default:
+			assertion.Response.Timeout = int(webauthn.Config.Timeouts.Login.Timeout.Milliseconds())
+		}
+	}
+
+	session = &SessionData{
+		Challenge:            assertion.Response.Challenge.String(),
+		RelyingPartyID:       assertion.Response.RelyingPartyID,
+		UserID:               userID,
+		AllowedCredentialIDs: assertion.Response.GetAllowedCredentialIDs(),
+		UserVerification:     assertion.Response.UserVerification,
+		Extensions:           assertion.Response.Extensions,
+	}
+
+	if webauthn.Config.Timeouts.Login.Enforce {
+		session.Expires = time.Now().Add(time.Millisecond * time.Duration(assertion.Response.Timeout))
+	}
+
+	return assertion, session, nil
+}
+
+// FinishLogin takes the response from the client and validates it against the user credentials and stored session data.
+//
+// As with all Finish functions, this function requires a [*http.Request] but you can perform the same steps with the
+// [protocol.ParseCredentialRequestResponseBody] or [protocol.ParseCredentialRequestResponseBytes] which require an
+// [io.Reader] or byte array respectively, you can also use an arbitrary [*protocol.ParsedCredentialAssertionData] which is
+// returned from all of these functions i.e. by implementing a custom parser. The [*SessionData],
+// and [*protocol.ParsedCredentialAssertionData] can then be used with the [WebAuthn.ValidateLogin] function.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] provided does not contain
+// a [Credential] with the same ID byte array provided all [Credential]'s in the [SessionData] exist in the [User]'s
+// [Credential] list.
+func (webauthn *WebAuthn) FinishLogin(user User, session SessionData, response *http.Request) (credential *Credential, err error) {
+	var parsedResponse *protocol.ParsedCredentialAssertionData
+
+	if parsedResponse, err = protocol.ParseCredentialRequestResponse(response); err != nil {
+		return nil, err
+	}
+
+	return webauthn.ValidateLogin(user, session, parsedResponse)
+}
+
+// FinishDiscoverableLogin takes the response from the client and validates it against the handler and stored session data.
+// The handler helps to find out which user must be used to validate the response. This is a function defined in your
+// business code that will retrieve the user from your persistent data.
+//
+// As with all Finish functions, this function requires a [*http.Request] but you can perform the same steps with the
+// [protocol.ParseCredentialRequestResponseBody] or [protocol.ParseCredentialRequestResponseBytes] which require an
+// [io.Reader] or byte array respectively, you can also use an arbitrary [*protocol.ParsedCredentialAssertionData] which is
+// returned from all of these functions i.e. by implementing a custom parser. The [DiscoverableUserHandler], [*SessionData],
+// and [*protocol.ParsedCredentialAssertionData] can then be used with the [WebAuthn.ValidatePasskeyLogin] function.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] returned by the
+// handler does not contain a [Credential] with the same ID byte array provided all [Credential]'s
+// in the [SessionData] exist in the [User]'s [Credential] list.
+func (webauthn *WebAuthn) FinishDiscoverableLogin(handler DiscoverableUserHandler, session SessionData, response *http.Request) (credential *Credential, err error) {
+	var parsedResponse *protocol.ParsedCredentialAssertionData
+
+	if parsedResponse, err = protocol.ParseCredentialRequestResponse(response); err != nil {
+		return nil, err
+	}
+
+	return webauthn.ValidateDiscoverableLogin(handler, session, parsedResponse)
+}
+
+// FinishPasskeyLogin takes the response from the client and validate it against the handler and stored session data.
+// The handler helps to find out which user must be used to validate the response. This is a function defined in your
+// business code that will retrieve the user from your persistent data.
+//
+// As with all Finish functions this function requires a [*http.Request] but you can perform the same steps with the
+// [protocol.ParseCredentialRequestResponseBody] or [protocol.ParseCredentialRequestResponseBytes] which require an
+// io.Reader or byte array respectively, you can also use an arbitrary [*protocol.ParsedCredentialAssertionData] which is
+// returned from all of these functions i.e. by implementing a custom parser. The [DiscoverableUserHandler], [*SessionData],
+// and [*protocol.ParsedCredentialAssertionData] can then be used with the [WebAuthn.ValidatePasskeyLogin] function.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] returned by the
+// handler does not contain a [Credential] with the same ID byte array provided all [Credential]'s
+// in the [SessionData] exist in the [User]'s [Credential] list.
+func (webauthn *WebAuthn) FinishPasskeyLogin(handler DiscoverableUserHandler, session SessionData, response *http.Request) (user User, credential *Credential, err error) {
+	var parsedResponse *protocol.ParsedCredentialAssertionData
+
+	if parsedResponse, err = protocol.ParseCredentialRequestResponse(response); err != nil {
+		return nil, nil, err
+	}
+
+	return webauthn.ValidatePasskeyLogin(handler, session, parsedResponse)
+}
+
+// ValidateLogin takes a parsed response and validates it against the user credentials and session data.
+//
+// If you wish to skip performing the step required to parse the *protocol.ParsedCredentialAssertionData and
+// you're using net/http then you can use [WebAuthn.FinishLogin] instead.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] provided does not contain
+// a [Credential] with the same ID byte array provided all [Credential]'s in the [SessionData] exist in
+// the [User]'s [Credential] list.
+func (webauthn *WebAuthn) ValidateLogin(user User, session SessionData, parsedResponse *protocol.ParsedCredentialAssertionData) (credential *Credential, err error) {
+	if !bytes.Equal(user.WebAuthnID(), session.UserID) {
+		return nil, protocol.ErrBadRequest.WithDetails("ID mismatch for User and Session")
+	}
+
+	if !session.Expires.IsZero() && session.Expires.Before(time.Now()) {
+		return nil, protocol.ErrBadRequest.WithDetails("Session has Expired")
+	}
+
+	return webauthn.validateLogin(user, session, parsedResponse)
+}
+
+// ValidateDiscoverableLogin is similar to [WebAuthn.ValidateLogin] that allows for discoverable credentials. It's
+// recommended that [WebAuthn.ValidatePasskeyLogin] is used instead.
+//
+// If you wish to skip performing the step required to parse the [*protocol.ParsedCredentialAssertionData] and
+// you're using net/http then you can use [WebAuthn.FinishDiscoverableLogin] instead.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] returned by the
+// handler does not contain a [Credential] with the same ID byte array provided all [Credential]'s
+// in the [SessionData] exist in the [User]'s [Credential] list.
+//
+// Note: this is just a backwards compatibility layer over [WebAuthn.ValidatePasskeyLogin] which returns more information.
+func (webauthn *WebAuthn) ValidateDiscoverableLogin(handler DiscoverableUserHandler, session SessionData, parsedResponse *protocol.ParsedCredentialAssertionData) (credential *Credential, err error) {
+	_, credential, err = webauthn.ValidatePasskeyLogin(handler, session, parsedResponse)
+
+	return credential, err
+}
+
+// ValidatePasskeyLogin is similar to [WebAuthn.ValidateLogin] that allows for discoverable credentials.
+//
+// If you wish to skip performing the step required to parse the [*protocol.ParsedCredentialAssertionData] and
+// you're using net/http then you can use [WebAuthn.FinishPasskeyLogin] instead.
+//
+// This function will return the [protocol.ErrorUnknownCredential] error type when the [User] returned by the
+// handler does not contain a [Credential] with the same ID byte array provided all [Credential]'s
+// in the [SessionData] exist in the [User]'s [Credential] list.
+func (webauthn *WebAuthn) ValidatePasskeyLogin(handler DiscoverableUserHandler, session SessionData, parsedResponse *protocol.ParsedCredentialAssertionData) (user User, credential *Credential, err error) {
+	if len(session.UserID) != 0 {
+		return nil, nil, protocol.ErrBadRequest.WithDetails("Session was not initiated as a client-side discoverable login")
+	}
+
+	if !session.Expires.IsZero() && session.Expires.Before(time.Now()) {
+		return nil, nil, protocol.ErrBadRequest.WithDetails("Session has Expired")
+	}
+
+	if len(parsedResponse.Response.UserHandle) == 0 {
+		return nil, nil, protocol.ErrBadRequest.WithDetails("Client-side Discoverable Assertion was attempted with a blank User Handle")
+	}
+
+	if user, err = handler(parsedResponse.RawID, parsedResponse.Response.UserHandle); err != nil {
+		return nil, nil, protocol.ErrBadRequest.WithDetails(fmt.Sprintf("Failed to lookup Client-side Discoverable Credential: %s", err)).WithError(err)
+	}
+
+	if credential, err = webauthn.validateLogin(user, session, parsedResponse); err != nil {
+		return nil, nil, err
+	}
+
+	return user, credential, nil
+}
+
+// validateLogin takes a parsed response and validates it against the user credentials and session data.
+func (webauthn *WebAuthn) validateLogin(user User, session SessionData, parsedResponse *protocol.ParsedCredentialAssertionData) (*Credential, error) {
+	// Step 1. If the allowCredentials option was given when this authentication ceremony was initiated,
+	// verify that credential.id identifies one of the public key credentials that were listed in
+	// allowCredentials.
+
+	// NON-NORMATIVE Prior Step: Verify that the allowCredentials for the session are owned by the user provided.
+	credentials := user.WebAuthnCredentials()
+
+	if len(session.AllowedCredentialIDs) > 0 {
+		if !isCredentialsAllowedMatchingOwned(session.AllowedCredentialIDs, credentials) {
+			return nil, protocol.ErrBadRequest.WithDetails("User does not own all credentials from the allowed credential list")
+		}
+
+		if !isCredentialIDInCredentials(parsedResponse.RawID, credentials) {
+			return nil, &protocol.ErrorUnknownCredential{Err: protocol.ErrBadRequest.WithDetails("The credential ID provided is not owned by the user")}
+		}
+
+		if !isByteArrayInSlice(parsedResponse.RawID, session.AllowedCredentialIDs...) {
+			return nil, protocol.ErrBadRequest.WithDetails("The credential ID provided is not in the sessions allowed credential list")
+		}
+	}
+
+	// Step 2. If credential.response.userHandle is present, verify that the user identified by this value is
+	// the owner of the public key credential identified by credential.id.
+
+	// This is in part handled by our Step 1.
+
+	userHandle := parsedResponse.Response.UserHandle
+	if len(userHandle) > 0 {
+		if !bytes.Equal(userHandle, user.WebAuthnID()) {
+			return nil, protocol.ErrBadRequest.WithDetails("User handle and User ID do not match")
+		}
+	}
+
+	var (
+		found      bool
+		credential Credential
+	)
+
+	// Step 3. Using credential’s id attribute (or the corresponding rawId, if base64url encoding is inappropriate
+	// for your use case), look up the corresponding credential public key.
+	for _, credential = range credentials {
+		if bytes.Equal(credential.ID, parsedResponse.RawID) {
+			found = true
+
+			break
+		}
+
+		found = false
+	}
+
+	if !found {
+		return nil, protocol.ErrBadRequest.WithDetails("Unable to find the credential for the returned credential ID")
+	}
+
+	var (
+		appID string
+		err   error
+	)
+
+	// Ensure authenticators with a bad status are not used.
+	if webauthn.Config.MDS != nil {
+		var aaguid uuid.UUID
+
+		if len(credential.Authenticator.AAGUID) == 0 {
+			aaguid = uuid.Nil
+		} else if aaguid, err = uuid.FromBytes(credential.Authenticator.AAGUID); err != nil {
+			return nil, protocol.ErrBadRequest.WithDetails("Failed to decode AAGUID").WithInfo(fmt.Sprintf("Error occurred decoding AAGUID from the credential record: %s", err)).WithError(err)
+		}
+
+		if e := protocol.ValidateMetadata(context.Background(), webauthn.Config.MDS, aaguid, "", credential.AttestationType, nil); e != nil {
+			return nil, protocol.ErrBadRequest.WithDetails("Failed to validate credential record metadata").WithInfo(e.DevInfo).WithError(e)
+		}
+	}
+
+	shouldVerifyUser := session.UserVerification == protocol.VerificationRequired
+	shouldVerifyUserPresence := true
+
+	rpID := webauthn.Config.RPID
+	rpOrigins := webauthn.Config.RPOrigins
+	rpTopOrigins := webauthn.Config.RPTopOrigins
+
+	if appID, err = parsedResponse.GetAppID(session.Extensions, credential.AttestationType); err != nil {
+		return nil, err
+	}
+
+	// Handle steps 4 through 16.
+	if err = parsedResponse.Verify(session.Challenge, rpID, rpOrigins, rpTopOrigins, webauthn.Config.RPTopOriginVerificationMode, appID, shouldVerifyUser, shouldVerifyUserPresence, credential.PublicKey); err != nil {
+		return nil, err
+	}
+
+	// Check if the BackupEligible flag has changed.
+	if credential.Flags.BackupEligible != parsedResponse.Response.AuthenticatorData.Flags.HasBackupEligible() {
+		return nil, protocol.ErrBadRequest.WithDetails("Backup Eligible flag inconsistency detected during login validation")
+	}
+
+	// Check for the invalid combination BE=0 and BS=1.
+	if !parsedResponse.Response.AuthenticatorData.Flags.HasBackupEligible() && parsedResponse.Response.AuthenticatorData.Flags.HasBackupState() {
+		return nil, protocol.ErrBadRequest.WithDetails("Backup State Flag is true but Backup Eligible flag is false which is invalid")
+	}
+
+	// Handle step 17.
+	credential.Authenticator.UpdateCounter(parsedResponse.Response.AuthenticatorData.Counter)
+
+	// Update flags from response data.
+	credential.Flags.UserPresent = parsedResponse.Response.AuthenticatorData.Flags.HasUserPresent()
+	credential.Flags.UserVerified = parsedResponse.Response.AuthenticatorData.Flags.HasUserVerified()
+	credential.Flags.BackupEligible = parsedResponse.Response.AuthenticatorData.Flags.HasBackupEligible()
+	credential.Flags.BackupState = parsedResponse.Response.AuthenticatorData.Flags.HasBackupState()
+
+	return &credential, nil
+}

vendor/github.com/go-webauthn/webauthn/webauthn/login_opt.go

@@ -0,0 +1,88 @@
+package webauthn
+
+import "github.com/go-webauthn/webauthn/protocol"
+
+// WithChallenge overrides the default random challenge with a user supplied value.
+// In order to prevent replay attacks, the challenges MUST contain enough entropy to make guessing them infeasible.
+// Challenges SHOULD therefore be at least 16 bytes long.
+// This function is EXPERIMENTAL and can be removed without warning.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-challenge)
+//
+// Specification: §13.4.3. Cryptographic Challenges (https://www.w3.org/TR/webauthn/#sctn-cryptographic-challenges)
+func WithChallenge(challenge []byte) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.Challenge = challenge
+	}
+}
+
+// WithLoginRelyingPartyID sets the Relying Party ID for this particular login.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-rpid)
+func WithLoginRelyingPartyID(id string) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.RelyingPartyID = id
+	}
+}
+
+// WithAllowedCredentials adjusts the allowed credentials via a slice of [protocol.CredentialDescriptor] values,
+// discussed in the included specification sections with user-supplied values.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-allowcredentials)
+//
+// Specification: §5.10.3. Credential Descriptor (https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialdescriptor)
+func WithAllowedCredentials(allowList []protocol.CredentialDescriptor) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.AllowedCredentials = allowList
+	}
+}
+
+// WithUserVerification adjusts the user verification preference by providing a [protocol.UserVerificationRequirement].
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-userverification)
+func WithUserVerification(userVerification protocol.UserVerificationRequirement) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.UserVerification = userVerification
+	}
+}
+
+// WithAssertionPublicKeyCredentialHints adjusts the non-default hints for credential types to select during login by
+// providing a slice of [protocol.PublicKeyCredentialHints].
+//
+// WebAuthn Level 3.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialrequestoptions-hints)
+func WithAssertionPublicKeyCredentialHints(hints []protocol.PublicKeyCredentialHints) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.Hints = hints
+	}
+}
+
+// WithAssertionExtensions adjusts the requested extensions by providing a [protocol.AuthenticationExtensions].
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-extensions)
+func WithAssertionExtensions(extensions protocol.AuthenticationExtensions) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		cco.Extensions = extensions
+	}
+}
+
+// WithAppIdExtension automatically includes the specified appid if the AllowedCredentials contains a credential
+// with the type `fido-u2f`.
+//
+// Specification: §5.5. Options for Assertion Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialrequestoptions-extensions)
+func WithAppIdExtension(appid string) LoginOption {
+	return func(cco *protocol.PublicKeyCredentialRequestOptions) {
+		for _, credential := range cco.AllowedCredentials {
+			if credential.AttestationType == protocol.CredentialTypeFIDOU2F {
+				if cco.Extensions == nil {
+					cco.Extensions = map[string]any{}
+				}
+
+				cco.Extensions[protocol.ExtensionAppID] = appid
+
+				break
+			}
+		}
+	}
+}

vendor/github.com/go-webauthn/webauthn/webauthn/registration.go

@@ -0,0 +1,150 @@
+package webauthn
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// RegistrationOption describes a function which modifies the registration
+// [*protocol.PublicKeyCredentialCreationOptions] values.
+type RegistrationOption func(*protocol.PublicKeyCredentialCreationOptions)
+
+// BeginRegistration generates a new set of registration data to be sent to the client and authenticator. To set a
+// conditional mediation requirement for the registration see [WebAuthn.BeginMediatedRegistration].
+func (webauthn *WebAuthn) BeginRegistration(user User, opts ...RegistrationOption) (creation *protocol.CredentialCreation, session *SessionData, err error) {
+	return webauthn.BeginMediatedRegistration(user, protocol.MediationDefault, opts...)
+}
+
+// BeginMediatedRegistration is similar to [WebAuthn.BeginRegistration] however it also allows specifying a credential
+// mediation requirement.
+func (webauthn *WebAuthn) BeginMediatedRegistration(user User, mediation protocol.CredentialMediationRequirement, opts ...RegistrationOption) (creation *protocol.CredentialCreation, session *SessionData, err error) {
+	if err = webauthn.Config.validate(); err != nil {
+		return nil, nil, fmt.Errorf(errFmtConfigValidate, err)
+	}
+
+	challenge, err := protocol.CreateChallenge()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var entityUserID any
+
+	if webauthn.Config.EncodeUserIDAsString {
+		entityUserID = string(user.WebAuthnID())
+	} else {
+		entityUserID = protocol.URLEncodedBase64(user.WebAuthnID())
+	}
+
+	entityUser := protocol.UserEntity{
+		ID:          entityUserID,
+		DisplayName: user.WebAuthnDisplayName(),
+		CredentialEntity: protocol.CredentialEntity{
+			Name: user.WebAuthnName(),
+		},
+	}
+
+	entityRelyingParty := protocol.RelyingPartyEntity{
+		ID: webauthn.Config.RPID,
+		CredentialEntity: protocol.CredentialEntity{
+			Name: webauthn.Config.RPDisplayName,
+		},
+	}
+
+	credentialParams := CredentialParametersDefault()
+
+	creation = &protocol.CredentialCreation{
+		Response: protocol.PublicKeyCredentialCreationOptions{
+			RelyingParty:           entityRelyingParty,
+			User:                   entityUser,
+			Challenge:              challenge,
+			Parameters:             credentialParams,
+			AuthenticatorSelection: webauthn.Config.AuthenticatorSelection,
+			Attestation:            webauthn.Config.AttestationPreference,
+		},
+		Mediation: mediation,
+	}
+
+	for _, opt := range opts {
+		opt(&creation.Response)
+	}
+
+	if len(creation.Response.RelyingParty.ID) == 0 {
+		return nil, nil, fmt.Errorf("error generating credential creation: the relying party id must be provided via the configuration or a functional option for a creation")
+	} else if err = protocol.ValidateRPID(creation.Response.RelyingParty.ID); err != nil {
+		return nil, nil, fmt.Errorf("error generating credential creation: the relying party id failed to validate as it's not a valid domain string with error: %w", err)
+	}
+
+	if len(creation.Response.RelyingParty.Name) == 0 {
+		return nil, nil, fmt.Errorf("error generating credential creation: the relying party display name must be provided via the configuration or a functional option for a creation")
+	}
+
+	if creation.Response.Timeout == 0 {
+		switch creation.Response.AuthenticatorSelection.UserVerification {
+		case protocol.VerificationDiscouraged:
+			creation.Response.Timeout = int(webauthn.Config.Timeouts.Registration.TimeoutUVD.Milliseconds())
+		default:
+			creation.Response.Timeout = int(webauthn.Config.Timeouts.Registration.Timeout.Milliseconds())
+		}
+	}
+
+	session = &SessionData{
+		Challenge:        challenge.String(),
+		RelyingPartyID:   creation.Response.RelyingParty.ID,
+		UserID:           user.WebAuthnID(),
+		UserVerification: creation.Response.AuthenticatorSelection.UserVerification,
+		CredParams:       creation.Response.Parameters,
+		Mediation:        creation.Mediation,
+	}
+
+	if webauthn.Config.Timeouts.Registration.Enforce {
+		session.Expires = time.Now().Add(time.Millisecond * time.Duration(creation.Response.Timeout))
+	}
+
+	return creation, session, nil
+}
+
+// FinishRegistration takes the response from the authenticator and client and verify the credential against the user's
+// credentials and session data.
+//
+// As with all Finish functions this function requires a [*http.Request] but you can perform the same steps with the
+// [protocol.ParseCredentialCreationResponseBody] or [protocol.ParseCredentialCreationResponseBytes] which require an
+// [io.Reader] or byte array respectively, you can also use an arbitrary [*protocol.ParsedCredentialCreationData] which is
+// returned from all of these functions i.e. by implementing a custom parser. The [User], [*SessionData], and
+// [*protocol.ParsedCredentialCreationData] can then be used with the [WebAuthn.CreateCredential] function.
+func (webauthn *WebAuthn) FinishRegistration(user User, session SessionData, request *http.Request) (credential *Credential, err error) {
+	parsedResponse, err := protocol.ParseCredentialCreationResponse(request)
+	if err != nil {
+		return nil, err
+	}
+
+	return webauthn.CreateCredential(user, session, parsedResponse)
+}
+
+// CreateCredential verifies a parsed response against the user's credentials and session data.
+//
+// If you wish to skip performing the step required to parse the [*protocol.ParsedCredentialCreationData] and
+// you're using net/http then you can use [WebAuthn.FinishRegistration] instead.
+func (webauthn *WebAuthn) CreateCredential(user User, session SessionData, parsedResponse *protocol.ParsedCredentialCreationData) (credential *Credential, err error) {
+	if !bytes.Equal(user.WebAuthnID(), session.UserID) {
+		return nil, protocol.ErrBadRequest.WithDetails("ID mismatch for User and Session")
+	}
+
+	if !session.Expires.IsZero() && session.Expires.Before(time.Now()) {
+		return nil, protocol.ErrBadRequest.WithDetails("Session has Expired")
+	}
+
+	shouldVerifyUser := session.UserVerification == protocol.VerificationRequired
+	shouldVerifyUserPresence := session.Mediation != protocol.MediationConditional
+
+	var clientDataHash []byte
+
+	if clientDataHash, err = parsedResponse.Verify(session.Challenge, shouldVerifyUser, shouldVerifyUserPresence, webauthn.Config.RPID, webauthn.Config.RPOrigins, webauthn.Config.RPTopOrigins, webauthn.Config.RPTopOriginVerificationMode, webauthn.Config.MDS, session.CredParams); err != nil {
+		return nil, err
+	}
+
+	return NewCredential(clientDataHash, parsedResponse)
+}

vendor/github.com/go-webauthn/webauthn/webauthn/registration_credential_parameters.go

@@ -0,0 +1,117 @@
+package webauthn
+
+import (
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// CredentialParametersDefault is the default [protocol.CredentialParameter] list.
+func CredentialParametersDefault() []protocol.CredentialParameter {
+	return []protocol.CredentialParameter{
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES512,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS512,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS512,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgEdDSA,
+		},
+	}
+}
+
+// CredentialParametersRecommendedL3 is explicitly the Level 3 recommended [protocol.CredentialParameter] list.
+func CredentialParametersRecommendedL3() []protocol.CredentialParameter {
+	return []protocol.CredentialParameter{
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgEdDSA,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS256,
+		},
+	}
+}
+
+// CredentialParametersExtendedL3 is the Level 3 recommended [protocol.CredentialParameter] list with all of the other
+// parameters supported by the library.
+func CredentialParametersExtendedL3() []protocol.CredentialParameter {
+	return []protocol.CredentialParameter{
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgEdDSA,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgES512,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgRS512,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS256,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS384,
+		},
+		{
+			Type:      protocol.PublicKeyCredentialType,
+			Algorithm: webauthncose.AlgPS512,
+		},
+	}
+}

vendor/github.com/go-webauthn/webauthn/webauthn/registration_opt.go

@@ -0,0 +1,132 @@
+package webauthn
+
+import "github.com/go-webauthn/webauthn/protocol"
+
+// WithCredentialParameters adjusts the credential parameters in the registration options.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams)
+func WithCredentialParameters(credentialParams []protocol.CredentialParameter) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.Parameters = credentialParams
+	}
+}
+
+// WithExclusions adjusts the non-default parameters regarding credentials to exclude from registration.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-excludecredentials)
+func WithExclusions(excludeList []protocol.CredentialDescriptor) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.CredentialExcludeList = excludeList
+	}
+}
+
+// WithAuthenticatorSelection adjusts the non-default parameters regarding the authenticator to select during
+// registration.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-authenticatorselection)
+//
+// Specification: §5.4.4. Authenticator Selection Criteria (https://www.w3.org/TR/webauthn/#dictdef-authenticatorselectioncriteria)
+func WithAuthenticatorSelection(authenticatorSelection protocol.AuthenticatorSelection) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.AuthenticatorSelection = authenticatorSelection
+	}
+}
+
+// WithResidentKeyRequirement sets both the resident key and require resident key protocol options.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-authenticatorselection)
+//
+// Specification: §5.4.4. Authenticator Selection Criteria (https://www.w3.org/TR/webauthn/#dictdef-authenticatorselectioncriteria)
+func WithResidentKeyRequirement(requirement protocol.ResidentKeyRequirement) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.AuthenticatorSelection.ResidentKey = requirement
+
+		switch requirement {
+		case protocol.ResidentKeyRequirementRequired:
+			cco.AuthenticatorSelection.RequireResidentKey = protocol.ResidentKeyRequired()
+		default:
+			cco.AuthenticatorSelection.RequireResidentKey = protocol.ResidentKeyNotRequired()
+		}
+	}
+}
+
+// WithPublicKeyCredentialHints adjusts the non-default hints for credential types to select during registration.
+//
+// WebAuthn Level 3.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialcreationoptions-hints)
+func WithPublicKeyCredentialHints(hints []protocol.PublicKeyCredentialHints) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.Hints = hints
+	}
+}
+
+// WithConveyancePreference adjusts the non-default parameters regarding whether the authenticator should attest to the
+// credential.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-attestation)
+func WithConveyancePreference(preference protocol.ConveyancePreference) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.Attestation = preference
+	}
+}
+
+// WithAttestationFormats adjusts the non-default formats for credential types to select during registration.
+//
+// WebAuthn Level 3.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialcreationoptions-attestationformats)
+func WithAttestationFormats(formats []protocol.AttestationFormat) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.AttestationFormats = formats
+	}
+}
+
+// WithExtensions adjusts the extension parameter in the registration options.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialcreationoptions-extensions)
+//
+// Specification: §9. Extensions (https://www.w3.org/TR/webauthn/#webauthn-extensions)
+func WithExtensions(extension protocol.AuthenticationExtensions) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.Extensions = extension
+	}
+}
+
+// WithAppIdExcludeExtension automatically includes the specified appid if the CredentialExcludeList contains a credential
+// with the type `fido-u2f`.
+//
+// Specification: §5.4. Parameters for Credential Generation (https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialcreationoptions-extensions)
+//
+// Specification: §9. Extensions (https://www.w3.org/TR/webauthn/#webauthn-extensions)
+//
+// Specification: §10.1.2. FIDO AppID Exclusion Extension (https://www.w3.org/TR/webauthn/#sctn-appid-exclude-extension)
+func WithAppIdExcludeExtension(appid string) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		for _, credential := range cco.CredentialExcludeList {
+			if credential.AttestationType == protocol.CredentialTypeFIDOU2F {
+				if cco.Extensions == nil {
+					cco.Extensions = map[string]any{}
+				}
+
+				cco.Extensions[protocol.ExtensionAppIDExclude] = appid
+
+				break
+			}
+		}
+	}
+}
+
+// WithRegistrationRelyingPartyID sets the relying party id for the registration.
+func WithRegistrationRelyingPartyID(id string) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.RelyingParty.ID = id
+	}
+}
+
+// WithRegistrationRelyingPartyName sets the relying party name for the registration.
+func WithRegistrationRelyingPartyName(name string) RegistrationOption {
+	return func(cco *protocol.PublicKeyCredentialCreationOptions) {
+		cco.RelyingParty.Name = name
+	}
+}

vendor/github.com/go-webauthn/webauthn/webauthn/types.go

@@ -0,0 +1,215 @@
+package webauthn
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/go-webauthn/webauthn/metadata"
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// New creates a new WebAuthn object given the proper Config.
+func New(config *Config) (*WebAuthn, error) {
+	if err := config.validate(); err != nil {
+		return nil, fmt.Errorf(errFmtConfigValidate, err)
+	}
+
+	return &WebAuthn{
+		config,
+	}, nil
+}
+
+// WebAuthn is the primary interface of this package and contains the request handlers that should be called.
+type WebAuthn struct {
+	Config *Config
+}
+
+// Config represents the WebAuthn configuration.
+type Config struct {
+	// RPID configures the Relying Party Server ID. This should generally be the origin without a scheme and port.
+	RPID string
+
+	// RPDisplayName configures the display name for the Relying Party Server. This can be any string.
+	RPDisplayName string
+
+	// RPOrigins configures the list of Relying Party Server Origins that are permitted. The provided origins can either
+	// be fully qualified origins or strings for simple string comparison. The strings are matched using canonical
+	// origin matching semantics specifically if they start with 'http://' or 'https://' if the provided origin has a
+	// case-insensitive equal scheme and host component they are equal, otherwise simple string comparison is utilized
+	// to determine equality.
+	RPOrigins []string
+
+	// RPTopOrigins configures the list of Relying Party Server Top Origins that are permitted. The provided origins can
+	// either be fully qualified origins or strings for simple string comparison. The strings are matched using
+	// canonical origin matching semantics specifically if they start with 'http://' or 'https://' if the provided
+	// origin has a case-insensitive equal scheme and host component they are equal, otherwise simple string comparison
+	// is utilized to determine equality.
+	RPTopOrigins []string
+
+	// RPTopOriginVerificationMode determines the verification mode for the Top Origin value. By default the
+	// TopOriginIgnoreVerificationMode is used however this is going to change at such a time as WebAuthn Level 3
+	// becomes recommended, implementers should explicitly set this value if they want stability.
+	RPTopOriginVerificationMode protocol.TopOriginVerificationMode
+
+	// AttestationPreference sets the default attestation conveyance preferences.
+	AttestationPreference protocol.ConveyancePreference
+
+	// AuthenticatorSelection sets the default authenticator selection options.
+	AuthenticatorSelection protocol.AuthenticatorSelection
+
+	// Debug enables various debug options.
+	Debug bool
+
+	// EncodeUserIDAsString ensures the user.id value during registrations is encoded as a raw UTF8 string. This is
+	// useful when you only use printable ASCII characters for the random user.id but the browser library does not
+	// decode the URL Safe Base64 data.
+	EncodeUserIDAsString bool
+
+	// Timeouts configures various timeouts.
+	Timeouts TimeoutsConfig
+
+	// MDS is a metadata.Provider and enables various metadata validations if configured.
+	MDS metadata.Provider
+
+	validated bool
+}
+
+// TimeoutsConfig represents the WebAuthn timeouts configuration.
+type TimeoutsConfig struct {
+	Login        TimeoutConfig
+	Registration TimeoutConfig
+}
+
+// TimeoutConfig represents the WebAuthn timeouts configuration for either registration or login..
+type TimeoutConfig struct {
+	// Enforce the timeouts at the Relying Party / Server. This means if enabled and the user takes too long that even
+	// if the browser does not enforce the timeout the Relying Party / Server will.
+	Enforce bool
+
+	// Timeout is the timeout for logins/registrations when the UserVerificationRequirement is set to anything other
+	// than discouraged.
+	Timeout time.Duration
+
+	// TimeoutUVD is the timeout for logins/registrations when the UserVerificationRequirement is set to discouraged.
+	TimeoutUVD time.Duration
+}
+
+// Validate that the config flags in Config are properly set.
+func (config *Config) validate() (err error) {
+	if config.validated {
+		return nil
+	}
+
+	if len(config.RPID) != 0 {
+		if err = protocol.ValidateRPID(config.RPID); err != nil {
+			return fmt.Errorf(errFmtFieldNotValidDomainString, "RPID", err)
+		}
+	}
+
+	defaultTimeoutConfig := defaultTimeout
+	defaultTimeoutUVDConfig := defaultTimeoutUVD
+
+	if config.Timeouts.Login.Timeout.Milliseconds() == 0 {
+		config.Timeouts.Login.Timeout = defaultTimeoutConfig
+	}
+
+	if config.Timeouts.Login.TimeoutUVD.Milliseconds() == 0 {
+		config.Timeouts.Login.TimeoutUVD = defaultTimeoutUVDConfig
+	}
+
+	if config.Timeouts.Registration.Timeout.Milliseconds() == 0 {
+		config.Timeouts.Registration.Timeout = defaultTimeoutConfig
+	}
+
+	if config.Timeouts.Registration.TimeoutUVD.Milliseconds() == 0 {
+		config.Timeouts.Registration.TimeoutUVD = defaultTimeoutUVDConfig
+	}
+
+	if len(config.RPOrigins) == 0 {
+		return fmt.Errorf("must provide at least one value to the 'RPOrigins' field")
+	}
+
+	if config.RPTopOriginVerificationMode == protocol.TopOriginDefaultVerificationMode {
+		config.RPTopOriginVerificationMode = protocol.TopOriginIgnoreVerificationMode
+	}
+
+	config.validated = true
+
+	return nil
+}
+
+func (c *Config) GetRPID() string {
+	return c.RPID
+}
+
+func (c *Config) GetOrigins() []string {
+	return c.RPOrigins
+}
+
+func (c *Config) GetTopOrigins() []string {
+	return c.RPTopOrigins
+}
+
+func (c *Config) GetTopOriginVerificationMode() protocol.TopOriginVerificationMode {
+	return c.RPTopOriginVerificationMode
+}
+
+func (c *Config) GetMetaDataProvider() metadata.Provider {
+	return c.MDS
+}
+
+type ConfigProvider interface {
+	GetRPID() string
+	GetOrigins() []string
+	GetTopOrigins() []string
+	GetTopOriginVerificationMode() protocol.TopOriginVerificationMode
+	GetMetaDataProvider() metadata.Provider
+}
+
+// User is an interface with the Relying Party's User entry and provides the fields and methods needed for WebAuthn
+// registration operations.
+type User interface {
+	// WebAuthnID provides the user handle of the user account. A user handle is an opaque byte sequence with a maximum
+	// size of 64 bytes, and is not meant to be displayed to the user.
+	//
+	// To ensure secure operation, authentication and authorization decisions MUST be made on the basis of this id
+	// member, not the displayName nor name members. See Section 6.1 of [RFC8266].
+	//
+	// It's recommended this value is completely random and uses the entire 64 bytes.
+	//
+	// Specification: §5.4.3. User Account Parameters for Credential Generation (https://w3c.github.io/webauthn/#dom-publickeycredentialuserentity-id)
+	WebAuthnID() []byte
+
+	// WebAuthnName provides the name attribute of the user account during registration and is a human-palatable name
+	// for the user account, intended only for display. For example, "Alex Müller" or "田中倫". The Relying Party SHOULD
+	// let the user choose this, and SHOULD NOT restrict the choice more than necessary.
+	//
+	// Specification: §5.4.3. User Account Parameters for Credential Generation (https://w3c.github.io/webauthn/#dictdef-publickeycredentialuserentity)
+	WebAuthnName() string
+
+	// WebAuthnDisplayName provides the name attribute of the user account during registration and is a human-palatable
+	// name for the user account, intended only for display. For example, "Alex Müller" or "田中倫". The Relying Party
+	// SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.
+	//
+	// Specification: §5.4.3. User Account Parameters for Credential Generation (https://www.w3.org/TR/webauthn/#dom-publickeycredentialuserentity-displayname)
+	WebAuthnDisplayName() string
+
+	// WebAuthnCredentials provides the slice of [Credential] objects owned by the user. This generally should be all
+	// the [Credential] objects owned by the user regardless of which flow is being used.
+	WebAuthnCredentials() []Credential
+}
+
+// SessionData is the data that should be stored by the Relying Party for the duration of the web authentication
+// ceremony.
+type SessionData struct {
+	Challenge            string    `json:"challenge"`
+	RelyingPartyID       string    `json:"rpId"`
+	UserID               []byte    `json:"user_id"`
+	AllowedCredentialIDs [][]byte  `json:"allowed_credentials,omitempty"`
+	Expires              time.Time `json:"expires"`
+
+	UserVerification protocol.UserVerificationRequirement    `json:"userVerification"`
+	Extensions       protocol.AuthenticationExtensions       `json:"extensions,omitempty"`
+	CredParams       []protocol.CredentialParameter          `json:"credParams,omitempty"`
+	Mediation        protocol.CredentialMediationRequirement `json:"mediation,omitempty"`
+}

vendor/github.com/go-webauthn/webauthn/webauthn/util.go

@@ -0,0 +1,40 @@
+package webauthn
+
+import "bytes"
+
+func isByteArrayInSlice(needle []byte, haystack ...[]byte) (valid bool) {
+	for _, hay := range haystack {
+		if bytes.Equal(needle, hay) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func isCredentialsAllowedMatchingOwned(allowedCredentialIDs [][]byte, credentials []Credential) (valid bool) {
+	var credential Credential
+
+allowed:
+	for _, allowedCredentialID := range allowedCredentialIDs {
+		for _, credential = range credentials {
+			if bytes.Equal(credential.ID, allowedCredentialID) {
+				continue allowed
+			}
+		}
+
+		return false
+	}
+
+	return true
+}
+
+func isCredentialIDInCredentials(credentialID []byte, credentials []Credential) (valid bool) {
+	for _, credential := range credentials {
+		if bytes.Equal(credential.ID, credentialID) {
+			return true
+		}
+	}
+
+	return false
+}

vendor/github.com/go-webauthn/x/LICENSE

@@ -0,0 +1,21 @@
+Copyright (c) 2021-2023 github.com/go-webauthn authors.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+   disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
+   disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products
+   derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/go-webauthn/x/encoding/asn1/README.md

@@ -0,0 +1 @@
+Current commit base is 3e43f48cb6311c3c459f5c7aa69ae7d28b7fc821.

vendor/github.com/go-webauthn/x/encoding/asn1/common.go

@@ -0,0 +1,205 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package asn1
+
+import (
+	"reflect"
+	"strconv"
+	"strings"
+)
+
+// ASN.1 objects have metadata preceding them:
+//   the tag: the type of the object
+//   a flag denoting if this object is compound or not
+//   the class type: the namespace of the tag
+//   the length of the object, in bytes
+
+// Here are some standard tags and classes
+
+// ASN.1 tags represent the type of the following object.
+const (
+	TagBoolean         = 1
+	TagInteger         = 2
+	TagBitString       = 3
+	TagOctetString     = 4
+	TagNull            = 5
+	TagOID             = 6
+	TagEnum            = 10
+	TagUTF8String      = 12
+	TagSequence        = 16
+	TagSet             = 17
+	TagNumericString   = 18
+	TagPrintableString = 19
+	TagT61String       = 20
+	TagIA5String       = 22
+	TagUTCTime         = 23
+	TagGeneralizedTime = 24
+	TagGeneralString   = 27
+	TagBMPString       = 30
+)
+
+// ASN.1 class types represent the namespace of the tag.
+const (
+	ClassUniversal       = 0
+	ClassApplication     = 1
+	ClassContextSpecific = 2
+	ClassPrivate         = 3
+)
+
+type tagAndLength struct {
+	class, tag, length int
+	isCompound         bool
+}
+
+// ASN.1 has IMPLICIT and EXPLICIT tags, which can be translated as "instead
+// of" and "in addition to". When not specified, every primitive type has a
+// default tag in the UNIVERSAL class.
+//
+// For example: a BIT STRING is tagged [UNIVERSAL 3] by default (although ASN.1
+// doesn't actually have a UNIVERSAL keyword). However, by saying [IMPLICIT
+// CONTEXT-SPECIFIC 42], that means that the tag is replaced by another.
+//
+// On the other hand, if it said [EXPLICIT CONTEXT-SPECIFIC 10], then an
+// /additional/ tag would wrap the default tag. This explicit tag will have the
+// compound flag set.
+//
+// (This is used in order to remove ambiguity with optional elements.)
+//
+// You can layer EXPLICIT and IMPLICIT tags to an arbitrary depth, however we
+// don't support that here. We support a single layer of EXPLICIT or IMPLICIT
+// tagging with tag strings on the fields of a structure.
+
+// fieldParameters is the parsed representation of tag string from a structure field.
+type fieldParameters struct {
+	optional     bool   // true iff the field is OPTIONAL
+	explicit     bool   // true iff an EXPLICIT tag is in use.
+	application  bool   // true iff an APPLICATION tag is in use.
+	private      bool   // true iff a PRIVATE tag is in use.
+	defaultValue *int64 // a default value for INTEGER typed fields (maybe nil).
+	tag          *int   // the EXPLICIT or IMPLICIT tag (maybe nil).
+	stringType   int    // the string tag to use when marshaling.
+	timeType     int    // the time tag to use when marshaling.
+	set          bool   // true iff this should be encoded as a SET
+	omitEmpty    bool   // true iff this should be omitted if empty when marshaling.
+
+	// Invariants:
+	//   if explicit is set, tag is non-nil.
+}
+
+// Given a tag string with the format specified in the package comment,
+// parseFieldParameters will parse it into a fieldParameters structure,
+// ignoring unknown parts of the string.
+func parseFieldParameters(str string) (ret fieldParameters) {
+	var part string
+	for len(str) > 0 {
+		part, str, _ = strings.Cut(str, ",")
+		switch {
+		case part == "optional":
+			ret.optional = true
+		case part == "explicit":
+			ret.explicit = true
+			if ret.tag == nil {
+				ret.tag = new(int)
+			}
+		case part == "generalized":
+			ret.timeType = TagGeneralizedTime
+		case part == "utc":
+			ret.timeType = TagUTCTime
+		case part == "ia5":
+			ret.stringType = TagIA5String
+		case part == "general":
+			ret.stringType = TagGeneralString
+		case part == "printable":
+			ret.stringType = TagPrintableString
+		case part == "numeric":
+			ret.stringType = TagNumericString
+		case part == "utf8":
+			ret.stringType = TagUTF8String
+		case strings.HasPrefix(part, "default:"):
+			i, err := strconv.ParseInt(part[8:], 10, 64)
+			if err == nil {
+				ret.defaultValue = new(int64)
+				*ret.defaultValue = i
+			}
+		case strings.HasPrefix(part, "tag:"):
+			i, err := strconv.Atoi(part[4:])
+			if err == nil {
+				ret.tag = new(int)
+				*ret.tag = i
+			}
+		case part == "set":
+			ret.set = true
+		case part == "application":
+			ret.application = true
+			if ret.tag == nil {
+				ret.tag = new(int)
+			}
+		case part == "private":
+			ret.private = true
+			if ret.tag == nil {
+				ret.tag = new(int)
+			}
+		case part == "omitempty":
+			ret.omitEmpty = true
+		}
+	}
+	return
+}
+
+// Given a reflected Go type, getUniversalType returns the default tag number
+// and expected compound flag.
+func getUniversalType(t reflect.Type) (matchAny bool, tagNumber int, isCompound, ok bool) {
+	switch t {
+	case rawValueType:
+		return true, -1, false, true
+	case objectIdentifierType:
+		return false, TagOID, false, true
+	case bitStringType:
+		return false, TagBitString, false, true
+	case timeType:
+		return false, TagUTCTime, false, true
+	case enumeratedType:
+		return false, TagEnum, false, true
+	case bigIntType:
+		return false, TagInteger, false, true
+	}
+	switch t.Kind() {
+	case reflect.Bool:
+		return false, TagBoolean, false, true
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return false, TagInteger, false, true
+	case reflect.Struct:
+		return false, TagSequence, true, true
+	case reflect.Slice:
+		if t.Elem().Kind() == reflect.Uint8 {
+			return false, TagOctetString, false, true
+		}
+		if strings.HasSuffix(t.Name(), "SET") {
+			return false, TagSet, true, true
+		}
+		return false, TagSequence, true, true
+	case reflect.String:
+		return false, TagPrintableString, false, true
+	}
+	return false, 0, false, false
+}
+
+func sliceCapWithSize(size, c uint64) int {
+	if int64(c) < 0 || c != uint64(int(c)) {
+		return -1
+	}
+	if size > 0 && c > (1<<64-1)/size {
+		return -1
+	}
+	if c*size > chunk {
+		c = chunk / size
+		if c == 0 {
+			c = 1
+		}
+	}
+	return int(c)
+}
+
+const chunk = 10 << 20

vendor/github.com/go-webauthn/x/encoding/asn1/marshal.go

@@ -0,0 +1,761 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package asn1
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"math/big"
+	"reflect"
+	"slices"
+	"time"
+	"unicode/utf8"
+)
+
+var (
+	byte00Encoder encoder = byteEncoder(0x00)
+	byteFFEncoder encoder = byteEncoder(0xff)
+)
+
+// encoder represents an ASN.1 element that is waiting to be marshaled.
+type encoder interface {
+	// Len returns the number of bytes needed to marshal this element.
+	Len() int
+	// Encode encodes this element by writing Len() bytes to dst.
+	Encode(dst []byte)
+}
+
+type byteEncoder byte
+
+func (c byteEncoder) Len() int {
+	return 1
+}
+
+func (c byteEncoder) Encode(dst []byte) {
+	dst[0] = byte(c)
+}
+
+type bytesEncoder []byte
+
+func (b bytesEncoder) Len() int {
+	return len(b)
+}
+
+func (b bytesEncoder) Encode(dst []byte) {
+	if copy(dst, b) != len(b) {
+		panic("internal error")
+	}
+}
+
+type stringEncoder string
+
+func (s stringEncoder) Len() int {
+	return len(s)
+}
+
+func (s stringEncoder) Encode(dst []byte) {
+	if copy(dst, s) != len(s) {
+		panic("internal error")
+	}
+}
+
+type multiEncoder []encoder
+
+func (m multiEncoder) Len() int {
+	var size int
+	for _, e := range m {
+		size += e.Len()
+	}
+	return size
+}
+
+func (m multiEncoder) Encode(dst []byte) {
+	var off int
+	for _, e := range m {
+		e.Encode(dst[off:])
+		off += e.Len()
+	}
+}
+
+type setEncoder []encoder
+
+func (s setEncoder) Len() int {
+	var size int
+	for _, e := range s {
+		size += e.Len()
+	}
+	return size
+}
+
+func (s setEncoder) Encode(dst []byte) {
+	// Per X690 Section 11.6: The encodings of the component values of a
+	// set-of value shall appear in ascending order, the encodings being
+	// compared as octet strings with the shorter components being padded
+	// at their trailing end with 0-octets.
+	//
+	// First we encode each element to its TLV encoding and then use
+	// octetSort to get the ordering expected by X690 DER rules before
+	// writing the sorted encodings out to dst.
+	l := make([][]byte, len(s))
+	for i, e := range s {
+		l[i] = make([]byte, e.Len())
+		e.Encode(l[i])
+	}
+
+	// Since we are using bytes.Compare to compare TLV encodings we
+	// don't need to right pad s[i] and s[j] to the same length as
+	// suggested in X690. If len(s[i]) < len(s[j]) the length octet of
+	// s[i], which is the first determining byte, will inherently be
+	// smaller than the length octet of s[j]. This lets us skip the
+	// padding step.
+	slices.SortFunc(l, bytes.Compare)
+
+	var off int
+	for _, b := range l {
+		copy(dst[off:], b)
+		off += len(b)
+	}
+}
+
+type taggedEncoder struct {
+	// scratch contains temporary space for encoding the tag and length of
+	// an element in order to avoid extra allocations.
+	scratch [8]byte
+	tag     encoder
+	body    encoder
+}
+
+func (t *taggedEncoder) Len() int {
+	return t.tag.Len() + t.body.Len()
+}
+
+func (t *taggedEncoder) Encode(dst []byte) {
+	t.tag.Encode(dst)
+	t.body.Encode(dst[t.tag.Len():])
+}
+
+type int64Encoder int64
+
+func (i int64Encoder) Len() int {
+	n := 1
+
+	for i > 127 {
+		n++
+		i >>= 8
+	}
+
+	for i < -128 {
+		n++
+		i >>= 8
+	}
+
+	return n
+}
+
+func (i int64Encoder) Encode(dst []byte) {
+	n := i.Len()
+
+	for j := 0; j < n; j++ {
+		dst[j] = byte(i >> uint((n-1-j)*8))
+	}
+}
+
+func base128IntLength(n int64) int {
+	if n == 0 {
+		return 1
+	}
+
+	l := 0
+	for i := n; i > 0; i >>= 7 {
+		l++
+	}
+
+	return l
+}
+
+func appendBase128Int(dst []byte, n int64) []byte {
+	l := base128IntLength(n)
+
+	for i := l - 1; i >= 0; i-- {
+		o := byte(n >> uint(i*7))
+		o &= 0x7f
+		if i != 0 {
+			o |= 0x80
+		}
+
+		dst = append(dst, o)
+	}
+
+	return dst
+}
+
+func makeBigInt(n *big.Int) (encoder, error) {
+	if n == nil {
+		return nil, StructuralError{"empty integer"}
+	}
+
+	if n.Sign() < 0 {
+		// A negative number has to be converted to two's-complement
+		// form. So we'll invert and subtract 1. If the
+		// most-significant-bit isn't set then we'll need to pad the
+		// beginning with 0xff in order to keep the number negative.
+		nMinus1 := new(big.Int).Neg(n)
+		nMinus1.Sub(nMinus1, bigOne)
+		bytes := nMinus1.Bytes()
+		for i := range bytes {
+			bytes[i] ^= 0xff
+		}
+		if len(bytes) == 0 || bytes[0]&0x80 == 0 {
+			return multiEncoder([]encoder{byteFFEncoder, bytesEncoder(bytes)}), nil
+		}
+		return bytesEncoder(bytes), nil
+	} else if n.Sign() == 0 {
+		// Zero is written as a single 0 zero rather than no bytes.
+		return byte00Encoder, nil
+	} else {
+		bytes := n.Bytes()
+		if len(bytes) > 0 && bytes[0]&0x80 != 0 {
+			// We'll have to pad this with 0x00 in order to stop it
+			// looking like a negative number.
+			return multiEncoder([]encoder{byte00Encoder, bytesEncoder(bytes)}), nil
+		}
+		return bytesEncoder(bytes), nil
+	}
+}
+
+func appendLength(dst []byte, i int) []byte {
+	n := lengthLength(i)
+
+	for ; n > 0; n-- {
+		dst = append(dst, byte(i>>uint((n-1)*8)))
+	}
+
+	return dst
+}
+
+func lengthLength(i int) (numBytes int) {
+	numBytes = 1
+	for i > 255 {
+		numBytes++
+		i >>= 8
+	}
+	return
+}
+
+func appendTagAndLength(dst []byte, t tagAndLength) []byte {
+	b := uint8(t.class) << 6
+	if t.isCompound {
+		b |= 0x20
+	}
+	if t.tag >= 31 {
+		b |= 0x1f
+		dst = append(dst, b)
+		dst = appendBase128Int(dst, int64(t.tag))
+	} else {
+		b |= uint8(t.tag)
+		dst = append(dst, b)
+	}
+
+	if t.length >= 128 {
+		l := lengthLength(t.length)
+		dst = append(dst, 0x80|byte(l))
+		dst = appendLength(dst, t.length)
+	} else {
+		dst = append(dst, byte(t.length))
+	}
+
+	return dst
+}
+
+type bitStringEncoder BitString
+
+func (b bitStringEncoder) Len() int {
+	return len(b.Bytes) + 1
+}
+
+func (b bitStringEncoder) Encode(dst []byte) {
+	dst[0] = byte((8 - b.BitLength%8) % 8)
+	if copy(dst[1:], b.Bytes) != len(b.Bytes) {
+		panic("internal error")
+	}
+}
+
+type oidEncoder []int
+
+func (oid oidEncoder) Len() int {
+	l := base128IntLength(int64(oid[0]*40 + oid[1]))
+	for i := 2; i < len(oid); i++ {
+		l += base128IntLength(int64(oid[i]))
+	}
+	return l
+}
+
+func (oid oidEncoder) Encode(dst []byte) {
+	dst = appendBase128Int(dst[:0], int64(oid[0]*40+oid[1]))
+	for i := 2; i < len(oid); i++ {
+		dst = appendBase128Int(dst, int64(oid[i]))
+	}
+}
+
+func makeObjectIdentifier(oid []int) (e encoder, err error) {
+	if len(oid) < 2 || oid[0] > 2 || (oid[0] < 2 && oid[1] >= 40) {
+		return nil, StructuralError{"invalid object identifier"}
+	}
+
+	return oidEncoder(oid), nil
+}
+
+func makePrintableString(s string) (e encoder, err error) {
+	for i := 0; i < len(s); i++ {
+		// The asterisk is often used in PrintableString, even though
+		// it is invalid. If a PrintableString was specifically
+		// requested then the asterisk is permitted by this code.
+		// Ampersand is allowed in parsing due a handful of CA
+		// certificates, however when making new certificates
+		// it is rejected.
+		if !isPrintable(s[i], allowAsterisk, rejectAmpersand) {
+			return nil, StructuralError{"PrintableString contains invalid character"}
+		}
+	}
+
+	return stringEncoder(s), nil
+}
+
+func makeIA5String(s string) (e encoder, err error) {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= utf8.RuneSelf {
+			return nil, StructuralError{"IA5String contains invalid character"}
+		}
+	}
+
+	return stringEncoder(s), nil
+}
+
+func makeNumericString(s string) (e encoder, err error) {
+	for i := 0; i < len(s); i++ {
+		if !isNumeric(s[i]) {
+			return nil, StructuralError{"NumericString contains invalid character"}
+		}
+	}
+
+	return stringEncoder(s), nil
+}
+
+func makeUTF8String(s string) encoder {
+	return stringEncoder(s)
+}
+
+func appendTwoDigits(dst []byte, v int) []byte {
+	return append(dst, byte('0'+(v/10)%10), byte('0'+v%10))
+}
+
+func appendFourDigits(dst []byte, v int) []byte {
+	return append(dst,
+		byte('0'+(v/1000)%10),
+		byte('0'+(v/100)%10),
+		byte('0'+(v/10)%10),
+		byte('0'+v%10))
+}
+
+func outsideUTCRange(t time.Time) bool {
+	year := t.Year()
+	return year < 1950 || year >= 2050
+}
+
+func makeUTCTime(t time.Time) (e encoder, err error) {
+	dst := make([]byte, 0, 18)
+
+	dst, err = appendUTCTime(dst, t)
+	if err != nil {
+		return nil, err
+	}
+
+	return bytesEncoder(dst), nil
+}
+
+func makeGeneralizedTime(t time.Time) (e encoder, err error) {
+	dst := make([]byte, 0, 20)
+
+	dst, err = appendGeneralizedTime(dst, t)
+	if err != nil {
+		return nil, err
+	}
+
+	return bytesEncoder(dst), nil
+}
+
+func appendUTCTime(dst []byte, t time.Time) (ret []byte, err error) {
+	year := t.Year()
+
+	switch {
+	case 1950 <= year && year < 2000:
+		dst = appendTwoDigits(dst, year-1900)
+	case 2000 <= year && year < 2050:
+		dst = appendTwoDigits(dst, year-2000)
+	default:
+		return nil, StructuralError{"cannot represent time as UTCTime"}
+	}
+
+	return appendTimeCommon(dst, t), nil
+}
+
+func appendGeneralizedTime(dst []byte, t time.Time) (ret []byte, err error) {
+	year := t.Year()
+	if year < 0 || year > 9999 {
+		return nil, StructuralError{"cannot represent time as GeneralizedTime"}
+	}
+
+	dst = appendFourDigits(dst, year)
+
+	return appendTimeCommon(dst, t), nil
+}
+
+func appendTimeCommon(dst []byte, t time.Time) []byte {
+	_, month, day := t.Date()
+
+	dst = appendTwoDigits(dst, int(month))
+	dst = appendTwoDigits(dst, day)
+
+	hour, min, sec := t.Clock()
+
+	dst = appendTwoDigits(dst, hour)
+	dst = appendTwoDigits(dst, min)
+	dst = appendTwoDigits(dst, sec)
+
+	_, offset := t.Zone()
+
+	switch {
+	case offset/60 == 0:
+		return append(dst, 'Z')
+	case offset > 0:
+		dst = append(dst, '+')
+	case offset < 0:
+		dst = append(dst, '-')
+	}
+
+	offsetMinutes := offset / 60
+	if offsetMinutes < 0 {
+		offsetMinutes = -offsetMinutes
+	}
+
+	dst = appendTwoDigits(dst, offsetMinutes/60)
+	dst = appendTwoDigits(dst, offsetMinutes%60)
+
+	return dst
+}
+
+func stripTagAndLength(in []byte) []byte {
+	_, offset, err := parseTagAndLength(in, 0)
+	if err != nil {
+		return in
+	}
+	return in[offset:]
+}
+
+func makeBody(value reflect.Value, params fieldParameters, opts *marshalOpts) (e encoder, err error) {
+	switch value.Type() {
+	case flagType:
+		return bytesEncoder(nil), nil
+	case timeType:
+		t, _ := reflect.TypeAssert[time.Time](value)
+		if params.timeType == TagGeneralizedTime || outsideUTCRange(t) {
+			return makeGeneralizedTime(t)
+		}
+		return makeUTCTime(t)
+	case bitStringType:
+		v, _ := reflect.TypeAssert[BitString](value)
+		return bitStringEncoder(v), nil
+	case objectIdentifierType:
+		v, _ := reflect.TypeAssert[ObjectIdentifier](value)
+		return makeObjectIdentifier(v)
+	case bigIntType:
+		v, _ := reflect.TypeAssert[*big.Int](value)
+		return makeBigInt(v)
+	}
+
+	switch v := value; v.Kind() {
+	case reflect.Bool:
+		if v.Bool() {
+			return byteFFEncoder, nil
+		}
+		return byte00Encoder, nil
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return int64Encoder(v.Int()), nil
+	case reflect.Struct:
+		t := v.Type()
+
+		for i := 0; i < t.NumField(); i++ {
+			if !t.Field(i).IsExported() {
+				return nil, StructuralError{"struct contains unexported fields"}
+			}
+		}
+
+		startingField := 0
+
+		n := t.NumField()
+		if n == 0 {
+			return bytesEncoder(nil), nil
+		}
+
+		// If the first element of the structure is a non-empty
+		// RawContents, then we don't bother serializing the rest.
+		if t.Field(0).Type == rawContentsType {
+			s := v.Field(0)
+			if s.Len() > 0 {
+				bytes := s.Bytes()
+				/* The RawContents will contain the tag and
+				 * length fields but we'll also be writing
+				 * those ourselves, so we strip them out of
+				 * bytes */
+				return bytesEncoder(stripTagAndLength(bytes)), nil
+			}
+
+			startingField = 1
+		}
+
+		switch n1 := n - startingField; n1 {
+		case 0:
+			return bytesEncoder(nil), nil
+		case 1:
+			return makeField(v.Field(startingField), parseFieldParameters(t.Field(startingField).Tag.Get("asn1")), opts)
+		default:
+			m := make([]encoder, n1)
+			for i := 0; i < n1; i++ {
+				m[i], err = makeField(v.Field(i+startingField), parseFieldParameters(t.Field(i+startingField).Tag.Get("asn1")), opts)
+				if err != nil {
+					return nil, err
+				}
+			}
+
+			return multiEncoder(m), nil
+		}
+	case reflect.Slice:
+		sliceType := v.Type()
+		if sliceType.Elem().Kind() == reflect.Uint8 {
+			return bytesEncoder(v.Bytes()), nil
+		}
+
+		var fp fieldParameters
+
+		if opts.slicePreserveTypes {
+			fp.stringType = params.stringType
+			fp.timeType = params.timeType
+		}
+
+		switch l := v.Len(); l {
+		case 0:
+			return bytesEncoder(nil), nil
+		case 1:
+			return makeField(v.Index(0), fp, opts)
+		default:
+			m := make([]encoder, l)
+
+			for i := 0; i < l; i++ {
+				m[i], err = makeField(v.Index(i), fp, opts)
+				if err != nil {
+					return nil, err
+				}
+			}
+
+			if params.set {
+				return setEncoder(m), nil
+			}
+			return multiEncoder(m), nil
+		}
+	case reflect.String:
+		switch params.stringType {
+		case TagIA5String, TagGeneralString:
+			return makeIA5String(v.String())
+		case TagPrintableString:
+			return makePrintableString(v.String())
+		case TagNumericString:
+			return makeNumericString(v.String())
+		default:
+			return makeUTF8String(v.String()), nil
+		}
+	}
+
+	return nil, StructuralError{"unknown Go type"}
+}
+
+func makeField(v reflect.Value, params fieldParameters, opts *marshalOpts) (e encoder, err error) {
+	if !v.IsValid() {
+		return nil, fmt.Errorf("asn1: cannot marshal nil value")
+	}
+	// If the field is an interface{} then recurse into it.
+	if v.Kind() == reflect.Interface && v.Type().NumMethod() == 0 {
+		return makeField(v.Elem(), params, opts)
+	}
+
+	if v.Kind() == reflect.Slice && v.Len() == 0 && params.omitEmpty {
+		return bytesEncoder(nil), nil
+	}
+
+	if params.optional && params.defaultValue != nil && canHaveDefaultValue(v.Kind()) {
+		defaultValue := reflect.New(v.Type()).Elem()
+		defaultValue.SetInt(*params.defaultValue)
+
+		if reflect.DeepEqual(v.Interface(), defaultValue.Interface()) {
+			return bytesEncoder(nil), nil
+		}
+	}
+
+	// If no default value is given then the zero value for the type is
+	// assumed to be the default value. This isn't obviously the correct
+	// behavior, but it's what Go has traditionally done.
+	if params.optional && params.defaultValue == nil {
+		if reflect.DeepEqual(v.Interface(), reflect.Zero(v.Type()).Interface()) {
+			return bytesEncoder(nil), nil
+		}
+	}
+
+	if v.Type() == rawValueType {
+		rv, _ := reflect.TypeAssert[RawValue](v)
+		if len(rv.FullBytes) != 0 {
+			return bytesEncoder(rv.FullBytes), nil
+		}
+
+		t := new(taggedEncoder)
+
+		t.tag = bytesEncoder(appendTagAndLength(t.scratch[:0], tagAndLength{rv.Class, rv.Tag, len(rv.Bytes), rv.IsCompound}))
+		t.body = bytesEncoder(rv.Bytes)
+
+		return t, nil
+	}
+
+	matchAny, tag, isCompound, ok := getUniversalType(v.Type())
+	if !ok || matchAny {
+		return nil, StructuralError{fmt.Sprintf("unknown Go type: %v", v.Type())}
+	}
+
+	if params.timeType != 0 && tag != TagUTCTime {
+		return nil, StructuralError{"explicit time type given to non-time member"}
+	}
+
+	if params.stringType != 0 && tag != TagPrintableString && (!opts.sliceAllowStrings || v.Kind() != reflect.Slice || tag != TagSequence || v.Type().Elem().Kind() != reflect.String) {
+		return nil, StructuralError{"explicit string type given to non-string member"}
+	}
+
+	switch tag {
+	case TagPrintableString:
+		if params.stringType == 0 {
+			// This is a string without an explicit string type. We'll use
+			// a PrintableString if the character set in the string is
+			// sufficiently limited, otherwise we'll use a UTF8String.
+			for _, r := range v.String() {
+				if r >= utf8.RuneSelf || !isPrintable(byte(r), rejectAsterisk, rejectAmpersand) {
+					if !utf8.ValidString(v.String()) {
+						return nil, errors.New("asn1: string not valid UTF-8")
+					}
+					tag = TagUTF8String
+					break
+				}
+			}
+		} else {
+			tag = params.stringType
+		}
+	case TagUTCTime:
+		t, _ := reflect.TypeAssert[time.Time](v)
+		if params.timeType == TagGeneralizedTime || outsideUTCRange(t) {
+			tag = TagGeneralizedTime
+		}
+	}
+
+	if params.set {
+		if tag != TagSequence {
+			return nil, StructuralError{"non sequence tagged as set"}
+		}
+		tag = TagSet
+	}
+
+	// makeField can be called for a slice that should be treated as a SET
+	// but doesn't have params.set set, for instance when using a slice
+	// with the SET type name suffix. In this case getUniversalType returns
+	// TagSet, but makeBody doesn't know about that so will treat the slice
+	// as a sequence. To work around this we set params.set.
+	if tag == TagSet && !params.set {
+		params.set = true
+	}
+
+	t := new(taggedEncoder)
+
+	t.body, err = makeBody(v, params, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	bodyLen := t.body.Len()
+
+	class := ClassUniversal
+	if params.tag != nil {
+		if params.application {
+			class = ClassApplication
+		} else if params.private {
+			class = ClassPrivate
+		} else {
+			class = ClassContextSpecific
+		}
+
+		if params.explicit {
+			t.tag = bytesEncoder(appendTagAndLength(t.scratch[:0], tagAndLength{ClassUniversal, tag, bodyLen, isCompound}))
+
+			tt := new(taggedEncoder)
+
+			tt.body = t
+
+			tt.tag = bytesEncoder(appendTagAndLength(tt.scratch[:0], tagAndLength{
+				class:      class,
+				tag:        *params.tag,
+				length:     bodyLen + t.tag.Len(),
+				isCompound: true,
+			}))
+
+			return tt, nil
+		}
+
+		// implicit tag.
+		tag = *params.tag
+	}
+
+	t.tag = bytesEncoder(appendTagAndLength(t.scratch[:0], tagAndLength{class, tag, bodyLen, isCompound}))
+
+	return t, nil
+}
+
+// Marshal returns the ASN.1 encoding of val.
+//
+// In addition to the struct tags recognized by Unmarshal, the following can be
+// used:
+//
+//	ia5:         causes strings to be marshaled as ASN.1, IA5String values
+//	general:     causes strings to be marshaled as ASN.1, GeneralString values
+//	omitempty:   causes empty slices to be skipped
+//	printable:   causes strings to be marshaled as ASN.1, PrintableString values
+//	utf8:        causes strings to be marshaled as ASN.1, UTF8String values
+//	numeric:     causes strings to be marshaled as ASN.1, NumericString values
+//	utc:         causes time.Time to be marshaled as ASN.1, UTCTime values
+//	generalized: causes time.Time to be marshaled as ASN.1, GeneralizedTime values
+func Marshal(val any, opts ...MarshalOpt) ([]byte, error) {
+	return MarshalWithParams(val, "", opts...)
+}
+
+// MarshalWithParams allows field parameters to be specified for the
+// top-level element. The form of the params is the same as the field tags.
+func MarshalWithParams(val any, params string, opts ...MarshalOpt) ([]byte, error) {
+	o := &marshalOpts{}
+
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	e, err := makeField(reflect.ValueOf(val), parseFieldParameters(params), o)
+	if err != nil {
+		return nil, err
+	}
+	b := make([]byte, e.Len())
+	e.Encode(b)
+	return b, nil
+}

vendor/github.com/go-webauthn/x/encoding/asn1/marshal_opts.go

@@ -0,0 +1,25 @@
+package asn1
+
+type marshalOpts struct {
+	slicePreserveTypes bool
+	sliceAllowStrings  bool
+}
+
+// MarshalOpt describes a functional option for marshalling.
+type MarshalOpt func(opts *marshalOpts)
+
+// WithMarshalSlicePreserveTypes preserves the type values from the field parameters when marshaling slices. This is an
+// option since it deviates from stdlib.
+func WithMarshalSlicePreserveTypes(value bool) MarshalOpt {
+	return func(opts *marshalOpts) {
+		opts.slicePreserveTypes = value
+	}
+}
+
+// WithMarshalSliceAllowStrings allows slices of strings when marshaling slices. This is an option since it deviates
+// from stdlib.
+func WithMarshalSliceAllowStrings(value bool) MarshalOpt {
+	return func(opts *marshalOpts) {
+		opts.sliceAllowStrings = value
+	}
+}

vendor/github.com/go-webauthn/x/encoding/asn1/unmarshal_opts.go

@@ -0,0 +1,25 @@
+package asn1
+
+type unmarshalOpts struct {
+	allowTypeGeneralString bool
+	allowBERIntegers       bool
+}
+
+// UnmarshalOpt describes a functional option for unmarshalling.
+type UnmarshalOpt func(opts *unmarshalOpts)
+
+// WithUnmarshalAllowTypeGeneralString allows the use of ASN.1 DER GeneralString type. This is an option since it
+// deviates from stdlib.
+func WithUnmarshalAllowTypeGeneralString(value bool) UnmarshalOpt {
+	return func(opts *unmarshalOpts) {
+		opts.allowTypeGeneralString = value
+	}
+}
+
+// WithUnmarshalAllowBERIntegers permits the use of ASN.1 BER integer types. This is an option since it deviates from
+// stdlib.
+func WithUnmarshalAllowBERIntegers(value bool) UnmarshalOpt {
+	return func(opts *unmarshalOpts) {
+		opts.allowBERIntegers = value
+	}
+}

vendor/github.com/go-webauthn/x/revoke/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) 2014 CloudFlare Inc.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/go-webauthn/x/revoke/README.md

@@ -0,0 +1,4 @@
+# revoke
+
+A fork of [github.com/cloudflare/cfssl/revoke](https://github.com/cloudflare/cfssl/tree/master/revoke) primarily intent 
+on implementing functionality needed by [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn).

vendor/github.com/go-webauthn/x/revoke/doc.go

@@ -0,0 +1,4 @@
+// Package revoke provides functionality for checking the validity of a cert. Specifically, the temporal validity of the
+// certificate is checked first, then any CRL and OCSP url in the cert is checked. This is a fork of the
+// github.com/cloudflare/cfssl/revoke package. It's used to lookup the revocation status of X.509 Certificates.
+package revoke

vendor/github.com/go-webauthn/x/revoke/err.go

@@ -0,0 +1,442 @@
+package revoke
+
+import (
+	"crypto/x509"
+	"encoding/json"
+	"errors"
+	"fmt"
+)
+
+// Error is the error type usually returned by functions in CF SSL package.
+// It contains a 4-digit error code where the most significant digit
+// describes the category where the error occurred and the rest 3 digits
+// describe the specific error reason.
+type Error struct {
+	ErrorCode int    `json:"code"`
+	Message   string `json:"message"`
+}
+
+// The error interface implementation, which formats to a JSON object string.
+func (e *Error) Error() string {
+	marshaled, err := json.Marshal(e)
+	if err != nil {
+		panic(err)
+	}
+	return string(marshaled)
+
+}
+
+// Category is the most significant digit of the error code.
+type Category int
+
+// Reason is the last 3 digits of the error code.
+type Reason int
+
+const (
+	// Success indicates no error occurred.
+	Success Category = 1000 * iota // 0XXX
+
+	// CertificateError indicates a fault in a certificate.
+	CertificateError // 1XXX
+
+	// PrivateKeyError indicates a fault in a private key.
+	PrivateKeyError // 2XXX
+
+	// IntermediatesError indicates a fault in an intermediate.
+	IntermediatesError // 3XXX
+
+	// RootError indicates a fault in a root.
+	RootError // 4XXX
+
+	// PolicyError indicates an error arising from a malformed or
+	// non-existent policy, or a breach of policy.
+	PolicyError // 5XXX
+
+	// DialError indicates a network fault.
+	DialError // 6XXX
+
+	// APIClientError indicates a problem with the API client.
+	APIClientError // 7XXX
+
+	// OCSPError indicates a problem with OCSP signing
+	OCSPError // 8XXX
+
+	// CSRError indicates a problem with CSR parsing
+	CSRError // 9XXX
+
+	// CTError indicates a problem with the certificate transparency process
+	CTError // 10XXX
+
+	// CertStoreError indicates a problem with the certificate store
+	CertStoreError // 11XXX
+)
+
+// None is a non-specified error.
+const (
+	None Reason = iota
+)
+
+// Warning code for a success
+const (
+	BundleExpiringBit      int = 1 << iota // 0x01
+	BundleNotUbiquitousBit                 // 0x02
+)
+
+// Parsing errors
+const (
+	Unknown      Reason = iota // X000
+	ReadFailed                 // X001
+	DecodeFailed               // X002
+	ParseFailed                // X003
+)
+
+// The following represent certificate non-parsing errors, and must be
+// specified along with CertificateError.
+const (
+	// SelfSigned indicates that a certificate is self-signed and
+	// cannot be used in the manner being attempted.
+	SelfSigned Reason = 100 * (iota + 1) // Code 11XX
+
+	// VerifyFailed is an X.509 verification failure. The least two
+	// significant digits of 12XX is determined as the actual x509
+	// error is examined.
+	VerifyFailed // Code 12XX
+
+	// BadRequest indicates that the certificate request is invalid.
+	BadRequest // Code 13XX
+
+	// MissingSerial indicates that the profile specified
+	// 'ClientProvidesSerialNumbers', but the SignRequest did not include a serial
+	// number.
+	MissingSerial // Code 14XX
+)
+
+const (
+	certificateInvalid = 10 * (iota + 1) //121X
+	unknownAuthority                     //122x
+)
+
+// The following represent private-key non-parsing errors, and must be
+// specified with PrivateKeyError.
+const (
+	// Encrypted indicates that the private key is a PKCS #8 encrypted
+	// private key. At this time, CFSSL does not support decrypting
+	// these keys.
+	Encrypted Reason = 100 * (iota + 1) //21XX
+
+	// NotRSAOrECC indicates that they key is not an RSA or ECC
+	// private key; these are the only two private key types supported
+	// at this time by CFSSL.
+	NotRSAOrECC //22XX
+
+	// KeyMismatch indicates that the private key does not match
+	// the public key or certificate being presented with the key.
+	KeyMismatch //23XX
+
+	// GenerationFailed indicates that a private key could not
+	// be generated.
+	GenerationFailed //24XX
+
+	// Unavailable indicates that a private key mechanism (such as
+	// PKCS #11) was requested but support for that mechanism is
+	// not available.
+	Unavailable
+)
+
+// The following are policy-related non-parsing errors, and must be
+// specified along with PolicyError.
+const (
+	// NoKeyUsages indicates that the profile does not permit any
+	// key usages for the certificate.
+	NoKeyUsages Reason = 100 * (iota + 1) // 51XX
+
+	// InvalidPolicy indicates that policy being requested is not
+	// a valid policy or does not exist.
+	InvalidPolicy // 52XX
+
+	// InvalidRequest indicates a certificate request violated the
+	// constraints of the policy being applied to the request.
+	InvalidRequest // 53XX
+
+	// UnknownProfile indicates that the profile does not exist.
+	UnknownProfile // 54XX
+
+	UnmatchedWhitelist // 55xx
+)
+
+// The following are API client related errors, and should be
+// specified with APIClientError.
+const (
+	// AuthenticationFailure occurs when the client is unable
+	// to obtain an authentication token for the request.
+	AuthenticationFailure Reason = 100 * (iota + 1)
+
+	// JSONError wraps an encoding/json error.
+	JSONError
+
+	// IOError wraps an io/ioutil error.
+	IOError
+
+	// ClientHTTPError wraps a net/http error.
+	ClientHTTPError
+
+	// ServerRequestFailed covers any other failures from the API
+	// client.
+	ServerRequestFailed
+)
+
+// The following are OCSP related errors, and should be
+// specified with OCSPError
+const (
+	// IssuerMismatch ocurs when the certificate in the OCSP signing
+	// request was not issued by the CA that this responder responds for.
+	IssuerMismatch Reason = 100 * (iota + 1) // 81XX
+
+	// InvalidStatus occurs when the OCSP signing requests includes an
+	// invalid value for the certificate status.
+	InvalidStatus
+)
+
+// Certificate transparency related errors specified with CTError
+const (
+	// PrecertSubmissionFailed occurs when submitting a precertificate to
+	// a log server fails
+	PrecertSubmissionFailed = 100 * (iota + 1)
+	// CTClientConstructionFailed occurs when the construction of a new
+	// github.com/google/certificate-transparency client fails.
+	CTClientConstructionFailed
+	// PrecertMissingPoison occurs when a precert is passed to SignFromPrecert
+	// and is missing the CT poison extension.
+	PrecertMissingPoison
+	// PrecertInvalidPoison occurs when a precert is passed to SignFromPrecert
+	// and has a invalid CT poison extension value or the extension is not
+	// critical.
+	PrecertInvalidPoison
+)
+
+// Certificate persistence related errors specified with CertStoreError
+const (
+	// InsertionFailed occurs when a SQL insert query failes to complete.
+	InsertionFailed = 100 * (iota + 1)
+	// RecordNotFound occurs when a SQL query targeting on one unique
+	// record failes to update the specified row in the table.
+	RecordNotFound
+)
+
+// NewError provided the given category, reason, returns an Error.
+func NewError(category Category, reason Reason) *Error {
+	errorCode := int(category) + int(reason)
+	var msg string
+	switch category {
+	case OCSPError:
+		switch reason {
+		case ReadFailed:
+			msg = "No certificate provided"
+		case IssuerMismatch:
+			msg = "Certificate not issued by this issuer"
+		case InvalidStatus:
+			msg = "Invalid revocation status"
+		}
+	case CertificateError:
+		switch reason {
+		case Unknown:
+			msg = "Unknown certificate error"
+		case ReadFailed:
+			msg = "Failed to read certificate"
+		case DecodeFailed:
+			msg = "Failed to decode certificate"
+		case ParseFailed:
+			msg = "Failed to parse certificate"
+		case SelfSigned:
+			msg = "Certificate is self signed"
+		case VerifyFailed:
+			msg = "Unable to verify certificate"
+		case BadRequest:
+			msg = "Invalid certificate request"
+		case MissingSerial:
+			msg = "Missing serial number in request"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category CertificateError.",
+				reason))
+
+		}
+	case PrivateKeyError:
+		switch reason {
+		case Unknown:
+			msg = "Unknown private key error"
+		case ReadFailed:
+			msg = "Failed to read private key"
+		case DecodeFailed:
+			msg = "Failed to decode private key"
+		case ParseFailed:
+			msg = "Failed to parse private key"
+		case Encrypted:
+			msg = "Private key is encrypted."
+		case NotRSAOrECC:
+			msg = "Private key algorithm is not RSA or ECC"
+		case KeyMismatch:
+			msg = "Private key does not match public key"
+		case GenerationFailed:
+			msg = "Failed to new private key"
+		case Unavailable:
+			msg = "Private key is unavailable"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category PrivateKeyError.",
+				reason))
+		}
+	case IntermediatesError:
+		switch reason {
+		case Unknown:
+			msg = "Unknown intermediate certificate error"
+		case ReadFailed:
+			msg = "Failed to read intermediate certificate"
+		case DecodeFailed:
+			msg = "Failed to decode intermediate certificate"
+		case ParseFailed:
+			msg = "Failed to parse intermediate certificate"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category IntermediatesError.",
+				reason))
+		}
+	case RootError:
+		switch reason {
+		case Unknown:
+			msg = "Unknown root certificate error"
+		case ReadFailed:
+			msg = "Failed to read root certificate"
+		case DecodeFailed:
+			msg = "Failed to decode root certificate"
+		case ParseFailed:
+			msg = "Failed to parse root certificate"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category RootError.",
+				reason))
+		}
+	case PolicyError:
+		switch reason {
+		case Unknown:
+			msg = "Unknown policy error"
+		case NoKeyUsages:
+			msg = "Invalid policy: no key usage available"
+		case InvalidPolicy:
+			msg = "Invalid or unknown policy"
+		case InvalidRequest:
+			msg = "Policy violation request"
+		case UnknownProfile:
+			msg = "Unknown policy profile"
+		case UnmatchedWhitelist:
+			msg = "Request does not match policy whitelist"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category PolicyError.",
+				reason))
+		}
+	case DialError:
+		switch reason {
+		case Unknown:
+			msg = "Failed to dial remote server"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category DialError.",
+				reason))
+		}
+	case APIClientError:
+		switch reason {
+		case AuthenticationFailure:
+			msg = "API client authentication failure"
+		case JSONError:
+			msg = "API client JSON config error"
+		case ClientHTTPError:
+			msg = "API client HTTP error"
+		case IOError:
+			msg = "API client IO error"
+		case ServerRequestFailed:
+			msg = "API client error: Server request failed"
+		default:
+			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category APIClientError.",
+				reason))
+		}
+	case CSRError:
+		switch reason {
+		case Unknown:
+			msg = "CSR parsing failed due to unknown error"
+		case ReadFailed:
+			msg = "CSR file read failed"
+		case ParseFailed:
+			msg = "CSR Parsing failed"
+		case DecodeFailed:
+			msg = "CSR Decode failed"
+		case BadRequest:
+			msg = "CSR Bad request"
+		default:
+			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category APIClientError.", reason))
+		}
+	case CTError:
+		switch reason {
+		case Unknown:
+			msg = "Certificate transparency parsing failed due to unknown error"
+		case PrecertSubmissionFailed:
+			msg = "Certificate transparency precertificate submission failed"
+		case PrecertMissingPoison:
+			msg = "Precertificate is missing CT poison extension"
+		case PrecertInvalidPoison:
+			msg = "Precertificate contains an invalid CT poison extension"
+		default:
+			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category CTError.", reason))
+		}
+	case CertStoreError:
+		switch reason {
+		case Unknown:
+			msg = "Certificate store action failed due to unknown error"
+		default:
+			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category CertStoreError.", reason))
+		}
+
+	default:
+		panic(fmt.Sprintf("Unsupported CFSSL error type: %d.",
+			category))
+	}
+
+	return &Error{ErrorCode: errorCode, Message: msg}
+}
+
+// Wrap returns an error that contains the given error and an error code derived from
+// the given category, reason and the error. Currently, to avoid confusion, it is not
+// allowed to create an error of category Success
+func WrapError(category Category, reason Reason, err error) *Error {
+	errorCode := int(category) + int(reason)
+	if err == nil {
+		panic("Wrap needs a supplied error to initialize.")
+	}
+
+	// do not double wrap a error
+	switch err.(type) {
+	case *Error:
+		panic("Unable to wrap a wrapped error.")
+	}
+
+	switch category {
+	case CertificateError:
+		// given VerifyFailed , report the status with more detailed status code
+		// for some certificate errors we care.
+		if reason == VerifyFailed {
+			switch errorType := err.(type) {
+			case x509.CertificateInvalidError:
+				errorCode += certificateInvalid + int(errorType.Reason)
+			case x509.UnknownAuthorityError:
+				errorCode += unknownAuthority
+			}
+		}
+	case PrivateKeyError, IntermediatesError, RootError, PolicyError, DialError,
+		APIClientError, CSRError, CTError, CertStoreError, OCSPError:
+	// no-op, just use the error
+	default:
+		panic(fmt.Sprintf("Unsupported CFSSL error type: %d.",
+			category))
+	}
+
+	return &Error{ErrorCode: errorCode, Message: err.Error()}
+
+}
+
+var (
+	ErrFailedGetCRL = errors.New("failed to retrieve CRL")
+)

vendor/github.com/go-webauthn/x/revoke/helpers.go

@@ -0,0 +1,76 @@
+package revoke
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"net/url"
+)
+
+// ParseCertificatePEM parses and returns a PEM-encoded certificate,
+// can handle PEM encoded PKCS #7 structures.
+func ParseCertificatePEM(certPEM []byte) (*x509.Certificate, error) {
+	certPEM = bytes.TrimSpace(certPEM)
+	cert, rest, err := ParseOneCertificateFromPEM(certPEM)
+	if err != nil {
+		// Log the actual parsing error but throw a default parse error message.
+		return nil, NewError(CertificateError, ParseFailed)
+	} else if cert == nil {
+		return nil, NewError(CertificateError, DecodeFailed)
+	} else if len(rest) > 0 {
+		return nil, WrapError(CertificateError, ParseFailed, errors.New("the PEM file should contain only one object"))
+	} else if len(cert) > 1 {
+		return nil, WrapError(CertificateError, ParseFailed, errors.New("the PKCS7 object in the PEM file should contain only one certificate"))
+	}
+
+	return cert[0], nil
+}
+
+// ParseOneCertificateFromPEM attempts to parse one PEM encoded certificate object,
+// either a raw x509 certificate or a PKCS #7 structure possibly containing
+// multiple certificates, from the top of certsPEM, which itself may
+// contain multiple PEM encoded certificate objects.
+func ParseOneCertificateFromPEM(certsPEM []byte) ([]*x509.Certificate, []byte, error) {
+	block, rest := pem.Decode(certsPEM)
+	if block == nil {
+		return nil, rest, nil
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		var pkcs7data *PKCS7
+
+		if pkcs7data, err = ParsePKCS7(block.Bytes); err != nil {
+			return nil, rest, err
+		}
+
+		if pkcs7data.ContentInfo != "SignedData" {
+			return nil, rest, errors.New("only PKCS #7 Signed Data Content Info supported for certificate parsing")
+		}
+
+		certs := pkcs7data.Content.SignedData.Certificates
+		if certs == nil {
+			return nil, rest, errors.New("PKCS #7 structure contains no certificates")
+		}
+
+		return certs, rest, nil
+	}
+
+	return []*x509.Certificate{cert}, rest, nil
+}
+
+// We can't handle LDAP certificates, so this checks to see if the
+// URL string points to an LDAP resource so that we can ignore it.
+func ldapURL(uri string) bool {
+	u, err := url.Parse(uri)
+	if err != nil {
+		return false
+	}
+
+	if u.Scheme == "ldap" {
+		return true
+	}
+
+	return false
+}

vendor/github.com/go-webauthn/x/revoke/pkcs7.go

@@ -0,0 +1,185 @@
+// Package pkcs7 implements the subset of the CMS PKCS #7 datatype that is typically
+// used to package certificates and CRLs.  Using openssl, every certificate converted
+// to PKCS #7 format from another encoding such as PEM conforms to this implementation.
+// reference: https://www.openssl.org/docs/man1.1.0/apps/crl2pkcs7.html
+//
+//	PKCS #7 Data type, reference: https://tools.ietf.org/html/rfc2315
+//
+// The full pkcs#7 cryptographic message syntax allows for cryptographic enhancements,
+// for example data can be encrypted and signed and then packaged through pkcs#7 to be
+// sent over a network and then verified and decrypted.  It is asn1, and the type of
+// PKCS #7 ContentInfo, which comprises the PKCS #7 structure, is:
+//
+//	ContentInfo ::= SEQUENCE {
+//		contentType ContentType,
+//		content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
+//	}
+//
+// There are 6 possible ContentTypes, data, signedData, envelopedData,
+// signedAndEnvelopedData, digestedData, and encryptedData.  Here signedData, Data, and encrypted
+// Data are implemented, as the degenerate case of signedData without a signature is the typical
+// format for transferring certificates and CRLS, and Data and encryptedData are used in PKCS #12
+// formats.
+// The ContentType signedData has the form:
+//
+//	signedData ::= SEQUENCE {
+//		version Version,
+//		digestAlgorithms DigestAlgorithmIdentifiers,
+//		contentInfo ContentInfo,
+//		certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL
+//		crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
+//		signerInfos SignerInfos
+//	}
+//
+// As of yet signerInfos and digestAlgorithms are not parsed, as they are not relevant to
+// this system's use of PKCS #7 data.  Version is an integer type, note that PKCS #7 is
+// recursive, this second layer of ContentInfo is similar ignored for our degenerate
+// usage.  The ExtendedCertificatesAndCertificates type consists of a sequence of choices
+// between PKCS #6 extended certificates and x509 certificates.  Any sequence consisting
+// of any number of extended certificates is not yet supported in this implementation.
+//
+// The ContentType Data is simply a raw octet string and is parsed directly into a Go []byte slice.
+//
+// The ContentType encryptedData is the most complicated and its form can be gathered by
+// the go type below.  It essentially contains a raw octet string of encrypted data and an
+// algorithm identifier for use in decrypting this data.
+package revoke
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+)
+
+// Types used for asn1 Unmarshaling.
+
+type signedData struct {
+	Version          int
+	DigestAlgorithms asn1.RawValue
+	ContentInfo      asn1.RawValue
+	Certificates     asn1.RawValue `asn1:"optional" asn1:"tag:0"`
+	Crls             asn1.RawValue `asn1:"optional"`
+	SignerInfos      asn1.RawValue
+}
+
+type initPKCS7 struct {
+	Raw         asn1.RawContent
+	ContentType asn1.ObjectIdentifier
+	Content     asn1.RawValue `asn1:"tag:0,explicit,optional"`
+}
+
+// Object identifier strings of the three implemented PKCS7 types.
+const (
+	ObjIDData          = "1.2.840.113549.1.7.1"
+	ObjIDSignedData    = "1.2.840.113549.1.7.2"
+	ObjIDEncryptedData = "1.2.840.113549.1.7.6"
+)
+
+// PKCS7 represents the ASN1 PKCS #7 Content type.  It contains one of three
+// possible types of Content objects, as denoted by the object identifier in
+// the ContentInfo field, the other two being nil.  SignedData
+// is the degenerate SignedData Content info without signature used
+// to hold certificates and crls.  Data is raw bytes, and EncryptedData
+// is as defined in PKCS #7 standard.
+type PKCS7 struct {
+	Raw         asn1.RawContent
+	ContentInfo string
+	Content     Content
+}
+
+// Content implements three of the six possible PKCS7 data types. Only one is non-nil.
+type Content struct {
+	Data          []byte
+	SignedData    SignedData
+	EncryptedData EncryptedData
+}
+
+// SignedData defines the typical carrier of certificates and CRLs.
+type SignedData struct {
+	Raw          asn1.RawContent
+	Version      int
+	Certificates []*x509.Certificate
+	Crl          *pkix.CertificateList
+}
+
+// Data contains raw bytes.  Used as a subtype in PKCS12.
+type Data struct {
+	Bytes []byte
+}
+
+// EncryptedData contains encrypted data.  Used as a subtype in PKCS12.
+type EncryptedData struct {
+	Raw                  asn1.RawContent
+	Version              int
+	EncryptedContentInfo EncryptedContentInfo
+}
+
+// EncryptedContentInfo is a subtype of PKCS7EncryptedData.
+type EncryptedContentInfo struct {
+	Raw                        asn1.RawContent
+	ContentType                asn1.ObjectIdentifier
+	ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedContent           []byte `asn1:"tag:0,optional"`
+}
+
+// ParsePKCS7 attempts to parse the DER encoded bytes of a
+// PKCS7 structure.
+func ParsePKCS7(raw []byte) (msg *PKCS7, err error) {
+	var pkcs7 initPKCS7
+
+	_, err = asn1.Unmarshal(raw, &pkcs7)
+	if err != nil {
+		return nil, WrapError(CertificateError, ParseFailed, err)
+	}
+
+	msg = new(PKCS7)
+	msg.Raw = pkcs7.Raw
+	msg.ContentInfo = pkcs7.ContentType.String()
+	switch {
+	case msg.ContentInfo == ObjIDData:
+		msg.ContentInfo = "Data"
+		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &msg.Content.Data)
+		if err != nil {
+			return nil, WrapError(CertificateError, ParseFailed, err)
+		}
+	case msg.ContentInfo == ObjIDSignedData:
+		msg.ContentInfo = "SignedData"
+		var signedData signedData
+		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &signedData)
+		if err != nil {
+			return nil, WrapError(CertificateError, ParseFailed, err)
+		}
+		if len(signedData.Certificates.Bytes) != 0 {
+			msg.Content.SignedData.Certificates, err = x509.ParseCertificates(signedData.Certificates.Bytes)
+			if err != nil {
+				return nil, WrapError(CertificateError, ParseFailed, err)
+			}
+		}
+		if len(signedData.Crls.Bytes) != 0 {
+			msg.Content.SignedData.Crl, err = x509.ParseDERCRL(signedData.Crls.Bytes)
+			if err != nil {
+				return nil, WrapError(CertificateError, ParseFailed, err)
+			}
+		}
+		msg.Content.SignedData.Version = signedData.Version
+		msg.Content.SignedData.Raw = pkcs7.Content.Bytes
+	case msg.ContentInfo == ObjIDEncryptedData:
+		msg.ContentInfo = "EncryptedData"
+		var encryptedData EncryptedData
+		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &encryptedData)
+		if err != nil {
+			return nil, WrapError(CertificateError, ParseFailed, err)
+		}
+		if encryptedData.Version != 0 {
+			return nil, WrapError(CertificateError, ParseFailed, errors.New("Only support for PKCS #7 encryptedData version 0"))
+		}
+		msg.Content.EncryptedData = encryptedData
+
+	default:
+		return nil, WrapError(CertificateError, ParseFailed, errors.New("Attempt to parse PKCS# 7 Content not of type data, signed data or encrypted data"))
+	}
+
+	return msg, nil
+
+}

vendor/github.com/go-webauthn/x/revoke/revoke.go

@@ -0,0 +1,240 @@
+package revoke
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"golang.org/x/crypto/ocsp"
+)
+
+// revCheck should check the certificate for any revocations. It
+// returns a pair of booleans: the first indicates whether the certificate
+// is revoked, the second indicates whether the revocations were
+// successfully checked.. This leads to the following combinations:
+//
+//	false, false: an error was encountered while checking revocations.
+//
+//	false, true:  the certificate was checked successfully and
+//	                it is not revoked.
+//
+//	true, true:   the certificate was checked successfully and
+//	                it is revoked.
+//
+//	true, false:  failure to check revocation status causes
+//	                verification to fail
+func revCheck(cert *x509.Certificate) (revoked, ok bool, err error) {
+	for _, uri := range cert.CRLDistributionPoints {
+		if ldapURL(uri) {
+			continue
+		}
+
+		if revoked, ok, err = certIsRevokedCRL(cert, uri); !ok {
+			if HardFail {
+				return true, false, err
+			}
+			return false, false, err
+		} else if revoked {
+			return true, true, err
+		}
+	}
+
+	if revoked, ok, err = certIsRevokedOCSP(cert, HardFail); !ok {
+		if HardFail {
+			return true, false, err
+		}
+
+		return false, false, err
+	} else if revoked {
+		return true, true, err
+	}
+
+	return false, true, nil
+}
+
+func getIssuer(cert *x509.Certificate) (issuer *x509.Certificate) {
+	var (
+		uri string
+		err error
+	)
+
+	for _, uri = range cert.IssuingCertificateURL {
+		issuer, err = fetchRemote(uri)
+		if err != nil {
+			continue
+		}
+		break
+	}
+
+	return issuer
+}
+
+// VerifyCertificate ensures that the certificate passed in hasn't
+// expired and checks the CRL for the server.
+func VerifyCertificate(cert *x509.Certificate) (revoked, ok bool) {
+	revoked, ok, _ = VerifyCertificateError(cert)
+
+	return revoked, ok
+}
+
+// VerifyCertificateError ensures that the certificate passed in hasn't
+// expired and checks the CRL for the server.
+func VerifyCertificateError(cert *x509.Certificate) (revoked, ok bool, err error) {
+	if !time.Now().Before(cert.NotAfter) {
+		return true, true, fmt.Errorf("Certificate expired %s\n", cert.NotAfter)
+	} else if !time.Now().After(cert.NotBefore) {
+		return true, true, fmt.Errorf("Certificate isn't valid until %s\n", cert.NotBefore)
+	}
+	return revCheck(cert)
+}
+
+func fetchRemote(url string) (*x509.Certificate, error) {
+	resp, err := HTTPClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	in, err := remoteRead(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	p, _ := pem.Decode(in)
+	if p != nil {
+		return ParseCertificatePEM(in)
+	}
+
+	return x509.ParseCertificate(in)
+}
+
+func certIsRevokedOCSP(leaf *x509.Certificate, strict bool) (revoked, ok bool, e error) {
+	var err error
+
+	ocspURLs := leaf.OCSPServer
+	if len(ocspURLs) == 0 {
+		// OCSP not enabled for this certificate.
+		return false, true, nil
+	}
+
+	issuer := getIssuer(leaf)
+
+	if issuer == nil {
+		return false, false, nil
+	}
+
+	ocspRequest, err := ocsp.CreateRequest(leaf, issuer, &ocspOpts)
+	if err != nil {
+		return revoked, ok, err
+	}
+
+	for _, server := range ocspURLs {
+		resp, err := sendOCSPRequest(server, ocspRequest, leaf, issuer)
+		if err != nil {
+			if strict {
+				return revoked, ok, err
+			}
+			continue
+		}
+
+		// There wasn't an error fetching the OCSP status.
+		ok = true
+
+		if resp.Status != ocsp.Good {
+			// The certificate was revoked.
+			revoked = true
+		}
+
+		return revoked, ok, err
+	}
+	return revoked, ok, err
+}
+
+// sendOCSPRequest attempts to request an OCSP response from the
+// server. The error only indicates a failure to *fetch* the
+// certificate, and *does not* mean the certificate is valid.
+func sendOCSPRequest(server string, req []byte, leaf, issuer *x509.Certificate) (r *ocsp.Response, err error) {
+	var resp *http.Response
+
+	if len(req) > 256 {
+		buf := bytes.NewBuffer(req)
+		resp, err = HTTPClient.Post(server, "application/ocsp-request", buf)
+	} else {
+		reqURL := server + "/" + url.QueryEscape(base64.StdEncoding.EncodeToString(req))
+		resp, err = HTTPClient.Get(reqURL)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.New("failed to retrieve OSCP")
+	}
+
+	body, err := ocspRead(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	switch {
+	case bytes.Equal(body, ocsp.UnauthorizedErrorResponse):
+		return nil, errors.New("OSCP unauthorized")
+	case bytes.Equal(body, ocsp.MalformedRequestErrorResponse):
+		return nil, errors.New("OSCP malformed")
+	case bytes.Equal(body, ocsp.InternalErrorErrorResponse):
+		return nil, errors.New("OSCP internal error")
+	case bytes.Equal(body, ocsp.TryLaterErrorResponse):
+		return nil, errors.New("OSCP try later")
+	case bytes.Equal(body, ocsp.SigRequredErrorResponse):
+		return nil, errors.New("OSCP signature required")
+	}
+
+	return ocsp.ParseResponseForCert(body, leaf, issuer)
+}
+
+var (
+	// HTTPClient is an instance of http.Client that will be used for all HTTP requests.
+	HTTPClient = http.DefaultClient
+
+	// HardFail determines whether the failure to check the revocation
+	// status of a certificate (i.e. due to network failure) causes
+	// verification to fail (a hard failure).
+	HardFail = false
+
+	crlRead    = io.ReadAll
+	remoteRead = io.ReadAll
+	ocspRead   = io.ReadAll
+
+	ocspOpts = ocsp.RequestOptions{
+		Hash: crypto.SHA1,
+	}
+
+	crlLock = new(sync.Mutex)
+)
+
+// SetCRLFetcher sets the function to use to read from the http response body
+func SetCRLFetcher(fn func(io.Reader) ([]byte, error)) {
+	crlRead = fn
+}
+
+// SetRemoteFetcher sets the function to use to read from the http response body
+func SetRemoteFetcher(fn func(io.Reader) ([]byte, error)) {
+	remoteRead = fn
+}
+
+// SetOCSPFetcher sets the function to use to read from the http response body
+func SetOCSPFetcher(fn func(io.Reader) ([]byte, error)) {
+	ocspRead = fn
+}

vendor/github.com/go-webauthn/x/revoke/revoke_legacy.go

@@ -0,0 +1,87 @@
+//go:build !go1.19
+
+package revoke
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"time"
+)
+
+// CRLSet associates a PKIX certificate list with the URL the CRL is
+// fetched from.
+var (
+	CRLSet = map[string]*pkix.CertificateList{}
+)
+
+// fetchCRL fetches and parses a CRL.
+func fetchCRL(url string) (*pkix.CertificateList, error) {
+	resp, err := HTTPClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 300 {
+		return nil, ErrFailedGetCRL
+	}
+
+	body, err := crlRead(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	return x509.ParseCRL(body)
+}
+
+// check a cert against a specific CRL. Returns the same bool pair
+// as revCheck, plus an error if one occurred.
+func certIsRevokedCRL(cert *x509.Certificate, url string) (revoked, ok bool, err error) {
+	var crl *pkix.CertificateList
+
+	crlLock.Lock()
+
+	if crl, ok = CRLSet[url]; ok && crl == nil {
+		ok = false
+
+		delete(CRLSet, url)
+	}
+
+	crlLock.Unlock()
+
+	var shouldFetchCRL = true
+
+	if ok && !crl.HasExpired(time.Now()) {
+		shouldFetchCRL = false
+	}
+
+	issuer := getIssuer(cert)
+
+	if shouldFetchCRL {
+		if crl, err = fetchCRL(url); err != nil {
+			return false, false, err
+		}
+
+		// Check the CRL signature.
+		if issuer != nil {
+			if err = issuer.CheckCRLSignature(crl); err != nil {
+				return false, false, err
+			}
+		}
+
+		crlLock.Lock()
+		CRLSet[url] = crl
+		crlLock.Unlock()
+	}
+
+	var rc pkix.RevokedCertificate
+
+	for _, rc = range crl.TBSCertList.RevokedCertificates {
+		if cert.SerialNumber.Cmp(rc.SerialNumber) == 0 {
+			return true, true, err
+		}
+	}
+
+	return false, true, err
+}

vendor/github.com/go-webauthn/x/revoke/revoke_modern.go

@@ -0,0 +1,84 @@
+//go:build go1.19
+
+package revoke
+
+import (
+	"crypto/x509"
+	"time"
+)
+
+// CRLSet associates a PKIX certificate list with the URL the CRL is
+// fetched from.
+var (
+	CRLSet = map[string]*x509.RevocationList{}
+)
+
+// fetchCRL fetches and parses a CRL.
+func fetchCRL(url string) (*x509.RevocationList, error) {
+	resp, err := HTTPClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 300 {
+		return nil, ErrFailedGetCRL
+	}
+
+	body, err := crlRead(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	return x509.ParseRevocationList(body)
+}
+
+// check a cert against a specific CRL. Returns the same bool pair
+// as revCheck, plus an error if one occurred.
+func certIsRevokedCRL(cert *x509.Certificate, url string) (revoked, ok bool, err error) {
+	var crl *x509.RevocationList
+
+	crlLock.Lock()
+
+	if crl, ok = CRLSet[url]; ok && crl == nil {
+		ok = false
+
+		delete(CRLSet, url)
+	}
+
+	crlLock.Unlock()
+
+	var shouldFetchCRL = true
+
+	if ok && time.Now().Before(crl.NextUpdate) {
+		shouldFetchCRL = false
+	}
+
+	issuer := getIssuer(cert)
+
+	if shouldFetchCRL {
+		if crl, err = fetchCRL(url); err != nil {
+			return false, false, err
+		}
+
+		// Check the CRL signature.
+		if issuer != nil {
+			if err = crl.CheckSignatureFrom(issuer); err != nil {
+				return false, false, err
+			}
+		}
+
+		crlLock.Lock()
+		CRLSet[url] = crl
+		crlLock.Unlock()
+	}
+
+	for _, rcert := range crl.RevokedCertificates {
+		if cert.SerialNumber.Cmp(rcert.SerialNumber) == 0 {
+			return true, true, err
+		}
+	}
+
+	return false, true, err
+}