-
Notifications
You must be signed in to change notification settings - Fork 114
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5e242a8
commit f2e5a91
Showing
3 changed files
with
143 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| from fido2.ctap2.pin import ClientPin | ||
| from fido2.ctap2.credman import CredentialManagement | ||
| from fido2.server import Fido2Server, to_descriptor | ||
| from fido2.client import ClientError | ||
| from . import TEST_PIN | ||
|
|
||
| import pytest | ||
| import os | ||
|
|
||
|
|
||
| rp = {"id": "example.com", "name": "Example RP"} | ||
| user = {"id": b"user_id", "name": "A. User"} | ||
| server = Fido2Server(rp) | ||
|
|
||
|
|
||
| @pytest.fixture(scope="module") | ||
| def excluded_match(dev_manager): | ||
| if dev_manager.has_ctap2(): | ||
| return "CREDENTIAL_EXCLUDED" | ||
| return "DEVICE_INELIGIBLE" | ||
|
|
||
|
|
||
| @pytest.fixture(scope="module") | ||
| def credential(dev_manager): | ||
| create_options, state = server.register_begin(user) | ||
| result = dev_manager.client.make_credential(create_options.public_key) | ||
| auth_data = server.register_complete(state, result) | ||
| return auth_data.credential_data | ||
|
|
||
|
|
||
| @pytest.fixture(scope="module") | ||
| def discoverable_credential(dev_manager): | ||
| if not dev_manager.has_ctap2(): | ||
| pytest.skip("Authenticator does not support CTAP 2") | ||
|
|
||
| create_options, state = server.register_begin( | ||
| user, | ||
| resident_key_requirement="required", | ||
| ) | ||
| result = dev_manager.client.make_credential(create_options.public_key) | ||
| auth_data = server.register_complete(state, result) | ||
| yield auth_data.credential_data | ||
|
|
||
| # Delete credential via credman, or factory reset | ||
| if CredentialManagement.is_supported(dev_manager.info): | ||
| client_pin = ClientPin(dev_manager.ctap2) | ||
| token = client_pin.get_pin_token(TEST_PIN, ClientPin.PERMISSION.CREDENTIAL_MGMT) | ||
| credman = CredentialManagement(dev_manager.ctap2, client_pin.protocol, token) | ||
| cred_id = {"id": auth_data.credential_data.credential_id, "type": "public-key"} | ||
| credman.delete_cred(cred_id) | ||
| else: | ||
| dev_manager.factory_reset(setup=True) | ||
|
|
||
|
|
||
| def test_exclude_credentials_single(credential, client, excluded_match): | ||
| create_options, state = server.register_begin(user, [credential]) | ||
| with pytest.raises(ClientError, match=excluded_match): | ||
| client.make_credential(create_options.public_key) | ||
|
|
||
|
|
||
| def test_exclude_credentials_multiple(credential, client, excluded_match): | ||
| exclude = [{"id": os.urandom(32), "type": "public-key"} for _ in range(5)] | ||
| exclude.insert(3, to_descriptor(credential)) | ||
| create_options, state = server.register_begin(user, exclude) | ||
| with pytest.raises(ClientError, match=excluded_match): | ||
| client.make_credential(create_options.public_key) | ||
|
|
||
|
|
||
| def test_exclude_credentials_others(credential, client): | ||
| exclude = [{"id": os.urandom(32), "type": "public-key"} for _ in range(5)] | ||
| create_options, state = server.register_begin(user, exclude) | ||
| client.make_credential(create_options.public_key) | ||
|
|
||
|
|
||
| def test_allow_credentials_empty(discoverable_credential, client): | ||
| request_options, state = server.authenticate_begin() | ||
| result = client.get_assertion(request_options.public_key).get_response(0) | ||
| server.authenticate_complete(state, [discoverable_credential], result) | ||
|
|
||
|
|
||
| def test_allow_credentials_single(credential, client): | ||
| credentials = [credential] | ||
| request_options, state = server.authenticate_begin(credentials) | ||
| result = client.get_assertion(request_options.public_key).get_response(0) | ||
| server.authenticate_complete(state, credentials, result) | ||
|
|
||
|
|
||
| def test_allow_credentials_multiple(credential, client): | ||
| credentials = [credential] | ||
| allow = [{"id": os.urandom(32), "type": "public-key"} for _ in range(5)] | ||
| allow.insert(3, to_descriptor(credential)) | ||
| request_options, state = server.authenticate_begin(allow) | ||
| result = client.get_assertion(request_options.public_key).get_response(0) | ||
| server.authenticate_complete(state, credentials, result) | ||
|
|
||
|
|
||
| def test_allow_credentials_ineligible(credential, client): | ||
| allow = [{"id": os.urandom(32), "type": "public-key"} for _ in range(5)] | ||
| request_options, state = server.authenticate_begin(allow) | ||
| with pytest.raises(ClientError, match="DEVICE_INELIGIBLE"): | ||
| client.get_assertion(request_options.public_key) |