MadWizard\WebAuthn\Server\Registration\RegistrationVerifier::verify()

Complexity

Conditions	2
Paths	3

Size

Total Lines	57
Code Lines	16

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	14
CRAP Score	2.0078

Importance

Changes

0

<?php
    public function verify(PublicKeyCredentialInterface $credential, RegistrationContext $context): RegistrationResult
    {
        // SPEC 7.1 Registering a new credential
        $response = $credential->getResponse()->asAttestationResponse();

        // 1. Let JSONtext be the result of running UTF-8 decode on the value of response.clientDataJSON.
        // 2. Let C, the client data claimed as collected during the credential creation, be the result of running an
        //    implementation-specific JSON parser on JSONtext.
        // 3 - 6
        $clientData = $response->getParsedClientData();
        $this->checkClientData($clientData, $context);

        // 7. Compute the hash of response.clientDataJSON using SHA-256.
        $clientDataHash = $this->getClientDataHash($response);

        // 8. Perform CBOR decoding on the attestationObject field of the AuthenticatorAttestationResponse structure to
        //    obtain the attestation statement format fmt, the authenticator data authData, and the attestation
        //    statement attStmt.

        $attestation = AttestationObject::parse($response->getAttestationObject());
        $authData = new AuthenticatorData($attestation->getAuthenticatorData());

        $extensionContext = $this->processExtensions($credential, $authData, $context, ExtensionInterface::OPERATION_REGISTRATION);

        // 9 - 11
        $this->checkAuthenticatorData($authData, $context, $extensionContext);

        // 12. Verify that the values of the client extension outputs in clientExtensionResults and the authenticator
        //     extension outputs in the extensions in authData are as expected, considering the client extension input
        //     values that were given as the extensions option in the create() call. In particular, any extension
        //     identifier values in the clientExtensionResults and the extensions in authData MUST be also be present
        //     as extension identifier values in the extensions member of options, i.e., no extensions are present that
        //     were not requested. In the general case, the meaning of "are as expected" is specific to the
        //     Relying Party and which extensions are in use.
        //     Note: Since all extensions are OPTIONAL for both the client and the authenticator, the Relying Party MUST
        //     be prepared to handle cases where none or not all of the requested extensions were acted upon.

        // -> This is already checked in processExtensions above, the extensions need to be processed earlier because
        // extensions such as appid affect the effective rpId

        // 13. Determine the attestation statement format by performing a USASCII case-sensitive match on fmt against
        //     the set of supported WebAuthn Attestation Statement Format Identifier values.
        $format = $attestation->getFormat();

        try {
            $statement = $this->formatRegistry->createStatement($attestation);
            $verifier = $this->formatRegistry->getVerifier($attestation->getFormat());
        } catch (FormatNotSupportedException $e) {
            throw new VerificationException(sprintf("Attestation format '%s' not supported", $format), 0, $e);
        }

        // 14. Verify that attStmt is a correct attestation statement, conveying a valid attestation signature, by
        //     using the attestation statement format fmt’s verification procedure given attStmt, authData and the hash
        //     of the serialized client data computed in step 7.
        $verificationResult = $verifier->verify($statement, $authData, $clientDataHash);

        return new RegistrationResult(CredentialId::fromBuffer($credential->getRawId()), $authData, $attestation, $verificationResult, $context->getUserHandle());
    }