Merge branch 'PM-5731-create-c-web-authn-authenticator-to-support-maui-apps' of https://github.com/bitwarden/mobile into PM-5731-create-c-web-authn-authenticator-to-support-maui-apps

src/Core/Abstractions/IFido2ClientService.cs

@@ -0,0 +1,35 @@
+using Bit.Core.Utilities.Fido2;
+
+namespace Bit.Core.Abstractions
+{
+    /// <summary>
+    /// This class represents an abstraction of the WebAuthn Client as described by W3C:
+    /// https://www.w3.org/TR/webauthn-3/#webauthn-client
+    ///
+    /// The WebAuthn Client is an intermediary entity typically implemented in the user agent
+    /// (in whole, or in part). Conceptually, it underlies the Web Authentication API and embodies
+    /// the implementation of the Web Authentication API's operations.
+    ///
+    /// It is responsible for both marshalling the inputs for the underlying authenticator operations,
+    /// and for returning the results of the latter operations to the Web Authentication API's callers.
+    /// </summary>
+    public interface IFido2ClientService
+    {
+        /// <summary>
+        /// Allows WebAuthn Relying Party scripts to request the creation of a new public key credential source.
+        /// For more information please see: https://www.w3.org/TR/webauthn-3/#sctn-createCredential
+        /// </summary>
+        /// <param name="createCredentialParams">The parameters for the credential creation operation</param>
+        /// <returns>The new credential</returns>
+        Task<Fido2ClientCreateCredentialResult> CreateCredentialAsync(Fido2ClientCreateCredentialParams createCredentialParams);
+
+        /// <summary>
+        /// Allows WebAuthn Relying Party scripts to discover and use an existing public key credential, with the user’s consent.
+        /// Relying Party script can optionally specify some criteria to indicate what credential sources are acceptable to it.
+        /// For more information please see: https://www.w3.org/TR/webauthn-3/#sctn-getAssertion
+        /// </summary>
+        /// <param name="assertCredentialParams">The parameters for the credential assertion operation</param>
+        /// <returns>The asserted credential</returns>
+        Task<Fido2ClientAssertCredentialResult> AssertCredentialAsync(Fido2ClientAssertCredentialParams assertCredentialParams);
+    }
+}

src/Core/Services/Fido2AuthenticatorService.cs

@@ -128,6 +128,7 @@ namespace Bit.Core.Services
             string selectedCipherId;
             bool userVerified;
             bool userPresence;
+            // TODO: We might want reconsider allowing user presence to be optional
             if (assertionParams.AllowCredentialDescriptorList?.Length == 1 && assertionParams.RequireUserPresence == false)
             {
                 selectedCipherId = cipherOptions[0].Id;

src/Core/Services/Fido2ClientService.cs

@@ -0,0 +1,12 @@
+using Bit.Core.Abstractions;
+using Bit.Core.Utilities.Fido2;
+
+namespace Bit.Core.Services
+{
+    public class Fido2ClientService : IFido2ClientService
+    {
+        public Task<Fido2ClientCreateCredentialResult> CreateCredentialAsync(Fido2ClientCreateCredentialParams createCredentialParams) => throw new NotImplementedException();
+
+        public Task<Fido2ClientAssertCredentialResult> AssertCredentialAsync(Fido2ClientAssertCredentialParams assertCredentialParams) => throw new NotImplementedException();
+    }
+}

src/Core/Utilities/Fido2/AuthenticatorSelectionCriteria.cs

@@ -0,0 +1,18 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    #nullable enable
+    /// <summary>
+    /// The Relying Party's requirements of the authenticator used in the creation of the credential.
+    /// </summary>
+    public class AuthenticatorSelectionCriteria
+    {
+        public bool? RequireResidentKey { get; set; }
+        public string? ResidentKey { get; set; }
+        public string UserVerification { get; set; } = "preferred";
+
+        /// <summary>
+        /// This member is intended for use by Relying Parties that wish to select the appropriate authenticators to participate in the create() operation.
+        /// </summary>
+        // public AuthenticatorAttachment? AuthenticatorAttachment { get; set; } // not used
+    }
+}

src/Core/Utilities/Fido2/Fido2ClientAssertCredentialParams.cs

@@ -0,0 +1,51 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    #nullable enable
+
+    /// <summary>
+    /// Parameters for asserting a credential.
+    /// 
+    /// This class is an extended version of the WebAuthn struct:
+    /// https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialrequestoptions
+    /// </summary>
+    public class Fido2ClientAssertCredentialParams
+    {
+        /// <summary>
+        /// S challenge that the selected authenticator signs, along with other data, when producing an authentication
+        /// assertion. 
+        /// </summary>
+        public required byte[] Challenge { get; set; }
+
+        /// <summary>
+        /// The relying party identifier claimed by the caller. If omitted, its value will be the CredentialsContainer 
+        /// object's relevant settings object's origin's effective domain.
+        /// </summary>
+        public string RpId { get; set; }
+
+        /// <summary>
+        /// The Relying Party's origin (e.g., "https://example.com").
+        /// </summary>
+        public string Origin { get; set; }
+        
+        /// <summary>
+        /// A list of PublicKeyCredentialDescriptor objects representing public key credentials acceptable to the caller,
+        /// in descending order of the caller’s preference (the first item in the list is the most preferred credential,
+        /// and so on down the list).
+        /// </summary>
+        public PublicKeyCredentialDescriptor[] AllowCredentials { get; set; } = [];
+
+        /// <summary>
+        /// The Relying Party's requirements regarding user verification for the get() operation.
+        /// </summary>
+        public string UserVerification { get; set; } = "preferred";
+
+        /// <summary>
+        /// This time, in milliseconds, that the caller is willing to wait for the call to complete.
+        /// This is treated as a hint, and MAY be overridden by the client.
+        /// </summary>
+        /// <remarks>
+        /// This is not currently supported.
+        /// </remarks>
+        public int? Timeout { get; set; }
+    }
+}

src/Core/Utilities/Fido2/Fido2ClientAssertCredentialResult.cs

@@ -0,0 +1,20 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    /// <summary>
+    /// The result of asserting a credential.
+    /// 
+    /// See: https://www.w3.org/TR/webauthn-2/#publickeycredential
+    /// </summary>
+    public class Fido2ClientAssertCredentialResult
+    {
+        /// <summary>
+        /// Base64url encoding of the credential identifer.
+        /// </summary>
+        public required string Id { get; set; }
+
+        /// <summary>
+        /// The credential identifier.
+        /// </summary>
+        public required byte[] RawId { get; set; }
+    }
+}

src/Core/Utilities/Fido2/Fido2ClientAuthenticatorAssertionResponse.cs

@@ -0,0 +1,35 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    /// <summary>
+    /// This class represents an authenticator's response to a client's request for generation of a 
+    /// new authentication assertion given the WebAuthn Relying Party's challenge.
+    /// This response contains a cryptographic signature proving possession of the credential private key,
+    /// and optionally evidence of user consent to a specific transaction.
+    /// 
+    /// See: https://www.w3.org/TR/webauthn-2/#iface-authenticatorassertionresponse
+    /// </summary>
+    public class Fido2ClientAuthenticatorAssertionResponse
+    {
+        /// <summary>
+        /// The JSON-compatible serialization of client data passed to the authenticator by the client
+        /// in order to generate this assertion. The exact JSON serialization MUST be preserved, as the
+        /// hash of the serialized client data has been computed over it.
+        /// </summary>
+        public required byte[] ClientDataJSON { get; set; }
+
+        /// <summary>
+        /// The authenticator data returned by the authenticator.
+        /// </summary>
+        public required byte[] AuthenticatorData { get; set; }
+
+        /// <summary>
+        /// Raw signature returned from the authenticator.
+        /// </summary>
+        public required byte[] Signature { get; set; }
+
+        /// <summary>
+        /// The user handle returned from the authenticator, or null if the authenticator did not return a user handle. 
+        /// </summary>
+        public byte[] UserHandle { get; set; } = null;
+    }
+}

src/Core/Utilities/Fido2/Fido2ClientCreateCredentialParams.cs

@@ -0,0 +1,75 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    #nullable enable
+
+    /// <summary>
+    /// Parameters for creating a new credential.
+    /// </summary>
+    public class Fido2ClientCreateCredentialParams
+    {
+        /// <summary>
+        /// The Relaying Parties origin, see: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin
+        /// </summary>
+        public required string Origin { get; set; }
+
+        /// <summary>
+        /// A value which is true if and only if the caller’s environment settings object is same-origin with its ancestors.
+        /// It is false if caller is cross-origin.
+        /// </summary>
+        public bool SameOriginWithAncestors { get; set; }
+
+        /// <summary>
+        /// The Relying Party's preference for attestation conveyance
+        /// </summary>
+        public string? Attestation { get; set; } = "none";
+
+        /// <summary>
+        /// The Relying Party's requirements of the authenticator used in the creation of the credential.
+        /// </summary>
+        public AuthenticatorSelectionCriteria? AuthenticatorSelection { get; set; }
+
+        /// <summary>
+        /// Challenge intended to be used for generating the newly created credential's attestation object.
+        /// </summary>
+        public required byte[] Challenge { get; set; } // base64url encoded
+
+        /// <summary>
+        /// This member is intended for use by Relying Parties that wish to limit the creation of multiple credentials for
+        /// the same account on a single authenticator. The client is requested to return an error if the new credential would
+        /// be created on an authenticator that also contains one of the credentials enumerated in this parameter.
+        /// </summary>
+        public List<PublicKeyCredentialDescriptor>? ExcludeCredentials { get; set; }
+
+        /// <summary>
+        /// This member contains additional parameters requesting additional processing by the client and authenticator.
+        /// Not currently supported.
+        /// </summary>
+        public object? Extensions { get; set; }
+
+        /// <summary>
+        /// This member contains information about the desired properties of the credential to be created.
+        /// The sequence is ordered from most preferred to least preferred.
+        /// The client makes a best-effort to create the most preferred credential that it can.
+        /// </summary>
+        public required List<PublicKeyCredentialParameters> PubKeyCredParams { get; set; }
+
+        /// <summary>
+        /// Data about the Relying Party responsible for the request.
+        /// </summary>
+        public required PublicKeyCredentialRpEntity Rp { get; set; }
+
+        /// <summary>
+        /// Data about the user account for which the Relying Party is requesting attestation.
+        /// </summary>
+        public required PublicKeyCredentialUserEntity User { get; set; }
+
+        /// <summary>
+        /// This member specifies a time, in milliseconds, that the caller is willing to wait for the call to complete.
+        /// This is treated as a hint, and MAY be overridden by the client.
+        /// </summary>
+        /// <remarks>
+        /// This is not currently supported.
+        /// </remarks>
+        public int? Timeout { get; set; }
+    }
+}

src/Core/Utilities/Fido2/Fido2ClientCreateCredentialResult.cs

@@ -0,0 +1,19 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    /// <summary>
+    /// The result of creating a new credential.
+    /// 
+    /// This class is an extended version of the WebAuthn struct:
+    /// https://www.w3.org/TR/webauthn-3/#credentialcreationdata-attestationobjectresult
+    /// </summary>
+    public class Fido2ClientCreateCredentialResult
+    {
+        public byte[] CredentialId { get; set; }
+        public byte[] ClientDataJSON { get; set; }
+        public byte[] AttestationObject { get; set; }
+        public byte[] AuthData { get; set; }
+        public byte[] PublicKey { get; set; }
+        public int PublicKeyAlgorithm { get; set; }
+        public string[] Transports { get; set; }
+    }
+}

src/Core/Utilities/Fido2/PublicKeyCredentialParameters.cs

@@ -0,0 +1,15 @@
+namespace Bit.Core.Utilities.Fido2
+{
+    /// <summary>
+    /// A description of a key type and algorithm.
+    ///</example>
+    public class PublicKeyCredentialParameters 
+    {
+        public string Type { get; set; }
+
+        /// <summary>
+        /// Cose algorithm identifier, e.g. -7 for ES256.
+        /// </summary>
+        public int Alg { get; set; }
+    }
+}