ClientAssertionExtensionOutputs.java

// Copyright (c) 2018, Yubico AB
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this
//    list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
//    this list of conditions and the following disclaimer in the documentation
//    and/or other materials provided with the distribution.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package com.yubico.webauthn.data;

import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import com.fasterxml.jackson.annotation.JsonProperty;
import java.util.HashSet;
import java.util.Optional;
import java.util.Set;
import lombok.Builder;
import lombok.EqualsAndHashCode;
import lombok.NonNull;
import lombok.Value;

/**
 * Contains <a
 * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#client-extension-output">client
 * extension outputs</a> from a <code>navigator.credentials.get()</code> operation.
 *
 * <p>Note that there is no guarantee that any extension input present in {@link
 * AssertionExtensionInputs} will have a corresponding output present here.
 *
 * <p>The authenticator extension outputs are contained in the {@link AuthenticatorData} structure.
 *
 * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-extensions">§9. WebAuthn
 *     Extensions</a>
 */
@Value
@Builder(toBuilder = true)
@JsonIgnoreProperties(ignoreUnknown = true)
public class ClientAssertionExtensionOutputs implements ClientExtensionOutputs {

  /**
   * The extension output for the FIDO AppID Extension (<code>appid</code>), if any.
   *
   * <p>This value should be ignored because its behaviour is underspecified, see: <a
   * href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
   *
   * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
   *     FIDO AppID Extension (appid)</a>
   */
  private final Boolean appid;

  private final Extensions.LargeBlob.LargeBlobAuthenticationOutput largeBlob;

  private final Extensions.Prf.PrfAuthenticationOutput prf;

  @JsonCreator
  private ClientAssertionExtensionOutputs(
      @JsonProperty("appid") Boolean appid,
      @JsonProperty("largeBlob") Extensions.LargeBlob.LargeBlobAuthenticationOutput largeBlob,
      @JsonProperty("prf") Extensions.Prf.PrfAuthenticationOutput prf) {
    this.appid = appid;
    this.largeBlob = largeBlob;
    this.prf = prf;
  }

  @Override
  @EqualsAndHashCode.Include
  public Set<String> getExtensionIds() {
    HashSet<String> ids = new HashSet<>();
    if (appid != null) {
      ids.add(Extensions.Appid.EXTENSION_ID);
    }
    if (largeBlob != null) {
      ids.add(Extensions.LargeBlob.EXTENSION_ID);
    }
    if (prf != null) {
      ids.add(Extensions.Prf.EXTENSION_ID);
    }
    return ids;
  }

  /**
   * The extension output for the FIDO AppID Extension (<code>appid</code>), if any.
   *
   * <p>This value should be ignored because its behaviour is underspecified, see: <a
   * href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
   *
   * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
   *     FIDO AppID Extension (appid)</a>
   */
  public Optional<Boolean> getAppid() {
    return Optional.ofNullable(appid);
  }

  /**
   * The extension output for the <a
   * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">Large blob
   * storage (<code>largeBlob</code>) extension</a>, if any.
   *
   * @see com.yubico.webauthn.data.Extensions.LargeBlob.LargeBlobAuthenticationOutput
   * @see <a
   *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.Large
   *     blob storage extension (largeBlob)</a>
   */
  public Optional<Extensions.LargeBlob.LargeBlobAuthenticationOutput> getLargeBlob() {
    return Optional.ofNullable(largeBlob);
  }

  /**
   * The extension output for the <a
   * href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">Pseudo-random function
   * (<code>prf</code>) extension</a>, if any.
   *
   * @since 2.7.0
   * @see com.yubico.webauthn.data.Extensions.Prf.PrfAuthenticationOutput
   * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
   *     Pseudo-random function extension (prf)</a>
   */
  public Optional<Extensions.Prf.PrfAuthenticationOutput> getPrf() {
    return Optional.ofNullable(prf);
  }

  public static class ClientAssertionExtensionOutputsBuilder {

    /**
     * The extension output for the FIDO AppID Extension (<code>appid</code>).
     *
     * <p>This value should be ignored because its behaviour is underspecified, see: <a
     * href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
     *     FIDO AppID Extension (appid)</a>
     */
    public ClientAssertionExtensionOutputsBuilder appid(@NonNull Optional<Boolean> appid) {
      this.appid = appid.orElse(null);
      return this;
    }

    /*
     * Workaround, see: https://github.com/rzwitserloot/lombok/issues/2623#issuecomment-714816001
     * Consider reverting this workaround if Lombok fixes that issue.
     */
    private ClientAssertionExtensionOutputsBuilder appid(Boolean appid) {
      return this.appid(Optional.ofNullable(appid));
    }

    /**
     * The extension output for the FIDO AppID Extension (<code>appid</code>).
     *
     * <p>This value should be ignored because its behaviour is underspecified, see: <a
     * href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
     *     FIDO AppID Extension (appid)</a>
     */
    public ClientAssertionExtensionOutputsBuilder appid(boolean appid) {
      return this.appid(Optional.of(appid));
    }
  }
}













Active mutators

CONDITIONALS_BOUNDARY
EMPTY_RETURNS
FALSE_RETURNS
INCREMENTS
INVERT_NEGS
MATH
NEGATE_CONDITIONALS
NULL_RETURNS
PRIMITIVE_RETURNS
TRUE_RETURNS
VOID_METHOD_CALLS

Tests examined

com.yubico.webauthn.data.ExtensionsSpec (229 ms)
com.yubico.webauthn.data.BuildersSpec (465 ms)
com.yubico.webauthn.RelyingPartyV2AssertionSpec (725 ms)
com.yubico.webauthn.RelyingPartyAssertionSpec (1337 ms)
com.yubico.webauthn.data.JsonIoSpec (4556 ms)
com.yubico.webauthn.data.AuthenticatorDataSpec (79 ms)
com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest.itHasTheseBuilderMethods(com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest) (0 ms)

Report generated by PIT 1.15.0

1		// Copyright (c) 2018, Yubico AB
2		// All rights reserved.
3		//
4		// Redistribution and use in source and binary forms, with or without
5		// modification, are permitted provided that the following conditions are met:
6		//
7		// 1. Redistributions of source code must retain the above copyright notice, this
8		// list of conditions and the following disclaimer.
9		//
10		// 2. Redistributions in binary form must reproduce the above copyright notice,
11		// this list of conditions and the following disclaimer in the documentation
12		// and/or other materials provided with the distribution.
13		//
14		// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15		// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16		// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17		// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
18		// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19		// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20		// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
21		// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22		// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23		// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
25		package com.yubico.webauthn.data;
26
27		import com.fasterxml.jackson.annotation.JsonCreator;
28		import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
29		import com.fasterxml.jackson.annotation.JsonProperty;
30		import java.util.HashSet;
31		import java.util.Optional;
32		import java.util.Set;
33		import lombok.Builder;
34		import lombok.EqualsAndHashCode;
35		import lombok.NonNull;
36		import lombok.Value;
37
38		/**
39		* Contains <a
40		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#client-extension-output">client
41		* extension outputs</a> from a <code>navigator.credentials.get()</code> operation.
42		*
43		* <p>Note that there is no guarantee that any extension input present in {@link
44		* AssertionExtensionInputs} will have a corresponding output present here.
45		*
46		* <p>The authenticator extension outputs are contained in the {@link AuthenticatorData} structure.
47		*
48		* @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-extensions">§9. WebAuthn
49		* Extensions</a>
50		*/
51		@Value
52		@Builder(toBuilder = true)
53		@JsonIgnoreProperties(ignoreUnknown = true)
54		public class ClientAssertionExtensionOutputs implements ClientExtensionOutputs {
55
56		/**
57		* The extension output for the FIDO AppID Extension (<code>appid</code>), if any.
58		*
59		* <p>This value should be ignored because its behaviour is underspecified, see: <a
60		* href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
61		*
62		* @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
63		* FIDO AppID Extension (appid)</a>
64		*/
65		private final Boolean appid;
66
67		private final Extensions.LargeBlob.LargeBlobAuthenticationOutput largeBlob;
68
69		private final Extensions.Prf.PrfAuthenticationOutput prf;
70
71		@JsonCreator
72		private ClientAssertionExtensionOutputs(
73		@JsonProperty("appid") Boolean appid,
74		@JsonProperty("largeBlob") Extensions.LargeBlob.LargeBlobAuthenticationOutput largeBlob,
75		@JsonProperty("prf") Extensions.Prf.PrfAuthenticationOutput prf) {
76		this.appid = appid;
77		this.largeBlob = largeBlob;
78		this.prf = prf;
79		}
80
81		@Override
82		@EqualsAndHashCode.Include
83		public Set<String> getExtensionIds() {
84		HashSet<String> ids = new HashSet<>();
85	1 1. getExtensionIds : negated conditional → KILLED	if (appid != null) {
86		ids.add(Extensions.Appid.EXTENSION_ID);
87		}
88	1 1. getExtensionIds : negated conditional → KILLED	if (largeBlob != null) {
89		ids.add(Extensions.LargeBlob.EXTENSION_ID);
90		}
91	1 1. getExtensionIds : negated conditional → KILLED	if (prf != null) {
92		ids.add(Extensions.Prf.EXTENSION_ID);
93		}
94	1 1. getExtensionIds : replaced return value with Collections.emptySet for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getExtensionIds → KILLED	return ids;
95		}
96
97		/**
98		* The extension output for the FIDO AppID Extension (<code>appid</code>), if any.
99		*
100		* <p>This value should be ignored because its behaviour is underspecified, see: <a
101		* href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
102		*
103		* @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
104		* FIDO AppID Extension (appid)</a>
105		*/
106		public Optional<Boolean> getAppid() {
107	1 1. getAppid : replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getAppid → SURVIVED	return Optional.ofNullable(appid);
108		}
109
110		/**
111		* The extension output for the <a
112		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">Large blob
113		* storage (<code>largeBlob</code>) extension</a>, if any.
114		*
115		* @see com.yubico.webauthn.data.Extensions.LargeBlob.LargeBlobAuthenticationOutput
116		* @see <a
117		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.Large
118		* blob storage extension (largeBlob)</a>
119		*/
120		public Optional<Extensions.LargeBlob.LargeBlobAuthenticationOutput> getLargeBlob() {
121	1 1. getLargeBlob : replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getLargeBlob → KILLED	return Optional.ofNullable(largeBlob);
122		}
123
124		/**
125		* The extension output for the <a
126		* href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">Pseudo-random function
127		* (<code>prf</code>) extension</a>, if any.
128		*
129		* @since 2.7.0
130		* @see com.yubico.webauthn.data.Extensions.Prf.PrfAuthenticationOutput
131		* @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
132		* Pseudo-random function extension (prf)</a>
133		*/
134		public Optional<Extensions.Prf.PrfAuthenticationOutput> getPrf() {
135	1 1. getPrf : replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getPrf → KILLED	return Optional.ofNullable(prf);
136		}
137
138		public static class ClientAssertionExtensionOutputsBuilder {
139
140		/**
141		* The extension output for the FIDO AppID Extension (<code>appid</code>).
142		*
143		* <p>This value should be ignored because its behaviour is underspecified, see: <a
144		* href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
145		*
146		* @see <a
147		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
148		* FIDO AppID Extension (appid)</a>
149		*/
150	1 1. appid : negated conditional → KILLED	public ClientAssertionExtensionOutputsBuilder appid(@NonNull Optional<Boolean> appid) {
151		this.appid = appid.orElse(null);
152	1 1. appid : replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED	return this;
153		}
154
155		/*
156		* Workaround, see: https://github.com/rzwitserloot/lombok/issues/2623#issuecomment-714816001
157		* Consider reverting this workaround if Lombok fixes that issue.
158		*/
159		private ClientAssertionExtensionOutputsBuilder appid(Boolean appid) {
160	1 1. appid : replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED	return this.appid(Optional.ofNullable(appid));
161		}
162
163		/**
164		* The extension output for the FIDO AppID Extension (<code>appid</code>).
165		*
166		* <p>This value should be ignored because its behaviour is underspecified, see: <a
167		* href="https://github.com/w3c/webauthn/issues/1034">https://github.com/w3c/webauthn/issues/1034</a>.
168		*
169		* @see <a
170		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
171		* FIDO AppID Extension (appid)</a>
172		*/
173		public ClientAssertionExtensionOutputsBuilder appid(boolean appid) {
174	1 1. appid : replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED	return this.appid(Optional.of(appid));
175		}
176		}
177		}
		Mutations
85		1.1 Location : getExtensionIds Killed by : com.yubico.webauthn.data.ExtensionsSpec negated conditional → KILLED
88		1.1 Location : getExtensionIds Killed by : com.yubico.webauthn.data.ExtensionsSpec negated conditional → KILLED
91		1.1 Location : getExtensionIds Killed by : com.yubico.webauthn.data.ExtensionsSpec negated conditional → KILLED
94		1.1 Location : getExtensionIds Killed by : com.yubico.webauthn.data.ExtensionsSpec replaced return value with Collections.emptySet for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getExtensionIds → KILLED
107		1.1 Location : getAppid Killed by : none replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getAppid → SURVIVED
121		1.1 Location : getLargeBlob Killed by : com.yubico.webauthn.data.ExtensionsSpec replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getLargeBlob → KILLED
135		1.1 Location : getPrf Killed by : com.yubico.webauthn.RelyingPartyV2AssertionSpec replaced return value with Optional.empty for com/yubico/webauthn/data/ClientAssertionExtensionOutputs::getPrf → KILLED
150		1.1 Location : appid Killed by : com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest.itHasTheseBuilderMethods(com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest) negated conditional → KILLED
152		1.1 Location : appid Killed by : com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest.itHasTheseBuilderMethods(com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest) replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED
160		1.1 Location : appid Killed by : com.yubico.webauthn.data.BuildersSpec replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED
174		1.1 Location : appid Killed by : com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest.itHasTheseBuilderMethods(com.yubico.webauthn.data.ClientAssertionExtensionOutputsTest) replaced return value with null for com/yubico/webauthn/data/ClientAssertionExtensionOutputs$ClientAssertionExtensionOutputsBuilder::appid → KILLED

ClientAssertionExtensionOutputs.java

Mutations

Active mutators

Tests examined