Extensions.java

package com.yubico.webauthn.data;

import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonValue;
import com.upokecenter.cbor.CBORObject;
import com.upokecenter.cbor.CBORType;
import com.yubico.internal.util.ExceptionUtil;
import com.yubico.webauthn.FinishRegistrationOptions;
import com.yubico.webauthn.RelyingParty;
import com.yubico.webauthn.StartAssertionOptions;
import com.yubico.webauthn.StartRegistrationOptions;
import com.yubico.webauthn.extension.uvm.KeyProtectionType;
import com.yubico.webauthn.extension.uvm.MatcherProtectionType;
import com.yubico.webauthn.extension.uvm.UserVerificationMethod;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.NonNull;
import lombok.Value;
import lombok.experimental.UtilityClass;
import lombok.extern.slf4j.Slf4j;

/** Definitions for WebAuthn extensions. */
@Slf4j
@UtilityClass
public class Extensions {

  /**
   * Definitions for the FIDO AppID Extension (<code>appid</code>).
   *
   * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-extension">§10.1.
   *     FIDO AppID Extension (appid)</a>
   */
  public static class Appid {
    static final String EXTENSION_ID = "appid";
  }

  /**
   * Definitions for the 10.2. FIDO AppID Exclusion Extension (<code>appidExclude</code>).
   *
   * @see <a
   *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-appid-exclude-extension">10.2.
   *     FIDO AppID Exclusion Extension (appidExclude)</a>
   */
  public static class AppidExclude {
    static final String EXTENSION_ID = "appidExclude";
  }

  /**
   * Definitions for the Credential Properties Extension (<code>credProps</code>).
   *
   * @see <a
   *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-authenticator-credential-properties-extension">§10.4.
   *     Credential Properties Extension (credProps)</a>
   */
  public static class CredentialProperties {
    static final String EXTENSION_ID = "credProps";

    /**
     * Extension outputs for the Credential Properties Extension (<code>credProps</code>).
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-authenticator-credential-properties-extension">§10.4.
     *     Credential Properties Extension (credProps)</a>
     */
    @Value
    @Builder
    @JsonIgnoreProperties(ignoreUnknown = true)
    public static class CredentialPropertiesOutput {
      @JsonProperty("rk")
      private final Boolean rk;

      @JsonCreator
      private CredentialPropertiesOutput(@JsonProperty("rk") Boolean rk) {
        this.rk = rk;
      }

      /**
       * This OPTIONAL property, known abstractly as the <b>resident key credential property</b>
       * (i.e., <b>client-side discoverable credential property</b>), is a Boolean value indicating
       * whether the {@link PublicKeyCredential} returned as a result of a registration ceremony is
       * a <i>client-side discoverable credential</i> (passkey).
       *
       * <p>If this is <code>true</code>, the credential is a <i>discoverable credential</i>
       * (passkey).
       *
       * <p>If this is <code>false</code>, the credential is a <i>server-side credential</i>.
       *
       * <p>If this is not present, it is not known whether the credential is a discoverable
       * credential or a server-side credential.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-credentialpropertiesoutput-rk">§10.4.
       *     Credential Properties Extension (credProps)</a>
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#client-side-discoverable-credential">Client-side
       *     discoverable Credential</a>
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#server-side-credential">Server-side
       *     Credential</a>
       * @see <a href="https://passkeys.dev/docs/reference/terms/#passkey">Passkey</a> in <a
       *     href="https://passkeys.dev">passkeys.dev</a> reference
       */
      public Optional<Boolean> getRk() {
        return Optional.ofNullable(rk);
      }
    }
  }

  /**
   * Definitions for the Credential Protection (<code>credProtect</code>) extension.
   *
   * @since 2.7.0
   * @see <a
   *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
   *     §12.1. Credential Protection (credProtect)</a>
   */
  public static class CredentialProtection {
    static final String EXTENSION_ID = "credProtect";

    /**
     * Policy values for the Credential Protection (<code>credProtect</code>) extension.
     *
     * <p>Available values:
     *
     * <ul>
     *   <li>{@link #UV_OPTIONAL}
     *   <li>{@link #UV_OPTIONAL_WITH_CREDENTIAL_ID_LIST}
     *   <li>{@link #UV_REQUIRED}
     * </ul>
     *
     * @since 2.7.0
     * @see <a
     *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
     *     §12.1. Credential Protection (credProtect)</a>
     * @see CredentialProtectionInput#prefer(CredentialProtectionPolicy)
     * @see CredentialProtectionInput#require(CredentialProtectionPolicy)
     */
    @AllArgsConstructor
    public enum CredentialProtectionPolicy {
      /**
       * In this configuration, performing some form of user verification is always OPTIONAL. This
       * is the default behaviour if the extension is not specified; note however that some browsers
       * may set a different default extension input if the extension is not explicitly specified.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#user-verification">User
       *     Verification</a>
       */
      UV_OPTIONAL(0x01, "userVerificationOptional"),

      /**
       * In this configuration, performing some form of user verification is OPTIONAL when the
       * credential is used as the second authentication factor, and REQUIRED when the credential is
       * used as the first authentication factor.
       *
       * <p>In technical terms, user verification is REQUIRED when {@link
       * PublicKeyCredentialRequestOptions#getAllowCredentials() allowCredentials} is empty and
       * OPTIONAL when it is non-empty. {@link
       * PublicKeyCredentialRequestOptions#getAllowCredentials() allowCredentials} is non-empty when
       * {@link StartAssertionOptions.StartAssertionOptionsBuilder#username(String) username} or
       * {@link StartAssertionOptions.StartAssertionOptionsBuilder#userHandle(ByteArray) userHandle}
       * was set in the call to {@link RelyingParty#startAssertion(StartAssertionOptions)}, and is
       * empty when neither was set.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#user-verification">User
       *     Verification</a>
       */
      UV_OPTIONAL_WITH_CREDENTIAL_ID_LIST(0x02, "userVerificationOptionalWithCredentialIDList"),

      /**
       * In this configuration, performing some form of user verification is always REQUIRED.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#user-verification">User
       *     Verification</a>
       */
      UV_REQUIRED(0x03, "userVerificationRequired");

      final int cborValue;

      @JsonValue private final String jsValue;

      private static Optional<CredentialProtectionPolicy> fromCbor(int cborValue) {
        return Arrays.stream(CredentialProtectionPolicy.values())
            .filter(policy -> policy.cborValue == cborValue)
            .findAny();
      }

      private static Optional<CredentialProtectionPolicy> fromJs(String jsonValue) {
        return Arrays.stream(CredentialProtectionPolicy.values())
            .filter(policy -> policy.jsValue.equals(jsonValue))
            .findAny();
      }

      @JsonCreator
      private static CredentialProtectionPolicy fromJsonString(@NonNull String value) {
        return fromJs(value)
            .orElseThrow(
                () ->
                    new IllegalArgumentException(
                        String.format(
                            "Unknown %s value: %s",
                            CredentialProtectionPolicy.class.getSimpleName(), value)));
      }
    }

    /**
     * Extension inputs for the Credential Protection (<code>credProtect</code>) extension.
     *
     * <p>Instances may be created using the {@link #prefer(CredentialProtectionPolicy)} and {@link
     * #require(CredentialProtectionPolicy)} factory functions.
     *
     * @since 2.7.0
     * @see <a
     *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
     *     §12.1. Credential Protection (credProtect)</a>
     */
    @Value
    public static class CredentialProtectionInput {
      /**
       * The requested credential protection policy. This policy may or may not be satisfied; see
       * {@link #isEnforceCredentialProtectionPolicy()}.
       *
       * @since 2.7.0
       * @see CredentialProtectionPolicy
       * @see #isEnforceCredentialProtectionPolicy()
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       */
      private final CredentialProtectionPolicy credentialProtectionPolicy;

      /**
       * If this is <code>true</code> and {@link #getCredentialProtectionPolicy()
       * credentialProtectionPolicy} is not {@link CredentialProtectionPolicy#UV_OPTIONAL}, {@link
       * RelyingParty#finishRegistration(FinishRegistrationOptions)} will validate that the policy
       * set in {@link #getCredentialProtectionPolicy()} was satisfied and the browser is requested
       * to fail the registration if the policy cannot be satisfied.
       *
       * <p>{@link CredentialProtectionInput#prefer(CredentialProtectionPolicy)} sets this to <code>
       * false</code>. {@link CredentialProtectionInput#require(CredentialProtectionPolicy)} sets
       * this to <code>true</code>.
       *
       * @since 2.7.0
       * @see CredentialProtectionPolicy
       * @see #getCredentialProtectionPolicy()
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       */
      private final boolean enforceCredentialProtectionPolicy;

      @JsonCreator
      private CredentialProtectionInput(
          @JsonProperty("credentialProtectionPolicy")
              CredentialProtectionPolicy credentialProtectionPolicy,
          @JsonProperty("enforceCredentialProtectionPolicy")
              Boolean enforceCredentialProtectionPolicy) {
        this.credentialProtectionPolicy = credentialProtectionPolicy;
        this.enforceCredentialProtectionPolicy =
            enforceCredentialProtectionPolicy != null && enforceCredentialProtectionPolicy;
      }

      /**
       * Create a Credential Protection (<code>credProtect</code>) extension input that requests the
       * given policy when possible.
       *
       * <p>If the policy cannot be satisfied, the browser is requested to continue the registration
       * anyway. To determine what policy was applied, use {@link
       * AuthenticatorRegistrationExtensionOutputs#getCredProtect()} to inspect the extension
       * output. {@link RelyingParty#finishRegistration(FinishRegistrationOptions)} will not
       * validate what policy was applied.
       *
       * <p>Use {@link #require(CredentialProtectionPolicy)} instead to forbid the registration from
       * proceeding if the extension is not supported or the policy cannot be satisfied.
       *
       * @param policy the policy to request.
       * @return a <code>credProtect</code> extension input that requests the given policy when
       *     possible. The browser is requested to continue the registration even if this policy
       *     cannot be satisfied.
       * @since 2.7.0
       * @see #require(CredentialProtectionPolicy)
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       */
      public static CredentialProtectionInput prefer(
          @NonNull final CredentialProtectionPolicy policy) {
        return new CredentialProtectionInput(policy, false);
      }

      /**
       * Create a Credential Protection (<code>credProtect</code>) extension input that requires the
       * given policy.
       *
       * <p>If the policy is not {@link CredentialProtectionPolicy#UV_OPTIONAL} and cannot be
       * satisfied, the browser is requested to abort the registration instead of proceeding. {@link
       * RelyingParty#finishRegistration(FinishRegistrationOptions)} will validate that the policy
       * returned in the authenticator extension output equals this input policy, and throw an
       * exception otherwise. You can also use {@link
       * AuthenticatorRegistrationExtensionOutputs#getCredProtect()} to inspect the extension output
       * yourself.
       *
       * <p>Note that if the browser or authenticator does not support the extension, the
       * registration will fail. Use {@link #prefer(CredentialProtectionPolicy)} instead to allow
       * the registration to proceed if the extension is not supported or the policy cannot be
       * satisfied.
       *
       * @param policy the policy to require.
       * @return a <code>credProtect</code> extension input that requires the given policy. The
       *     browser is requested to abort the registration if this policy cannot be satisfied.
       * @since 2.7.0
       * @see <a
       *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
       *     §12.1. Credential Protection (credProtect)</a>
       */
      public static CredentialProtectionInput require(
          @NonNull final CredentialProtectionPolicy policy) {
        return new CredentialProtectionInput(policy, true);
      }
    }

    /**
     * Validate that the given response satisfies the <code>credProtect</code> extension policy set
     * in the request.
     *
     * <p>If the {@link
     * RegistrationExtensionInputs.RegistrationExtensionInputsBuilder#credProtect(CredentialProtectionInput)
     * credProtect} extension is not set in the request, this has no effect.
     *
     * <p>If the {@link
     * RegistrationExtensionInputs.RegistrationExtensionInputsBuilder#credProtect(CredentialProtectionInput)
     * credProtect} extension is set in the request with {@link
     * CredentialProtectionInput#isEnforceCredentialProtectionPolicy()
     * enforceCredentialProtectionPolicy} set to <code>false</code> or {@link
     * CredentialProtectionInput#getCredentialProtectionPolicy() credentialProtectionPolicy} set to
     * {@link CredentialProtectionPolicy#UV_OPTIONAL}, this has no effect.
     *
     * <p>If the {@link
     * RegistrationExtensionInputs.RegistrationExtensionInputsBuilder#credProtect(CredentialProtectionInput)
     * credProtect} extension is set in the request with {@link
     * CredentialProtectionInput#isEnforceCredentialProtectionPolicy()
     * enforceCredentialProtectionPolicy} set to <code>true</code> and {@link
     * CredentialProtectionInput#getCredentialProtectionPolicy() credentialProtectionPolicy} is not
     * set to {@link CredentialProtectionPolicy#UV_OPTIONAL}, then this throws an {@link
     * IllegalArgumentException} if the <code>credProtect</code> authenticator extension output does
     * not equal the {@link CredentialProtectionInput#getCredentialProtectionPolicy()
     * credentialProtectionPolicy} set in the request.
     *
     * <p>This function is called automatically in {@link
     * RelyingParty#finishRegistration(FinishRegistrationOptions)}; you should not need to call it
     * yourself.
     *
     * @param request the arguments to start the registration ceremony.
     * @param response the response from the registration ceremony.
     * @throws IllegalArgumentException if the {@link
     *     RegistrationExtensionInputs.RegistrationExtensionInputsBuilder#credProtect(CredentialProtectionInput)
     *     credProtect} extension is set in the request with {@link
     *     CredentialProtectionInput#isEnforceCredentialProtectionPolicy()
     *     enforceCredentialProtectionPolicy} set to <code>true</code> and {@link
     *     CredentialProtectionInput#getCredentialProtectionPolicy() credentialProtectionPolicy} not
     *     set to {@link CredentialProtectionPolicy#UV_OPTIONAL}, and the <code>credProtect
     *     </code> authenticator extension output does not equal the {@link
     *     CredentialProtectionInput#getCredentialProtectionPolicy() credentialProtectionPolicy} set
     *     in the request.
     * @since 2.7.0
     * @see <a
     *     href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credProtect-extension">CTAP2
     *     §12.1. Credential Protection (credProtect)</a>
     */
    public static void validateExtensionOutput(
        PublicKeyCredentialCreationOptions request,
        PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
            response) {
      request
          .getExtensions()
          .getCredProtect()
          .ifPresent(
              credProtectInput -> {
                if (credProtectInput.isEnforceCredentialProtectionPolicy()
                    && credProtectInput.getCredentialProtectionPolicy()
                        != CredentialProtectionPolicy.UV_OPTIONAL) {
                  Optional<CredentialProtectionPolicy> outputPolicy =
                      response
                          .getResponse()
                          .getParsedAuthenticatorData()
                          .getExtensions()
                          .flatMap(CredentialProtection::parseAuthenticatorExtensionOutput);
                  ExceptionUtil.assertTrue(
                      outputPolicy.equals(
                          Optional.of(credProtectInput.getCredentialProtectionPolicy())),
                      "Unsatisfied credProtect policy: required %s, got: %s",
                      credProtectInput.getCredentialProtectionPolicy(),
                      outputPolicy);
                }
              });
    }

    static Optional<CredentialProtectionPolicy> parseAuthenticatorExtensionOutput(CBORObject cbor) {
      return Optional.ofNullable(cbor.get(EXTENSION_ID))
          .map(
              cborObject ->
                  cborObject.isNumber() && cborObject.AsNumber().IsInteger()
                      ? cborObject.AsInt32()
                      : null)
          .flatMap(CredentialProtectionPolicy::fromCbor);
    }
  }

  /**
   * Definitions for the Large blob storage extension (<code>largeBlob</code>).
   *
   * @see <a
   *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
   *     Large blob storage extension (largeBlob)</a>
   */
  public static class LargeBlob {
    static final String EXTENSION_ID = "largeBlob";

    /**
     * Extension inputs for the Large blob storage extension (<code>largeBlob</code>) in
     * registration ceremonies.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
     *     Large blob storage extension (largeBlob)</a>
     */
    @Value
    public static class LargeBlobRegistrationInput {
      /**
       * The Relying Party's preference of whether the created credential should support the <code>
       * largeBlob</code> extension.
       */
      @JsonProperty private final LargeBlobSupport support;

      @JsonCreator
      public LargeBlobRegistrationInput(
          /**
           * The Relying Party's preference of whether the created credential should support the
           * <code>
           * largeBlob</code> extension.
           *
           * <p>Currently the only valid values are {@link LargeBlobSupport#REQUIRED} and {@link
           * LargeBlobSupport#PREFERRED}, but custom values MAY be constructed in case more values
           * are added in future revisions of the extension.
           */
          @JsonProperty("support") LargeBlobSupport support) {
        this.support = support;
      }

      /**
       * The known valid arguments for the Large blob storage extension (<code>largeBlob</code>)
       * input in registration ceremonies.
       *
       * <p>Currently the only valid values are {@link LargeBlobSupport#REQUIRED} and {@link
       * LargeBlobSupport#PREFERRED}, but custom values MAY be constructed in case more values are
       * added in future revisions of the extension.
       *
       * @see #REQUIRED
       * @see #PREFERRED
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      @Value
      public static class LargeBlobSupport {
        /**
         * The authenticator used for registration MUST support the <code>largeBlob</code>
         * extension.
         *
         * <p>Note: If the client does not support the <code>largeBlob</code> extension, this
         * requirement MAY be ignored.
         *
         * <p>Note: CTAP authenticators only support <code>largeBlob</code> in combination with
         * {@link AuthenticatorSelectionCriteria#getResidentKey()} set to <code>REQUIRED</code> in
         * {@link StartRegistrationOptions#getAuthenticatorSelection()}.
         *
         * @see <a
         *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
         *     Large blob storage extension (largeBlob)</a>
         */
        public static final LargeBlobSupport REQUIRED = new LargeBlobSupport("required");

        /**
         * If the authenticator used for registration supports the <code>largeBlob</code> extension,
         * it will be enabled for the created credential. If not supported, the credential will be
         * created without large blob support.
         *
         * <p>Note: CTAP authenticators only support <code>largeBlob</code> in combination with
         * {@link AuthenticatorSelectionCriteria#getResidentKey()} set to <code>REQUIRED</code> in
         * {@link StartRegistrationOptions#getAuthenticatorSelection()}.
         *
         * @see <a
         *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
         *     Large blob storage extension (largeBlob)</a>
         */
        public static final LargeBlobSupport PREFERRED = new LargeBlobSupport("preferred");

        /**
         * The underlying string value of this {@link LargeBlobSupport} value.
         *
         * @see #REQUIRED
         * @see #PREFERRED
         */
        @JsonValue private final String value;

        /**
         * Returns a new {@link Set} containing the {@link #REQUIRED} and {@link #PREFERRED} values.
         */
        public static Set<LargeBlobSupport> values() {
          return Stream.of(REQUIRED, PREFERRED).collect(Collectors.toSet());
        }
      }
    }

    /**
     * Extension inputs for the Large blob storage extension (<code>largeBlob</code>) in
     * authentication ceremonies.
     *
     * <p>Use the {@link #read()} and {@link #write(ByteArray)} factory functions to construct this
     * type.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
     *     Large blob storage extension (largeBlob)</a>
     */
    @Value
    public static class LargeBlobAuthenticationInput {
      /**
       * If <code>true</code>, indicates that the Relying Party would like to fetch the
       * previously-written blob associated with the asserted credential.
       *
       * @see #read()
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-read">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      @JsonProperty private final boolean read;

      /**
       * An opaque byte string that the Relying Party wishes to store with the existing credential.
       *
       * @see #write(ByteArray)
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-write">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      @JsonProperty private final ByteArray write;

      @JsonCreator
      private LargeBlobAuthenticationInput(
          @JsonProperty("read") final Boolean read, @JsonProperty("write") final ByteArray write) {
        if (read != null && read && write != null) {
          throw new IllegalArgumentException(
              "Parameters \"read\" and \"write\" of largeBlob extension must not both be present.");
        }

        this.read = read != null && read;
        this.write = write;
      }

      /**
       * Configure the Large blob storage extension (<code>largeBlob</code>) to fetch the
       * previously-written blob associated with the asserted credential.
       *
       * <p>Mutually exclusive with {@link #write(ByteArray)}.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-read">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public static LargeBlobAuthenticationInput read() {
        return new LargeBlobAuthenticationInput(true, null);
      }

      /**
       * Configure the Large blob storage extension (<code>largeBlob</code>) to store the given byte
       * array with the existing credential.
       *
       * <p>Mutually exclusive with {@link #read()}.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-write">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public static LargeBlobAuthenticationInput write(@NonNull final ByteArray write) {
        return new LargeBlobAuthenticationInput(false, write);
      }

      /**
       * @return <code>true</code> if the <code>read</code> property is set to <code>true</code>,
       *     <code>false</code> otherwise.
       * @see #read()
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-read">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public boolean getRead() {
        return read;
      }

      /**
       * @return The value of the <code>write</code> property if configured, empty otherwise.
       * @see #write(ByteArray)
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargeblobinputs-read">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public Optional<ByteArray> getWrite() {
        return Optional.ofNullable(write);
      }
    }

    /**
     * Extension outputs for the Large blob storage extension (<code>largeBlob</code>) in
     * registration ceremonies.
     *
     * <p>Use the {@link #supported(boolean)} factory function to construct this type.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
     *     Large blob storage extension (largeBlob)</a>
     */
    @Value
    public static class LargeBlobRegistrationOutput {
      /**
       * <code>true</code> if, and only if, the created credential supports storing large blobs.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargebloboutputs-supported">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       * @see LargeBlobRegistrationInput#getSupport()
       */
      @JsonProperty private final boolean supported;

      @JsonCreator
      private LargeBlobRegistrationOutput(@JsonProperty("supported") boolean supported) {
        this.supported = supported;
      }

      /**
       * Create a Large blob storage extension output with the <code>supported</code> output set to
       * the given value.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dictdef-authenticationextensionslargebloboutputs">
       *     dictionary AuthenticationExtensionsLargeBlobOutputs</a>
       */
      public static LargeBlobRegistrationOutput supported(boolean supported) {
        return new LargeBlobRegistrationOutput(supported);
      }
    }

    /**
     * Extension outputs for the Large blob storage extension (<code>largeBlob</code>) in
     * authentication ceremonies.
     *
     * @see <a
     *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-large-blob-extension">§10.5.
     *     Large blob storage extension (largeBlob)</a>
     */
    @Value
    public static class LargeBlobAuthenticationOutput {
      @JsonProperty private final ByteArray blob;
      @JsonProperty private final Boolean written;

      @JsonCreator
      private LargeBlobAuthenticationOutput(
          @JsonProperty("blob") ByteArray blob, @JsonProperty("written") Boolean written) {
        this.blob = blob;
        this.written = written;
      }

      /**
       * Create a Large blob storage extension output with the <code>blob</code> output set to the
       * given value.
       *
       * <p>This corresponds to the extension input {@link LargeBlobAuthenticationInput#read()
       * LargeBlobAuthenticationInput.read()}.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dictdef-authenticationextensionslargebloboutputs">
       *     dictionary AuthenticationExtensionsLargeBlobOutputs</a>
       */
      public static LargeBlobAuthenticationOutput read(final ByteArray blob) {
        return new LargeBlobAuthenticationOutput(blob, null);
      }

      /**
       * Create a Large blob storage extension output with the <code>written</code> output set to
       * the given value.
       *
       * <p>This corresponds to the extension input {@link
       * LargeBlobAuthenticationInput#write(ByteArray)
       * LargeBlobAuthenticationInput.write(ByteArray)}.
       *
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dictdef-authenticationextensionslargebloboutputs">
       *     dictionary AuthenticationExtensionsLargeBlobOutputs</a>
       */
      public static LargeBlobAuthenticationOutput write(final boolean write) {
        return new LargeBlobAuthenticationOutput(null, write);
      }

      /**
       * The opaque byte string that was associated with the credential identified by {@link
       * PublicKeyCredential#getId()}. Only valid if {@link LargeBlobAuthenticationInput#getRead()}
       * was <code>true</code>.
       *
       * @return A present {@link Optional} if {@link LargeBlobAuthenticationInput#getRead()} was
       *     <code>true</code> and the blob content was successfully read. Otherwise (if {@link
       *     LargeBlobAuthenticationInput#getRead()} was <code>false</code> or the content failed to
       *     be read) an empty {@link Optional}.
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargebloboutputs-blob">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public Optional<ByteArray> getBlob() {
        return Optional.ofNullable(blob);
      }

      /**
       * A boolean that indicates that the contents of {@link
       * LargeBlob.LargeBlobAuthenticationInput#write(ByteArray)
       * LargeBlobAuthenticationInput#write(ByteArray)} were successfully stored on the
       * authenticator, associated with the specified credential.
       *
       * @return Empty if {@link LargeBlobAuthenticationInput#getWrite()} was not present. Otherwise
       *     <code>true</code> if and only if the value of {@link
       *     LargeBlobAuthenticationInput#getWrite()} was successfully stored by the authenticator.
       * @see <a
       *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-authenticationextensionslargebloboutputs-written">§10.5.
       *     Large blob storage extension (largeBlob)</a>
       */
      public Optional<Boolean> getWritten() {
        return Optional.ofNullable(written);
      }
    }
  }

  /**
   * Definitions for the Pseudo-random function extension (<code>prf</code>).
   *
   * @since 2.7.0
   * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
   *     Pseudo-random function extension (prf)</a>
   */
  public static class Prf {
    static final String EXTENSION_ID = "prf";

    /**
     * One or two inputs to or outputs from the pseudo-random function (PRF) associated with a
     * credential.
     *
     * <p>{@link #getFirst()} is always present, but {@link #getSecond()} is empty when only one
     * input or output was given.
     *
     * @since 2.7.0
     * @see #one(ByteArray)
     * @see #two(ByteArray, ByteArray)
     * @see #oneOrTwo(ByteArray, Optional)
     * @see <a
     *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfvalues">dictionary
     *     AuthenticationExtensionsPRFValues</a>
     * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
     *     Pseudo-random function extension (prf)</a>
     */
    @Value
    public static class PrfValues {
      /**
       * The first PRF input to evaluate, or the result of that evaluation.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfvalues-first">AuthenticationExtensionsPRFValues.first</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty @NonNull private final ByteArray first;

      /**
       * The second PRF input to evaluate, if any, or the result of that evaluation.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfvalues-second">AuthenticationExtensionsPRFValues.second</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final ByteArray second;

      @JsonCreator
      private PrfValues(
          @JsonProperty("first") @NonNull final ByteArray first,
          @JsonProperty("second") final ByteArray second) {
        this.first = first;
        this.second = second;
      }

      /**
       * The second PRF input to evaluate, if any, or the result of that evaluation.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfvalues-second">AuthenticationExtensionsPRFValues.second</a>
       */
      public Optional<ByteArray> getSecond() {
        return Optional.ofNullable(second);
      }

      /**
       * Construct a {@link PrfValues} with a single PRF input or output.
       *
       * @param first the PRF input or output. Must not be null.
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfvalues">dictionary
       *     AuthenticationExtensionsPRFValues</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfValues one(@NonNull ByteArray first) {
        return new PrfValues(first, null);
      }

      /**
       * Construct a {@link PrfValues} with two PRF inputs or outputs.
       *
       * @param first the first PRF input or output. Must not be null.
       * @param second the second PRF input or output. Must not be null.
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfvalues">dictionary
       *     AuthenticationExtensionsPRFValues</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfValues two(@NonNull ByteArray first, @NonNull ByteArray second) {
        return new PrfValues(first, second);
      }

      /**
       * Construct a {@link PrfValues} with two PRF inputs or outputs if <code>second</code> is
       * present, otherwise a {@link PrfValues} with one inputs or output.
       *
       * @param first the first PRF input or output. Must not be null.
       * @param second the second PRF input or output, if any. Must not be null, but may be empty.
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfvalues">dictionary
       *     AuthenticationExtensionsPRFValues</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfValues oneOrTwo(
          @NonNull ByteArray first, @NonNull Optional<ByteArray> second) {
        return new PrfValues(first, second.orElse(null));
      }
    }

    /**
     * Inputs for the Pseudo-random function extension (<code>prf</code>) in registration
     * ceremonies.
     *
     * @since 2.7.0
     * @see <a
     *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfinputs">dictionary
     *     AuthenticationExtensionsPRFInputs</a>
     * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
     *     Pseudo-random function extension (prf)</a>
     */
    @Value
    public static class PrfRegistrationInput {
      /**
       * PRF inputs to evaluate immediately if possible. Note that not all authenticators support
       * this, in which case a follow-up authentication ceremony may be needed in order to evaluate
       * the PRF.
       *
       * @since 2.7.0
       * @see #eval(PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final PrfValues eval;

      @JsonCreator
      private PrfRegistrationInput(@JsonProperty("eval") PrfValues eval) {
        this.eval = eval;
      }

      /**
       * PRF inputs to evaluate immediately if possible. Note that not all authenticators support
       * this, in which case a follow-up authentication ceremony may be needed in order to evaluate
       * the PRF.
       *
       * @since 2.7.0
       * @see #eval(PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<PrfValues> getEval() {
        return Optional.ofNullable(eval);
      }

      /**
       * Enable PRF for the created credential, without evaluating the PRF at this time.
       *
       * @since 2.7.0
       * @see #eval(PrfValues)
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfRegistrationInput enable() {
        return new PrfRegistrationInput(null);
      }

      /**
       * Enable PRF for the created credential, and attempt to immediately evaluate the PRF with the
       * given inputs. Note that not all authenticators support this, in which case a follow-up
       * authentication ceremony may be needed in order to evaluate the PRF.
       *
       * @since 2.7.0
       * @see #enable()
       * @see #getEval()
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfRegistrationInput eval(@NonNull PrfValues eval) {
        return new PrfRegistrationInput(eval);
      }
    }

    /**
     * Outputs for the Pseudo-random function extension (<code>prf</code>) in registration
     * ceremonies.
     *
     * @since 2.7.0
     * @see <a
     *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfoutputs">dictionary
     *     AuthenticationExtensionsPRFOutputs</a>
     * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
     *     Pseudo-random function extension (prf)</a>
     */
    @Value
    public static class PrfRegistrationOutput {

      /**
       * <code>true</code> if, and only if, a PRF is available for use with the created credential.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-enabled">AuthenticationExtensionsPRFOutputs.enabled</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final Boolean enabled;

      /**
       * The results of evaluating the PRF for the inputs given in {@link
       * PrfRegistrationInput#getEval() eval}, if any.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-results">AuthenticationExtensionsPRFOutputs.results</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final PrfValues results;

      @JsonCreator
      PrfRegistrationOutput(
          @JsonProperty("enabled") Boolean enabled, @JsonProperty("results") PrfValues results) {
        this.enabled = enabled;
        this.results = results;
      }

      /**
       * <code>true</code> if, and only if, a PRF is available for use with the created credential.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-enabled">AuthenticationExtensionsPRFOutputs.enabled</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<Boolean> getEnabled() {
        return Optional.ofNullable(enabled);
      }

      /**
       * The results of evaluating the PRF for the inputs given in {@link
       * PrfRegistrationInput#getEval() eval}, if any.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-results">AuthenticationExtensionsPRFOutputs.results</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<PrfValues> getResults() {
        return Optional.ofNullable(results);
      }
    }

    /**
     * Inputs for the Pseudo-random function extension (<code>prf</code>) in authentication
     * ceremonies.
     *
     * @since 2.7.0
     * @see <a
     *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfinputs">dictionary
     *     AuthenticationExtensionsPRFInputs</a>
     * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
     *     Pseudo-random function extension (prf)</a>
     */
    @Value
    public static class PrfAuthenticationInput {
      /**
       * PRF inputs to use for any credential without a dedicated input listed in {@link
       * #getEvalByCredential()}.
       *
       * @since 2.7.0
       * @see #eval(PrfValues)
       * @see #evalByCredentialWithFallback(Map, PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final PrfValues eval;

      /**
       * A map of credential IDs to PRF inputs to use for that credential. Credentials without a
       * mapping here fall back to the inputs in {@link #getEval()} if present, otherwise no PRF is
       * evaluated for those credentials.
       *
       * @since 2.7.0
       * @see #evalByCredential(Map)
       * @see #evalByCredentialWithFallback(Map, PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-evalbycredential">AuthenticationExtensionsPRFInputs.evalByCredential</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final Map<ByteArray, PrfValues> evalByCredential;

      @JsonCreator
      private PrfAuthenticationInput(
          @JsonProperty("eval") PrfValues eval,
          @JsonProperty("evalByCredential") Map<ByteArray, PrfValues> evalByCredential) {
        this.eval = eval;
        this.evalByCredential =
            evalByCredential == null ? null : Collections.unmodifiableMap(evalByCredential);
      }

      /**
       * PRF inputs to use for any credential without a dedicated input listed in {@link
       * #getEvalByCredential()}.
       *
       * @since 2.7.0
       * @see #eval(PrfValues)
       * @see #evalByCredentialWithFallback(Map, PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<PrfValues> getEval() {
        return Optional.ofNullable(eval);
      }

      /**
       * A map of credential IDs to PRF inputs to use for that credential. Credentials without a
       * mapping here fall back to the inputs in {@link #getEval()} if present, otherwise no PRF is
       * evaluated for those credentials.
       *
       * @since 2.7.0
       * @see #evalByCredential(Map)
       * @see #evalByCredentialWithFallback(Map, PrfValues)
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-evalbycredential">AuthenticationExtensionsPRFInputs.evalByCredential</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<Map<ByteArray, PrfValues>> getEvalByCredential() {
        return Optional.ofNullable(evalByCredential);
      }

      private static HashMap<ByteArray, PrfValues> descriptorsToIds(
          Map<PublicKeyCredentialDescriptor, PrfValues> evalByCredential) {
        return evalByCredential.entrySet().stream()
            .reduce(
                new HashMap<>(),
                (ebc, entry) -> {
                  ebc.put(entry.getKey().getId(), entry.getValue());
                  return ebc;
                },
                (a, b) -> {
                  a.putAll(b);
                  return a;
                });
      }

      /**
       * Use the same PRF inputs for all credentials.
       *
       * @since 2.7.0
       * @see #getEval()
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfAuthenticationInput eval(@NonNull PrfValues eval) {
        return new PrfAuthenticationInput(eval, null);
      }

      /**
       * Use different PRF inputs for different credentials, and skip PRF evaluation for any
       * credentials not present in the map.
       *
       * @since 2.7.0
       * @see #getEvalByCredential()
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-evalbycredential">AuthenticationExtensionsPRFInputs.evalByCredential</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfAuthenticationInput evalByCredential(
          @NonNull Map<PublicKeyCredentialDescriptor, PrfValues> evalByCredential) {
        return new PrfAuthenticationInput(null, descriptorsToIds(evalByCredential));
      }

      /**
       * Use different PRF inputs for different credentials, and "fallback" inputs for any
       * credentials not present in the map.
       *
       * @param evalByCredential a map of credential IDs to PRF inputs to use for that credential.
       * @param eval "fallback" inputs to use for any credential not listed in <code>
       *     evalByCredential</code>.
       * @since 2.7.0
       * @see #getEvalByCredential()
       * @see #getEval() ()
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-evalbycredential">AuthenticationExtensionsPRFInputs.evalByCredential</a>
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfinputs-eval">AuthenticationExtensionsPRFInputs.eval</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public static PrfAuthenticationInput evalByCredentialWithFallback(
          @NonNull Map<PublicKeyCredentialDescriptor, PrfValues> evalByCredential,
          @NonNull PrfValues eval) {
        return new PrfAuthenticationInput(eval, descriptorsToIds(evalByCredential));
      }
    }

    /**
     * Outputs for the Pseudo-random function extension (<code>prf</code>) in authentication
     * ceremonies.
     *
     * @since 2.7.0
     * @see <a
     *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dictdef-authenticationextensionsprfoutputs">dictionary
     *     AuthenticationExtensionsPRFOutputs</a>
     * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
     *     Pseudo-random function extension (prf)</a>
     */
    @Value
    public static class PrfAuthenticationOutput {

      /**
       * The results of evaluating the PRF for the inputs given in {@link
       * PrfAuthenticationInput#getEval() eval} or {@link
       * PrfAuthenticationInput#getEvalByCredential() evalByCredential}, if any.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-results">AuthenticationExtensionsPRFOutputs.results</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      @JsonProperty private final PrfValues results;

      @JsonCreator
      PrfAuthenticationOutput(@JsonProperty("results") PrfValues results) {
        this.results = results;
      }

      /**
       * The results of evaluating the PRF for the inputs given in {@link
       * PrfAuthenticationInput#getEval() eval} or {@link
       * PrfAuthenticationInput#getEvalByCredential() evalByCredential}, if any.
       *
       * @since 2.7.0
       * @see <a
       *     href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#dom-authenticationextensionsprfoutputs-results">AuthenticationExtensionsPRFOutputs.results</a>
       * @see <a href="https://www.w3.org/TR/2025/WD-webauthn-3-20250127/#prf-extension">§10.1.4.
       *     Pseudo-random function extension (prf)</a>
       */
      public Optional<PrfValues> getResults() {
        return Optional.ofNullable(results);
      }
    }
  }

  /**
   * Definitions for the User Verification Method (<code>uvm</code>) Extension.
   *
   * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-uvm-extension">§10.3.
   *     User Verification Method Extension (uvm)</a>
   */
  public static class Uvm {
    static final String EXTENSION_ID = "uvm";

    /**
     * A <code>uvmEntry</code> as defined in <a
     * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-uvm-extension">§10.3. User
     * Verification Method Extension (uvm)</a>.
     *
     * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-uvm-extension">§10.3.
     *     User Verification Method Extension (uvm)</a>
     * @see UserVerificationMethod
     * @see KeyProtectionType
     * @see MatcherProtectionType
     */
    @Value
    public static class UvmEntry {
      private final UserVerificationMethod userVerificationMethod;
      private final KeyProtectionType keyProtectionType;
      private final MatcherProtectionType matcherProtectionType;

      public UvmEntry(
          @JsonProperty("userVerificationMethod") UserVerificationMethod userVerificationMethod,
          @JsonProperty("keyProtectionType") KeyProtectionType keyProtectionType,
          @JsonProperty("matcherProtectionType") MatcherProtectionType matcherProtectionType) {
        this.userVerificationMethod = userVerificationMethod;
        this.keyProtectionType = keyProtectionType;
        this.matcherProtectionType = matcherProtectionType;
      }
    }

    static Optional<List<UvmEntry>> parseAuthenticatorExtensionOutput(CBORObject cbor) {
      if (validateAuthenticatorExtensionOutput(cbor)) {
        return Optional.of(
            cbor.get(EXTENSION_ID).getValues().stream()
                .map(
                    uvmEntry ->
                        new UvmEntry(
                            UserVerificationMethod.fromValue(uvmEntry.get(0).AsInt32Value()),
                            KeyProtectionType.fromValue(
                                uvmEntry.get(1).AsNumber().ToInt16IfExact()),
                            MatcherProtectionType.fromValue(
                                uvmEntry.get(2).AsNumber().ToInt16IfExact())))
                .collect(Collectors.toList()));
      } else {
        return Optional.empty();
      }
    }

    private static boolean validateAuthenticatorExtensionOutput(CBORObject extensions) {
      if (!extensions.ContainsKey(EXTENSION_ID)) {
        return false;
      }

      CBORObject uvm = extensions.get(EXTENSION_ID);
      if (uvm.getType() != CBORType.Array) {
        log.debug(
            "Invalid CBOR type for \"{}\" extension output: expected array, was: {}",
            EXTENSION_ID,
            uvm.getType());
        return false;
      }

      if (uvm.size() < 1 || uvm.size() > 3) {
        log.debug(
            "Invalid length \"{}\" extension output array: expected 1 to 3 (inclusive), was: {}",
            EXTENSION_ID,
            uvm.size());
        return false;
      }

      for (CBORObject entry : uvm.getValues()) {
        if (entry.getType() != CBORType.Array) {
          log.debug("Invalid CBOR type for uvmEntry: expected array, was: {}", entry.getType());
          return false;
        }

        if (entry.size() != 3) {
          log.debug("Invalid length for uvmEntry: expected 3, was: {}", entry.size());
          return false;
        }

        for (CBORObject i : entry.getValues()) {
          if (!(i.isNumber() && i.AsNumber().IsInteger())) {
            log.debug("Invalid type for uvmEntry element: expected integer, was: {}", i.getType());
            return false;
          }
        }
      }

      return true;
    }
  }
}
















































































Active mutators

CONDITIONALS_BOUNDARY
EMPTY_RETURNS
FALSE_RETURNS
INCREMENTS
INVERT_NEGS
MATH
NEGATE_CONDITIONALS
NULL_RETURNS
PRIMITIVE_RETURNS
TRUE_RETURNS
VOID_METHOD_CALLS
Tests examined

com.yubico.webauthn.data.ExtensionsSpec (306 ms)
com.yubico.webauthn.RelyingPartyRegistrationSpec (11805 ms)
com.yubico.webauthn.RelyingPartyStartOperationSpec (239 ms)
com.yubico.webauthn.data.BuildersSpec (474 ms)
com.yubico.webauthn.data.JsonIoSpec (4396 ms)
com.yubico.webauthn.RelyingPartyAssertionSpec (1491 ms)
com.yubico.webauthn.RelyingPartyCeremoniesSpec (508 ms)
com.yubico.webauthn.AppleAttestationStatementVerifierSpec (1137 ms)
com.yubico.webauthn.data.AuthenticatorDataSpec (89 ms)
Report generated by PIT 1.15.0
Extensions.java

Mutations

Active mutators

Tests examined
