protocol

type AndroidSafetyNetAttestionResponse struct {
	Nonce                      []byte   `json:"nonce"`
	TimestampMs                int64    `json:"timestampMs"`
	ApkPackageName             string   `json:"apkPackageName"`
	ApkDigestSha256            []byte   `json:"apkDigestSha256"`
	CtsProfileMatch            bool     `json:"ctsProfileMatch"`
	ApkCertificateDigestSha256 [][]byte `json:"apkCertificateDigestSha256"`
	BasicIntegrity             bool     `json:"basicIntegrity"`
}

type AssertionResponse struct {
	PublicKeyCredential
	// This attribute contains the authenticator's response to the client’s request to generate an authentication assertion.
	Response AuthenticatorAssertionResponse `json:"response"`
}

type Attestation struct {
	Fmt      string                 `json:"fmt"`
	AuthData AuthenticatorData      `json:"authData"`
	AttStmt  map[string]interface{} `json:"attStmt"`
}

type AttestationConveyancePreference string

type AttestationFormatFunction func(Attestation, []byte) error

type AttestationResponse struct {
	PublicKeyCredential
	// This attribute contains the authenticator's response to the client’s request to create a public key credential.
	Response AuthenticatorAttestationResponse `json:"response"`
}

type AttestedCredentialData struct {
	// The AAGUID of the authenticator.
	AAGUID []byte
	// A probabilistically-unique byte sequence identifying a public key credential source and its authentication
	// assertions.
	CredentialID []byte
	// The decoded credential public key.
	COSEKey interface{}
}

type AuthenticationExtensionsClientInputs map[string]interface{}

type AuthenticatorAssertionResponse struct {
	AuthenticatorResponse
	// This attribute contains the authenticator data returned by the authenticator. See §6.1 Authenticator data.
	AuthenticatorData []byte `json:"authenticatorData"`
	// This attribute contains the raw signature returned from the authenticator. See §6.3.3 The
	// authenticatorGetAssertion operation.
	Signature []byte `json:"signature"`
	// This attribute contains the user handle returned from the authenticator, or null if the authenticator did not
	// return a user handle. See §6.3.3 The authenticatorGetAssertion operation.
	UserHandle []byte `json:"userHandle,omitempty"`
}

type AuthenticatorAttachment string

type AuthenticatorAttestationResponse struct {
	AuthenticatorResponse
	// This attribute contains an attestation object, which is opaque to, and cryptographically protected against
	// tampering by, the client. The attestation object contains both authenticator data and an attestation statement.
	// The former contains the AAGUID, a unique credential ID, and the credential public key. The contents of the
	// attestation statement are determined by the attestation statement format used by the authenticator. It also
	// contains any additional information that the Relying Party's server requires to validate the attestation
	// statement, as well as to decode and validate the authenticator data along with the JSON-serialized client data.
	// For more details, see §6.4 Attestation, §6.4.4 Generating an Attestation Object, and Figure 5.
	AttestationObject []byte `json:"attestationObject"`
}

type AuthenticatorData struct {
	// SHA-256 hash of the RP ID associated with the credential.
	RPIDHash []byte
	// Flags
	Flags AuthenticatorDataFlags
	// Signature counter, 32-bit unsigned big-endian integer.
	SignCount uint32
	// attested credential data (if present). See §6.4.1 Attested credential data for details. Its length depends on the
	// length of the credential ID and credential public key being attested.
	AttestedCredentialData AttestedCredentialData
	// Raw contains the raw bytes of this AuthenticatorData.
	Raw []byte
}

type AuthenticatorDataFlags byte

type AuthenticatorResponse struct {
	// This attribute contains a JSON serialization of the client data passed to the authenticator by the client in
	// its call to either create() or get().
	ClientDataJSON []byte `json:"clientDataJSON"`
}

type AuthenticatorSelectionCriteria struct {
	// If this member is present, eligible authenticators are filtered to only authenticators attached with the
	// specified §5.4.5 Authenticator Attachment enumeration (enum AuthenticatorAttachment).
	AuthenticatorAttachment AuthenticatorAttachment `json:"authenticatorAttachment,omitempty"`
	// This member describes the Relying Parties' requirements regarding resident credentials. If the parameter is set
	// to true, the authenticator MUST create a client-side-resident public key credential source when creating a
	// public key credential.
	RequireResidentKey bool `json:"requireResidentKey"`
	// This member describes the Relying Party's requirements regarding user verification for the create() operation.
	// Eligible authenticators are filtered to only those capable of satisfying this requirement.
	UserVerification UserVerificationRequirement `json:"userVerification,omitempty"`
}

type AuthenticatorTransport string

type COSEAlgorithmIdentifier int

type Challenge []byte

type CollectedClientData struct {
	// This member contains the string "webauthn.create" when creating new credentials, and "webauthn.get" when getting
	// an assertion from an existing credential. The purpose of this member is to prevent certain types of signature
	// confusion attacks (where an attacker substitutes one legitimate signature for another).
	Type string `json:"type"`
	// This member contains the base64url encoding of the challenge provided by the RP. See the §13.1 Cryptographic
	// Challenges security consideration.
	Challenge string `json:"challenge"`
	// This member contains the fully qualified origin of the requester, as provided to the authenticator by the client,
	// in the syntax defined by [RFC6454].
	Origin string `json:"origin"`
	// This OPTIONAL member contains information about the state of the Token Binding protocol used when communicating
	// with the Relying Party. Its absence indicates that the client doesn’t support token binding.
	TokenBinding *TokenBinding `json:"tokenBinding,omitempty"`
}

type CredentialCreationOptions struct {
	PublicKey PublicKeyCredentialCreationOptions `json:"publicKey"`
}

type CredentialRequestOptions struct {
	PublicKey PublicKeyCredentialRequestOptions `json:"publicKey"`
}

type Error struct {
	// Name is the name of this error.
	Name string `json:"error"`
	// Description is the description of this error.
	Description string `json:"description"`
	// Hint contains further information about the error.
	Hint string `json:"hint,omitempty"`
	// Code contains the status code that should be returned when this error is returned.
	Code int `json:"status_code,omitempty"`
	// Debug contains debug information about this error that should not be shown to the user.
	Debug string `json:"debug,omitempty"`
}

type ParsedAssertionResponse struct {
	ParsedPublicKeyCredential
	// This attribute contains the authenticator's response to the client’s request to generate an authentication assertion.
	Response ParsedAuthenticatorAssertionResponse
	// RawResponse contains the unparsed AssertionResponse.
	RawResponse AssertionResponse
}

type ParsedAttestationResponse struct {
	ParsedPublicKeyCredential
	// This attribute contains the authenticator's response to the client’s request to create a public key credential.
	Response ParsedAuthenticatorAttestationResponse
	// RawResponse contains the unparsed AttestationResponse.
	RawResponse AttestationResponse
}

type ParsedAuthenticatorAssertionResponse struct {
	ParsedAuthenticatorResponse
	// This attribute contains the authenticator data returned by the authenticator. See §6.1 Authenticator data.
	AuthData AuthenticatorData
	// This attribute contains the raw signature returned from the authenticator. See §6.3.3 The
	// authenticatorGetAssertion operation.
	Signature []byte
	// This attribute contains the user handle returned from the authenticator, or null if the authenticator did not
	// return a user handle. See §6.3.3 The authenticatorGetAssertion operation.
	UserHandle []byte
}

type ParsedAuthenticatorAttestationResponse struct {
	ParsedAuthenticatorResponse
	// This attribute contains an attestation object, which is opaque to, and cryptographically protected against
	// tampering by, the client. The attestation object contains both authenticator data and an attestation statement.
	// The former contains the AAGUID, a unique credential ID, and the credential public key. The contents of the
	// attestation statement are determined by the attestation statement format used by the authenticator. It also
	// contains any additional information that the Relying Party's server requires to validate the attestation
	// statement, as well as to decode and validate the authenticator data along with the JSON-serialized client data.
	// For more details, see §6.4 Attestation, §6.4.4 Generating an Attestation Object, and Figure 5.
	Attestation Attestation
}

type ParsedAuthenticatorResponse struct {
	// This attribute contains the parsed client data passed to the authenticator by the client in its call to either
	// create() or get().
	ClientData CollectedClientData
}

type ParsedPublicKeyCredential struct {
	// This attribute is inherited from Credential, though PublicKeyCredential overrides Credential's getter, instead
	// returning the base64url encoding of the data contained in the object’s [[identifier]] internal slot.
	ID string
	// This attribute returns the ArrayBuffer contained in the [[identifier]] internal slot.
	RawID []byte
	// The PublicKeyCredential interface object's [[type]] internal slot's value is the string "public-key".
	Type string
}

type PublicKeyCredential struct {
	// This attribute is inherited from Credential, though PublicKeyCredential overrides Credential's getter, instead
	// returning the base64url encoding of the data contained in the object’s [[identifier]] internal slot.
	ID string `json:"id"`
	// This attribute returns the ArrayBuffer contained in the [[identifier]] internal slot.
	RawID []byte `json:"rawId"`
	// The PublicKeyCredential interface object's [[type]] internal slot's value is the string "public-key".
	Type string `json:"type"`
}

type PublicKeyCredentialCreationOptions struct {
	// This member contains data about the Relying Party responsible for the request.
	// Its value’s name member is REQUIRED. See §5.4.1 Public Key Entity Description (dictionary
	// PublicKeyCredentialEntity) for further details.
	// Its value’s id member specifies the RP ID with which the credential should be associated. If omitted, its value
	// will be the CredentialsContainer object’s relevant settings object's origin's effective domain. See §5.4.2
	// Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity) for further details.
	RP PublicKeyCredentialRpEntity `json:"rp"`
	// This member contains data about the user account for which the Relying Party is requesting attestation.
	// Its value’s name, displayName and id members are REQUIRED. See §5.4.1 Public Key Entity Description
	// (dictionary PublicKeyCredentialEntity) and §5.4.3 User Account Parameters for Credential Generation
	// (dictionary PublicKeyCredentialUserEntity) for further details.
	User PublicKeyCredentialUserEntity `json:"user"`

	// This member contains a challenge intended to be used for generating the newly created credential’s attestation
	// object. See the §13.1 Cryptographic Challenges security consideration.
	Challenge Challenge `json:"challenge"`
	// This member contains information about the desired properties of the credential to be created. The sequence is
	// ordered from most preferred to least preferred. The client makes a best-effort to create the most preferred
	// credential that it can.
	PubKeyCredParams []PublicKeyCredentialParameters `json:"pubKeyCredParams,omitempty"`

	// This member specifies a time, in milliseconds, that the caller is willing to wait for the call to complete.
	// This is treated as a hint, and MAY be overridden by the client.
	Timeout uint `json:"timeout,omitempty"`
	// This member is intended for use by Relying Parties that wish to limit the creation of multiple credentials for
	// the same account on a single authenticator. The client is requested to return an error if the new credential
	// would be created on an authenticator that also contains one of the credentials enumerated in this parameter.
	ExcludeCredentials []PublicKeyCredentialDescriptor `json:"excludeCredentials,omitempty"`
	// This member is intended for use by Relying Parties that wish to select the appropriate authenticators to
	// participate in the create() operation.
	AuthenticatorSelection AuthenticatorSelectionCriteria `json:"authenticatorSelection,omitempty"`
	// This member is intended for use by Relying Parties that wish to express their preference for attestation
	// conveyance. The default is none.
	Attestation AttestationConveyancePreference `json:"attestation,omitempty"`
	// This member contains additional parameters requesting additional processing by the client and authenticator. For
	// example, the caller may request that only authenticators with certain capabilities be used to create the
	// credential, or that particular information be returned in the attestation object. Some extensions are defined in
	// §9 WebAuthn Extensions; consult the IANA "WebAuthn Extension Identifier" registry established by
	// [WebAuthn-Registries] for an up-to-date list of registered WebAuthn Extensions.
	Extensions AuthenticationExtensionsClientInputs `json:"extensions,omitempty"`
}

type PublicKeyCredentialDescriptor struct {
	// This member contains the type of the public key credential the caller is referring to.
	Type PublicKeyCredentialType `json:"type"`
	// This member contains the credential ID of the public key credential the caller is referring to.
	ID []byte `json:"id"`
	// This OPTIONAL member contains a hint as to how the client might communicate with the managing authenticator of
	// the public key credential the caller is referring to.
	Transport []AuthenticatorTransport `json:"transports,omitempty"`
}

type PublicKeyCredentialEntity struct {
	// A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents.
	Name string `json:"name"`
}

type PublicKeyCredentialParameters struct {
	// This member specifies the type of credential to be created.
	Type PublicKeyCredentialType `json:"type"`
	// This member specifies the cryptographic signature algorithm with which the newly generated credential will be
	// used, and thus also the type of asymmetric key pair to be generated, e.g., RSA or Elliptic Curve.
	Algorithm COSEAlgorithmIdentifier `json:"alg"`
}

type PublicKeyCredentialRequestOptions struct {
	// This member represents a challenge that the selected authenticator signs, along with other data, when producing
	// an authentication assertion. See the §13.1 Cryptographic Challenges security consideration.
	Challenge Challenge `json:"challenge"`
	// This OPTIONAL member specifies a time, in milliseconds, that the caller is willing to wait for the call to
	// complete. The value is treated as a hint, and MAY be overridden by the client.
	Timeout uint `json:"timeout,omitempty"`
	// This OPTIONAL member specifies the relying party identifier claimed by the caller. If omitted, its value will be
	// the CredentialsContainer object’s relevant settings object's origin's effective domain.
	RPID string `json:"rpId,omitempty"`
	// This OPTIONAL member contains a list of PublicKeyCredentialDescriptor objects representing public key credentials
	// acceptable to the caller, in descending order of the caller’s preference (the first item in the list is the most
	// preferred credential, and so on down the list).
	AllowCredentials []PublicKeyCredentialDescriptor `json:"allowCredentials,omitempty"`
	// This member describes the Relying Party's requirements regarding user verification for the get() operation.
	// Eligible authenticators are filtered to only those capable of satisfying this requirement.
	UserVerification UserVerificationRequirement `json:"userVerification,omitempty"`
	// This OPTIONAL member contains additional parameters requesting additional processing by the client and
	// authenticator. For example, if transaction confirmation is sought from the user, then the prompt string might
	// be included as an extension.
	Extensions AuthenticationExtensionsClientInputs `json:"extensions,omitempty"`
}

type PublicKeyCredentialRpEntity struct {
	PublicKeyCredentialEntity
	// A unique identifier for the Relying Party entity, which sets the RP ID.
	ID string `json:"id,omitempty"`
}

type PublicKeyCredentialType string

type PublicKeyCredentialUserEntity struct {
	PublicKeyCredentialEntity

	// The user handle of the user account entity. To ensure secure operation, authentication and authorization
	// decisions MUST be made on the basis of this id member, not the displayName nor name members. See
	// Section 6.1 of [RFC8266].
	ID []byte `json:"id"`
	// A human-palatable name for the user account, intended only for display. For example, "Alex P. Müller" or
	// "田中 倫". The Relying Party SHOULD let the user choose this, and SHOULD NOT restrict the choice more than
	// necessary.
	DisplayName string `json:"displayName"`
}

type TokenBinding struct {
	// This member is one of the following:
	Status TokenBindingStatus `json:"status,omitempty"`
	// This member MUST be present if status is present, and MUST a base64url encoding of the Token Binding ID that was
	// used when communicating with the Relying Party.
	ID string `json:"id,omitempty"`
}

type TokenBindingStatus string

type UserVerificationRequirement string