make_credential_request_handler.h 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_MAKE_CREDENTIAL_REQUEST_HANDLER_H_
  5. #define DEVICE_FIDO_MAKE_CREDENTIAL_REQUEST_HANDLER_H_
  6. #include <memory>
  7. #include <string>
  8. #include <utility>
  9. #include <vector>
  10. #include "base/callback.h"
  11. #include "base/component_export.h"
  12. #include "base/memory/raw_ptr.h"
  13. #include "base/memory/weak_ptr.h"
  14. #include "base/sequence_checker.h"
  15. #include "device/fido/auth_token_requester.h"
  16. #include "device/fido/authenticator_make_credential_response.h"
  17. #include "device/fido/authenticator_selection_criteria.h"
  18. #include "device/fido/bio/enroller.h"
  19. #include "device/fido/ctap_make_credential_request.h"
  20. #include "device/fido/fido_constants.h"
  21. #include "device/fido/fido_request_handler_base.h"
  22. #include "device/fido/fido_transport_protocol.h"
  23. #include "device/fido/fido_types.h"
  24. #include "device/fido/pin.h"
  25. #include "third_party/abseil-cpp/absl/types/optional.h"
  26. namespace base {
  27. class ElapsedTimer;
  28. }
  29. namespace device {
  30. class FidoAuthenticator;
  31. class FidoDiscoveryFactory;
  32. namespace pin {
  33. class TokenResponse;
  34. } // namespace pin
  35. enum class MakeCredentialStatus {
  36. kSuccess,
  37. kAuthenticatorResponseInvalid,
  38. kUserConsentButCredentialExcluded,
  39. kUserConsentDenied,
  40. kAuthenticatorRemovedDuringPINEntry,
  41. kSoftPINBlock,
  42. kHardPINBlock,
  43. kAuthenticatorMissingResidentKeys,
  44. // TODO(agl): kAuthenticatorMissingUserVerification can
  45. // also be returned when the authenticator supports UV, but
  46. // there's no UI support for collecting a PIN. This could
  47. // be clearer.
  48. kAuthenticatorMissingUserVerification,
  49. kAuthenticatorMissingLargeBlob,
  50. kNoCommonAlgorithms,
  51. kStorageFull,
  52. kWinInvalidStateError,
  53. kWinNotAllowedError,
  54. };
  55. class COMPONENT_EXPORT(DEVICE_FIDO) MakeCredentialRequestHandler
  56. : public FidoRequestHandlerBase,
  57. public AuthTokenRequester::Delegate,
  58. public BioEnroller::Delegate {
  59. public:
  60. using CompletionCallback = base::OnceCallback<void(
  61. MakeCredentialStatus,
  62. absl::optional<AuthenticatorMakeCredentialResponse>,
  63. const FidoAuthenticator*)>;
  64. MakeCredentialRequestHandler(
  65. FidoDiscoveryFactory* fido_discovery_factory,
  66. const base::flat_set<FidoTransportProtocol>& supported_transports,
  67. CtapMakeCredentialRequest request_parameter,
  68. const MakeCredentialOptions& options,
  69. CompletionCallback completion_callback);
  70. MakeCredentialRequestHandler(const MakeCredentialRequestHandler&) = delete;
  71. MakeCredentialRequestHandler& operator=(const MakeCredentialRequestHandler&) =
  72. delete;
  73. ~MakeCredentialRequestHandler() override;
  74. private:
  75. enum class State {
  76. kWaitingForTouch,
  77. kWaitingForToken,
  78. kBioEnrollment,
  79. kBioEnrollmentDone,
  80. kWaitingForResponseWithToken,
  81. kFinished,
  82. };
  83. // FidoRequestHandlerBase:
  84. void DispatchRequest(FidoAuthenticator* authenticator) override;
  85. void AuthenticatorRemoved(FidoDiscoveryBase* discovery,
  86. FidoAuthenticator* authenticator) override;
  87. // AuthTokenRequester::Delegate:
  88. bool AuthenticatorSelectedForPINUVAuthToken(
  89. FidoAuthenticator* authenticator) override;
  90. void CollectPIN(pin::PINEntryReason reason,
  91. pin::PINEntryError error,
  92. uint32_t min_pin_length,
  93. int attempts,
  94. ProvidePINCallback provide_pin_cb) override;
  95. void PromptForInternalUVRetry(int attempts) override;
  96. void HavePINUVAuthTokenResultForAuthenticator(
  97. FidoAuthenticator* authenticator,
  98. AuthTokenRequester::Result result,
  99. absl::optional<pin::TokenResponse> response) override;
  100. // BioEnroller::Delegate:
  101. void OnSampleCollected(BioEnrollmentSampleStatus status,
  102. int samples_remaining) override;
  103. void OnEnrollmentDone(
  104. absl::optional<std::vector<uint8_t>> template_id) override;
  105. void OnEnrollmentError(CtapDeviceResponseCode status) override;
  106. void ObtainPINUVAuthToken(FidoAuthenticator* authenticator,
  107. bool skip_pin_touch,
  108. bool internal_uv_locked);
  109. void DispatchRequestAfterAppIdExclude(
  110. std::unique_ptr<CtapMakeCredentialRequest> request,
  111. FidoAuthenticator* authenticator,
  112. CtapDeviceResponseCode status,
  113. absl::optional<bool> unused);
  114. void HandleResponse(
  115. FidoAuthenticator* authenticator,
  116. std::unique_ptr<CtapMakeCredentialRequest> request,
  117. base::ElapsedTimer request_timer,
  118. CtapDeviceResponseCode response_code,
  119. absl::optional<AuthenticatorMakeCredentialResponse> response);
  120. void HandleExcludedAuthenticator(FidoAuthenticator* authenticator);
  121. void HandleInapplicableAuthenticator(FidoAuthenticator* authenticator,
  122. MakeCredentialStatus status);
  123. void OnEnrollmentComplete(std::unique_ptr<CtapMakeCredentialRequest> request);
  124. void OnEnrollmentDismissed();
  125. void DispatchRequestWithToken(
  126. FidoAuthenticator* authenticator,
  127. std::unique_ptr<CtapMakeCredentialRequest> request,
  128. pin::TokenResponse token);
  129. void SpecializeRequestForAuthenticator(
  130. CtapMakeCredentialRequest* request,
  131. const FidoAuthenticator* authenticator);
  132. CompletionCallback completion_callback_;
  133. State state_ = State::kWaitingForTouch;
  134. bool suppress_attestation_ = false;
  135. CtapMakeCredentialRequest request_;
  136. absl::optional<base::RepeatingClosure> bio_enrollment_complete_barrier_;
  137. const MakeCredentialOptions options_;
  138. std::map<FidoAuthenticator*, std::unique_ptr<AuthTokenRequester>>
  139. auth_token_requester_map_;
  140. // selected_authenticator_for_pin_uv_auth_token_ points to the authenticator
  141. // that was tapped by the user while requesting a pinUvAuthToken from
  142. // connected authenticators. The object is owned by the underlying discovery
  143. // object and this pointer is cleared if it's removed during processing.
  144. raw_ptr<FidoAuthenticator> selected_authenticator_for_pin_uv_auth_token_ =
  145. nullptr;
  146. absl::optional<pin::TokenResponse> token_;
  147. std::unique_ptr<BioEnroller> bio_enroller_;
  148. // On ChromeOS, non-U2F cross-platform requests may be dispatched to the
  149. // platform authenticator if the request is user-presence-only and the
  150. // authenticator has been configured for user-presence-only mode via an
  151. // enterprise policy. For such requests, this field will be true.
  152. bool allow_platform_authenticator_for_cross_platform_request_ = false;
  153. SEQUENCE_CHECKER(my_sequence_checker_);
  154. base::WeakPtrFactory<MakeCredentialRequestHandler> weak_factory_{this};
  155. };
  156. } // namespace device
  157. #endif // DEVICE_FIDO_MAKE_CREDENTIAL_REQUEST_HANDLER_H_