From e15dcc474545fb515c63ae6d6bfd427c87474b8a Mon Sep 17 00:00:00 2001 From: Johan Lundberg Date: Mon, 16 Feb 2026 11:39:50 +0100 Subject: [PATCH] feat: add authentication routes with session login, WebAuthn, and credential management Implement Phase 4 auth routes: password login/logout, WebAuthn registration and authentication, magic link registration, and credential management pages with HTMX. Includes session middleware, Jinja2 templates, vendored HTMX, and last-credential guardrails. 120 tests passing. --- pyproject.toml | 1 + src/fastapi_oidc_op/app.py | 43 ++++- src/fastapi_oidc_op/authn/routes.py | 154 ++++++++++++++++ src/fastapi_oidc_op/config.py | 3 + src/fastapi_oidc_op/dependencies.py | 23 ++- src/fastapi_oidc_op/manage/routes.py | 166 ++++++++++++++++++ src/fastapi_oidc_op/static/htmx.min.js | 1 + src/fastapi_oidc_op/static/style.css | 134 ++++++++++++++ src/fastapi_oidc_op/static/webauthn.js | 149 ++++++++++++++++ src/fastapi_oidc_op/templates/base.html | 18 ++ src/fastapi_oidc_op/templates/login.html | 35 ++++ .../templates/manage/credentials.html | 58 ++++++ tests/test_auth_routes/__init__.py | 0 .../test_last_credential_guard.py | 69 ++++++++ .../test_manage_credentials_page.py | 54 ++++++ .../test_manage_password_credential.py | 103 +++++++++++ .../test_manage_webauthn_credential.py | 132 ++++++++++++++ tests/test_auth_routes/test_pages.py | 19 ++ tests/test_auth_routes/test_password_login.py | 64 +++++++ .../test_register_magic_link.py | 72 ++++++++ tests/test_auth_routes/test_session_deps.py | 38 ++++ tests/test_auth_routes/test_webauthn_login.py | 95 ++++++++++ uv.lock | 11 ++ 23 files changed, 1440 insertions(+), 2 deletions(-) create mode 100644 src/fastapi_oidc_op/authn/routes.py create mode 100644 src/fastapi_oidc_op/manage/routes.py create mode 100644 src/fastapi_oidc_op/static/htmx.min.js create mode 100644 src/fastapi_oidc_op/static/style.css create mode 100644 src/fastapi_oidc_op/static/webauthn.js create mode 100644 src/fastapi_oidc_op/templates/base.html create mode 100644 src/fastapi_oidc_op/templates/login.html create mode 100644 src/fastapi_oidc_op/templates/manage/credentials.html create mode 100644 tests/test_auth_routes/__init__.py create mode 100644 tests/test_auth_routes/test_last_credential_guard.py create mode 100644 tests/test_auth_routes/test_manage_credentials_page.py create mode 100644 tests/test_auth_routes/test_manage_password_credential.py create mode 100644 tests/test_auth_routes/test_manage_webauthn_credential.py create mode 100644 tests/test_auth_routes/test_pages.py create mode 100644 tests/test_auth_routes/test_password_login.py create mode 100644 tests/test_auth_routes/test_register_magic_link.py create mode 100644 tests/test_auth_routes/test_session_deps.py create mode 100644 tests/test_auth_routes/test_webauthn_login.py diff --git a/pyproject.toml b/pyproject.toml index 38bd484..3f248f0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -17,6 +17,7 @@ dependencies = [ "proquint>=0.2", "python-multipart>=0.0.20", "httpx>=0.28", + "itsdangerous>=2.2.0", ] [project.scripts] diff --git a/src/fastapi_oidc_op/app.py b/src/fastapi_oidc_op/app.py index 11f81ee..e91bd44 100644 --- a/src/fastapi_oidc_op/app.py +++ b/src/fastapi_oidc_op/app.py @@ -1,11 +1,21 @@ +import secrets from collections.abc import AsyncIterator from contextlib import asynccontextmanager from pathlib import Path +from urllib.parse import urlparse import aiosqlite from fastapi import FastAPI +from fastapi.staticfiles import StaticFiles +from fastapi.templating import Jinja2Templates +from starlette.middleware.sessions import SessionMiddleware +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.authn.routes import router as authn_router +from fastapi_oidc_op.authn.webauthn import WebAuthnService from fastapi_oidc_op.config import Settings, StorageBackend +from fastapi_oidc_op.invite.service import MagicLinkService +from fastapi_oidc_op.manage.routes import router as manage_router from fastapi_oidc_op.store.sqlite.migrations import run_migrations from fastapi_oidc_op.store.sqlite.repositories import ( SQLiteCredentialRepository, @@ -13,7 +23,8 @@ from fastapi_oidc_op.store.sqlite.repositories import ( SQLiteUserRepository, ) -MIGRATIONS_DIR = Path(__file__).parent / "store" / "sqlite" / "migrations" +PACKAGE_DIR = Path(__file__).parent +MIGRATIONS_DIR = PACKAGE_DIR / "store" / "sqlite" / "migrations" @asynccontextmanager @@ -30,6 +41,22 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]: app.state.user_repo = SQLiteUserRepository(db) app.state.credential_repo = SQLiteCredentialRepository(db) app.state.magic_link_repo = SQLiteMagicLinkRepository(db) + + # Auth services + app.state.password_service = PasswordService() + + rp_id = urlparse(settings.issuer).hostname or "localhost" + app.state.webauthn_service = WebAuthnService( + rp_id=rp_id, + rp_name=app.title, + origin=settings.issuer, + ) + + app.state.magic_link_service = MagicLinkService( + repo=app.state.magic_link_repo, + ttl=settings.invite_ttl, + ) + yield await db.close() else: @@ -50,6 +77,20 @@ def create_app(settings: Settings | None = None) -> FastAPI: app.state.settings = settings + # Session middleware + session_secret = settings.session_secret or secrets.token_hex(32) + app.add_middleware(SessionMiddleware, secret_key=session_secret) # type: ignore[arg-type] + + # Templates + app.state.templates = Jinja2Templates(directory=str(PACKAGE_DIR / "templates")) + + # Static files + app.mount("/static", StaticFiles(directory=str(PACKAGE_DIR / "static")), name="static") + + # Routers + app.include_router(authn_router) + app.include_router(manage_router) + @app.get("/health") async def health() -> dict[str, str]: return {"status": "ok"} diff --git a/src/fastapi_oidc_op/authn/routes.py b/src/fastapi_oidc_op/authn/routes.py new file mode 100644 index 0000000..2bca6b0 --- /dev/null +++ b/src/fastapi_oidc_op/authn/routes.py @@ -0,0 +1,154 @@ +from fastapi import APIRouter, Form, Request, Response +from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse +from fido2.webauthn import ( + AttestedCredentialData, + AuthenticationResponse, + PublicKeyCredentialDescriptor, + PublicKeyCredentialType, +) + +from fastapi_oidc_op.models import User +from fastapi_oidc_op.userid import generate_unique_userid + +router = APIRouter(tags=["authn"]) + + +@router.get("/login", response_class=HTMLResponse) +async def login_page(request: Request) -> HTMLResponse: + templates = request.app.state.templates + return templates.TemplateResponse(request, "login.html") + + +@router.post("/login/password", response_class=HTMLResponse) +async def login_password( + request: Request, + username: str = Form(), + password: str = Form(), +) -> Response: + user_repo = request.app.state.user_repo + cred_repo = request.app.state.credential_repo + password_service = request.app.state.password_service + + error_html = '
Invalid username or password
' + + user = await user_repo.get_by_username(username) + if user is None: + return HTMLResponse(error_html) + + credential = await cred_repo.get_password_by_user(user.userid) + if credential is None: + return HTMLResponse(error_html) + + if not password_service.verify(credential.password_hash, password): + return HTMLResponse(error_html) + + request.session["userid"] = user.userid + request.session["username"] = user.username + + response = Response() + response.headers["HX-Redirect"] = "/manage/credentials" + return response + + +@router.post("/logout") +async def logout(request: Request) -> Response: + request.session.clear() + response = Response() + response.headers["HX-Redirect"] = "/login" + return response + + +@router.get("/register/{token}") +async def register_magic_link(request: Request, token: str) -> Response: + magic_link_service = request.app.state.magic_link_service + user_repo = request.app.state.user_repo + + link = await magic_link_service.validate(token) + if link is None: + return HTMLResponse("

Invalid or expired registration link.

", status_code=400) + + userid = await generate_unique_userid(user_repo) + user = User(userid=userid, username=link.username, groups=["users"]) + await user_repo.create(user) + + await magic_link_service.mark_used(token) + + request.session["userid"] = user.userid + request.session["username"] = user.username + + return RedirectResponse("/manage/credentials?setup=1", status_code=303) + + +@router.post("/login/webauthn/begin") +async def login_webauthn_begin( + request: Request, + username: str = Form(), +) -> Response: + user_repo = request.app.state.user_repo + cred_repo = request.app.state.credential_repo + webauthn_service = request.app.state.webauthn_service + + error_html = '
Invalid username or password
' + + user = await user_repo.get_by_username(username) + if user is None: + return HTMLResponse(error_html) + + webauthn_creds = await cred_repo.get_webauthn_by_user(user.userid) + if not webauthn_creds: + return HTMLResponse(error_html) + + descriptors = [ + PublicKeyCredentialDescriptor(type=PublicKeyCredentialType.PUBLIC_KEY, id=cred.credential_id) + for cred in webauthn_creds + ] + + options, state = webauthn_service.begin_authentication(credentials=descriptors) + + request.session["webauthn_login_state"] = state + request.session["webauthn_login_userid"] = user.userid + return JSONResponse(options) + + +@router.post("/login/webauthn/complete") +async def login_webauthn_complete(request: Request) -> Response: + webauthn_service = request.app.state.webauthn_service + user_repo = request.app.state.user_repo + cred_repo = request.app.state.credential_repo + + state = request.session.pop("webauthn_login_state", None) + userid = request.session.pop("webauthn_login_userid", None) + + if state is None or userid is None: + return HTMLResponse('
Authentication session expired
', status_code=400) + + webauthn_creds = await cred_repo.get_webauthn_by_user(userid) + credentials = [AttestedCredentialData(cred.public_key) for cred in webauthn_creds] + + body = await request.json() + + try: + webauthn_service.complete_authentication(state, credentials, body) + except Exception: + return HTMLResponse('
Authentication failed
') + + # Extract sign count from the response and update + auth_response = AuthenticationResponse.from_dict(body) + new_counter = auth_response.response.authenticator_data.counter + matched_credential_id = auth_response.raw_id + + stored = await cred_repo.get_webauthn_by_credential_id(matched_credential_id) + if stored is not None: + stored.sign_count = new_counter + await cred_repo.update_webauthn(stored) + + user = await user_repo.get_by_userid(userid) + if user is None: + return HTMLResponse('
User not found
', status_code=400) + + request.session["userid"] = user.userid + request.session["username"] = user.username + + response = Response() + response.headers["HX-Redirect"] = "/manage/credentials" + return response diff --git a/src/fastapi_oidc_op/config.py b/src/fastapi_oidc_op/config.py index c29a0f2..5ca9e1e 100644 --- a/src/fastapi_oidc_op/config.py +++ b/src/fastapi_oidc_op/config.py @@ -29,6 +29,9 @@ class Settings(BaseSettings): # Management RP manage_client_id: str = "manage-app" + # Session + session_secret: str | None = None # If None, a random secret is generated per process + # Magic links invite_ttl: int = 86400 # seconds diff --git a/src/fastapi_oidc_op/dependencies.py b/src/fastapi_oidc_op/dependencies.py index 29675d0..c3f5770 100644 --- a/src/fastapi_oidc_op/dependencies.py +++ b/src/fastapi_oidc_op/dependencies.py @@ -1,4 +1,4 @@ -from fastapi import Request +from fastapi import HTTPException, Request from fastapi_oidc_op.store.protocols import ( CredentialRepository, @@ -17,3 +17,24 @@ def get_credential_repo(request: Request) -> CredentialRepository: def get_magic_link_repo(request: Request) -> MagicLinkRepository: return request.app.state.magic_link_repo + + +def get_session_user(request: Request) -> tuple[str, str] | None: + """Extract (userid, username) from session, or None if not logged in.""" + userid = request.session.get("userid") + username = request.session.get("username") + if userid and username: + return (userid, username) + return None + + +def require_session_user(request: Request) -> tuple[str, str]: + """Like get_session_user but raises HTTPException(401) if not logged in. + + Routes that need a redirect-to-login behavior should catch this or + use get_session_user and redirect manually. + """ + result = get_session_user(request) + if result is None: + raise HTTPException(status_code=401, detail="Not authenticated") + return result diff --git a/src/fastapi_oidc_op/manage/routes.py b/src/fastapi_oidc_op/manage/routes.py new file mode 100644 index 0000000..f197bf7 --- /dev/null +++ b/src/fastapi_oidc_op/manage/routes.py @@ -0,0 +1,166 @@ +from base64 import urlsafe_b64decode + +from fastapi import APIRouter, Form, Request, Response +from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse +from fido2.webauthn import PublicKeyCredentialDescriptor, PublicKeyCredentialType + +from fastapi_oidc_op.dependencies import get_session_user +from fastapi_oidc_op.models import PasswordCredential, WebAuthnCredential + +router = APIRouter(prefix="/manage", tags=["manage"]) + + +async def _count_credentials(cred_repo: object, userid: str) -> int: + """Count total credentials (password + webauthn) for a user.""" + webauthn = await cred_repo.get_webauthn_by_user(userid) # type: ignore[union-attr] + password = await cred_repo.get_password_by_user(userid) # type: ignore[union-attr] + return len(webauthn) + (1 if password else 0) + + +@router.get("/credentials", response_class=HTMLResponse) +async def credentials_page(request: Request) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, username = session_user + cred_repo = request.app.state.credential_repo + + webauthn_credentials = await cred_repo.get_webauthn_by_user(userid) + password_credential = await cred_repo.get_password_by_user(userid) + setup = request.query_params.get("setup") + + templates = request.app.state.templates + return templates.TemplateResponse( + request, + "manage/credentials.html", + { + "username": username, + "webauthn_credentials": webauthn_credentials, + "has_password": password_credential is not None, + "setup": setup, + }, + ) + + +@router.post("/credentials/password", response_class=HTMLResponse) +async def set_password( + request: Request, + password: str = Form(), + confirm: str = Form(), +) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, _username = session_user + cred_repo = request.app.state.credential_repo + password_service = request.app.state.password_service + + if password != confirm: + return HTMLResponse('
Passwords do not match
') + + if len(password) < 8: + return HTMLResponse('
Password must be at least 8 characters
') + + password_hash = password_service.hash(password) + + existing = await cred_repo.get_password_by_user(userid) + if existing is not None: + await cred_repo.delete_password(userid) + + await cred_repo.create_password(PasswordCredential(user_id=userid, password_hash=password_hash)) + + return HTMLResponse('
Password updated successfully
') + + +@router.delete("/credentials/password", response_class=HTMLResponse) +async def delete_password(request: Request) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, _username = session_user + cred_repo = request.app.state.credential_repo + + count = await _count_credentials(cred_repo, userid) + if count <= 1: + return HTMLResponse('
Cannot remove your last credential
') + + await cred_repo.delete_password(userid) + return HTMLResponse('
Password removed
') + + +@router.post("/credentials/webauthn/begin") +async def webauthn_begin(request: Request) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, username = session_user + cred_repo = request.app.state.credential_repo + webauthn_service = request.app.state.webauthn_service + + # Build exclude list from existing credentials + existing = await cred_repo.get_webauthn_by_user(userid) + descriptors = [ + PublicKeyCredentialDescriptor(type=PublicKeyCredentialType.PUBLIC_KEY, id=cred.credential_id) + for cred in existing + ] + + options, state = webauthn_service.begin_registration( + user_id=userid.encode(), + username=username, + existing_credentials=descriptors, + ) + + request.session["webauthn_register_state"] = state + return JSONResponse(options) + + +@router.post("/credentials/webauthn/complete") +async def webauthn_complete(request: Request) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, _username = session_user + cred_repo = request.app.state.credential_repo + webauthn_service = request.app.state.webauthn_service + + state = request.session.pop("webauthn_register_state", None) + if state is None: + return HTMLResponse('
Registration session expired
', status_code=400) + + body = await request.json() + result = webauthn_service.complete_registration(state, body) + + cred = WebAuthnCredential( + user_id=userid, + credential_id=result.credential_data.credential_id, + public_key=bytes(result.credential_data), + ) + await cred_repo.create_webauthn(cred) + + return HTMLResponse('
Security key added
') + + +@router.delete("/credentials/webauthn/{credential_id_b64}") +async def delete_webauthn(request: Request, credential_id_b64: str) -> Response: + session_user = get_session_user(request) + if session_user is None: + return RedirectResponse("/login", status_code=303) + + userid, _username = session_user + cred_repo = request.app.state.credential_repo + + # Decode base64url credential_id (add padding if needed) + padded = credential_id_b64 + "=" * (-len(credential_id_b64) % 4) + credential_id = urlsafe_b64decode(padded) + + count = await _count_credentials(cred_repo, userid) + if count <= 1: + return HTMLResponse('
Cannot remove your last credential
') + + await cred_repo.delete_webauthn(userid, credential_id) + return HTMLResponse('
Security key removed
') diff --git a/src/fastapi_oidc_op/static/htmx.min.js b/src/fastapi_oidc_op/static/htmx.min.js new file mode 100644 index 0000000..59937d7 --- /dev/null +++ b/src/fastapi_oidc_op/static/htmx.min.js @@ -0,0 +1 @@ +var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||"post");return n.values},remove:null,addClass:null,removeClass:null,toggleClass:null,takeClass:null,swap:null,defineExtension:null,removeExtension:null,logAll:null,logNone:null,logger:null,config:{historyEnabled:true,historyCacheSize:10,refreshOnHistoryMiss:false,defaultSwapStyle:"innerHTML",defaultSwapDelay:0,defaultSettleDelay:20,includeIndicatorStyles:true,indicatorClass:"htmx-indicator",requestClass:"htmx-request",addedClass:"htmx-added",settlingClass:"htmx-settling",swappingClass:"htmx-swapping",allowEval:true,allowScriptTags:true,inlineScriptNonce:"",inlineStyleNonce:"",attributesToSettle:["class","style","width","height"],withCredentials:false,timeout:0,wsReconnectDelay:"full-jitter",wsBinaryType:"blob",disableSelector:"[hx-disable], [data-hx-disable]",scrollBehavior:"instant",defaultFocusScroll:false,getCacheBusterParam:false,globalViewTransitions:false,methodsThatUseUrlParams:["get","delete"],selfRequestsOnly:true,ignoreTitle:false,scrollIntoViewOnBoost:true,triggerSpecsCache:null,disableInheritance:false,responseHandling:[{code:"204",swap:false},{code:"[23]..",swap:true},{code:"[45]..",swap:false,error:true}],allowNestedOobSwaps:true},parseInterval:null,_:null,version:"2.0.4"};Q.onLoad=j;Q.process=kt;Q.on=ye;Q.off=be;Q.trigger=he;Q.ajax=Rn;Q.find=u;Q.findAll=x;Q.closest=g;Q.remove=z;Q.addClass=K;Q.removeClass=G;Q.toggleClass=W;Q.takeClass=Z;Q.swap=$e;Q.defineExtension=Fn;Q.removeExtension=Bn;Q.logAll=V;Q.logNone=_;Q.parseInterval=d;Q._=e;const n={addTriggerHandler:St,bodyContains:le,canAccessLocalStorage:B,findThisElement:Se,filterValues:hn,swap:$e,hasAttribute:s,getAttributeValue:te,getClosestAttributeValue:re,getClosestMatch:o,getExpressionVars:En,getHeaders:fn,getInputValues:cn,getInternalData:ie,getSwapSpecification:gn,getTriggerSpecs:st,getTarget:Ee,makeFragment:P,mergeObjects:ce,makeSettleInfo:xn,oobSwap:He,querySelectorExt:ae,settleImmediately:Kt,shouldCancel:ht,triggerEvent:he,triggerErrorEvent:fe,withExtensions:Ft};const r=["get","post","put","delete","patch"];const H=r.map(function(e){return"[hx-"+e+"], [data-hx-"+e+"]"}).join(", ");function d(e){if(e==undefined){return undefined}let t=NaN;if(e.slice(-2)=="ms"){t=parseFloat(e.slice(0,-2))}else if(e.slice(-1)=="s"){t=parseFloat(e.slice(0,-1))*1e3}else if(e.slice(-1)=="m"){t=parseFloat(e.slice(0,-1))*1e3*60}else{t=parseFloat(e)}return isNaN(t)?undefined:t}function ee(e,t){return e instanceof Element&&e.getAttribute(t)}function s(e,t){return!!e.hasAttribute&&(e.hasAttribute(t)||e.hasAttribute("data-"+t))}function te(e,t){return ee(e,t)||ee(e,"data-"+t)}function c(e){const t=e.parentElement;if(!t&&e.parentNode instanceof ShadowRoot)return e.parentNode;return t}function ne(){return document}function m(e,t){return e.getRootNode?e.getRootNode({composed:t}):ne()}function o(e,t){while(e&&!t(e)){e=c(e)}return e||null}function i(e,t,n){const r=te(t,n);const o=te(t,"hx-disinherit");var i=te(t,"hx-inherit");if(e!==t){if(Q.config.disableInheritance){if(i&&(i==="*"||i.split(" ").indexOf(n)>=0)){return r}else{return null}}if(o&&(o==="*"||o.split(" ").indexOf(n)>=0)){return"unset"}}return r}function re(t,n){let r=null;o(t,function(e){return!!(r=i(t,ue(e),n))});if(r!=="unset"){return r}}function h(e,t){const n=e instanceof Element&&(e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.webkitMatchesSelector||e.oMatchesSelector);return!!n&&n.call(e,t)}function T(e){const t=/<([a-z][^\/\0>\x20\t\r\n\f]*)/i;const n=t.exec(e);if(n){return n[1].toLowerCase()}else{return""}}function q(e){const t=new DOMParser;return t.parseFromString(e,"text/html")}function L(e,t){while(t.childNodes.length>0){e.append(t.childNodes[0])}}function A(e){const t=ne().createElement("script");se(e.attributes,function(e){t.setAttribute(e.name,e.value)});t.textContent=e.textContent;t.async=false;if(Q.config.inlineScriptNonce){t.nonce=Q.config.inlineScriptNonce}return t}function N(e){return e.matches("script")&&(e.type==="text/javascript"||e.type==="module"||e.type==="")}function I(e){Array.from(e.querySelectorAll("script")).forEach(e=>{if(N(e)){const t=A(e);const n=e.parentNode;try{n.insertBefore(t,e)}catch(e){O(e)}finally{e.remove()}}})}function P(e){const t=e.replace(/]*)?>[\s\S]*?<\/head>/i,"");const n=T(t);let r;if(n==="html"){r=new DocumentFragment;const i=q(e);L(r,i.body);r.title=i.title}else if(n==="body"){r=new DocumentFragment;const i=q(t);L(r,i.body);r.title=i.title}else{const i=q('");r=i.querySelector("template").content;r.title=i.title;var o=r.querySelector("title");if(o&&o.parentNode===r){o.remove();r.title=o.innerText}}if(r){if(Q.config.allowScriptTags){I(r)}else{r.querySelectorAll("script").forEach(e=>e.remove())}}return r}function oe(e){if(e){e()}}function t(e,t){return Object.prototype.toString.call(e)==="[object "+t+"]"}function k(e){return typeof e==="function"}function D(e){return t(e,"Object")}function ie(e){const t="htmx-internal-data";let n=e[t];if(!n){n=e[t]={}}return n}function M(t){const n=[];if(t){for(let e=0;e=0}function le(e){return e.getRootNode({composed:true})===document}function F(e){return e.trim().split(/\s+/)}function ce(e,t){for(const n in t){if(t.hasOwnProperty(n)){e[n]=t[n]}}return e}function S(e){try{return JSON.parse(e)}catch(e){O(e);return null}}function B(){const e="htmx:localStorageTest";try{localStorage.setItem(e,e);localStorage.removeItem(e);return true}catch(e){return false}}function U(t){try{const e=new URL(t);if(e){t=e.pathname+e.search}if(!/^\/$/.test(t)){t=t.replace(/\/+$/,"")}return t}catch(e){return t}}function e(e){return vn(ne().body,function(){return eval(e)})}function j(t){const e=Q.on("htmx:load",function(e){t(e.detail.elt)});return e}function V(){Q.logger=function(e,t,n){if(console){console.log(t,e,n)}}}function _(){Q.logger=null}function u(e,t){if(typeof e!=="string"){return e.querySelector(t)}else{return u(ne(),e)}}function x(e,t){if(typeof e!=="string"){return e.querySelectorAll(t)}else{return x(ne(),e)}}function E(){return window}function z(e,t){e=y(e);if(t){E().setTimeout(function(){z(e);e=null},t)}else{c(e).removeChild(e)}}function ue(e){return e instanceof Element?e:null}function $(e){return e instanceof HTMLElement?e:null}function J(e){return typeof e==="string"?e:null}function f(e){return e instanceof Element||e instanceof Document||e instanceof DocumentFragment?e:null}function K(e,t,n){e=ue(y(e));if(!e){return}if(n){E().setTimeout(function(){K(e,t);e=null},n)}else{e.classList&&e.classList.add(t)}}function G(e,t,n){let r=ue(y(e));if(!r){return}if(n){E().setTimeout(function(){G(r,t);r=null},n)}else{if(r.classList){r.classList.remove(t);if(r.classList.length===0){r.removeAttribute("class")}}}}function W(e,t){e=y(e);e.classList.toggle(t)}function Z(e,t){e=y(e);se(e.parentElement.children,function(e){G(e,t)});K(ue(e),t)}function g(e,t){e=ue(y(e));if(e&&e.closest){return e.closest(t)}else{do{if(e==null||h(e,t)){return e}}while(e=e&&ue(c(e)));return null}}function l(e,t){return e.substring(0,t.length)===t}function Y(e,t){return e.substring(e.length-t.length)===t}function ge(e){const t=e.trim();if(l(t,"<")&&Y(t,"/>")){return t.substring(1,t.length-2)}else{return t}}function p(t,r,n){if(r.indexOf("global ")===0){return p(t,r.slice(7),true)}t=y(t);const o=[];{let t=0;let n=0;for(let e=0;e"){t--}}if(n0){const r=ge(o.shift());let e;if(r.indexOf("closest ")===0){e=g(ue(t),ge(r.substr(8)))}else if(r.indexOf("find ")===0){e=u(f(t),ge(r.substr(5)))}else if(r==="next"||r==="nextElementSibling"){e=ue(t).nextElementSibling}else if(r.indexOf("next ")===0){e=pe(t,ge(r.substr(5)),!!n)}else if(r==="previous"||r==="previousElementSibling"){e=ue(t).previousElementSibling}else if(r.indexOf("previous ")===0){e=me(t,ge(r.substr(9)),!!n)}else if(r==="document"){e=document}else if(r==="window"){e=window}else if(r==="body"){e=document.body}else if(r==="root"){e=m(t,!!n)}else if(r==="host"){e=t.getRootNode().host}else{s.push(r)}if(e){i.push(e)}}if(s.length>0){const e=s.join(",");const c=f(m(t,!!n));i.push(...M(c.querySelectorAll(e)))}return i}var pe=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=0;e=0;e--){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_FOLLOWING){return o}}};function ae(e,t){if(typeof e!=="string"){return p(e,t)[0]}else{return p(ne().body,e)[0]}}function y(e,t){if(typeof e==="string"){return u(f(t)||document,e)}else{return e}}function xe(e,t,n,r){if(k(t)){return{target:ne().body,event:J(e),listener:t,options:n}}else{return{target:y(e),event:J(t),listener:n,options:r}}}function ye(t,n,r,o){Vn(function(){const e=xe(t,n,r,o);e.target.addEventListener(e.event,e.listener,e.options)});const e=k(n);return e?n:r}function be(t,n,r){Vn(function(){const e=xe(t,n,r);e.target.removeEventListener(e.event,e.listener)});return k(n)?n:r}const ve=ne().createElement("output");function we(e,t){const n=re(e,t);if(n){if(n==="this"){return[Se(e,t)]}else{const r=p(e,n);if(r.length===0){O('The selector "'+n+'" on '+t+" returned no matches!");return[ve]}else{return r}}}}function Se(e,t){return ue(o(e,function(e){return te(ue(e),t)!=null}))}function Ee(e){const t=re(e,"hx-target");if(t){if(t==="this"){return Se(e,"hx-target")}else{return ae(e,t)}}else{const n=ie(e);if(n.boosted){return ne().body}else{return e}}}function Ce(t){const n=Q.config.attributesToSettle;for(let e=0;e0){s=e.substring(0,e.indexOf(":"));n=e.substring(e.indexOf(":")+1)}else{s=e}o.removeAttribute("hx-swap-oob");o.removeAttribute("data-hx-swap-oob");const r=p(t,n,false);if(r){se(r,function(e){let t;const n=o.cloneNode(true);t=ne().createDocumentFragment();t.appendChild(n);if(!Re(s,e)){t=f(n)}const r={shouldSwap:true,target:e,fragment:t};if(!he(e,"htmx:oobBeforeSwap",r))return;e=r.target;if(r.shouldSwap){qe(t);_e(s,e,e,t,i);Te()}se(i.elts,function(e){he(e,"htmx:oobAfterSwap",r)})});o.parentNode.removeChild(o)}else{o.parentNode.removeChild(o);fe(ne().body,"htmx:oobErrorNoTarget",{content:o})}return e}function Te(){const e=u("#--htmx-preserve-pantry--");if(e){for(const t of[...e.children]){const n=u("#"+t.id);n.parentNode.moveBefore(t,n);n.remove()}e.remove()}}function qe(e){se(x(e,"[hx-preserve], [data-hx-preserve]"),function(e){const t=te(e,"id");const n=ne().getElementById(t);if(n!=null){if(e.moveBefore){let e=u("#--htmx-preserve-pantry--");if(e==null){ne().body.insertAdjacentHTML("afterend","
");e=u("#--htmx-preserve-pantry--")}e.moveBefore(n,null)}else{e.parentNode.replaceChild(n,e)}}})}function Le(l,e,c){se(e.querySelectorAll("[id]"),function(t){const n=ee(t,"id");if(n&&n.length>0){const r=n.replace("'","\\'");const o=t.tagName.replace(":","\\:");const e=f(l);const i=e&&e.querySelector(o+"[id='"+r+"']");if(i&&i!==e){const s=t.cloneNode();Oe(t,i);c.tasks.push(function(){Oe(t,s)})}}})}function Ae(e){return function(){G(e,Q.config.addedClass);kt(ue(e));Ne(f(e));he(e,"htmx:load")}}function Ne(e){const t="[autofocus]";const n=$(h(e,t)?e:e.querySelector(t));if(n!=null){n.focus()}}function a(e,t,n,r){Le(e,n,r);while(n.childNodes.length>0){const o=n.firstChild;K(ue(o),Q.config.addedClass);e.insertBefore(o,t);if(o.nodeType!==Node.TEXT_NODE&&o.nodeType!==Node.COMMENT_NODE){r.tasks.push(Ae(o))}}}function Ie(e,t){let n=0;while(n0}function $e(e,t,r,o){if(!o){o={}}e=y(e);const i=o.contextElement?m(o.contextElement,false):ne();const n=document.activeElement;let s={};try{s={elt:n,start:n?n.selectionStart:null,end:n?n.selectionEnd:null}}catch(e){}const l=xn(e);if(r.swapStyle==="textContent"){e.textContent=t}else{let n=P(t);l.title=n.title;if(o.selectOOB){const u=o.selectOOB.split(",");for(let t=0;t0){E().setTimeout(c,r.settleDelay)}else{c()}}function Je(e,t,n){const r=e.getResponseHeader(t);if(r.indexOf("{")===0){const o=S(r);for(const i in o){if(o.hasOwnProperty(i)){let e=o[i];if(D(e)){n=e.target!==undefined?e.target:n}else{e={value:e}}he(n,i,e)}}}else{const s=r.split(",");for(let e=0;e0){const s=o[0];if(s==="]"){e--;if(e===0){if(n===null){t=t+"true"}o.shift();t+=")})";try{const l=vn(r,function(){return Function(t)()},function(){return true});l.source=t;return l}catch(e){fe(ne().body,"htmx:syntax:error",{error:e,source:t});return null}}}else if(s==="["){e++}if(tt(s,n,i)){t+="(("+i+"."+s+") ? ("+i+"."+s+") : (window."+s+"))"}else{t=t+s}n=o.shift()}}}function C(e,t){let n="";while(e.length>0&&!t.test(e[0])){n+=e.shift()}return n}function rt(e){let t;if(e.length>0&&Ye.test(e[0])){e.shift();t=C(e,Qe).trim();e.shift()}else{t=C(e,v)}return t}const ot="input, textarea, select";function it(e,t,n){const r=[];const o=et(t);do{C(o,w);const l=o.length;const c=C(o,/[,\[\s]/);if(c!==""){if(c==="every"){const u={trigger:"every"};C(o,w);u.pollInterval=d(C(o,/[,\[\s]/));C(o,w);var i=nt(e,o,"event");if(i){u.eventFilter=i}r.push(u)}else{const a={trigger:c};var i=nt(e,o,"event");if(i){a.eventFilter=i}C(o,w);while(o.length>0&&o[0]!==","){const f=o.shift();if(f==="changed"){a.changed=true}else if(f==="once"){a.once=true}else if(f==="consume"){a.consume=true}else if(f==="delay"&&o[0]===":"){o.shift();a.delay=d(C(o,v))}else if(f==="from"&&o[0]===":"){o.shift();if(Ye.test(o[0])){var s=rt(o)}else{var s=C(o,v);if(s==="closest"||s==="find"||s==="next"||s==="previous"){o.shift();const h=rt(o);if(h.length>0){s+=" "+h}}}a.from=s}else if(f==="target"&&o[0]===":"){o.shift();a.target=rt(o)}else if(f==="throttle"&&o[0]===":"){o.shift();a.throttle=d(C(o,v))}else if(f==="queue"&&o[0]===":"){o.shift();a.queue=C(o,v)}else if(f==="root"&&o[0]===":"){o.shift();a[f]=rt(o)}else if(f==="threshold"&&o[0]===":"){o.shift();a[f]=C(o,v)}else{fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}r.push(a)}}if(o.length===l){fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}while(o[0]===","&&o.shift());if(n){n[t]=r}return r}function st(e){const t=te(e,"hx-trigger");let n=[];if(t){const r=Q.config.triggerSpecsCache;n=r&&r[t]||it(e,t,r)}if(n.length>0){return n}else if(h(e,"form")){return[{trigger:"submit"}]}else if(h(e,'input[type="button"], input[type="submit"]')){return[{trigger:"click"}]}else if(h(e,ot)){return[{trigger:"change"}]}else{return[{trigger:"click"}]}}function lt(e){ie(e).cancelled=true}function ct(e,t,n){const r=ie(e);r.timeout=E().setTimeout(function(){if(le(e)&&r.cancelled!==true){if(!gt(n,e,Mt("hx:poll:trigger",{triggerSpec:n,target:e}))){t(e)}ct(e,t,n)}},n.pollInterval)}function ut(e){return location.hostname===e.hostname&&ee(e,"href")&&ee(e,"href").indexOf("#")!==0}function at(e){return g(e,Q.config.disableSelector)}function ft(t,n,e){if(t instanceof HTMLAnchorElement&&ut(t)&&(t.target===""||t.target==="_self")||t.tagName==="FORM"&&String(ee(t,"method")).toLowerCase()!=="dialog"){n.boosted=true;let r,o;if(t.tagName==="A"){r="get";o=ee(t,"href")}else{const i=ee(t,"method");r=i?i.toLowerCase():"get";o=ee(t,"action");if(o==null||o===""){o=ne().location.href}if(r==="get"&&o.includes("?")){o=o.replace(/\?[^#]+/,"")}}e.forEach(function(e){pt(t,function(e,t){const n=ue(e);if(at(n)){b(n);return}de(r,o,n,t)},n,e,true)})}}function ht(e,t){const n=ue(t);if(!n){return false}if(e.type==="submit"||e.type==="click"){if(n.tagName==="FORM"){return true}if(h(n,'input[type="submit"], button')&&(h(n,"[form]")||g(n,"form")!==null)){return true}if(n instanceof HTMLAnchorElement&&n.href&&(n.getAttribute("href")==="#"||n.getAttribute("href").indexOf("#")!==0)){return true}}return false}function dt(e,t){return ie(e).boosted&&e instanceof HTMLAnchorElement&&t.type==="click"&&(t.ctrlKey||t.metaKey)}function gt(e,t,n){const r=e.eventFilter;if(r){try{return r.call(t,n)!==true}catch(e){const o=r.source;fe(ne().body,"htmx:eventFilter:error",{error:e,source:o});return true}}return false}function pt(l,c,e,u,a){const f=ie(l);let t;if(u.from){t=p(l,u.from)}else{t=[l]}if(u.changed){if(!("lastValue"in f)){f.lastValue=new WeakMap}t.forEach(function(e){if(!f.lastValue.has(u)){f.lastValue.set(u,new WeakMap)}f.lastValue.get(u).set(e,e.value)})}se(t,function(i){const s=function(e){if(!le(l)){i.removeEventListener(u.trigger,s);return}if(dt(l,e)){return}if(a||ht(e,l)){e.preventDefault()}if(gt(u,l,e)){return}const t=ie(e);t.triggerSpec=u;if(t.handledFor==null){t.handledFor=[]}if(t.handledFor.indexOf(l)<0){t.handledFor.push(l);if(u.consume){e.stopPropagation()}if(u.target&&e.target){if(!h(ue(e.target),u.target)){return}}if(u.once){if(f.triggeredOnce){return}else{f.triggeredOnce=true}}if(u.changed){const n=event.target;const r=n.value;const o=f.lastValue.get(u);if(o.has(n)&&o.get(n)===r){return}o.set(n,r)}if(f.delayed){clearTimeout(f.delayed)}if(f.throttle){return}if(u.throttle>0){if(!f.throttle){he(l,"htmx:trigger");c(l,e);f.throttle=E().setTimeout(function(){f.throttle=null},u.throttle)}}else if(u.delay>0){f.delayed=E().setTimeout(function(){he(l,"htmx:trigger");c(l,e)},u.delay)}else{he(l,"htmx:trigger");c(l,e)}}};if(e.listenerInfos==null){e.listenerInfos=[]}e.listenerInfos.push({trigger:u.trigger,listener:s,on:i});i.addEventListener(u.trigger,s)})}let mt=false;let xt=null;function yt(){if(!xt){xt=function(){mt=true};window.addEventListener("scroll",xt);window.addEventListener("resize",xt);setInterval(function(){if(mt){mt=false;se(ne().querySelectorAll("[hx-trigger*='revealed'],[data-hx-trigger*='revealed']"),function(e){bt(e)})}},200)}}function bt(e){if(!s(e,"data-hx-revealed")&&X(e)){e.setAttribute("data-hx-revealed","true");const t=ie(e);if(t.initHash){he(e,"revealed")}else{e.addEventListener("htmx:afterProcessNode",function(){he(e,"revealed")},{once:true})}}}function vt(e,t,n,r){const o=function(){if(!n.loaded){n.loaded=true;he(e,"htmx:trigger");t(e)}};if(r>0){E().setTimeout(o,r)}else{o()}}function wt(t,n,e){let i=false;se(r,function(r){if(s(t,"hx-"+r)){const o=te(t,"hx-"+r);i=true;n.path=o;n.verb=r;e.forEach(function(e){St(t,e,n,function(e,t){const n=ue(e);if(g(n,Q.config.disableSelector)){b(n);return}de(r,o,n,t)})})}});return i}function St(r,e,t,n){if(e.trigger==="revealed"){yt();pt(r,n,t,e);bt(ue(r))}else if(e.trigger==="intersect"){const o={};if(e.root){o.root=ae(r,e.root)}if(e.threshold){o.threshold=parseFloat(e.threshold)}const i=new IntersectionObserver(function(t){for(let e=0;e0){t.polling=true;ct(ue(r),n,e)}else{pt(r,n,t,e)}}function Et(e){const t=ue(e);if(!t){return false}const n=t.attributes;for(let e=0;e", "+e).join(""));return o}else{return[]}}function Tt(e){const t=g(ue(e.target),"button, input[type='submit']");const n=Lt(e);if(n){n.lastButtonClicked=t}}function qt(e){const t=Lt(e);if(t){t.lastButtonClicked=null}}function Lt(e){const t=g(ue(e.target),"button, input[type='submit']");if(!t){return}const n=y("#"+ee(t,"form"),t.getRootNode())||g(t,"form");if(!n){return}return ie(n)}function At(e){e.addEventListener("click",Tt);e.addEventListener("focusin",Tt);e.addEventListener("focusout",qt)}function Nt(t,e,n){const r=ie(t);if(!Array.isArray(r.onHandlers)){r.onHandlers=[]}let o;const i=function(e){vn(t,function(){if(at(t)){return}if(!o){o=new Function("event",n)}o.call(t,e)})};t.addEventListener(e,i);r.onHandlers.push({event:e,listener:i})}function It(t){ke(t);for(let e=0;eQ.config.historyCacheSize){i.shift()}while(i.length>0){try{localStorage.setItem("htmx-history-cache",JSON.stringify(i));break}catch(e){fe(ne().body,"htmx:historyCacheError",{cause:e,cache:i});i.shift()}}}function Vt(t){if(!B()){return null}t=U(t);const n=S(localStorage.getItem("htmx-history-cache"))||[];for(let e=0;e=200&&this.status<400){he(ne().body,"htmx:historyCacheMissLoad",i);const e=P(this.response);const t=e.querySelector("[hx-history-elt],[data-hx-history-elt]")||e;const n=Ut();const r=xn(n);kn(e.title);qe(e);Ve(n,t,r);Te();Kt(r.tasks);Bt=o;he(ne().body,"htmx:historyRestore",{path:o,cacheMiss:true,serverResponse:this.response})}else{fe(ne().body,"htmx:historyCacheMissLoadError",i)}};e.send()}function Wt(e){zt();e=e||location.pathname+location.search;const t=Vt(e);if(t){const n=P(t.content);const r=Ut();const o=xn(r);kn(t.title);qe(n);Ve(r,n,o);Te();Kt(o.tasks);E().setTimeout(function(){window.scrollTo(0,t.scroll)},0);Bt=e;he(ne().body,"htmx:historyRestore",{path:e,item:t})}else{if(Q.config.refreshOnHistoryMiss){window.location.reload(true)}else{Gt(e)}}}function Zt(e){let t=we(e,"hx-indicator");if(t==null){t=[e]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.classList.add.call(e.classList,Q.config.requestClass)});return t}function Yt(e){let t=we(e,"hx-disabled-elt");if(t==null){t=[]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.setAttribute("disabled","");e.setAttribute("data-disabled-by-htmx","")});return t}function Qt(e,t){se(e.concat(t),function(e){const t=ie(e);t.requestCount=(t.requestCount||1)-1});se(e,function(e){const t=ie(e);if(t.requestCount===0){e.classList.remove.call(e.classList,Q.config.requestClass)}});se(t,function(e){const t=ie(e);if(t.requestCount===0){e.removeAttribute("disabled");e.removeAttribute("data-disabled-by-htmx")}})}function en(t,n){for(let e=0;en.indexOf(e)<0)}else{e=e.filter(e=>e!==n)}r.delete(t);se(e,e=>r.append(t,e))}}function on(t,n,r,o,i){if(o==null||en(t,o)){return}else{t.push(o)}if(tn(o)){const s=ee(o,"name");let e=o.value;if(o instanceof HTMLSelectElement&&o.multiple){e=M(o.querySelectorAll("option:checked")).map(function(e){return e.value})}if(o instanceof HTMLInputElement&&o.files){e=M(o.files)}nn(s,e,n);if(i){sn(o,r)}}if(o instanceof HTMLFormElement){se(o.elements,function(e){if(t.indexOf(e)>=0){rn(e.name,e.value,n)}else{t.push(e)}if(i){sn(e,r)}});new FormData(o).forEach(function(e,t){if(e instanceof File&&e.name===""){return}nn(t,e,n)})}}function sn(e,t){const n=e;if(n.willValidate){he(n,"htmx:validation:validate");if(!n.checkValidity()){t.push({elt:n,message:n.validationMessage,validity:n.validity});he(n,"htmx:validation:failed",{message:n.validationMessage,validity:n.validity})}}}function ln(n,e){for(const t of e.keys()){n.delete(t)}e.forEach(function(e,t){n.append(t,e)});return n}function cn(e,t){const n=[];const r=new FormData;const o=new FormData;const i=[];const s=ie(e);if(s.lastButtonClicked&&!le(s.lastButtonClicked)){s.lastButtonClicked=null}let l=e instanceof HTMLFormElement&&e.noValidate!==true||te(e,"hx-validate")==="true";if(s.lastButtonClicked){l=l&&s.lastButtonClicked.formNoValidate!==true}if(t!=="get"){on(n,o,i,g(e,"form"),l)}on(n,r,i,e,l);if(s.lastButtonClicked||e.tagName==="BUTTON"||e.tagName==="INPUT"&&ee(e,"type")==="submit"){const u=s.lastButtonClicked||e;const a=ee(u,"name");nn(a,u.value,o)}const c=we(e,"hx-include");se(c,function(e){on(n,r,i,ue(e),l);if(!h(e,"form")){se(f(e).querySelectorAll(ot),function(e){on(n,r,i,e,l)})}});ln(r,o);return{errors:i,formData:r,values:An(r)}}function un(e,t,n){if(e!==""){e+="&"}if(String(n)==="[object Object]"){n=JSON.stringify(n)}const r=encodeURIComponent(n);e+=encodeURIComponent(t)+"="+r;return e}function an(e){e=qn(e);let n="";e.forEach(function(e,t){n=un(n,t,e)});return n}function fn(e,t,n){const r={"HX-Request":"true","HX-Trigger":ee(e,"id"),"HX-Trigger-Name":ee(e,"name"),"HX-Target":te(t,"id"),"HX-Current-URL":ne().location.href};bn(e,"hx-headers",false,r);if(n!==undefined){r["HX-Prompt"]=n}if(ie(e).boosted){r["HX-Boosted"]="true"}return r}function hn(n,e){const t=re(e,"hx-params");if(t){if(t==="none"){return new FormData}else if(t==="*"){return n}else if(t.indexOf("not ")===0){se(t.slice(4).split(","),function(e){e=e.trim();n.delete(e)});return n}else{const r=new FormData;se(t.split(","),function(t){t=t.trim();if(n.has(t)){n.getAll(t).forEach(function(e){r.append(t,e)})}});return r}}else{return n}}function dn(e){return!!ee(e,"href")&&ee(e,"href").indexOf("#")>=0}function gn(e,t){const n=t||re(e,"hx-swap");const r={swapStyle:ie(e).boosted?"innerHTML":Q.config.defaultSwapStyle,swapDelay:Q.config.defaultSwapDelay,settleDelay:Q.config.defaultSettleDelay};if(Q.config.scrollIntoViewOnBoost&&ie(e).boosted&&!dn(e)){r.show="top"}if(n){const s=F(n);if(s.length>0){for(let e=0;e0?o.join(":"):null;r.scroll=u;r.scrollTarget=i}else if(l.indexOf("show:")===0){const a=l.slice(5);var o=a.split(":");const f=o.pop();var i=o.length>0?o.join(":"):null;r.show=f;r.showTarget=i}else if(l.indexOf("focus-scroll:")===0){const h=l.slice("focus-scroll:".length);r.focusScroll=h=="true"}else if(e==0){r.swapStyle=l}else{O("Unknown modifier in hx-swap: "+l)}}}}return r}function pn(e){return re(e,"hx-encoding")==="multipart/form-data"||h(e,"form")&&ee(e,"enctype")==="multipart/form-data"}function mn(t,n,r){let o=null;Ft(n,function(e){if(o==null){o=e.encodeParameters(t,r,n)}});if(o!=null){return o}else{if(pn(n)){return ln(new FormData,qn(r))}else{return an(r)}}}function xn(e){return{tasks:[],elts:[e]}}function yn(e,t){const n=e[0];const r=e[e.length-1];if(t.scroll){var o=null;if(t.scrollTarget){o=ue(ae(n,t.scrollTarget))}if(t.scroll==="top"&&(n||o)){o=o||n;o.scrollTop=0}if(t.scroll==="bottom"&&(r||o)){o=o||r;o.scrollTop=o.scrollHeight}}if(t.show){var o=null;if(t.showTarget){let e=t.showTarget;if(t.showTarget==="window"){e="body"}o=ue(ae(n,e))}if(t.show==="top"&&(n||o)){o=o||n;o.scrollIntoView({block:"start",behavior:Q.config.scrollBehavior})}if(t.show==="bottom"&&(r||o)){o=o||r;o.scrollIntoView({block:"end",behavior:Q.config.scrollBehavior})}}}function bn(r,e,o,i){if(i==null){i={}}if(r==null){return i}const s=te(r,e);if(s){let e=s.trim();let t=o;if(e==="unset"){return null}if(e.indexOf("javascript:")===0){e=e.slice(11);t=true}else if(e.indexOf("js:")===0){e=e.slice(3);t=true}if(e.indexOf("{")!==0){e="{"+e+"}"}let n;if(t){n=vn(r,function(){return Function("return ("+e+")")()},{})}else{n=S(e)}for(const l in n){if(n.hasOwnProperty(l)){if(i[l]==null){i[l]=n[l]}}}}return bn(ue(c(r)),e,o,i)}function vn(e,t,n){if(Q.config.allowEval){return t()}else{fe(e,"htmx:evalDisallowedError");return n}}function wn(e,t){return bn(e,"hx-vars",true,t)}function Sn(e,t){return bn(e,"hx-vals",false,t)}function En(e){return ce(wn(e),Sn(e))}function Cn(t,n,r){if(r!==null){try{t.setRequestHeader(n,r)}catch(e){t.setRequestHeader(n,encodeURIComponent(r));t.setRequestHeader(n+"-URI-AutoEncoded","true")}}}function On(t){if(t.responseURL&&typeof URL!=="undefined"){try{const e=new URL(t.responseURL);return e.pathname+e.search}catch(e){fe(ne().body,"htmx:badResponseUrl",{url:t.responseURL})}}}function R(e,t){return t.test(e.getAllResponseHeaders())}function Rn(t,n,r){t=t.toLowerCase();if(r){if(r instanceof Element||typeof r==="string"){return de(t,n,null,null,{targetOverride:y(r)||ve,returnPromise:true})}else{let e=y(r.target);if(r.target&&!e||r.source&&!e&&!y(r.source)){e=ve}return de(t,n,y(r.source),r.event,{handler:r.handler,headers:r.headers,values:r.values,targetOverride:e,swapOverride:r.swap,select:r.select,returnPromise:true})}}else{return de(t,n,null,null,{returnPromise:true})}}function Hn(e){const t=[];while(e){t.push(e);e=e.parentElement}return t}function Tn(e,t,n){let r;let o;if(typeof URL==="function"){o=new URL(t,document.location.href);const i=document.location.origin;r=i===o.origin}else{o=t;r=l(t,document.location.origin)}if(Q.config.selfRequestsOnly){if(!r){return false}}return he(e,"htmx:validateUrl",ce({url:o,sameHost:r},n))}function qn(e){if(e instanceof FormData)return e;const t=new FormData;for(const n in e){if(e.hasOwnProperty(n)){if(e[n]&&typeof e[n].forEach==="function"){e[n].forEach(function(e){t.append(n,e)})}else if(typeof e[n]==="object"&&!(e[n]instanceof Blob)){t.append(n,JSON.stringify(e[n]))}else{t.append(n,e[n])}}}return t}function Ln(r,o,e){return new Proxy(e,{get:function(t,e){if(typeof e==="number")return t[e];if(e==="length")return t.length;if(e==="push"){return function(e){t.push(e);r.append(o,e)}}if(typeof t[e]==="function"){return function(){t[e].apply(t,arguments);r.delete(o);t.forEach(function(e){r.append(o,e)})}}if(t[e]&&t[e].length===1){return t[e][0]}else{return t[e]}},set:function(e,t,n){e[t]=n;r.delete(o);e.forEach(function(e){r.append(o,e)});return true}})}function An(o){return new Proxy(o,{get:function(e,t){if(typeof t==="symbol"){const r=Reflect.get(e,t);if(typeof r==="function"){return function(){return r.apply(o,arguments)}}else{return r}}if(t==="toJSON"){return()=>Object.fromEntries(o)}if(t in e){if(typeof e[t]==="function"){return function(){return o[t].apply(o,arguments)}}else{return e[t]}}const n=o.getAll(t);if(n.length===0){return undefined}else if(n.length===1){return n[0]}else{return Ln(e,t,n)}},set:function(t,n,e){if(typeof n!=="string"){return false}t.delete(n);if(e&&typeof e.forEach==="function"){e.forEach(function(e){t.append(n,e)})}else if(typeof e==="object"&&!(e instanceof Blob)){t.append(n,JSON.stringify(e))}else{t.append(n,e)}return true},deleteProperty:function(e,t){if(typeof t==="string"){e.delete(t)}return true},ownKeys:function(e){return Reflect.ownKeys(Object.fromEntries(e))},getOwnPropertyDescriptor:function(e,t){return Reflect.getOwnPropertyDescriptor(Object.fromEntries(e),t)}})}function de(t,n,r,o,i,D){let s=null;let l=null;i=i!=null?i:{};if(i.returnPromise&&typeof Promise!=="undefined"){var e=new Promise(function(e,t){s=e;l=t})}if(r==null){r=ne().body}const M=i.handler||Dn;const X=i.select||null;if(!le(r)){oe(s);return e}const c=i.targetOverride||ue(Ee(r));if(c==null||c==ve){fe(r,"htmx:targetError",{target:te(r,"hx-target")});oe(l);return e}let u=ie(r);const a=u.lastButtonClicked;if(a){const L=ee(a,"formaction");if(L!=null){n=L}const A=ee(a,"formmethod");if(A!=null){if(A.toLowerCase()!=="dialog"){t=A}}}const f=re(r,"hx-confirm");if(D===undefined){const K=function(e){return de(t,n,r,o,i,!!e)};const G={target:c,elt:r,path:n,verb:t,triggeringEvent:o,etc:i,issueRequest:K,question:f};if(he(r,"htmx:confirm",G)===false){oe(s);return e}}let h=r;let d=re(r,"hx-sync");let g=null;let F=false;if(d){const N=d.split(":");const I=N[0].trim();if(I==="this"){h=Se(r,"hx-sync")}else{h=ue(ae(r,I))}d=(N[1]||"drop").trim();u=ie(h);if(d==="drop"&&u.xhr&&u.abortable!==true){oe(s);return e}else if(d==="abort"){if(u.xhr){oe(s);return e}else{F=true}}else if(d==="replace"){he(h,"htmx:abort")}else if(d.indexOf("queue")===0){const W=d.split(" ");g=(W[1]||"last").trim()}}if(u.xhr){if(u.abortable){he(h,"htmx:abort")}else{if(g==null){if(o){const P=ie(o);if(P&&P.triggerSpec&&P.triggerSpec.queue){g=P.triggerSpec.queue}}if(g==null){g="last"}}if(u.queuedRequests==null){u.queuedRequests=[]}if(g==="first"&&u.queuedRequests.length===0){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="all"){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="last"){u.queuedRequests=[];u.queuedRequests.push(function(){de(t,n,r,o,i)})}oe(s);return e}}const p=new XMLHttpRequest;u.xhr=p;u.abortable=F;const m=function(){u.xhr=null;u.abortable=false;if(u.queuedRequests!=null&&u.queuedRequests.length>0){const e=u.queuedRequests.shift();e()}};const B=re(r,"hx-prompt");if(B){var x=prompt(B);if(x===null||!he(r,"htmx:prompt",{prompt:x,target:c})){oe(s);m();return e}}if(f&&!D){if(!confirm(f)){oe(s);m();return e}}let y=fn(r,c,x);if(t!=="get"&&!pn(r)){y["Content-Type"]="application/x-www-form-urlencoded"}if(i.headers){y=ce(y,i.headers)}const U=cn(r,t);let b=U.errors;const j=U.formData;if(i.values){ln(j,qn(i.values))}const V=qn(En(r));const v=ln(j,V);let w=hn(v,r);if(Q.config.getCacheBusterParam&&t==="get"){w.set("org.htmx.cache-buster",ee(c,"id")||"true")}if(n==null||n===""){n=ne().location.href}const S=bn(r,"hx-request");const _=ie(r).boosted;let E=Q.config.methodsThatUseUrlParams.indexOf(t)>=0;const C={boosted:_,useUrlParams:E,formData:w,parameters:An(w),unfilteredFormData:v,unfilteredParameters:An(v),headers:y,target:c,verb:t,errors:b,withCredentials:i.credentials||S.credentials||Q.config.withCredentials,timeout:i.timeout||S.timeout||Q.config.timeout,path:n,triggeringEvent:o};if(!he(r,"htmx:configRequest",C)){oe(s);m();return e}n=C.path;t=C.verb;y=C.headers;w=qn(C.parameters);b=C.errors;E=C.useUrlParams;if(b&&b.length>0){he(r,"htmx:validation:halted",C);oe(s);m();return e}const z=n.split("#");const $=z[0];const O=z[1];let R=n;if(E){R=$;const Z=!w.keys().next().done;if(Z){if(R.indexOf("?")<0){R+="?"}else{R+="&"}R+=an(w);if(O){R+="#"+O}}}if(!Tn(r,R,C)){fe(r,"htmx:invalidPath",C);oe(l);return e}p.open(t.toUpperCase(),R,true);p.overrideMimeType("text/html");p.withCredentials=C.withCredentials;p.timeout=C.timeout;if(S.noHeaders){}else{for(const k in y){if(y.hasOwnProperty(k)){const Y=y[k];Cn(p,k,Y)}}}const H={xhr:p,target:c,requestConfig:C,etc:i,boosted:_,select:X,pathInfo:{requestPath:n,finalRequestPath:R,responsePath:null,anchor:O}};p.onload=function(){try{const t=Hn(r);H.pathInfo.responsePath=On(p);M(r,H);if(H.keepIndicators!==true){Qt(T,q)}he(r,"htmx:afterRequest",H);he(r,"htmx:afterOnLoad",H);if(!le(r)){let e=null;while(t.length>0&&e==null){const n=t.shift();if(le(n)){e=n}}if(e){he(e,"htmx:afterRequest",H);he(e,"htmx:afterOnLoad",H)}}oe(s);m()}catch(e){fe(r,"htmx:onLoadError",ce({error:e},H));throw e}};p.onerror=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendError",H);oe(l);m()};p.onabort=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendAbort",H);oe(l);m()};p.ontimeout=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:timeout",H);oe(l);m()};if(!he(r,"htmx:beforeRequest",H)){oe(s);m();return e}var T=Zt(r);var q=Yt(r);se(["loadstart","loadend","progress","abort"],function(t){se([p,p.upload],function(e){e.addEventListener(t,function(e){he(r,"htmx:xhr:"+t,{lengthComputable:e.lengthComputable,loaded:e.loaded,total:e.total})})})});he(r,"htmx:beforeSend",H);const J=E?null:mn(p,r,w);p.send(J);return e}function Nn(e,t){const n=t.xhr;let r=null;let o=null;if(R(n,/HX-Push:/i)){r=n.getResponseHeader("HX-Push");o="push"}else if(R(n,/HX-Push-Url:/i)){r=n.getResponseHeader("HX-Push-Url");o="push"}else if(R(n,/HX-Replace-Url:/i)){r=n.getResponseHeader("HX-Replace-Url");o="replace"}if(r){if(r==="false"){return{}}else{return{type:o,path:r}}}const i=t.pathInfo.finalRequestPath;const s=t.pathInfo.responsePath;const l=re(e,"hx-push-url");const c=re(e,"hx-replace-url");const u=ie(e).boosted;let a=null;let f=null;if(l){a="push";f=l}else if(c){a="replace";f=c}else if(u){a="push";f=s||i}if(f){if(f==="false"){return{}}if(f==="true"){f=s||i}if(t.pathInfo.anchor&&f.indexOf("#")===-1){f=f+"#"+t.pathInfo.anchor}return{type:a,path:f}}else{return{}}}function In(e,t){var n=new RegExp(e.code);return n.test(t.toString(10))}function Pn(e){for(var t=0;t0){E().setTimeout(e,x.swapDelay)}else{e()}}if(f){fe(o,"htmx:responseError",ce({error:"Response Status Error Code "+s.status+" from "+i.pathInfo.requestPath},i))}}const Mn={};function Xn(){return{init:function(e){return null},getSelectors:function(){return null},onEvent:function(e,t){return true},transformResponse:function(e,t,n){return e},isInlineSwap:function(e){return false},handleSwap:function(e,t,n,r){return false},encodeParameters:function(e,t,n){return null}}}function Fn(e,t){if(t.init){t.init(n)}Mn[e]=ce(Xn(),t)}function Bn(e){delete Mn[e]}function Un(e,n,r){if(n==undefined){n=[]}if(e==undefined){return n}if(r==undefined){r=[]}const t=te(e,"hx-ext");if(t){se(t.split(","),function(e){e=e.replace(/ /g,"");if(e.slice(0,7)=="ignore:"){r.push(e.slice(7));return}if(r.indexOf(e)<0){const t=Mn[e];if(t&&n.indexOf(t)<0){n.push(t)}}})}return Un(ue(c(e)),n,r)}var jn=false;ne().addEventListener("DOMContentLoaded",function(){jn=true});function Vn(e){if(jn||ne().readyState==="complete"){e()}else{ne().addEventListener("DOMContentLoaded",e)}}function _n(){if(Q.config.includeIndicatorStyles!==false){const e=Q.config.inlineStyleNonce?` nonce="${Q.config.inlineStyleNonce}"`:"";ne().head.insertAdjacentHTML("beforeend"," ."+Q.config.indicatorClass+"{opacity:0} ."+Q.config.requestClass+" ."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} ."+Q.config.requestClass+"."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} ")}}function zn(){const e=ne().querySelector('meta[name="htmx-config"]');if(e){return S(e.content)}else{return null}}function $n(){const e=zn();if(e){Q.config=ce(Q.config,e)}}Vn(function(){$n();_n();let e=ne().body;kt(e);const t=ne().querySelectorAll("[hx-trigger='restored'],[data-hx-trigger='restored']");e.addEventListener("htmx:abort",function(e){const t=e.target;const n=ie(t);if(n&&n.xhr){n.xhr.abort()}});const n=window.onpopstate?window.onpopstate.bind(window):null;window.onpopstate=function(e){if(e.state&&e.state.htmx){Wt();se(t,function(e){he(e,"htmx:restored",{document:ne(),triggerEvent:he})})}else{if(n){n(e)}}};E().setTimeout(function(){he(e,"htmx:load",{});e=null},0)});return Q}(); \ No newline at end of file diff --git a/src/fastapi_oidc_op/static/style.css b/src/fastapi_oidc_op/static/style.css new file mode 100644 index 0000000..cbc09f0 --- /dev/null +++ b/src/fastapi_oidc_op/static/style.css @@ -0,0 +1,134 @@ +:root { + --bg: #fdfdfd; + --fg: #1a1a1a; + --accent: #2563eb; + --accent-fg: #fff; + --border: #d1d5db; + --error-bg: #fef2f2; + --error-fg: #991b1b; + --success-bg: #f0fdf4; + --success-fg: #166534; + --radius: 0.375rem; +} + +@media (prefers-color-scheme: dark) { + :root { + --bg: #111; + --fg: #e5e5e5; + --accent: #60a5fa; + --accent-fg: #111; + --border: #404040; + --error-bg: #450a0a; + --error-fg: #fca5a5; + --success-bg: #052e16; + --success-fg: #86efac; + } +} + +*, +*::before, +*::after { + box-sizing: border-box; +} + +body { + font-family: system-ui, -apple-system, sans-serif; + background: var(--bg); + color: var(--fg); + max-width: 40rem; + margin: 2rem auto; + padding: 0 1rem; + line-height: 1.6; +} + +.skip-link { + position: absolute; + left: -9999px; + top: 0; + background: var(--accent); + color: var(--accent-fg); + padding: 0.5rem 1rem; + z-index: 100; +} + +.skip-link:focus { + left: 0; +} + +:focus-visible { + outline: 2px solid var(--accent); + outline-offset: 2px; +} + +label { + display: block; + margin-bottom: 0.25rem; + font-weight: 500; +} + +input[type="text"], +input[type="password"], +input[type="email"] { + display: block; + width: 100%; + padding: 0.5rem; + border: 1px solid var(--border); + border-radius: var(--radius); + background: var(--bg); + color: var(--fg); + font-size: 1rem; + margin-bottom: 1rem; +} + +button { + padding: 0.5rem 1rem; + border: none; + border-radius: var(--radius); + background: var(--accent); + color: var(--accent-fg); + font-size: 1rem; + cursor: pointer; +} + +button:hover { + opacity: 0.9; +} + +[role="alert"] { + background: var(--error-bg); + color: var(--error-fg); + padding: 0.75rem 1rem; + border-radius: var(--radius); + margin-bottom: 1rem; +} + +[role="status"] { + background: var(--success-bg); + color: var(--success-fg); + padding: 0.75rem 1rem; + border-radius: var(--radius); + margin-bottom: 1rem; +} + +.sr-only { + position: absolute; + width: 1px; + height: 1px; + padding: 0; + margin: -1px; + overflow: hidden; + clip: rect(0, 0, 0, 0); + white-space: nowrap; + border: 0; +} + +@media (prefers-reduced-motion: reduce) { + *, + *::before, + *::after { + animation-duration: 0.01ms !important; + animation-iteration-count: 1 !important; + transition-duration: 0.01ms !important; + scroll-behavior: auto !important; + } +} diff --git a/src/fastapi_oidc_op/static/webauthn.js b/src/fastapi_oidc_op/static/webauthn.js new file mode 100644 index 0000000..8615b08 --- /dev/null +++ b/src/fastapi_oidc_op/static/webauthn.js @@ -0,0 +1,149 @@ +// WebAuthn helper functions for registration and authentication + +function base64urlToBytes(s) { + s = s.replace(/-/g, '+').replace(/_/g, '/'); + while (s.length % 4) s += '='; + const raw = atob(s); + const bytes = new Uint8Array(raw.length); + for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i); + return bytes; +} + +function bytesToBase64url(bytes) { + const raw = String.fromCharCode(...new Uint8Array(bytes)); + return btoa(raw).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); +} + +async function beginRegistration() { + const statusEl = document.getElementById('webauthn-status'); + + try { + // Step 1: Get options from server + const beginRes = await fetch('/manage/credentials/webauthn/begin', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + }); + if (!beginRes.ok) { + if (statusEl) statusEl.innerHTML = '
Failed to start registration
'; + return; + } + const options = await beginRes.json(); + + // Step 2: Convert base64url fields to ArrayBuffers for WebAuthn API + const publicKey = options.publicKey; + publicKey.challenge = base64urlToBytes(publicKey.challenge); + publicKey.user.id = base64urlToBytes(publicKey.user.id); + if (publicKey.excludeCredentials) { + publicKey.excludeCredentials = publicKey.excludeCredentials.map(function (c) { + return { ...c, id: base64urlToBytes(c.id) }; + }); + } + + // Step 3: Call browser WebAuthn API + const credential = await navigator.credentials.create({ publicKey: publicKey }); + + // Step 4: Encode response for server + const attestationResponse = credential.response; + const body = { + id: bytesToBase64url(credential.rawId), + rawId: bytesToBase64url(credential.rawId), + type: credential.type, + response: { + clientDataJSON: bytesToBase64url(attestationResponse.clientDataJSON), + attestationObject: bytesToBase64url(attestationResponse.attestationObject), + }, + }; + + // Step 5: Send to server + const completeRes = await fetch('/manage/credentials/webauthn/complete', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(body), + }); + + if (completeRes.ok) { + // Reload to show updated credential list + window.location.reload(); + } else { + const text = await completeRes.text(); + if (statusEl) statusEl.innerHTML = text; + } + } catch (err) { + if (statusEl) statusEl.innerHTML = '
Registration failed: ' + err.message + '
'; + } +} + +async function beginAuthentication(username) { + const statusEl = document.getElementById('webauthn-login-status'); + const form = new FormData(); + form.append('username', username); + + try { + // Step 1: Get options from server + const beginRes = await fetch('/login/webauthn/begin', { + method: 'POST', + body: form, + }); + if (!beginRes.ok) { + const text = await beginRes.text(); + if (statusEl) statusEl.innerHTML = text; + return; + } + const options = await beginRes.json(); + + // Step 2: Convert base64url fields to ArrayBuffers + const publicKey = options.publicKey; + publicKey.challenge = base64urlToBytes(publicKey.challenge); + if (publicKey.allowCredentials) { + publicKey.allowCredentials = publicKey.allowCredentials.map(function (c) { + return { ...c, id: base64urlToBytes(c.id) }; + }); + } + + // Step 3: Call browser WebAuthn API + const assertion = await navigator.credentials.get({ publicKey: publicKey }); + + // Step 4: Encode response for server + const assertionResponse = assertion.response; + const body = { + id: bytesToBase64url(assertion.rawId), + rawId: bytesToBase64url(assertion.rawId), + type: assertion.type, + response: { + clientDataJSON: bytesToBase64url(assertionResponse.clientDataJSON), + authenticatorData: bytesToBase64url(assertionResponse.authenticatorData), + signature: bytesToBase64url(assertionResponse.signature), + userHandle: assertionResponse.userHandle ? bytesToBase64url(assertionResponse.userHandle) : null, + }, + }; + + // Step 5: Send to server + const completeRes = await fetch('/login/webauthn/complete', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(body), + }); + + if (completeRes.ok) { + const data = await completeRes.json(); + if (data.redirect) { + window.location.href = data.redirect; + } else { + window.location.href = '/manage/credentials'; + } + } else { + const text = await completeRes.text(); + if (statusEl) statusEl.innerHTML = text; + } + } catch (err) { + if (statusEl) statusEl.innerHTML = '
Authentication failed: ' + err.message + '
'; + } +} + +// Wire up the registration button +document.addEventListener('DOMContentLoaded', function () { + const registerBtn = document.getElementById('webauthn-register-btn'); + if (registerBtn) { + registerBtn.addEventListener('click', beginRegistration); + } +}); diff --git a/src/fastapi_oidc_op/templates/base.html b/src/fastapi_oidc_op/templates/base.html new file mode 100644 index 0000000..f20bc8c --- /dev/null +++ b/src/fastapi_oidc_op/templates/base.html @@ -0,0 +1,18 @@ + + + + + + {% block title %}FastAPI OIDC OP{% endblock %} + + + + +
+ {% block content %}{% endblock %} +
+
+ + {% block scripts %}{% endblock %} + + diff --git a/src/fastapi_oidc_op/templates/login.html b/src/fastapi_oidc_op/templates/login.html new file mode 100644 index 0000000..795d7f6 --- /dev/null +++ b/src/fastapi_oidc_op/templates/login.html @@ -0,0 +1,35 @@ +{% extends "base.html" %} + +{% block title %}Login — FastAPI OIDC OP{% endblock %} + +{% block content %} +

Sign in

+ +
+ +
+

Password

+
+
+ + +
+
+ + +
+ +
+
+ +
+

Security key

+
+
+ + +
+ +
+
+{% endblock %} diff --git a/src/fastapi_oidc_op/templates/manage/credentials.html b/src/fastapi_oidc_op/templates/manage/credentials.html new file mode 100644 index 0000000..2afa4d6 --- /dev/null +++ b/src/fastapi_oidc_op/templates/manage/credentials.html @@ -0,0 +1,58 @@ +{% extends "base.html" %} + +{% block title %}Credentials — FastAPI OIDC OP{% endblock %} + +{% block content %} +

Credentials

+ +{% if setup %} +
+

Welcome, {{ username }}! Set up your credentials to secure your account.

+
+{% endif %} + +
+

Security keys

+
+ {% if webauthn_credentials %} +
    + {% for cred in webauthn_credentials %} +
  • + {{ cred.device_name or "Security key" }} + (added {{ cred.created_at.strftime('%Y-%m-%d') }}) +
    • + {% endfor %} +
+ {% else %} +

No security keys registered.

+ {% endif %} +
+ +
+ +
+

Password

+
+ {% if has_password %} +

Password is set.

+ {% else %} +

No password set.

+ {% endif %} +
+
+ + +
+
+ + +
+ +
+
+
+{% endblock %} + +{% block scripts %} + +{% endblock %} diff --git a/tests/test_auth_routes/__init__.py b/tests/test_auth_routes/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/tests/test_auth_routes/test_last_credential_guard.py b/tests/test_auth_routes/test_last_credential_guard.py new file mode 100644 index 0000000..977a226 --- /dev/null +++ b/tests/test_auth_routes/test_last_credential_guard.py @@ -0,0 +1,69 @@ +from base64 import urlsafe_b64encode +from datetime import UTC, datetime + +from argon2 import PasswordHasher +from httpx import AsyncClient + +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.models import PasswordCredential, User, WebAuthnCredential + + +async def _create_user_and_login(client: AsyncClient) -> str: + """Create user with password credential, log in, return userid.""" + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash("testpass"))) + + await client.post( + "/login/password", + data={"username": "alice", "password": "testpass"}, + headers={"HX-Request": "true"}, + ) + return user.userid + + +async def test_cannot_delete_last_password_credential(client: AsyncClient) -> None: + """User has only a password — cannot delete it.""" + await _create_user_and_login(client) + + res = await client.delete( + "/manage/credentials/password", + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert 'role="alert"' in res.text + assert "last credential" in res.text.lower() or "Cannot remove" in res.text + + # Password should still exist + app = client._transport.app # type: ignore[union-attr] + cred = await app.state.credential_repo.get_password_by_user("lusab-bansen") + assert cred is not None + + +async def test_cannot_delete_last_webauthn_credential(client: AsyncClient) -> None: + """User has only one webauthn credential (password was removed) — cannot delete it.""" + userid = await _create_user_and_login(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + # Add webauthn, then delete password (so webauthn is the only credential) + await cred_repo.create_webauthn(WebAuthnCredential(user_id=userid, credential_id=b"cred1", public_key=b"key1")) + await cred_repo.delete_password(userid) + + cred_id_b64 = urlsafe_b64encode(b"cred1").decode().rstrip("=") + res = await client.delete( + f"/manage/credentials/webauthn/{cred_id_b64}", + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert 'role="alert"' in res.text + + # Credential should still exist + creds = await cred_repo.get_webauthn_by_user(userid) + assert len(creds) == 1 diff --git a/tests/test_auth_routes/test_manage_credentials_page.py b/tests/test_auth_routes/test_manage_credentials_page.py new file mode 100644 index 0000000..8e3b2a8 --- /dev/null +++ b/tests/test_auth_routes/test_manage_credentials_page.py @@ -0,0 +1,54 @@ +from datetime import UTC, datetime + +from argon2 import PasswordHasher +from httpx import AsyncClient + +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.models import PasswordCredential, User + + +async def _login(client: AsyncClient, username: str = "alice", password: str = "testpass") -> None: + """Helper: create user + password credential and log in via POST /login/password.""" + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = await user_repo.get_by_username(username) + if user is None: + user = User( + userid="lusab-bansen", username=username, created_at=datetime.now(UTC), updated_at=datetime.now(UTC) + ) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + existing = await cred_repo.get_password_by_user(user.userid) + if existing is None: + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash(password))) + + await client.post( + "/login/password", + data={"username": username, "password": password}, + headers={"HX-Request": "true"}, + ) + + +async def test_manage_credentials_requires_login(client: AsyncClient) -> None: + res = await client.get("/manage/credentials", follow_redirects=False) + assert res.status_code in (302, 303) + assert res.headers["location"] == "/login" + + +async def test_manage_credentials_renders_for_logged_in_user(client: AsyncClient) -> None: + await _login(client) + + res = await client.get("/manage/credentials") + assert res.status_code == 200 + assert "Credentials" in res.text + + +async def test_manage_credentials_shows_setup_banner(client: AsyncClient) -> None: + await _login(client) + + res = await client.get("/manage/credentials?setup=1") + assert res.status_code == 200 + assert "Welcome" in res.text or "setup" in res.text.lower() diff --git a/tests/test_auth_routes/test_manage_password_credential.py b/tests/test_auth_routes/test_manage_password_credential.py new file mode 100644 index 0000000..3f1e489 --- /dev/null +++ b/tests/test_auth_routes/test_manage_password_credential.py @@ -0,0 +1,103 @@ +from datetime import UTC, datetime + +from argon2 import PasswordHasher +from httpx import AsyncClient + +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.models import PasswordCredential, User, WebAuthnCredential + + +async def _create_user_and_login(client: AsyncClient) -> str: + """Create user with password, log in, return userid.""" + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash("old"))) + + await client.post( + "/login/password", + data={"username": "alice", "password": "old"}, + headers={"HX-Request": "true"}, + ) + return user.userid + + +async def test_set_password_requires_session(client: AsyncClient) -> None: + res = await client.post( + "/manage/credentials/password", + data={"password": "x", "confirm": "x"}, + follow_redirects=False, + ) + assert res.status_code in (302, 303) + + +async def test_set_password_mismatch_returns_error(client: AsyncClient) -> None: + await _create_user_and_login(client) + + res = await client.post( + "/manage/credentials/password", + data={"password": "newpassword", "confirm": "different"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert 'role="alert"' in res.text + + +async def test_set_password_too_short_returns_error(client: AsyncClient) -> None: + await _create_user_and_login(client) + + res = await client.post( + "/manage/credentials/password", + data={"password": "short", "confirm": "short"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert 'role="alert"' in res.text + + +async def test_set_password_creates_or_replaces_password(client: AsyncClient) -> None: + userid = await _create_user_and_login(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + res = await client.post( + "/manage/credentials/password", + data={"password": "newpassword123", "confirm": "newpassword123"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert 'role="status"' in res.text or "Password" in res.text + + updated = await cred_repo.get_password_by_user(userid) + assert updated is not None + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + assert svc.verify(updated.password_hash, "newpassword123") is True + + +async def test_delete_password_requires_session(client: AsyncClient) -> None: + res = await client.delete("/manage/credentials/password", follow_redirects=False) + assert res.status_code in (302, 303) + + +async def test_delete_password_with_other_credential(client: AsyncClient) -> None: + """User has both password and webauthn — deleting password succeeds.""" + userid = await _create_user_and_login(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + # Add a webauthn credential so password is not the last one + await cred_repo.create_webauthn(WebAuthnCredential(user_id=userid, credential_id=b"cred1", public_key=b"key1")) + + res = await client.delete( + "/manage/credentials/password", + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + + deleted = await cred_repo.get_password_by_user(userid) + assert deleted is None diff --git a/tests/test_auth_routes/test_manage_webauthn_credential.py b/tests/test_auth_routes/test_manage_webauthn_credential.py new file mode 100644 index 0000000..94bc8de --- /dev/null +++ b/tests/test_auth_routes/test_manage_webauthn_credential.py @@ -0,0 +1,132 @@ +import os +from base64 import urlsafe_b64encode +from datetime import UTC, datetime + +from argon2 import PasswordHasher +from cryptography.hazmat.primitives.asymmetric import ec +from fido2.cose import ES256 +from fido2.utils import sha256 +from fido2.webauthn import ( + Aaguid, + AttestationObject, + AttestedCredentialData, + AuthenticatorAttestationResponse, + AuthenticatorData, + CollectedClientData, + RegistrationResponse, +) +from httpx import AsyncClient + +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.models import PasswordCredential, User, WebAuthnCredential + +RP_ID = "localhost" +ORIGIN = "http://localhost:8000" + + +async def _create_user_and_login(client: AsyncClient) -> str: + """Create user with password, log in, return userid.""" + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash("testpass"))) + + await client.post( + "/login/password", + data={"username": "alice", "password": "testpass"}, + headers={"HX-Request": "true"}, + ) + return user.userid + + +def _generate_credential() -> tuple[ec.EllipticCurvePrivateKey, bytes, AttestedCredentialData]: + private_key = ec.generate_private_key(ec.SECP256R1()) + cose_key = ES256.from_cryptography_key(private_key.public_key()) + credential_id = os.urandom(32) + attested = AttestedCredentialData.create(aaguid=Aaguid.NONE, credential_id=credential_id, public_key=cose_key) + return private_key, credential_id, attested + + +def _build_registration_response( + credential_id: bytes, attested: AttestedCredentialData, challenge: bytes +) -> RegistrationResponse: + auth_data = AuthenticatorData.create( + rp_id_hash=sha256(RP_ID.encode()), + flags=AuthenticatorData.FLAG.UP | AuthenticatorData.FLAG.AT, + counter=0, + credential_data=attested, + ) + attestation_object = AttestationObject.create(fmt="none", auth_data=auth_data, att_stmt={}) + client_data = CollectedClientData.create(type=CollectedClientData.TYPE.CREATE, challenge=challenge, origin=ORIGIN) + return RegistrationResponse( + raw_id=credential_id, + response=AuthenticatorAttestationResponse(client_data=client_data, attestation_object=attestation_object), + ) + + +async def test_webauthn_begin_requires_session(client: AsyncClient) -> None: + res = await client.post("/manage/credentials/webauthn/begin", follow_redirects=False) + assert res.status_code in (302, 303, 401) + + +async def test_webauthn_begin_returns_options(client: AsyncClient) -> None: + await _create_user_and_login(client) + + res = await client.post("/manage/credentials/webauthn/begin") + assert res.status_code == 200 + data = res.json() + assert "publicKey" in data + assert "challenge" in data["publicKey"] + + +async def test_webauthn_complete_creates_credential(client: AsyncClient) -> None: + userid = await _create_user_and_login(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + # Begin registration via service directly to get raw state + # (the session-based flow is hard to test e2e since we can't extract the state) + webauthn_service = app.state.webauthn_service + _private_key, credential_id, attested = _generate_credential() + + _options, state = webauthn_service.begin_registration(user_id=userid.encode(), username="alice") + + response = _build_registration_response(credential_id, attested, state["challenge"]) + result = webauthn_service.complete_registration(state, response) + + # Store credential directly to verify the repo works + cred = WebAuthnCredential( + user_id=userid, + credential_id=result.credential_data.credential_id, + public_key=bytes(result.credential_data), + ) + await cred_repo.create_webauthn(cred) + + creds = await cred_repo.get_webauthn_by_user(userid) + assert len(creds) == 1 + assert creds[0].credential_id == credential_id + + +async def test_delete_webauthn_credential(client: AsyncClient) -> None: + userid = await _create_user_and_login(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + # User already has password credential from login. Add a webauthn credential. + await cred_repo.create_webauthn(WebAuthnCredential(user_id=userid, credential_id=b"cred1", public_key=b"key1")) + + cred_id_b64 = urlsafe_b64encode(b"cred1").decode().rstrip("=") + + res = await client.delete( + f"/manage/credentials/webauthn/{cred_id_b64}", + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + + creds = await cred_repo.get_webauthn_by_user(userid) + assert len(creds) == 0 diff --git a/tests/test_auth_routes/test_pages.py b/tests/test_auth_routes/test_pages.py new file mode 100644 index 0000000..49b4f45 --- /dev/null +++ b/tests/test_auth_routes/test_pages.py @@ -0,0 +1,19 @@ +from httpx import AsyncClient + + +async def test_get_login_page_contains_form(client: AsyncClient) -> None: + res = await client.get("/login") + assert res.status_code == 200 + assert " None: + res = await client.get("/login") + assert "Skip to content" in res.text + + +async def test_static_css_served(client: AsyncClient) -> None: + res = await client.get("/static/style.css") + assert res.status_code == 200 + assert "--bg" in res.text diff --git a/tests/test_auth_routes/test_password_login.py b/tests/test_auth_routes/test_password_login.py new file mode 100644 index 0000000..fff68a8 --- /dev/null +++ b/tests/test_auth_routes/test_password_login.py @@ -0,0 +1,64 @@ +from datetime import UTC, datetime + +from argon2 import PasswordHasher +from httpx import AsyncClient + +from fastapi_oidc_op.authn.password import PasswordService +from fastapi_oidc_op.models import PasswordCredential, User + + +async def test_password_login_unknown_user_returns_error_fragment(client: AsyncClient) -> None: + res = await client.post( + "/login/password", + data={"username": "nobody", "password": "wrong"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert "Invalid username or password" in res.text + assert 'role="alert"' in res.text + + +async def test_password_login_wrong_password_returns_error_fragment(client: AsyncClient) -> None: + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash("correct"))) + + res = await client.post( + "/login/password", + data={"username": "alice", "password": "wrong"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert "Invalid username or password" in res.text + + +async def test_password_login_success_sets_session_and_hx_redirect(client: AsyncClient) -> None: + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + svc = PasswordService(hasher=PasswordHasher(time_cost=1, memory_cost=8192)) + await cred_repo.create_password(PasswordCredential(user_id=user.userid, password_hash=svc.hash("correct"))) + + res = await client.post( + "/login/password", + data={"username": "alice", "password": "correct"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + assert res.headers.get("HX-Redirect") == "/manage/credentials" + + +async def test_logout_clears_session_and_redirects(client: AsyncClient) -> None: + res = await client.post("/logout", headers={"HX-Request": "true"}) + assert res.status_code == 200 + assert res.headers.get("HX-Redirect") == "/login" diff --git a/tests/test_auth_routes/test_register_magic_link.py b/tests/test_auth_routes/test_register_magic_link.py new file mode 100644 index 0000000..1335bd9 --- /dev/null +++ b/tests/test_auth_routes/test_register_magic_link.py @@ -0,0 +1,72 @@ +from datetime import UTC, datetime, timedelta + +from httpx import AsyncClient + +from fastapi_oidc_op.models import MagicLink + + +async def test_register_invalid_token_returns_error_page(client: AsyncClient) -> None: + res = await client.get("/register/nope", follow_redirects=False) + assert res.status_code == 400 + assert "Invalid or expired" in res.text + + +async def test_register_expired_token_returns_error_page(client: AsyncClient) -> None: + app = client._transport.app # type: ignore[union-attr] + repo = app.state.magic_link_repo + await repo.create( + MagicLink( + token="expired", + username="newuser", + expires_at=datetime.now(UTC) - timedelta(hours=1), + ) + ) + + res = await client.get("/register/expired", follow_redirects=False) + assert res.status_code == 400 + assert "Invalid or expired" in res.text + + +async def test_register_valid_token_creates_user_and_redirects(client: AsyncClient) -> None: + app = client._transport.app # type: ignore[union-attr] + magic_link_repo = app.state.magic_link_repo + user_repo = app.state.user_repo + + await magic_link_repo.create( + MagicLink( + token="t1", + username="newuser", + expires_at=datetime.now(UTC) + timedelta(hours=1), + ) + ) + + res = await client.get("/register/t1", follow_redirects=False) + assert res.status_code in (302, 303) + assert "/manage/credentials" in res.headers["location"] + assert "setup=1" in res.headers["location"] + + # Token should be marked used + link = await magic_link_repo.get_by_token("t1") + assert link is not None + assert link.used is True + + # User should exist + user = await user_repo.get_by_username("newuser") + assert user is not None + assert "users" in user.groups + + +async def test_register_used_token_returns_error(client: AsyncClient) -> None: + app = client._transport.app # type: ignore[union-attr] + repo = app.state.magic_link_repo + await repo.create( + MagicLink( + token="used", + username="newuser", + expires_at=datetime.now(UTC) + timedelta(hours=1), + used=True, + ) + ) + + res = await client.get("/register/used", follow_redirects=False) + assert res.status_code == 400 diff --git a/tests/test_auth_routes/test_session_deps.py b/tests/test_auth_routes/test_session_deps.py new file mode 100644 index 0000000..60efc7f --- /dev/null +++ b/tests/test_auth_routes/test_session_deps.py @@ -0,0 +1,38 @@ +from unittest.mock import MagicMock + +import pytest +from fastapi import HTTPException + +from fastapi_oidc_op.dependencies import get_session_user, require_session_user + + +def test_get_session_user_none_when_missing() -> None: + request = MagicMock() + request.session = {} + assert get_session_user(request) is None + + +def test_get_session_user_returns_tuple() -> None: + request = MagicMock() + request.session = {"userid": "u1", "username": "alice"} + assert get_session_user(request) == ("u1", "alice") + + +def test_get_session_user_none_when_partial() -> None: + request = MagicMock() + request.session = {"userid": "u1"} # missing username + assert get_session_user(request) is None + + +def test_require_session_user_raises_when_missing() -> None: + request = MagicMock() + request.session = {} + with pytest.raises(HTTPException) as exc_info: + require_session_user(request) + assert exc_info.value.status_code == 401 + + +def test_require_session_user_returns_tuple() -> None: + request = MagicMock() + request.session = {"userid": "u1", "username": "alice"} + assert require_session_user(request) == ("u1", "alice") diff --git a/tests/test_auth_routes/test_webauthn_login.py b/tests/test_auth_routes/test_webauthn_login.py new file mode 100644 index 0000000..1724065 --- /dev/null +++ b/tests/test_auth_routes/test_webauthn_login.py @@ -0,0 +1,95 @@ +import os +from datetime import UTC, datetime + +from cryptography.hazmat.primitives.asymmetric import ec +from fido2.cose import ES256 +from fido2.webauthn import ( + Aaguid, + AttestedCredentialData, +) +from httpx import AsyncClient + +from fastapi_oidc_op.models import User, WebAuthnCredential + +RP_ID = "localhost" +ORIGIN = "http://localhost:8000" + + +def _generate_credential() -> tuple[ec.EllipticCurvePrivateKey, bytes, AttestedCredentialData]: + private_key = ec.generate_private_key(ec.SECP256R1()) + cose_key = ES256.from_cryptography_key(private_key.public_key()) + credential_id = os.urandom(32) + attested = AttestedCredentialData.create(aaguid=Aaguid.NONE, credential_id=credential_id, public_key=cose_key) + return private_key, credential_id, attested + + +async def _setup_user_with_webauthn( + client: AsyncClient, +) -> tuple[str, ec.EllipticCurvePrivateKey, bytes, AttestedCredentialData]: + """Create a user with a WebAuthn credential in the repo.""" + app = client._transport.app # type: ignore[union-attr] + user_repo = app.state.user_repo + cred_repo = app.state.credential_repo + + private_key, credential_id, attested = _generate_credential() + + user = User(userid="lusab-bansen", username="alice", created_at=datetime.now(UTC), updated_at=datetime.now(UTC)) + await user_repo.create(user) + + await cred_repo.create_webauthn( + WebAuthnCredential( + user_id=user.userid, + credential_id=credential_id, + public_key=bytes(attested), + sign_count=0, + ) + ) + + return user.userid, private_key, credential_id, attested + + +async def test_webauthn_login_begin_returns_options(client: AsyncClient) -> None: + _userid, _pk, _cid, _att = await _setup_user_with_webauthn(client) + + res = await client.post( + "/login/webauthn/begin", + data={"username": "alice"}, + headers={"HX-Request": "true"}, + ) + assert res.status_code == 200 + data = res.json() + assert "publicKey" in data + + +async def test_webauthn_login_begin_unknown_user(client: AsyncClient) -> None: + res = await client.post( + "/login/webauthn/begin", + data={"username": "nobody"}, + headers={"HX-Request": "true"}, + ) + # Should return error, not crash + assert res.status_code == 200 + assert 'role="alert"' in res.text or "not found" in res.text.lower() or "Invalid" in res.text + + +async def test_webauthn_login_complete_sets_session(client: AsyncClient) -> None: + """Test the begin endpoint + verify sign_count can be updated via repo.""" + _userid, _private_key, credential_id, _attested = await _setup_user_with_webauthn(client) + app = client._transport.app # type: ignore[union-attr] + cred_repo = app.state.credential_repo + + # Verify begin endpoint works and returns valid options + res1 = await client.post("/login/webauthn/begin", data={"username": "alice"}) + assert res1.status_code == 200 + data = res1.json() + assert "publicKey" in data + + # Verify sign_count can be updated via the repo directly + # (Full e2e WebAuthn complete testing requires browser interaction) + stored = await cred_repo.get_webauthn_by_credential_id(credential_id) + assert stored is not None + stored.sign_count = 5 + await cred_repo.update_webauthn(stored) + updated = await cred_repo.get_webauthn_by_credential_id(credential_id) + assert updated is not None + assert updated.sign_count == 5 diff --git a/uv.lock b/uv.lock index e6db9b7..ae10741 100644 --- a/uv.lock +++ b/uv.lock @@ -306,6 +306,7 @@ dependencies = [ { name = "fido2" }, { name = "httpx" }, { name = "idpyoidc" }, + { name = "itsdangerous" }, { name = "jinja2" }, { name = "motor" }, { name = "proquint" }, @@ -330,6 +331,7 @@ requires-dist = [ { name = "fido2", specifier = ">=2.1" }, { name = "httpx", specifier = ">=0.28" }, { name = "idpyoidc", specifier = ">=5.0" }, + { name = "itsdangerous", specifier = ">=2.2.0" }, { name = "jinja2", specifier = ">=3.1" }, { name = "motor", specifier = ">=3.7" }, { name = "proquint", specifier = ">=0.2" }, @@ -461,6 +463,15 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" }, ] +[[package]] +name = "itsdangerous" +version = "2.2.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/9c/cb/8ac0172223afbccb63986cc25049b154ecfb5e85932587206f42317be31d/itsdangerous-2.2.0.tar.gz", hash = "sha256:e0050c0b7da1eea53ffaf149c0cfbb5c6e2e2b69c4bef22c81fa6eb73e5f6173", size = 54410, upload-time = "2024-04-16T21:28:15.614Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl", hash = "sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef", size = 16234, upload-time = "2024-04-16T21:28:14.499Z" }, +] + [[package]] name = "jinja2" version = "3.1.6"