From 4f9cd29be0d62efaa4a63b9d06bb6e0e4260df1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@mfauth.net>
Date: Sun, 25 Aug 2024 21:03:53 -0300
Subject: [PATCH] Inline Webauthn\Server::loadAndCheckAttestationResponse()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Webauthn\Server was removed in web-auth/webauthn-lib v4.

Signed-off-by: Maurício Meneghini Fauth <mauricio@mfauth.net>
---
 src/WebAuthn/WebauthnLibServer.php | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/src/WebAuthn/WebauthnLibServer.php b/src/WebAuthn/WebauthnLibServer.php
index 6ff4236a23..66af0f3d59 100644
--- a/src/WebAuthn/WebauthnLibServer.php
+++ b/src/WebAuthn/WebauthnLibServer.php
@@ -17,6 +17,8 @@ use Webauthn\AuthenticationExtensions\AuthenticationExtensionsClientInputs;
 use Webauthn\AuthenticationExtensions\ExtensionOutputCheckerHandler;
 use Webauthn\AuthenticatorAssertionResponse;
 use Webauthn\AuthenticatorAssertionResponseValidator;
+use Webauthn\AuthenticatorAttestationResponse;
+use Webauthn\AuthenticatorAttestationResponseValidator;
 use Webauthn\AuthenticatorSelectionCriteria;
 use Webauthn\PublicKeyCredentialCreationOptions;
 use Webauthn\PublicKeyCredentialDescriptor;
@@ -27,7 +29,6 @@ use Webauthn\PublicKeyCredentialRpEntity;
 use Webauthn\PublicKeyCredentialSource;
 use Webauthn\PublicKeyCredentialSourceRepository;
 use Webauthn\PublicKeyCredentialUserEntity;
-use Webauthn\Server as WebauthnServer;
 use Webauthn\TokenBinding\IgnoreTokenBindingHandler;
 use Webauthn\TrustPath\EmptyTrustPath;
 use Webmozart\Assert\Assert;
@@ -237,9 +238,7 @@ final class WebauthnLibServer implements Server
         Assert::isArray($creationOptions['user']);
         Assert::keyExists($creationOptions['user'], 'id');
         $host = $request->getUri()->getHost();
-        $relyingPartyEntity = new PublicKeyCredentialRpEntity('phpMyAdmin (' . $host . ')', $host);
         $publicKeyCredentialSourceRepository = $this->createPublicKeyCredentialSourceRepository();
-        $server = new WebauthnServer($relyingPartyEntity, $publicKeyCredentialSourceRepository);
         $creationOptionsArray = [
             'rp' => ['name' => 'phpMyAdmin (' . $host . ')', 'id' => $host],
             'pubKeyCredParams' => [
@@ -266,8 +265,29 @@ final class WebauthnLibServer implements Server
         ];
         $credentialCreationOptions = PublicKeyCredentialCreationOptions::createFromArray($creationOptionsArray);
         Assert::isInstanceOf($credentialCreationOptions, PublicKeyCredentialCreationOptions::class);
-        $publicKeyCredentialSource = $server->loadAndCheckAttestationResponse(
-            $attestationResponse,
+
+        $attestationStatementSupportManager = new AttestationStatementSupportManager();
+        $attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
+        $attestationObjectLoader = AttestationObjectLoader::create($attestationStatementSupportManager);
+        $publicKeyCredentialLoader = PublicKeyCredentialLoader::create($attestationObjectLoader);
+
+        $publicKeyCredential = $publicKeyCredentialLoader->load($attestationResponse);
+        $authenticatorResponse = $publicKeyCredential->getResponse();
+        Assert::isInstanceOf(
+            $authenticatorResponse,
+            AuthenticatorAttestationResponse::class,
+            'Not an authenticator attestation response',
+        );
+
+        $authenticatorAttestationResponseValidator = new AuthenticatorAttestationResponseValidator(
+            $attestationStatementSupportManager,
+            $publicKeyCredentialSourceRepository,
+            new IgnoreTokenBindingHandler(),
+            new ExtensionOutputCheckerHandler(),
+        );
+
+        $publicKeyCredentialSource = $authenticatorAttestationResponseValidator->check(
+            $authenticatorResponse,
             $credentialCreationOptions,
             $request,
         );