<?php
// WebAuthn / passkey verification, hand-rolled to keep the project's "no
// third-party code" rule. Only what a single-user site needs: register a
// credential, then verify assertions against the stored public key.
//
// Attestation is deliberately NOT verified. Attestation only proves which
// make and model of authenticator was used, which matters when an
// organisation must restrict employees to approved hardware. Here the owner
// chooses their own device, so any authenticator they can use is acceptable,
// and skipping it avoids shipping a CA bundle of vendor roots.
require_once __DIR__ . '/auth.php';

function b64url_encode(string $bin): string
{
    return rtrim(strtr(base64_encode($bin), '+/', '-_'), '=');
}

function b64url_decode(string $txt): string
{
    return (string)base64_decode(strtr($txt, '-_', '+/'), true);
}

// The Relying Party id a credential is bound to: the host without its port.
// Credentials are scoped to this, so a passkey made on localhost will not
// work on the live domain and vice versa — each host needs its own.
function webauthn_rp_id(): string
{
    $host = (string)($_SERVER['HTTP_HOST'] ?? 'localhost');
    return preg_replace('/:\d+$/', '', $host);
}

// The exact origin the browser will report in clientDataJSON, port included.
function webauthn_origin(): string
{
    return (is_https() ? 'https://' : 'http://') . ($_SERVER['HTTP_HOST'] ?? 'localhost');
}

// Passkeys need a secure context. Browsers make one exception, localhost,
// which is what lets this work under MAMP without a certificate.
function webauthn_available(): bool
{
    $host = webauthn_rp_id();
    return is_https() || $host === 'localhost' || $host === '127.0.0.1' || $host === '::1';
}

/* ---------- CBOR ---------- */

// Length/value field shared by every CBOR major type.
function cbor_arg(string $d, int &$o, int $info): int
{
    if ($info < 24) {
        return $info;
    }
    if ($info === 24) {
        return ord($d[$o++]);
    }
    if ($info === 25) {
        $v = unpack('n', substr($d, $o, 2))[1];
        $o += 2;
        return $v;
    }
    if ($info === 26) {
        $v = unpack('N', substr($d, $o, 4))[1];
        $o += 4;
        return $v;
    }
    if ($info === 27) {
        $v = unpack('J', substr($d, $o, 8))[1];
        $o += 8;
        return $v;
    }
    throw new RuntimeException('Bad CBOR length marker ' . $info);
}

// Decodes the CBOR subset WebAuthn actually uses. $o advances past the
// decoded item, which is how the authenticator-data parser finds where the
// variable-length public key ends.
function cbor_decode(string $d, int &$o = 0)
{
    if ($o >= strlen($d)) {
        throw new RuntimeException('CBOR ended early');
    }
    $b     = ord($d[$o++]);
    $major = $b >> 5;
    $info  = $b & 0x1f;

    if ($major === 7) {
        // Simple values. Floats never appear in COSE keys or attestation.
        if ($info === 20) {
            return false;
        }
        if ($info === 21) {
            return true;
        }
        if ($info === 22 || $info === 23) {
            return null;
        }
        throw new RuntimeException('Unsupported CBOR simple value ' . $info);
    }

    $arg = cbor_arg($d, $o, $info);

    switch ($major) {
        case 0:
            return $arg;
        case 1:
            return -1 - $arg;
        case 2:
        case 3:
            $s  = substr($d, $o, $arg);
            $o += $arg;
            return $s;
        case 4:
            $a = [];
            for ($i = 0; $i < $arg; $i++) {
                $a[] = cbor_decode($d, $o);
            }
            return $a;
        case 5:
            $m = [];
            for ($i = 0; $i < $arg; $i++) {
                $k     = cbor_decode($d, $o);
                $m[$k] = cbor_decode($d, $o);
            }
            return $m;
    }
    throw new RuntimeException('Unsupported CBOR major type ' . $major);
}

/* ---------- DER ---------- */

function der_len(int $n): string
{
    if ($n < 128) {
        return chr($n);
    }
    $bytes = ltrim(pack('N', $n), "\x00");
    return chr(0x80 | strlen($bytes)) . $bytes;
}

function der_tlv(int $tag, string $value): string
{
    return chr($tag) . der_len(strlen($value)) . $value;
}

// DER INTEGERs are signed, so a leading bit of 1 needs a 0x00 pad or the
// value reads as negative.
function der_int(string $bytes): string
{
    $bytes = ltrim($bytes, "\x00");
    if ($bytes === '') {
        $bytes = "\x00";
    }
    if (ord($bytes[0]) & 0x80) {
        $bytes = "\x00" . $bytes;
    }
    return der_tlv(0x02, $bytes);
}

// A COSE public key (RFC 8152) as a PEM SubjectPublicKeyInfo, which is what
// openssl_verify() wants. ES256 and RS256 cover every mainstream passkey
// provider — Apple, Google, Windows Hello, and the FIDO2 keys.
function cose_to_pem(array $cose): string
{
    $kty = $cose[1] ?? null;
    $alg = $cose[3] ?? null;

    if ($kty === 2) { // Elliptic curve
        if ($alg !== -7) {
            throw new RuntimeException('Unsupported EC algorithm ' . var_export($alg, true));
        }
        if (($cose[-1] ?? null) !== 1) {
            throw new RuntimeException('Only the P-256 curve is supported');
        }
        $x = str_pad((string)($cose[-2] ?? ''), 32, "\x00", STR_PAD_LEFT);
        $y = str_pad((string)($cose[-3] ?? ''), 32, "\x00", STR_PAD_LEFT);
        $algId  = der_tlv(0x30, hex2bin('06072a8648ce3d0201') . hex2bin('06082a8648ce3d030107'));
        $point  = der_tlv(0x03, "\x00" . "\x04" . $x . $y); // 0x04 = uncompressed
        $spki   = der_tlv(0x30, $algId . $point);
    } elseif ($kty === 3) { // RSA
        if ($alg !== -257) {
            throw new RuntimeException('Unsupported RSA algorithm ' . var_export($alg, true));
        }
        $n     = (string)($cose[-1] ?? '');
        $e     = (string)($cose[-2] ?? '');
        $algId = der_tlv(0x30, hex2bin('06092a864886f70d010101') . "\x05\x00"); // rsaEncryption, NULL params
        $inner = der_tlv(0x30, der_int($n) . der_int($e));
        $spki  = der_tlv(0x30, $algId . der_tlv(0x03, "\x00" . $inner));
    } else {
        throw new RuntimeException('Unsupported key type ' . var_export($kty, true));
    }

    return "-----BEGIN PUBLIC KEY-----\n" . chunk_split(base64_encode($spki), 64, "\n") . "-----END PUBLIC KEY-----\n";
}

/* ---------- authenticator data ---------- */

// authData is a packed struct: 32-byte RP id hash, 1 flag byte, 4-byte
// signature counter, and — when the AT flag is set — the new credential.
function parse_auth_data(string $ad): array
{
    if (strlen($ad) < 37) {
        throw new RuntimeException('Authenticator data too short');
    }
    $out = [
        'rp_id_hash' => substr($ad, 0, 32),
        'flags'      => ord($ad[32]),
        'sign_count' => unpack('N', substr($ad, 33, 4))[1],
    ];
    if ($out['flags'] & 0x40) { // AT: attested credential data present
        $len = unpack('n', substr($ad, 53, 2))[1]; // 16 bytes AAGUID first
        $out['credential_id'] = substr($ad, 55, $len);
        $offset = 55 + $len;
        $out['cose_key'] = cbor_decode($ad, $offset);
    }
    return $out;
}

// Checks the parts of clientDataJSON that are the same for registration and
// login: that the browser signed OUR challenge, for OUR origin, in the
// ceremony we asked for. Getting any of these wrong is how a WebAuthn
// implementation ends up accepting a replayed or cross-site assertion.
function verify_client_data(string $json, string $expectedType, string $challenge): void
{
    $cd = json_decode($json, true);
    if (!is_array($cd)) {
        throw new RuntimeException('clientDataJSON is not valid JSON');
    }
    if (($cd['type'] ?? '') !== $expectedType) {
        throw new RuntimeException('Wrong ceremony type');
    }
    if (!hash_equals(b64url_encode($challenge), (string)($cd['challenge'] ?? ''))) {
        throw new RuntimeException('Challenge does not match');
    }
    if (!hash_equals(webauthn_origin(), (string)($cd['origin'] ?? ''))) {
        throw new RuntimeException('Origin does not match');
    }
}

// Registration: verify the ceremony and return the row to store.
function webauthn_verify_registration(string $clientDataJSON, string $attestationObject, string $challenge): array
{
    verify_client_data($clientDataJSON, 'webauthn.create', $challenge);

    $att = cbor_decode($attestationObject);
    if (!isset($att['authData'])) {
        throw new RuntimeException('Attestation object has no authenticator data');
    }
    $ad = parse_auth_data($att['authData']);

    if (!hash_equals(hash('sha256', webauthn_rp_id(), true), $ad['rp_id_hash'])) {
        throw new RuntimeException('Credential is for a different site');
    }
    if (!($ad['flags'] & 0x01)) {
        throw new RuntimeException('User presence was not verified');
    }
    if (empty($ad['credential_id']) || empty($ad['cose_key'])) {
        throw new RuntimeException('No credential in the attestation');
    }

    return [
        'credential_id' => b64url_encode($ad['credential_id']),
        'public_key'    => cose_to_pem($ad['cose_key']),
        'sign_count'    => $ad['sign_count'],
    ];
}

// Login: verify the assertion signature against the stored public key.
// The signed message is authData concatenated with the SHA-256 of the client
// data — never the client data itself.
function webauthn_verify_assertion(
    string $clientDataJSON,
    string $authenticatorData,
    string $signature,
    string $challenge,
    string $pem,
    int $storedCount
): int {
    verify_client_data($clientDataJSON, 'webauthn.get', $challenge);
    $ad = parse_auth_data($authenticatorData);

    if (!hash_equals(hash('sha256', webauthn_rp_id(), true), $ad['rp_id_hash'])) {
        throw new RuntimeException('Assertion is for a different site');
    }
    if (!($ad['flags'] & 0x01)) {
        throw new RuntimeException('User presence was not verified');
    }

    $signed = $authenticatorData . hash('sha256', $clientDataJSON, true);
    if (openssl_verify($signed, $signature, $pem, OPENSSL_ALGO_SHA256) !== 1) {
        throw new RuntimeException('Signature does not verify');
    }

    // A counter that failed to advance suggests a cloned authenticator. Many
    // passkey providers (Apple and Google among them) always report 0 because
    // the credential is synced across devices by design, so the check only
    // applies when the authenticator actually keeps a counter.
    if ($storedCount > 0 && $ad['sign_count'] > 0 && $ad['sign_count'] <= $storedCount) {
        throw new RuntimeException('Signature counter went backwards');
    }
    return $ad['sign_count'];
}