@spec compute_client_data_hash(String.t()) :: {:ok, binary()}

Computes SHA256 hash of client data JSON.

Parameters

• client_data_json - Client data JSON string

Returns

• {:ok, hash} - Successfully computed hash

@spec parse_authenticator_data(binary()) ::
  {:ok, ExSwan.Attestation.AuthenticatorData.t()} | {:error, atom()}

Parses authenticator data from binary format.

Extracts RP ID hash, flags, signature counter, and other fields from the binary authenticator data according to the WebAuthn specification.

Parameters

• auth_data_bytes - Binary authenticator data

Returns

• {:ok, authenticator_data} - Successfully parsed authenticator data
• {:error, reason} - Parsing failure

@spec parse_client_data(String.t(), String.t()) ::
  {:ok, {map(), String.t()}} | {:error, atom()}

Parses and verifies client data JSON from base64 encoding.

Decodes the base64 client data, parses the JSON, and validates the structure. This is used by both registration and authentication flows.

Parameters

• client_data_base64 - Base64url encoded client data JSON
• expected_type - Expected client data type ("webauthn.create" or "webauthn.get")

Returns

• {:ok, {client_data, client_data_json}} - Successfully parsed client data
• {:error, reason} - Parsing or validation failure

@spec remove_nil_values(map()) :: map()

Removes nil values from a map recursively.

Parameters

• map - Map to clean

Returns

• Cleaned map with nil values removed

@spec verify_challenge(String.t(), binary() | function()) :: :ok | {:error, atom()}

Verifies client data challenge against expected challenge.

Supports both binary challenges and custom challenge verification functions for compatibility with SimpleWebAuthn patterns.

Parameters

• received_challenge - Challenge from client data (base64url encoded)
• expected_challenge - Expected challenge (binary or verification function)

Returns

• :ok - Challenge verification successful
• {:error, reason} - Challenge verification failed

@spec verify_origin(String.t(), String.t() | [String.t()]) ::
  :ok | {:error, :origin_mismatch}

Verifies client data origin against expected origin(s).

Parameters

• received_origin - Origin from client data
• expected_origins - Expected origin(s) (string or list of strings)

Returns

• :ok - Origin verification successful
• {:error, :origin_mismatch} - Origin verification failed

@spec verify_rp_id_hash(binary(), String.t()) :: :ok | {:error, :rp_id_hash_mismatch}

Verifies RP ID hash against expected relying party ID.

Parameters

• received_hash - RP ID hash from authenticator data
• rp_id - Expected relying party ID

Returns

• :ok - Hash verification successful
• {:error, :rp_id_hash_mismatch} - Hash verification failed

@spec verify_user_presence(ExSwan.Attestation.AuthenticatorData.t()) ::
  :ok | {:error, :user_not_present}

Verifies user presence flag in authenticator data.

Parameters

• authenticator_data - Parsed authenticator data

Returns

• :ok - User presence verified
• {:error, :user_not_present} - User presence verification failed