ExSwan.Test.Authenticator (exswan_test v0.1.0)

A small software authenticator for application tests.

It creates real ES256 signatures and browser-shaped registration and authentication responses. It is intended only for tests and must not be used to authenticate users in production.

The authenticator owns one credential. Reuse it across registration and authentication to model a browser authenticator, or create separate values to model unknown credentials.

Summary

Types

t()

Functions

authentication_response(authenticator, opts)

Builds a valid signed authentication response.

credential(authenticator, opts \\ [])

Returns the stored credential corresponding to the authenticator.

new(opts \\ [])

Creates a deterministic authenticator.

registration_response(authenticator, opts)

Builds a valid none-attestation registration response.

tamper(response, atom)

Corrupts a signed response without requiring callers to understand its encoding.

Types

t()

@type t() :: %ExSwan.Test.Authenticator{
  credential_id: binary(),
  private_key: binary(),
  public_key: map(),
  user_handle: binary() | nil
}

Functions

authentication_response(authenticator, opts)

@spec authentication_response(
  t(),
  keyword()
) :: map()

Builds a valid signed authentication response.

Required options are :challenge, :origin, and :rp_id. Scenario controls include :flags, :sign_count, :credential_id, and :user_handle. The default counter is 1.

credential(authenticator, opts \\ [])

@spec credential(
  t(),
  keyword()
) :: ExSwan.Credential.t()

Returns the stored credential corresponding to the authenticator.

Use :sign_count, :credential_device_type, and :credential_backed_up to model persisted state before authentication.

new(opts \\ [])

@spec new(keyword()) :: t()

Creates a deterministic authenticator.

Options may replace :credential_id, :user_handle, or the 32-byte P-256 :private_key. Defaults are stable so snapshots and database assertions remain simple.

iex> authenticator = ExSwan.Test.Authenticator.new(user_handle: <<1, 2, 3>>)
iex> byte_size(authenticator.credential_id)
32

registration_response(authenticator, opts)

@spec registration_response(
  t(),
  keyword()
) :: map()

Builds a valid none-attestation registration response.

Required options are :challenge, :origin, and :rp_id. Useful scenario controls include :flags, :sign_count, :credential_id, :client_extensions, and :transports.

tamper(response, atom)

@spec tamper(map(), :signature | :client_data | :authenticator_data) :: map()

Corrupts a signed response without requiring callers to understand its encoding.

Currently supported mutations are :signature, :client_data, and :authenticator_data.