pps-php/examples/06-policy-binding.php at master · pps-protocol/pps-php · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
<?php

/**
 * PPS-PHP Example 06: Policy Binding
 *
 * Demonstrates dynamic security policy binding:
 * 1. Server defines a policy object
 * 2. Client binds the policy hash to the Pulse
 * 3. Server verifies the policy hash matches
 *
 * Usage:
 *   php examples/06-policy-binding.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../vendor/autoload.php';

use Pps\Client\AuthenticatorClient;
use Pps\Key\KeyManager;
use Pps\Payload\PolicyObject;
use Pps\Server\AuthenticationHandler;
use Pps\Server\ChallengeGenerator;
use Pps\Storage\InMemoryStorage;
use Pps\Util\SystemTimeProvider;

echo "=== PPS-PHP Example 06: Policy Binding ===\n\n";

$storage = new InMemoryStorage();
$timeProvider = new SystemTimeProvider();
$rpId = 'example.com';

// ---------------------------------------------------------------
// Setup: Register device
// ---------------------------------------------------------------

$clientState = KeyManager::createClientState($rpId);
$kid = $clientState['kid'];
$normalSeed = \Pps\Crypto\Base64Url::decode($clientState['current_seed']);
$normalKey = \Pps\Key\KeyManager::keyPairFromSeed($normalSeed);

$storage->saveDeviceState($kid, [
    'kid' => $kid,
    'current_pk' => $normalKey->publicKeyB64u(),
    'key_seq' => 0,
    'last_counter' => 0,
    'revoked' => false,
]);

// ---------------------------------------------------------------
// Step 1: Server defines policy
// ---------------------------------------------------------------

echo "Step 1: Server defines policy\n";

$policy = new PolicyObject();
$policy->minTrustDigits = 8;
$policy->requireBiometric = true;
$policy->requireSecureEnclave = true;
$policy->maxAmountMinor = 10000000;
$policy->requireAmountMark = true;

echo "  Policy hash: " . \Pps\Crypto\Base64Url::encode($policy->hash()) . "\n\n";

// ---------------------------------------------------------------
// Step 2: Client creates Pulse with policy binding
// ---------------------------------------------------------------

echo "Step 2: Client creates Pulse with policy binding\n";

$challengeGen = new ChallengeGenerator($timeProvider);
$challenge = $challengeGen->create($rpId);

$client = new AuthenticatorClient($clientState, $timeProvider);
$pulse = $client
    ->rpId($rpId)
    ->nonce($challenge->nonceB64u)
    ->policy($policy)
    ->amountMinor(2500067)
    ->createPulse();

echo "  Trust Code: " . $pulse['trust_code'] . "\n\n";

// ---------------------------------------------------------------
// Step 3: Server verifies policy binding
// ---------------------------------------------------------------

echo "Step 3: Server verifies policy binding\n";

$handler = new AuthenticationHandler($storage, $timeProvider);
$result = $handler->verify(
    pulseToken: $pulse['token'],
    rpId: $rpId,
    nonceB64u: $challenge->nonceB64u,
    amountMinor: 2500067,
    policy: $policy,
    trustCode: $pulse['trust_code']
);

if ($result->ok) {
    echo "  Verification: SUCCESS\n";
    echo "  Policy binding verified: YES\n";
} else {
    echo "  Verification: FAILED\n";
    echo "  Error: " . $result->error . "\n";
    exit(1);
}

echo "\n=== Example 06 Complete ===\n";