/*

MIT License

Copyright (c) Microsoft Corporation. All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE

*/

#pragma once

#include <winapifamily.h>

#pragma region Desktop Family or OneCore Family
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)

#ifdef __cplusplus
extern "C" {
#endif

#ifndef WINAPI
#define WINAPI __stdcall
#endif

#ifndef INITGUID
#define INITGUID
#include <guiddef.h>
#undef INITGUID
#else
#include <guiddef.h>
#endif

//+------------------------------------------------------------------------------------------
// APIs.
//-------------------------------------------------------------------------------------------

typedef enum _PLUGIN_AUTHENTICATOR_STATE
{
    AuthenticatorState_Disabled = 0,
    AuthenticatorState_Enabled
} AUTHENTICATOR_STATE;

HRESULT
WINAPI
WebAuthNPluginGetAuthenticatorState(
    _In_ REFCLSID rclsid,
    _Out_ AUTHENTICATOR_STATE* pluginAuthenticatorState
);

//
// Plugin Authenticator API: WebAuthNAddPluginAuthenticator: Add Plugin Authenticator
//

typedef struct _WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS {
    // Authenticator Name
    LPCWSTR pwszAuthenticatorName;

    // Plugin COM ClsId
    REFCLSID rclsid;

    // Plugin RPID (Required for a nested WebAuthN call originating from a plugin)
    LPCWSTR pwszPluginRpId;

    // Plugin Authenticator Logo for the Light themes. base64 encoded SVG 1.1 (Optional)
    LPCWSTR pwszLightThemeLogoSvg;

    // Plugin Authenticator Logo for the Dark themes. base64 encoded SVG 1.1 (Optional)
    LPCWSTR pwszDarkThemeLogoSvg;

    // CTAP CBOR encoded authenticatorGetInfo
    DWORD cbAuthenticatorInfo;
    _Field_size_bytes_(cbAuthenticatorInfo)
    const BYTE* pbAuthenticatorInfo;

    // List of supported RP IDs (Relying Party IDs). Should be 0/nullptr if all RPs are supported.
    DWORD cSupportedRpIds;
    const LPCWSTR* ppwszSupportedRpIds;

} WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS, *PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS;
typedef const WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS *PCWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS;

typedef struct _EXPERIMENTAL_WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2 {
    // Authenticator Name
    LPCWSTR pwszAuthenticatorName;

    // Plugin COM ClsId
    const CLSID* pClsid;

    // Plugin RPID (Required for a nested WebAuthN call originating from a plugin)
    LPCWSTR pwszPluginRpId;

    // Plugin Authenticator Logo for the Light themes. base64 encoded SVG 1.1 (Optional)
    LPCWSTR pwszLightThemeLogoSvg;

    // Plugin Authenticator Logo for the Dark themes. base64 encoded SVG 1.1 (Optional)
    LPCWSTR pwszDarkThemeLogoSvg;

    // CTAP CBOR encoded authenticatorGetInfo
    DWORD cbAuthenticatorInfo;
    _Field_size_bytes_(cbAuthenticatorInfo)
    const BYTE* pbAuthenticatorInfo;

    // List of supported RP IDs (Relying Party IDs). Should be 0/nullptr if all RPs are supported.
    DWORD cSupportedRpIds;
    const LPCWSTR* ppwszSupportedRpIds;

    // String name used in KeyCredentialManager.RequestCreateAsync called from the same App context (Optional)
    LPCWSTR pwszUserVerificationKeyName;

} EXPERIMENTAL_WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2, *EXPERIMENTAL_PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2;
typedef const EXPERIMENTAL_WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2 *EXPERIMENTAL_PCWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2;

typedef struct _WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE {
    // Plugin operation signing Public Key - Used to sign the request in PCWEBAUTHN_PLUGIN_OPERATION_REQUEST. Refer pluginauthenticator.h.
    DWORD cbOpSignPubKey;
    _Field_size_bytes_(cbOpSignPubKey)
    PBYTE pbOpSignPubKey;

} WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE, *PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE;
typedef const WEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE *PCWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE;

HRESULT
WINAPI
WebAuthNPluginAddAuthenticator(
    _In_ PCWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS pPluginAddAuthenticatorOptions,
    _Outptr_result_maybenull_ PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE* ppPluginAddAuthenticatorResponse);

HRESULT
WINAPI
EXPERIMENTAL_WebAuthNPluginAddAuthenticator2(
    _In_ EXPERIMENTAL_PCWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_OPTIONS_2 pPluginAddAuthenticatorOptions,
    _Outptr_result_maybenull_ PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE* ppPluginAddAuthenticatorResponse);

void
WINAPI
WebAuthNPluginFreeAddAuthenticatorResponse(
    _In_opt_ PWEBAUTHN_PLUGIN_ADD_AUTHENTICATOR_RESPONSE pPluginAddAuthenticatorResponse);

//
// Plugin Authenticator API: WebAuthNRemovePluginAuthenticator: Remove Plugin Authenticator
//

HRESULT
WINAPI
WebAuthNPluginRemoveAuthenticator(
    _In_ REFCLSID rclsid);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorUpdateDetails: Update Credential Metadata for Browser AutoFill Scenarios
//

typedef struct _WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS {
    // Authenticator Name
    LPCWSTR pwszAuthenticatorName;

    // Plugin COM ClsId
    REFCLSID rclsid;

    // New Plugin COM ClsId
    REFCLSID rclsidNew;

    // Plugin Authenticator Logo for the Light themes. base64 encoded SVG 1.1 (Optional, NULL removes this)
    LPCWSTR pwszLightThemeLogoSvg;

    // Plugin Authenticator Logo for the Dark themes. base64 encoded SVG 1.1 (Optional, NULL removes this)
    LPCWSTR pwszDarkThemeLogoSvg;

    // CTAP CBOR encoded authenticatorGetInfo
    DWORD cbAuthenticatorInfo;
    _Field_size_bytes_(cbAuthenticatorInfo)
    const BYTE* pbAuthenticatorInfo;

    // List of supported RP IDs (Relying Party IDs). Should be 0/nullptr if all RPs are supported.
    DWORD cSupportedRpIds;
    const LPCWSTR* ppwszSupportedRpIds;

} WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS, *PWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS;
typedef const WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS *PCWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS;

typedef struct _EXPERIMENTAL_WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2 {
    // Authenticator Name
    LPCWSTR pwszAuthenticatorName;

    // Plugin COM ClsId
    const CLSID* pClsid;

    // New Plugin COM ClsId
    const CLSID* pClsidNew;

    // Plugin Authenticator Logo for the Light themes. base64 encoded SVG 1.1 (Optional, NULL removes this)
    LPCWSTR pwszLightThemeLogoSvg;

    // Plugin Authenticator Logo for the Dark themes. base64 encoded SVG 1.1 (Optional, NULL removes this)
    LPCWSTR pwszDarkThemeLogoSvg;

    // CTAP CBOR encoded authenticatorGetInfo
    DWORD cbAuthenticatorInfo;
    _Field_size_bytes_(cbAuthenticatorInfo)
    const BYTE* pbAuthenticatorInfo;

    // List of supported RP IDs (Relying Party IDs). Should be 0/nullptr if all RPs are supported.
    DWORD cSupportedRpIds;
    const LPCWSTR* ppwszSupportedRpIds;

    // String name used in KeyCredentialManager.RequestCreateAsync (Optional, NULL removes this)
    LPCWSTR pwszUserVerificationKeyName;

} EXPERIMENTAL_WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2, *EXPERIMENTAL_PWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2;
typedef const EXPERIMENTAL_WEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2 *EXPERIMENTAL_PCWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2;

HRESULT
WINAPI
WebAuthNPluginUpdateAuthenticatorDetails(
    _In_ PCWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS pPluginUpdateAuthenticatorDetails);

HRESULT
WINAPI
EXPERIMENTAL_WebAuthNPluginUpdateAuthenticatorDetails2(
    _In_ EXPERIMENTAL_PCWEBAUTHN_PLUGIN_UPDATE_AUTHENTICATOR_DETAILS_2 pPluginUpdateAuthenticatorDetails);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorAddCredentials: Add Credential Metadata for Browser AutoFill Scenarios
//

typedef struct _WEBAUTHN_PLUGIN_CREDENTIAL_DETAILS {
    // Size of pbCredentialId.
    DWORD cbCredentialId;

    // Credential Identifier bytes. This field is required.
    _Field_size_bytes_(cbCredentialId)
    const BYTE* pbCredentialId;

    // Identifier for the RP. This field is required.
    LPCWSTR pwszRpId;

    // Contains the friendly name of the Relying Party, such as "Acme Corporation", "Widgets Inc" or "Awesome Site".
    // This field is required.
    LPCWSTR pwszRpName;

    // Identifier for the User. This field is required.
    DWORD cbUserId;

    // User Identifier bytes. This field is required.
    _Field_size_bytes_(cbUserId)
    const BYTE* pbUserId;

    // Contains a detailed name for this account, such as "john.p.smith@example.com".
    LPCWSTR pwszUserName;

    // For User: Contains the friendly name associated with the user account such as "John P. Smith".
    LPCWSTR pwszUserDisplayName;

} WEBAUTHN_PLUGIN_CREDENTIAL_DETAILS, *PWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS;
typedef const WEBAUTHN_PLUGIN_CREDENTIAL_DETAILS *PCWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS;

HRESULT
WINAPI
WebAuthNPluginAuthenticatorAddCredentials(
    _In_ REFCLSID rclsid,
    _In_ DWORD cCredentialDetails,
    _In_reads_(cCredentialDetails) PCWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS pCredentialDetails);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorRemoveCredentials: Remove Credential Metadata for Browser AutoFill Scenarios
//

HRESULT
WINAPI
WebAuthNPluginAuthenticatorRemoveCredentials(
    _In_ REFCLSID rclsid,
    _In_ DWORD cCredentialDetails,
    _In_reads_(cCredentialDetails) PCWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS pCredentialDetails);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorRemoveAllCredentials: Remove All Credential Metadata for Browser AutoFill Scenarios
//

HRESULT
WINAPI
WebAuthNPluginAuthenticatorRemoveAllCredentials(
    _In_ REFCLSID rclsid);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorGetAllCredentials: Get All Credential Metadata cached for Browser AutoFill Scenarios
//

HRESULT
WINAPI
WebAuthNPluginAuthenticatorGetAllCredentials(
    _In_ REFCLSID rclsid,
    _Out_ DWORD* pcCredentialDetails,
    _Outptr_result_buffer_maybenull_(*pcCredentialDetails) PWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS* ppCredentialDetailsArray);

//
// Plugin Authenticator API: WebAuthNPluginAuthenticatorFreeCredentialDetailsArray: Free Credential Metadata cached for Browser AutoFill Scenarios
//

void
WINAPI
WebAuthNPluginAuthenticatorFreeCredentialDetailsArray(
    _In_ DWORD cCredentialDetails,
    _In_reads_(cCredentialDetails) PWEBAUTHN_PLUGIN_CREDENTIAL_DETAILS pCredentialDetailsArray);

//
// Hello UV API for Plugin: WebAuthNPluginPerformUv: Perform Hello UV related operations
//

typedef enum _WEBAUTHN_PLUGIN_PERFORM_UV_OPERATION_TYPE
{
    PerformUserVerification = 1,
    GetUserVerificationCount,
    GetPublicKey
} WEBAUTHN_PLUGIN_PERFORM_UV_OPERATION_TYPE;

typedef struct _WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST {

    // Windows handle of the top-level window displayed by the plugin and currently is in foreground as part of the ongoing webauthn operation.
    HWND hwnd;

    // The webauthn transaction id from the WEBAUTHN_PLUGIN_OPERATION_REQUEST
    REFGUID rguidTransactionId;

    // The username attached to the credential that is in use for this webauthn operation
    LPCWSTR pwszUsername;

    // A text hint displayed on the windows hello prompt
    LPCWSTR pwszDisplayHint;
} WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST, *PWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST;
typedef const WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST *PCWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST;

typedef struct _EXPERIMENTAL_WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2 {

    // Windows handle of the top-level window displayed by the plugin and currently is in foreground as part of the ongoing webauthn operation.
    HWND hwnd;

    // The webauthn transaction id from the WEBAUTHN_PLUGIN_OPERATION_REQUEST
    const GUID* pGuidTransactionId;

    // The username attached to the credential that is in use for this webauthn operation
    LPCWSTR pwszUsername;

    // A text hint displayed on the windows hello prompt
    LPCWSTR pwszDisplayHint;

    // The custom byte buffer to be signed by the UV key (Optional)
    // Depending on the signing algorithm, this input may be expected to be a hash. This API will not do any hashing prior to signing.
    DWORD cbBufferToSign;
    _Field_size_bytes_(cbBufferToSign)
    PBYTE pbBufferToSign;
} EXPERIMENTAL_WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2, *EXPERIMENTAL_PWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2;
typedef const EXPERIMENTAL_WEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2 *EXPERIMENTAL_PCWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2;

HRESULT
WINAPI
WebAuthNPluginPerformUserVerification(
    _In_ PCWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST pPluginUserVerification,
    _Out_ DWORD* pcbResponse,
    _Outptr_result_buffer_maybenull_(*pcbResponse) PBYTE* ppbResponse);

HRESULT
WINAPI
EXPERIMENTAL_WebAuthNPluginPerformUserVerification2(
    _In_ EXPERIMENTAL_PCWEBAUTHN_PLUGIN_USER_VERIFICATION_REQUEST_2 pPluginUserVerification,
    _Out_ DWORD* pcbResponse,
    _Outptr_result_buffer_maybenull_(*pcbResponse) PBYTE* ppbResponse);

void
WINAPI
WebAuthNPluginFreeUserVerificationResponse(
    _In_opt_ PBYTE ppbResponse);

HRESULT
WINAPI
WebAuthNPluginGetUserVerificationCount(
    _In_ REFCLSID rclsid,
    _Out_ DWORD* pdwVerificationCount);

HRESULT
WINAPI
WebAuthNPluginGetUserVerificationPublicKey(
    _In_ REFCLSID rclsid,
    _Out_ DWORD* pcbPublicKey,
    _Outptr_result_bytebuffer_(*pcbPublicKey) PBYTE* ppbPublicKey); // Free using WebAuthNPluginFreePublicKeyResponse

HRESULT
WINAPI
WebAuthNPluginGetOperationSigningPublicKey(
    _In_ REFCLSID rclsid,
    _Out_ DWORD* pcbOpSignPubKey,
    _Outptr_result_buffer_maybenull_(*pcbOpSignPubKey) PBYTE* ppbOpSignPubKey); // Free using WebAuthNPluginFreePublicKeyResponse

void WINAPI WebAuthNPluginFreePublicKeyResponse(
    _In_opt_ PBYTE pbOpSignPubKey);

#define WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS_VERSION_1 1
#define WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS_CURRENT_VERSION WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS_VERSION_1
typedef struct _WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS {
    //Version of this structure, to allow for modifications in the future.
    DWORD dwVersion;

    // Following have following values:
    //  +1 - TRUE
    //   0 - Not defined
    //  -1 - FALSE
    //up: "true" | "false"
    LONG lUp;
    //uv: "true" | "false"
    LONG lUv;
    //rk: "true" | "false"
    LONG lRequireResidentKey;
} WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS, *PWEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS;
typedef const WEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS *PCWEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS;

#define WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY_VERSION_1 1
#define WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY_CURRENT_VERSION WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY_VERSION_1
typedef struct _WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY {
    //Version of this structure, to allow for modifications in the future.
    DWORD dwVersion;

    // Key type
    LONG lKty;

    // Hash Algorithm: ES256, ES384, ES512
    LONG lAlg;

    // Curve
    LONG lCrv;

    //Size of "x" (X Coordinate)
    DWORD cbX;

    //"x" (X Coordinate) data. Big Endian.
    PBYTE pbX;

    //Size of "y" (Y Coordinate)
    DWORD cbY;

    //"y" (Y Coordinate) data. Big Endian.
    PBYTE pbY;
} WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY, *PWEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY;
typedef const WEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY *PCWEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY;

#define WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION_VERSION_1 1
#define WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION_CURRENT_VERSION WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION_VERSION_1
typedef struct _WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION {
    //Version of this structure, to allow for modifications in the future.
    DWORD dwVersion;

    // Platform's key agreement public key
    PWEBAUTHN_CTAPCBOR_ECC_PUBLIC_KEY pKeyAgreement;

    DWORD cbEncryptedSalt;
    PBYTE pbEncryptedSalt;

    DWORD cbSaltAuth;
    PBYTE pbSaltAuth;
} WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION, *PWEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION;
typedef const WEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION *PCWEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION;

#define WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST_VERSION_1 1
#define WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST_CURRENT_VERSION WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST_VERSION_1
typedef struct _WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST {
    //Version of this structure, to allow for modifications in the future.
    DWORD dwVersion;
    
    //Input RP ID. Raw UTF8 bytes before conversion.
    //These are the bytes to be hashed in the Authenticator Data.
    DWORD cbRpId;
    PBYTE pbRpId;
    
    //Client Data Hash
    DWORD cbClientDataHash;
    PBYTE pbClientDataHash;
    
    //RP Information
    PCWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation;
    
    //User Information
    PCWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation;
    
    // Crypto Parameters
    WEBAUTHN_COSE_CREDENTIAL_PARAMETERS WebAuthNCredentialParameters;
    
    //Credentials used for exclusion
    WEBAUTHN_CREDENTIAL_LIST CredentialList;
    
    //Optional extensions to parse when performing the operation.
    DWORD cbCborExtensionsMap;
    PBYTE pbCborExtensionsMap;
    
    // Authenticator Options (Optional)
    PWEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS pAuthenticatorOptions;
    
    // Pin Auth (Optional)
    BOOL fEmptyPinAuth; // Zero length PinAuth is included in the request
    DWORD cbPinAuth;
    PBYTE pbPinAuth;
    
    //"hmac-secret": true extension
    LONG lHmacSecretExt;

    // "hmac-secret-mc" extension
    PWEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION pHmacSecretMcExtension;

    //"prf" extension
    LONG lPrfExt;
    DWORD cbHmacSecretSaltValues;
    PBYTE pbHmacSecretSaltValues;

    //"credProtect" extension. Nonzero if present
    DWORD dwCredProtect;

    // Nonzero if present
    DWORD dwPinProtocol;

    // Nonzero if present
    DWORD dwEnterpriseAttestation;

    //"credBlob" extension. Nonzero if present
    DWORD cbCredBlobExt;
    PBYTE pbCredBlobExt;

    //"largeBlobKey": true extension
    LONG lLargeBlobKeyExt;

    //"largeBlob": extension
    DWORD dwLargeBlobSupport;

    //"minPinLength": true extension
    LONG lMinPinLengthExt;

    // "json" extension. Nonzero if present
    DWORD cbJsonExt;
    PBYTE pbJsonExt;
} WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST, *PWEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST;
typedef const WEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST *PCWEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST;

_Success_(return == S_OK)
HRESULT
WINAPI
WebAuthNEncodeMakeCredentialResponse(
    _In_ PCWEBAUTHN_CREDENTIAL_ATTESTATION pCredentialAttestation,
    _Out_ DWORD* pcbResp,
    _Outptr_result_buffer_maybenull_(*pcbResp) BYTE** ppbResp
    );

_Success_(return == S_OK)
HRESULT
WINAPI
WebAuthNDecodeMakeCredentialRequest(
    _In_ DWORD cbEncoded,
    _In_reads_bytes_(cbEncoded) const BYTE* pbEncoded,
    _Outptr_ PWEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST* ppMakeCredentialRequest
    );

void
WINAPI
WebAuthNFreeDecodedMakeCredentialRequest(
    _In_opt_ PWEBAUTHN_CTAPCBOR_MAKE_CREDENTIAL_REQUEST pMakeCredentialRequest
    );

#define WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST_VERSION_1 1
#define WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST_CURRENT_VERSION WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST_VERSION_1
typedef struct _WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST {
    //Version of this structure, to allow for modifications in the future.
    DWORD dwVersion;
    
    //RP ID. After UTF8 to Unicode conversion,
    PCWSTR pwszRpId;
    
    //Input RP ID. Raw UTF8 bytes before conversion.
    //These are the bytes to be hashed in the Authenticator Data.
    DWORD cbRpId;
    PBYTE pbRpId;
    
    //Client Data Hash
    DWORD cbClientDataHash;
    PBYTE pbClientDataHash;
    
    //Credentials used for inclusion
    WEBAUTHN_CREDENTIAL_LIST CredentialList;
    
    //Optional extensions to parse when performing the operation.
    DWORD cbCborExtensionsMap;
    PBYTE pbCborExtensionsMap;
    
    // Authenticator Options (Optional)
    PWEBAUTHN_CTAPCBOR_AUTHENTICATOR_OPTIONS pAuthenticatorOptions;
    
    // Pin Auth (Optional)
    BOOL fEmptyPinAuth; // Zero length PinAuth is included in the request
    DWORD cbPinAuth;
    PBYTE pbPinAuth;
    
    // HMAC Salt Extension (Optional)
    PWEBAUTHN_CTAPCBOR_HMAC_SALT_EXTENSION pHmacSaltExtension;

    // PRF Extension
    DWORD cbHmacSecretSaltValues;
    PBYTE pbHmacSecretSaltValues;

    DWORD dwPinProtocol;

    //"credBlob": true  extension
    LONG lCredBlobExt;

    //"largeBlobKey": true extension
    LONG lLargeBlobKeyExt;

    //"largeBlob" extension
    DWORD dwCredLargeBlobOperation;
    DWORD cbCredLargeBlobCompressed;
    PBYTE pbCredLargeBlobCompressed;
    DWORD dwCredLargeBlobOriginalSize;

    // "json" extension. Nonzero if present
    DWORD cbJsonExt;
    PBYTE pbJsonExt;
} WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST, *PWEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST;
typedef const WEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST *PCWEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST;

_Success_(return == S_OK)
HRESULT
WINAPI
WebAuthNDecodeGetAssertionRequest(
    _In_ DWORD cbEncoded,
    _In_reads_bytes_(cbEncoded) const BYTE* pbEncoded,
    _Outptr_ PWEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST* ppGetAssertionRequest
    );

void
WINAPI
WebAuthNFreeDecodedGetAssertionRequest(
    _In_opt_ PWEBAUTHN_CTAPCBOR_GET_ASSERTION_REQUEST pGetAssertionRequest
    );

typedef struct _WEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE {
    // [1] credential (optional)
    // [2] authenticatorData
    // [3] signature
    WEBAUTHN_ASSERTION                      WebAuthNAssertion;
    
    // [4] user (optional)
    PCWEBAUTHN_USER_ENTITY_INFORMATION      pUserInformation;
    
    // [5] numberOfCredentials (optional)
    DWORD                                   dwNumberOfCredentials;
    
    // [6] userSelected (optional)
    LONG                                    lUserSelected;
    
    // [7] largeBlobKey (optional)
    DWORD                                   cbLargeBlobKey;
    PBYTE                                   pbLargeBlobKey;
    
    // [8] unsignedExtensionOutputs
    DWORD                                   cbUnsignedExtensionOutputs;
    PBYTE                                   pbUnsignedExtensionOutputs;
} WEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE, *PWEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE;
typedef const WEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE *PCWEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE;

_Success_(return == S_OK)
HRESULT
WINAPI
WebAuthNEncodeGetAssertionResponse(
    _In_ PCWEBAUTHN_CTAPCBOR_GET_ASSERTION_RESPONSE pGetAssertionResponse,
    _Out_ DWORD* pcbResp,
    _Outptr_result_buffer_maybenull_(*pcbResp) BYTE** ppbResp
    );

typedef void (CALLBACK* WEBAUTHN_PLUGIN_STATUS_CHANGE_CALLBACK )(void* context);

HRESULT
WINAPI
WebAuthNPluginRegisterStatusChangeCallback(
    _In_ WEBAUTHN_PLUGIN_STATUS_CHANGE_CALLBACK callback,
    _In_ void* context,
    _In_ REFCLSID rclsid,
    _Out_ DWORD* pdwRegister
    );

HRESULT
WINAPI
WebAuthNPluginUnregisterStatusChangeCallback(
    _In_ DWORD* pdwRegister
    );


#ifdef __cplusplus
}       // Balance extern "C" above
#endif

#endif // WINAPI_FAMILY_PARTITION
#pragma endregion