Deprecate Android SafetyNet support (#585)

* Deprecate Android SafetyNet support The Android SafetyNet support is marked as deprecated starting from version 4.9.0 and will be completely removed in version 5.0.0. This includes key verification classes, configuration options, and dependencies. This decision arises from updates in the latest symfony and webauthn environments.
web-auth · Apr 9, 2024 · 19dd122 · 19dd122
1 parent c0c9641
commit 19dd122
Show file tree

Hide file tree

Showing 7 changed files with 49 additions and 1 deletion.
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
@@ -860,6 +860,14 @@ parameters:
 			count: 4
 			path: src/symfony/src/DependencyInjection/Configuration.php
 
+		-
+			message: """
+				#^Call to deprecated method addAndroidSafetynetConfig\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Configuration\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/Configuration.php
+
 		-
 			message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeParentInterface\\:\\:scalarNode\\(\\)\\.$#"
 			count: 1
@@ -1030,6 +1038,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/DependencyInjection/Factory/Security/WebauthnFactory.php
 
+		-
+			message: """
+				#^Call to deprecated method loadAndroidSafetyNet\\(\\) of class Webauthn\\\\Bundle\\\\DependencyInjection\\\\WebauthnExtension\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/DependencyInjection/WebauthnExtension.php
+
 		-
 			message: "#^Cannot access offset 'failure_handler' on mixed\\.$#"
 			count: 4
@@ -1241,6 +1257,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Repository/PublicKeyCredentialSourceRepository.php
 
+		-
+			message: """
+				#^Fetching class constant class of deprecated class Webauthn\\\\AttestationStatement\\\\AndroidSafetyNetAttestationStatementSupport\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/Resources/config/android_safetynet.php
+
 		-
 			message: """
 				#^Fetching class constant class of deprecated class Webauthn\\\\PublicKeyCredentialLoader\\:
@@ -1768,6 +1792,14 @@ parameters:
 			count: 1
 			path: src/symfony/src/Service/PublicKeyCredentialRequestOptionsFactory.php
 
+		-
+			message: """
+				#^Instantiation of deprecated class Webauthn\\\\Bundle\\\\DependencyInjection\\\\Compiler\\\\EnforcedSafetyNetApiKeyVerificationCompilerPass\\:
+				since 4\\.9\\.0 and will be removed in 5\\.0\\.0\\. Android SafetyNet is now deprecated\\.$#
+			"""
+			count: 1
+			path: src/symfony/src/WebauthnBundle.php
+
 		-
 			message: "#^Method Webauthn\\\\Bundle\\\\WebauthnBundle\\:\\:getContainerExtension\\(\\) never returns null so it can be removed from the return type\\.$#"
 			count: 1

diff --git a/...fony/src/DependencyInjection/Compiler/EnforcedSafetyNetApiKeyVerificationCompilerPass.php b/...fony/src/DependencyInjection/Compiler/EnforcedSafetyNetApiKeyVerificationCompilerPass.php
@@ -9,6 +9,9 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Webauthn\AttestationStatement\AndroidSafetyNetAttestationStatementSupport;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class EnforcedSafetyNetApiKeyVerificationCompilerPass implements CompilerPassInterface
 {
     public function process(ContainerBuilder $container): void

diff --git a/src/symfony/src/DependencyInjection/Configuration.php b/src/symfony/src/DependencyInjection/Configuration.php
@@ -456,10 +456,14 @@ private function addMetadataConfig(ArrayNodeDefinition $rootNode): void
             ->end();
     }
 
+    /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+     */
     private function addAndroidSafetynetConfig(ArrayNodeDefinition $rootNode): void
     {
         $rootNode->children()
             ->arrayNode('android_safetynet')
+                ->setDeprecated('web-auth/webauthn-symfony-bundle', '4.9.0', 'Android SafetyNet is now deprecated.')
                 ->addDefaultsIfNotSet()
                 ->info('Additional configuration options for the Android SafetyNet attestation.')
                 ->children()

diff --git a/src/symfony/src/DependencyInjection/WebauthnExtension.php b/src/symfony/src/DependencyInjection/WebauthnExtension.php
@@ -357,6 +357,7 @@ private function loadRequestControllersSupport(ContainerBuilder $container, arra
     }
 
     /**
+     * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
      * @param mixed[] $config
      */
     private function loadAndroidSafetyNet(ContainerBuilder $container, FileLoader $loader, array $config): void

diff --git a/src/symfony/src/Resources/config/android_safetynet.php b/src/symfony/src/Resources/config/android_safetynet.php
@@ -10,6 +10,7 @@
 use function Symfony\Component\DependencyInjection\Loader\Configurator\param;
 use function Symfony\Component\DependencyInjection\Loader\Configurator\service;
 
+//TODO >=5.0.0: Remove this file
 return static function (ContainerConfigurator $container): void {
     $container = $container->services()
         ->defaults()
@@ -19,6 +20,11 @@
     if (class_exists(JWKFactory::class) && class_exists(RS256::class)) {
         $container
             ->set(AndroidSafetyNetAttestationStatementSupport::class)
+            ->deprecate(
+                'web-auth/webauthn-symfony-bundle',
+                '4.9.0',
+                'The "%service_id%" service is deprecated and will be removed in version 5.0.0. Android SafetyNet is now deprecated.'
+            )
             ->args([service(ClockInterface::class)->nullOnInvalid()])
             ->call('setMaxAge', [param('webauthn.android_safetynet.max_age')])
             ->call('setLeeway', [param('webauthn.android_safetynet.leeway')]);

diff --git a/src/webauthn/composer.json b/src/webauthn/composer.json
@@ -51,7 +51,6 @@
         "symfony/property-info": "As of 4.5.x, the symfony/serializer component will become mandatory for converting objects such as the Metadata Statement",
         "phpdocumentor/reflection-docblock": "As of 4.5.x, the phpdocumentor/reflection-docblock component will become mandatory for converting objects such as the Metadata Statement",
         "psr/log-implementation": "Recommended to receive logs from the library",
-        "web-token/jwt-library": "Mandatory for the AndroidSafetyNet Attestation Statement support",
         "symfony/event-dispatcher": "Recommended to use dispatched events"
     }
 }
diff --git a/src/webauthn/src/AttestationStatement/AndroidSafetyNetAttestationStatementSupport.php b/src/webauthn/src/AttestationStatement/AndroidSafetyNetAttestationStatementSupport.php
@@ -43,6 +43,9 @@
 use function is_string;
 use const JSON_THROW_ON_ERROR;
 
+/**
+ * @deprecated since 4.9.0 and will be removed in 5.0.0. Android SafetyNet is now deprecated.
+ */
 final class AndroidSafetyNetAttestationStatementSupport implements AttestationStatementSupport, CanDispatchEvents
 {
     private ?string $apiKey = null;