== Deep-Dive

=== Project Modules

WebAuthn4J consists of the following four modules.

==== Core webauthn4j-core.jar

Provides core features for attestation and assertion verification.

==== Metadata webauthn4j-metadata.jar

Provides additional features regarding FIDO Metadata Service.
As FIDO Metadata Statement specification is still draft, it is in experimental status.
The included classes don't follow semantic versioning and the design may be changed even though it is public.

==== Test webauthn4j-test.jar

Internal library for WebAuthn4J testing. The included classes don't follow semantic versioning and the design
may be changed even though it is public.

==== Util webauthn4j-util.jar

Contains utility classes used in WebAuthn4J library.

=== Custom converter implementation

WebAuthn4J uses Jackson library for JSON and CBOR serialization and deserialization.
If you would like to custom serialization or deserialization, register custom serializer or deserializer to the
underlying Jackson `ObjectMapper`.

==== Custom converter registration

Since WebAuthn4J wraps `ObjectMapper` with `ObjectConverter`, inject your customized `ObjectMapper` through `ObjectConverter`
constructor and specify the `ObjectConverter` instance to the `WebAuthnManager` instance creation parameter.

=== Custom validator implementation

WebAuthn4J can add custom validator.
For registration validation, implement `CustomRegistrationValidator`.
For authentication validation, implement `CustomAuthenticationValidator`.

==== Custom validator registration

`CustomRegistrationValidator` and `CustomAuthenticationValidator` implementation can be registered to `WebAuthnManager`
via its constructor's `customRegistrationValidators` and `customAuthenticationValidators` parameters.

=== Classes

==== Data Transfer Objects

Classes under `com.webauthn4j.data` package are designed as immutable DTO.

==== Converter, Jackson Modules for WebAuthn

Classes under `com.webauthn4j.data` package are designed as being serializable and deserializable.

Some Classes under `converter` package needs custom serializer and deserializer. Jackson's module named
`WebAuthnJSONModule` and `WebAuthnCBORModule` consolidate these custom serializer and deserializer.
WebAuthn4J’s validators register these modules onto Jackson's `ObjectMapper` automatically.

If you want to use WebAuthn4J’s serializer and deserializer outside of WebAuthnManager,
you can register these modules onto Jackson's `ObjectMapper`.

==== TrustAnchorsResolver

`TrustAnchorsResolver` interface is used by `TrustAnchorCertPathTrustworthinessValidator` to explore root certificates
in the verification of the authenticity of the attestation statements.

==== TrustAnchorsProvider

`TrustAnchorsProvider` is an interface that `TrustAnchorsResolverImpl` delegates TrustAnchor load operation to.
KeyStoreFileTrustAnchorsProvider is provided as an implementation for loading TrustAnchor from Java Key Store file.
Spring Security WebAuthn also provides `CertFileResourcesTrustAnchorProvider` to load TrustAnchor from Spring Resource.

==== Exceptions

If some verification fails, WebAuthn4J throws an exception class inheriting `ValidationException`.

=== Logging

WebAuthn4J uses SLF4J as log interface library. You can use any kind of this implementation like Logback as you want.

