supabase / supabase-flutter / 27546909655
92%

DEFAULT BRANCH: main
Ran
Jobs 8
Files 76
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.194% (+0.5%) from 84.678%
27546909655

push

github

web-flow 
feat(gotrue): add passkey (WebAuthn) support (#1392)

## What kind of change does this PR introduce?

Feature. Closes #1369.

Adds support for the Supabase Auth Passkeys (BETA) API (`/passkeys/*`
endpoints), mirroring the two-step `auth.passkey.*` API surface of
auth-js.

## What is the new behavior?

New `supabase.auth.passkey` namespace (`GoTruePasskeyApi`):

- `startRegistration()` / `verifyRegistration(challengeId:,
credential:)` to register a passkey for the signed-in user
- `startAuthentication(captchaToken:)` /
`verifyAuthentication(challengeId:, credential:)` to sign in with a
passkey; persists the session and fires `AuthChangeEvent.signedIn`
- `list()`, `update(passkeyId:, friendlyName:)`, `delete(passkeyId:)`
for management

New `supabase.auth.admin.passkey` namespace (`GoTrueAdminPasskeyApi`)
with `listPasskeys(userId:)` and `deletePasskey(userId:, passkeyId:)`.

Supporting changes:

- New types: `Passkey`, `PasskeyRegistrationOptionsResponse`,
`PasskeyAuthenticationOptionsResponse`
- PATCH support in `GotrueFetch` (used by the passkey rename endpoint)
- `FactorType.webauthn`, a `webauthn` bucket in `mfa.listFactors()`,
`AMRMethod.passkey` and `AMRMethod.mfaWebauthn`
- New server error codes in `ErrorCode` (`passkey_disabled`,
`webauthn_*`, `mfa_webauthn_*`, `too_many_passkeys`)

## Design notes

- The native WebAuthn ceremony (FaceID/TouchID/security key prompt) is
left to the app via a platform plugin (e.g. `credential_manager`, or
`navigator.credentials` on web). Options and credentials are exchanged
as `Map<String, dynamic>` in the W3C WebAuthn L3 JSON format, which is
what those plugins accept and produce. This matches the two-step
`auth.passkey.start*/verify*` API in auth-js; its one-call
`signInWithPasskey()` performs the ceremony in-browser, which a pure
Dart package cannot do cross-platform. A high-level helper on top of a
pluggable authenticator interface is a possible follow-up, as is the
separate MFA WebAuthn factor flow.
- auth... (continued)

4022 of 4721 relevant lines covered (85.19%)

3.48 hits per line

Coverage Regressions

Lines Coverage ∆ File
123
70.52
0.05% packages/gotrue/lib/src/gotrue_client.dart
17
66.67
1.45% packages/gotrue/lib/src/types/mfa.dart
5
93.67
0.34% packages/gotrue/lib/src/gotrue_admin_api.dart
3
0.0
0.0% packages/gotrue/lib/src/types/error_code.dart
2
97.65
0.12% packages/gotrue/lib/src/gotrue_mfa_api.dart
1
93.02
0.17% packages/gotrue/lib/src/fetch.dart
Jobs
ID Job ID Ran Files Coverage
6 supabase_flutter - 27546909655.6 7
78.57
GitHub Action Run
7 gotrue - 27546909655.7 26
81.87
GitHub Action Run
8 supabase - 27546909655.8 15
88.62
GitHub Action Run
7 functions_client - 27544768443.7 2
97.1
GitHub Action Run
5 realtime_client - 27544768443.5 11
87.65
GitHub Action Run
2 storage_client - 27544768443.2 5
93.01
GitHub Action Run
8 yet_another_json_isolate - 27544768443.8 1
79.03
GitHub Action Run
6 postgrest - 27544768443.6 9
83.74
GitHub Action Run
Source Files on build 27546909655