supabase / supabase-flutter / 27546909655

85%

push

github

feat(gotrue): add passkey (WebAuthn) support (#1392)

## What kind of change does this PR introduce?

Feature. Closes #1369.

Adds support for the Supabase Auth Passkeys (BETA) API (`/passkeys/*`
endpoints), mirroring the two-step `auth.passkey.*` API surface of
auth-js.

## What is the new behavior?

New `supabase.auth.passkey` namespace (`GoTruePasskeyApi`):

- `startRegistration()` / `verifyRegistration(challengeId:,
credential:)` to register a passkey for the signed-in user
- `startAuthentication(captchaToken:)` /
`verifyAuthentication(challengeId:, credential:)` to sign in with a
passkey; persists the session and fires `AuthChangeEvent.signedIn`
- `list()`, `update(passkeyId:, friendlyName:)`, `delete(passkeyId:)`
for management

New `supabase.auth.admin.passkey` namespace (`GoTrueAdminPasskeyApi`)
with `listPasskeys(userId:)` and `deletePasskey(userId:, passkeyId:)`.

Supporting changes:

- New types: `Passkey`, `PasskeyRegistrationOptionsResponse`,
`PasskeyAuthenticationOptionsResponse`
- PATCH support in `GotrueFetch` (used by the passkey rename endpoint)
- `FactorType.webauthn`, a `webauthn` bucket in `mfa.listFactors()`,
`AMRMethod.passkey` and `AMRMethod.mfaWebauthn`
- New server error codes in `ErrorCode` (`passkey_disabled`,
`webauthn_*`, `mfa_webauthn_*`, `too_many_passkeys`)

## Design notes

- The native WebAuthn ceremony (FaceID/TouchID/security key prompt) is
left to the app via a platform plugin (e.g. `credential_manager`, or
`navigator.credentials` on web). Options and credentials are exchanged
as `Map<String, dynamic>` in the W3C WebAuthn L3 JSON format, which is
what those plugins accept and produce. This matches the two-step
`auth.passkey.start*/verify*` API in auth-js; its one-call
`signInWithPasskey()` performs the ceremony in-browser, which a pure
Dart package cannot do cross-platform. A high-level helper on top of a
pluggable authenticator interface is a possible follow-up, as is the
separate MFA WebAuthn factor flow.
- auth... (continued)

147 of 147 new or added lines in 7 files covered. (100.0%)

4022 of 4721 relevant lines covered (85.19%)

3.48 hits per line