supabase / supabase-swift / 27678645985

81%

Build Type

push

github

Committed by web-flow

Commit Message

feat(auth): add WebAuthn/passkey support (#1013)

* feat(auth): add WebAuthn/passkey support

Add WebAuthn as a second factor (MFA) and first-factor passkey
authentication. Includes native AuthenticationServices ceremony helpers
(signInWithPasskey, registerPasskey, enrollWebAuthnFactor,
verifyWebAuthnFactor) for iOS 16+/macOS 13+, plus lower-level
options/verify methods, passkey CRUD, new types and error codes.

WebAuthn credential payloads are encoded without the snake_case strategy
so W3C field names (clientDataJSON, attestationObject, ...) reach the
backend verbatim.

Linear: SDK-839

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(auth): gate WebAuthn/passkey API behind @_spi(Experimental)

WebAuthn/passkey support is experimental — the first-factor /passkeys/* contract
in particular is inferred and may change. Mark the whole surface (types, passkey
methods, MFA ceremony helpers, the webauthn members on MFAChallengeParams /
MFAVerifyParams / AuthMFAChallengeResponse / AuthMFAListFactorsResponse, and the
5 error codes) as @_spi(Experimental), re-exported through the Supabase umbrella.

Consumers opt in with `@_spi(Experimental) import Supabase`. The stable TOTP/phone
MFA API is unchanged. Keeping it out of the public API surface lets the inferred
contract evolve without breaking-API friction.

Linear: SDK-839

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(auth): keep MFAVerifyParams.code non-optional for API stability

Reverting `code` to a non-optional `String` (it had become `String?` to support the
experimental webauthn verify init) avoids a breaking public-API change flagged by the
API-stability check. The webauthn init sets `code = ""`; that path builds its request
body manually via `encodeWebAuthnBody`, so `code` is never encoded for webauthn.

Linear: SDK-839

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(integration): grant table permissions to anon/authenticated

The integration-test s... (continued)

Coverage Stats

237 of 365 new or added lines in 7 files covered. (64.93%)

21 existing lines in 1 file now uncovered.

7489 of 9244 relevant lines covered (81.01%)

36.93 hits per line