Add new isPasskeyPlatformAuthenticatorAvailable()

[MasterKale]

Describe the issue

w3c/webauthn#1901 is adding a new PublicKeyCredential.isPasskeyPlatformAuthenticatorAvailable() to offer RP's a signal that users will likely be able to use a passkey via the local platform authenticator, or via hybrid authentication.

Reproduction Steps

N/A

Expected behavior

N/A

Code Samples + WebAuthn Options and Responses

N/A

Dependencies

N/A

SimpleWebAuthn Libraries

N/A

Additional context

N/A

[MasterKale]

Update: this method is being removed from WebAuthn in w3c/webauthn#1936, but there's no reason I couldn't still add a method of this name to this project using the proposed getClientCapabilities() API that's being proposed in w3c/webauthn#1923.

[bschoenmaeckers]

Is the return value going to be undefined when passkeyPlatformAuthenticator is not present in getClientCapabilities()?

[MasterKale]

Is the return value going to be undefined when passkeyPlatformAuthenticator is not present in getClientCapabilities()?

Hello @bschoenmaeckers that's a good question. I'm inclined to keep the method a binary yes/no. Based on possible return values for getClientCapabilities()...

When the value for a given capability is true, the feature is known to be currently supported by the client. When the value for a given capability is false, the feature is known to be not currently supported by the client. When a capability does not exist as a key, the availability of the client feature is not known.

...false or undefined for passkeyPlatformAuthenticator are not positive signals it's available. Thus in my mind whatever I'd do if the signal was true, I'd not do it if the signal was not true. This seems like a simplified way of handling the signal that'd probably work the majority of use cases. For use cases that come up in which mapping undefined to false is undesirable, that specific RP could leverage getClientCapabilities() directly to get the additional fidelity of knowing whether passkeyPlatformAuthenticator was truly false or actually undefined.

How does that sound?

[MasterKale]

Having said that, getClientCapabilities() is pretty easy to use on its own, so there may not be a need for me to do anything here after all 🤔

[timcappalli]

How about canUsePasskeys(): boolean?

If getClientCapabilities() isn't available, or returns undefined, but isUserVerifyingPlatformAuthenticatorAvailable() returns true, this can return true as well.