passkey feature implementation

FirebaseAuth/Sources/Public/well-known/apple-app-site-association.json

@@ -0,0 +1,38 @@
+{
+  "applinks": {
+      "details": [
+           {
+             "appID": "EQHXZ8M8AV.com.google.firebaseAuthSDKSampleApp.dev",
+             "components": [
+               {
+                  "#": "no_universal_links",
+                  "exclude": true,
+                  "comment": "Matches any URL with a fragment that equals no_universal_links and instructs the system not to open it as a universal link."
+               },
+               {
+                  "/": "/buy/*",
+                  "comment": "Matches any URL with a path that starts with /buy/."
+               },
+               {
+                  "/": "/help/website/*",
+                  "exclude": true,
+                  "comment": "Matches any URL with a path that starts with /help/website/ and instructs the system not to open it as a universal link."
+               },
+               {
+                  "/": "/help/*",
+                  "?": { "articleNumber": "????" },
+                  "comment": "Matches any URL with a path that starts with /help/ and that has a query item with name 'articleNumber' and a value of exactly four characters."
+               }
+             ]
+           }
+       ]
+   },
+   "webcredentials": {
+      "apps": [ "EQHXZ8M8AV.com.google.firebaseAuthSDKSampleApp.dev" ]
+   },
+
+
+    "appclips": {
+        "apps": ["EQHXZ8M8AV.com.google.firebaseAuthSDKSampleApp.dev.Clip"]
+    }
+}

FirebaseAuth/Sources/Swift/Auth/Auth.swift

@@ -18,6 +18,7 @@
 import FirebaseAuthInterop
 import FirebaseCore
 import FirebaseCoreExtension
+
 #if COCOAPODS
   internal import GoogleUtilities
 #else
@@ -28,6 +29,10 @@
 #if os(iOS) || os(tvOS) || targetEnvironment(macCatalyst)
   import UIKit
 #endif
+#if os(iOS) || os(tvOS) || os(macOS) || targetEnvironment(macCatalyst)
+    import AuthenticationServices
+#endif
+
 
 // Export the deprecated Objective-C defined globals and typedefs.
 #if SWIFT_PACKAGE
@@ -824,6 +829,62 @@
       }
     }
   }
+
+  let sessionId = "sessionId"
+
+  // MARK: Passkeys
+  @available(iOS 15.0, *)
+  public func startPasskeySignIn() async throws -> ASAuthorizationPlatformPublicKeyCredentialAssertionRequest {
+
+    let request = StartPasskeySignInRequest(
+      sessionId: sessionId,
+      requestConfiguration: requestConfiguration
+    )
+
+    let response = try await self.backend.startPasskeySignIn(request: request)
+
+    guard let challengeData = Data(base64Encoded: response.challenge ?? "nil") else {
+      throw NSError(domain: "com.firebase.auth", code: -3, userInfo: [NSLocalizedDescriptionKey: "Invalid challenge data"])
+    }
+
+    let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(
+      relyingPartyIdentifier: response.rpID ?? "fir-ios-auth-sample.web.app.com"
+    )
+    let assertionRequest = provider.createCredentialAssertionRequest(challenge: challengeData)
+
+    return assertionRequest
+  }
+
+  @available(iOS 15.0, *)
+  public func finalizePasskeySignIn(platformCredential: ASAuthorizationPlatformPublicKeyCredentialAssertion) async throws -> AuthDataResult {
+    guard let credentialID = platformCredential.credentialID.base64EncodedString(),
+          let clientDataJson = platformCredential.rawClientDataJSON.base64EncodedString(),
+          let authenticatorData = platformCredential.rawAuthenticatorData.base64EncodedString(),
+          let signature = platformCredential.signature.base64EncodedString(),
+          let userID = platformCredential.userID.base64EncodedString()
+    else {
+      throw NSError(domain: "com.firebase.auth", code: -4, userInfo: [NSLocalizedDescriptionKey: "Invalid platform credential data"])
+    }
+
+    let request = FinalizePasskeySignInRequest(credentialID: credentialID,
+                                               clientDataJson: clientDataJson,
+                                               authenticatorData: authenticatorData,
+                                               signature: signature,
+                                               userID: userID,
+                                               requestConfiguration: requestConfiguration)
+
+    let response = try await backend.finalizePasskeySignIn(request: request)
+
+    let user = try await completeSignIn(withAccessToken: response.idToken,
+                                        accessTokenExpirationDate: nil,
+                                        refreshToken: response.refreshToken,
+                                        anonymous: false)
+    let authDataResult = AuthDataResult(withUser: user, additionalUserInfo: nil)
+
+    try updateCurrentUser(user, byForce: false, savingToDisk: false)
+    return authDataResult
+  }
+
 
   /// Creates and, on success, signs in a user with the given email address and password.
   ///
@@ -2425,3 +2486,15 @@
   /// Mutations should occur within a @synchronized(self) context.
   private var listenerHandles: NSMutableArray = []
 }
+
+extension Data {
+    func base64EncodedString() -> String? {
+        return base64EncodedString()
+    }
+}
+
+extension String {
+    func base64EncodedString() -> String? {
+      return self.data(using: .utf8)?.base64EncodedString()
+    }
+}

FirebaseAuth/Sources/Swift/Backend/AuthBackend.swift

@@ -37,6 +37,39 @@ final class AuthBackend: AuthBackendProtocol {
   init(rpcIssuer: any AuthBackendRPCIssuerProtocol) {
     self.rpcIssuer = rpcIssuer
   }
+
+  public func startPasskeyEnrollment(request: StartPasskeyEnrollmentRequest) async throws -> StartPasskeyEnrollmentResponse {
+    guard #available(iOS 16.0, macOS 12.0, tvOS 16.0, *) else {
+      throw AuthErrorUtils.error(code: AuthErrorCode.operationNotAllowed, message: "OS version is not supported for this action.")
+    }
+    let response = try await call(with: request) as StartPasskeyEnrollmentResponse
+    return response
+  }
+
+  public func finalizePasskeyEnrollment(request: FinalizePasskeyEnrollmentRequest) async throws -> FinalizePasskeyEnrollmentResponse {
+    guard #available(iOS 16.0, macOS 12.0, tvOS 16.0, *) else {
+      throw AuthErrorUtils.error(code: AuthErrorCode.operationNotAllowed, message: "OS version is not supported for this action.")
+    }
+    let response = try await call(with: request) as FinalizePasskeyEnrollmentResponse
+    return response
+  }
+
+  public func startPasskeySignIn(request: StartPasskeySignInRequest) async throws -> StartPasskeySignInResponse {
+    guard #available(iOS 16.0, macOS 12.0, tvOS 16.0, *) else {
+      throw AuthErrorUtils.error(code: AuthErrorCode.operationNotAllowed, message: "OS version is not supported for this action.")
+    }
+    let response = try await call(with: request) as StartPasskeySignInResponse
+    return response
+  }
+
+  public func finalizePasskeySignIn(request: FinalizePasskeySignInRequest) async throws -> FinalizePasskeySignInResponse {
+    guard #available(iOS 16.0, macOS 12.0, tvOS 16.0, *) else{
+      throw AuthErrorUtils.error(code: AuthErrorCode.operationNotAllowed, message: "OS version is not supported for this action.")
+    }
+    let response = try await call(with: request) as FinalizePasskeySignInResponse
+    return response
+  }
+
 
   /// Calls the RPC using HTTP request.
   /// Possible error responses:

FirebaseAuth/Sources/Swift/Backend/RPC/FinalizePasskeyEnrollmentRequest.swift

@@ -0,0 +1,51 @@
+import Foundation
+/// Represents the request for the `finalizePasskeyEnrollment` endpoint.
+@available(iOS 13, *)
+class FinalizePasskeyEnrollmentRequest: IdentityToolkitRequest, AuthRPCRequest {
+  typealias Response = FinalizePasskeyEnrollmentResponse
+  var unencodedHTTPRequestBody: [String : AnyHashable]?
+
+  /// GCIP endpoint for finalizePasskeyEnrollment RPC.
+  let kFinalizePasskeyEnrollmentEndpoint = "accounts/passkeyEnrollment:finalize"
+
+
+  /// The raw user access token.
+  let idToken: String
+  //  name of user or passkey ?.?
+  let name: String
+  /// The credential ID.
+  var credentialID: String = "id"
+  /// The CollectedClientData object from the authenticator.
+  var clientDataJson: String = "clientDataJSON"
+  /// The attestation object from the authenticator.
+  var attestationObject: String = "response"
+
+  /// The request configuration.
+  let requestConfiguration: AuthRequestConfiguration?
+
+
+  /// Initializes a new `FinalizePasskeyEnrollmentRequest`.
+  ///
+  /// - Parameters:
+  ///   - IDToken: The raw user access token.
+  ///   - name: The passkey name.
+  ///   - credentialID: The credential ID.
+  ///   - clientDataJson: The CollectedClientData object from the authenticator.
+  ///   - attestationObject: The attestation object from the authenticator.
+  ///   - requestConfiguration: The request configuration.
+  init(idToken: String, name: String, credentialID: String, clientDataJson: String,
+       attestationObject: String, requestConfiguration: AuthRequestConfiguration) {
+    self.idToken = idToken
+    self.name = name
+    self.credentialID = credentialID
+    self.clientDataJson = clientDataJson
+    self.attestationObject = attestationObject
+    self.requestConfiguration = requestConfiguration
+    super.init(
+      endpoint: kFinalizePasskeyEnrollmentEndpoint,
+      requestConfiguration: requestConfiguration,
+      useIdentityPlatform: true
+    )
+  }
+}
+

FirebaseAuth/Sources/Swift/Backend/RPC/FinalizePasskeyEnrollmentResponse.swift

@@ -0,0 +1,28 @@
+import Foundation
+
+/// Represents the response from the `finalizePasskeyEnrollment` endpoint.
+@available(iOS 13, *)
+struct FinalizePasskeyEnrollmentResponse: AuthRPCResponse {
+
+    /// The ID token for the authenticated user.
+    public let idToken: String
+
+    /// The refresh token for the authenticated user.
+    public let refreshToken: String
+
+    private static let kIdTokenKey = "idToken"
+    private static let kRefreshTokenKey = "refreshToken"
+
+    /// Initializes a new `FinalizePasskeyEnrollmentResponse` from a dictionary.
+    ///
+    /// - Parameter dictionary: The dictionary containing the response data.
+    /// - Throws: An error if parsing fails.
+    public init(dictionary: [String: AnyHashable]) throws {
+        guard let idToken = dictionary[Self.kIdTokenKey] as? String,
+              let refreshToken = dictionary[Self.kRefreshTokenKey] as? String else {
+            throw AuthErrorUtils.unexpectedResponse(deserializedResponse: dictionary)
+        }
+        self.idToken = idToken
+        self.refreshToken = refreshToken
+    }
+}

FirebaseAuth/Sources/Swift/Backend/RPC/FinalizePasskeySignInRequest.swift

@@ -0,0 +1,43 @@
+import Foundation
+import AuthenticationServices
+
+/// Represents the request for the `finalizePasskeySignIn` endpoint.
+@available(iOS 13, *)
+class FinalizePasskeySignInRequest: IdentityToolkitRequest, AuthRPCRequest {
+  typealias Response = FinalizePasskeySignInResponse
+  var unencodedHTTPRequestBody: [String : AnyHashable]?
+
+
+  /// GCIP endpoint for finalizePasskeySignIn RPC.
+  private let finalizePasskeySignInEndpoint = "accounts/passkeySignIn:finalize"
+
+  /// The signature from the authenticator.
+  let signature: String
+  /// Identifier for the registered credential.
+  var credentialID: String = "id"
+  /// The CollectedClientData object from the authenticator.
+  var clientDataJSON: String = "clientDataJSON"
+  /// The AuthenticatorData from the authenticator.
+  var authenticatorData: String = "response"
+  /// The user ID.
+  let userID: String
+
+  /// Initializes a new `FinalizePasskeySignInRequest` with platform credential and request configuration.
+  ///
+  /// - Parameters:
+  ///   - credentialID: The credential ID.
+  ///   - clientDataJson: The CollectedClientData object from the authenticator.
+  ///   - authenticatorData: The AuthenticatorData from the authenticator.
+  ///   - signature: The signature from the authenticator.
+  ///   - userID: The user ID.
+  ///   - requestConfiguration: An object containing configurations to be added to the request.
+  init(credentialID: String, clientDataJson: String, authenticatorData: String, signature: String, userID: String, requestConfiguration: AuthRequestConfiguration) {
+
+    self.credentialID = credentialID
+    self.clientDataJSON = clientDataJson
+    self.authenticatorData = authenticatorData
+    self.signature = signature
+    self.userID = userID
+    super.init(endpoint: finalizePasskeySignInEndpoint, requestConfiguration: requestConfiguration, useIdentityPlatform: true)
+  }
+}

FirebaseAuth/Sources/Swift/Backend/RPC/FinalizePasskeySignInResponse.swift

@@ -0,0 +1,26 @@
+import Foundation
+
+/// Represents the response from the `finalizePasskeySignIn` endpoint.
+@available(iOS 13, *)
+struct FinalizePasskeySignInResponse: AuthRPCResponse {
+
+    /// The ID token for the authenticated user.
+    var idToken: String = "idToken"
+
+    /// The refresh token for the authenticated user.
+    var refreshToken: String = "refreshToken"
+
+
+    /// Initializes a new `FinalizePasskeySignInResponse` from a dictionary.
+    ///
+    /// - Parameter dictionary: The dictionary containing the response data.
+    /// - Throws: An error if parsing fails.
+    init(dictionary: [String: AnyHashable]) throws {
+      guard let idToken = dictionary[idToken] as? String,
+            let refreshToken = dictionary[refreshToken] as? String else {
+            throw AuthErrorUtils.unexpectedResponse(deserializedResponse: dictionary)
+        }
+        self.idToken = idToken
+        self.refreshToken = refreshToken
+    }
+}

FirebaseAuth/Sources/Swift/Backend/RPC/GetAccountInfoResponse.swift

@@ -91,6 +91,8 @@
     let phoneNumber: String?
 
     let mfaEnrollments: [AuthProtoMFAEnrollment]?
+
+    let enrolledPasskeys: [PasskeyInfo]?
 
     /// Designated initializer.
     /// - Parameter dictionary: The provider user info data from endpoint.
@@ -133,11 +135,21 @@
       } else {
         mfaEnrollments = nil
       }
+      if let passkeyEnrollmentData = dictionary["passkeyInfo"] as? [[String: AnyHashable]] {
+        var enrolledPasskeys = [PasskeyInfo]()
+        for passkeyInfoDict in passkeyEnrollmentData {
+          let passkeyInfo = PasskeyInfo(dictionary: passkeyInfoDict)
+          enrolledPasskeys.append(passkeyInfo)
+        }
+        self.enrolledPasskeys = enrolledPasskeys
+      } else {
+        self.enrolledPasskeys = nil
+      }
     }
   }
 
   /// The requested users' profiles.
   var users: [Self.User]?
 
   init(dictionary: [String: AnyHashable]) throws {
     guard let usersData = dictionary["users"] as? [[String: AnyHashable]] else {