Add API support for Passkeys

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/Auth.kt

@@ -13,6 +13,7 @@ import io.github.jan.supabase.auth.exception.TokenExpiredException
 import io.github.jan.supabase.auth.jwt.ClaimsRequestBuilder
 import io.github.jan.supabase.auth.jwt.ClaimsResponse
 import io.github.jan.supabase.auth.mfa.MfaApi
+import io.github.jan.supabase.auth.passkey.AuthPasskeyApi
 import io.github.jan.supabase.auth.providers.AuthProvider
 import io.github.jan.supabase.auth.providers.ExternalAuthConfigDefaults
 import io.github.jan.supabase.auth.providers.Google
@@ -85,10 +86,16 @@ interface Auth : MainPlugin<AuthConfig>, CustomSerializationPlugin {
     val admin: AdminApi
 
     /**
-     * Access to the mfa api where you can manage multi-factor authentication for the current user.
+     * Access to the [MfaApi] where you can manage multi-factor authentication for the current user.
      */
     val mfa: MfaApi
 
+    /**
+     * Access to the [AuthPasskeyApi] where you can manage the user's passkeys
+     */
+    @SupabaseExperimental
+    val passkeys: AuthPasskeyApi
+
     /**
      * The cache for the code verifier. This is used for PKCE authentication. Can be customized via [AuthConfig.codeVerifierCache]
      */

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/AuthImpl.kt

@@ -29,6 +29,8 @@ import io.github.jan.supabase.auth.jwt.ecdsaRawToDer
 import io.github.jan.supabase.auth.jwt.rsaJwkToDer
 import io.github.jan.supabase.auth.mfa.MfaApi
 import io.github.jan.supabase.auth.mfa.MfaApiImpl
+import io.github.jan.supabase.auth.passkey.AuthPasskeyApi
+import io.github.jan.supabase.auth.passkey.AuthPasskeyApiImpl
 import io.github.jan.supabase.auth.providers.AuthProvider
 import io.github.jan.supabase.auth.providers.ExternalAuthConfigDefaults
 import io.github.jan.supabase.auth.providers.IDTokenProvider
@@ -122,6 +124,9 @@ internal class AuthImpl(
     internal val userApi = if(config.requireValidSession) supabaseClient.authenticatedSupabaseApi(this) else publicApi
     override val admin: AdminApi = AdminApiImpl(publicApi)
     override val mfa: MfaApi = MfaApiImpl(userApi.resolve("factors"), this)
+    override val passkeys: AuthPasskeyApi = AuthPasskeyApiImpl(userApi.resolve("passkeys")) {
+        importSession(it)
+    }
     var sessionJob: Job? = null
     var refreshInformation: SessionRefreshInformation? = null
     override val isAutoRefreshRunning: Boolean

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/AuthPasskeyApi.kt

@@ -0,0 +1,122 @@
+package io.github.jan.supabase.auth.passkey
+
+import io.github.jan.supabase.auth.api.AuthenticatedSupabaseApi
+import io.github.jan.supabase.auth.user.UserSession
+import io.github.jan.supabase.safeBody
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import kotlinx.serialization.json.putJsonObject
+
+/**
+ * Interface for interacting with the Supabase Passkey API
+ */
+interface AuthPasskeyApi {
+
+    /**
+     * Start passkey registration for the current authenticated user.
+     */
+    suspend fun startRegistration(): PasskeyRegistrationResponse
+
+    /**
+     * Verify passkey registration with the credential response.
+     * @param challengeId Challenge ID from startRegistration
+     * @param credential Serialized credential
+     */
+    suspend fun verifyRegistration(challengeId: String, credential: String): PasskeyRegistrationVerifyResponse
+
+    /**
+     * Start passkey authentication.
+     * @param builder Extra parameters like a captcha token
+     */
+    suspend fun startAuthentication(builder: PasskeyAuthenticationBuilder.() -> Unit = {}): PasskeyAuthenticationOptionsResponse
+
+    /**
+     * Verify passkey authentication and create a session.
+     * @param challengeId Challenge ID from startAuthentication
+     * @param credential Serialized credential
+     */
+    suspend fun verifyAuthentication(challengeId: String, credential: String): UserSession
+
+    /**
+     * List all passkeys for the current user.
+     */
+    suspend fun list(): List<PasskeyListItem>
+
+    /**
+     * Update a passkey.
+     * @param passkeyId UUID of the passkey to delete
+     */
+    suspend fun delete(passkeyId: String)
+
+    /**
+     * Delete a passkey.
+     * @param passkeyId UUID of the passkey to update
+     * @param friendlyName New friendly name (max 120 chars)
+     */
+    suspend fun update(passkeyId: String, friendlyName: String): PasskeyListItem
+
+}
+
+internal class AuthPasskeyApiImpl(
+    private val api: AuthenticatedSupabaseApi,
+    private val saveSession: suspend (UserSession) -> Unit,
+): AuthPasskeyApi {
+
+    override suspend fun startRegistration(): PasskeyRegistrationResponse {
+        val result = api.post("registration/options")
+        return result.safeBody()
+    }
+
+    override suspend fun verifyRegistration(
+        challengeId: String,
+        credential: String
+    ): PasskeyRegistrationVerifyResponse {
+        return api.postJson("registration/verify", buildJsonObject {
+            put("challenge_id", challengeId)
+            put("credential", Json.decodeFromString(credential))
+        }).safeBody()
+    }
+
+    override suspend fun startAuthentication(builder: PasskeyAuthenticationBuilder.() -> Unit): PasskeyAuthenticationOptionsResponse {
+        return api.postJson("authentication/options", buildJsonObject {
+            val builder = PasskeyAuthenticationBuilder().apply(builder)
+            builder.captchaToken?.let {
+                putJsonObject("gotrue_meta_security") {
+                    put("captcha_token", it)
+                }
+            }
+        }).safeBody()
+    }
+
+    override suspend fun verifyAuthentication(
+        challengeId: String,
+        credential: String
+    ): UserSession {
+        return api.postJson("authentication/verify", buildJsonObject {
+            put("challenge_id", challengeId)
+            put("credential", Json.decodeFromString(credential))
+        }).safeBody<UserSession>().also {
+            saveSession(it)
+        }
+    }
+
+    override suspend fun list(): List<PasskeyListItem> {
+        return api.get("").safeBody()
+    }
+
+    override suspend fun delete(passkeyId: String) {
+        api.delete(passkeyId)
+    }
+
+    override suspend fun update(
+        passkeyId: String,
+        friendlyName: String
+    ): PasskeyListItem {
+        return api.patchJson(passkeyId, buildJsonObject {
+            put("friendly_name", friendlyName)
+        }).safeBody()
+    }
+
+
+}

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/PasskeyAuthenticationBuilder.kt

@@ -0,0 +1,9 @@
+package io.github.jan.supabase.auth.passkey
+
+/**
+ * Builder for [AuthPasskeyApi.startAuthentication]
+ * @param captchaToken An optional captcha token for the authentication
+ */
+data class PasskeyAuthenticationBuilder(
+    var captchaToken: String? = null
+)

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/PasskeyAuthenticationOptionsResponse.kt

@@ -0,0 +1,20 @@
+package io.github.jan.supabase.auth.passkey
+
+import io.github.jan.supabase.serializer.UnixTimestampSerializer
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonObject
+import kotlin.time.Instant
+
+/**
+ * The response for [AuthPasskeyApi.startAuthentication]
+ * @param challengeId The challenge id
+ * @param options Server options
+ * @param expiresAt When the authentication session expires
+ */
+@Serializable
+data class PasskeyAuthenticationOptionsResponse(
+    @SerialName("challenge_id") val challengeId: String,
+    val options: JsonObject,
+    @SerialName("expires_at") @Serializable(UnixTimestampSerializer::class) val expiresAt: Instant
+)

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/PasskeyListItem.kt

@@ -0,0 +1,20 @@
+package io.github.jan.supabase.auth.passkey
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlin.time.Instant
+
+/**
+ * A passkey item for [AuthPasskeyApi.list]
+ * @param id The uuid for the passkey
+ * @param friendlyName The friendly name of the passkey
+ * @param createdAt When the passkey was created at
+ * @param lastUsedAt When the passkey was last used at
+ */
+@Serializable
+data class PasskeyListItem(
+    val id: String,
+    @SerialName("friendly_name") val friendlyName: String? = null,
+    @SerialName("created_at") val createdAt: Instant,
+    @SerialName("last_used_at") val lastUsedAt: Instant? = null
+)

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/PasskeyRegistrationResponse.kt

@@ -0,0 +1,19 @@
+package io.github.jan.supabase.auth.passkey
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonObject
+import kotlin.time.Instant
+
+/**
+ * Response for [AuthPasskeyApi.startRegistration]
+ * @param challengeId The challenge id
+ * @param options The server options
+ * @param expiresAt When the registration expires at
+ */
+@Serializable
+data class PasskeyRegistrationResponse(
+    @SerialName("challenge_id") val challengeId: String,
+    val options: JsonObject,
+    @SerialName("expires_at") val expiresAt: Instant
+)

Auth/src/commonMain/kotlin/io/github/jan/supabase/auth/passkey/PasskeyRegistrationVerifyResponse.kt

@@ -0,0 +1,18 @@
+package io.github.jan.supabase.auth.passkey
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlin.time.Instant
+
+/**
+ * Response for [AuthPasskeyApi.verifyRegistration]
+ * @param id The uuid of the passkey
+ * @param friendlyName The friendly name of the passkey
+ * @param createdAt When the passkey was created at
+ */
+@Serializable
+data class PasskeyRegistrationVerifyResponse(
+    val id: String,
+    @SerialName("friendly_name") val friendlyName: String? = null,
+    @SerialName("created_at") val createdAt: Instant
+)