Android: native Capacitor bridge to CredentialManager for passkeys#30
Merged
Merged
Conversation
Android System WebView does not back WebAuthn even though it exposes
navigator.credentials, so the existing JS path fails inside the
Capacitor wrapper and the user lands on the "Passkeys aren't available
in this webview" error. Add a tempest-passkey-bridge Capacitor plugin
that wraps androidx.credentials.CredentialManager.createCredential and
getCredential, and route the web-side ceremony through it whenever
Capacitor.isNativePlatform() is true. Browsers and the desktop shell
keep using navigator.credentials.
Render /.well-known/assetlinks.json on tempest-web at container start
from ANDROID_PACKAGE_NAME and ANDROID_ASSETLINKS_SHA256, so the RP
origin can authorize the Android app for passkey requests. The Android
workflow now prints the signing cert SHA-256 from each assembled APK
so the value can be pasted into the env. RAILWAY.md documents the env
vars; scripts/android-cert-sha.sh extracts the SHA from any APK or
keystore locally.
iOS does not need a native bridge because WKWebView ships WebAuthn
from iOS 16; the iOS plugin is a stub that reports unavailable so the
JS path stays in charge.
Anchor /android/ and /ios/ in apps/mobile/.gitignore so the
auto-scaffolded Capacitor projects stay ignored but the plugin source
under apps/mobile/plugins/passkey-bridge/{android,ios}/ is tracked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Android System WebView does not back WebAuthn even though it exposes
navigator.credentials, so the existing JS path fails inside the
Capacitor wrapper and the user lands on the "Passkeys aren't available
in this webview" error. Add a tempest-passkey-bridge Capacitor plugin
that wraps androidx.credentials.CredentialManager.createCredential and
getCredential, and route the web-side ceremony through it whenever
Capacitor.isNativePlatform() is true. Browsers and the desktop shell
keep using navigator.credentials.
Render /.well-known/assetlinks.json on tempest-web at container start
from ANDROID_PACKAGE_NAME and ANDROID_ASSETLINKS_SHA256, so the RP
origin can authorize the Android app for passkey requests. The Android
workflow now prints the signing cert SHA-256 from each assembled APK
so the value can be pasted into the env. RAILWAY.md documents the env
vars; scripts/android-cert-sha.sh extracts the SHA from any APK or
keystore locally.
iOS does not need a native bridge because WKWebView ships WebAuthn
from iOS 16; the iOS plugin is a stub that reports unavailable so the
JS path stays in charge.
Anchor /android/ and /ios/ in apps/mobile/.gitignore so the
auto-scaffolded Capacitor projects stay ignored but the plugin source
under apps/mobile/plugins/passkey-bridge/{android,ios}/ is tracked.