Add WebAuthn authentication credential registration endpoints and schemas

[KaveeshaPiumini]

This pull request adds support for WebAuthn (Passkey) credential registration to the Authentication API specification. It introduces new endpoints for starting and finishing WebAuthn registration, along with the necessary request and response schemas. These changes enable clients to register public-key credentials for passwordless authentication flows.

API endpoint additions:

• Added POST /auth/webauthn/register/start endpoint to initiate WebAuthn/Passkey credential creation for a user, including request/response models and detailed client and server error handling (e.g., empty user ID, user not found).
• Added POST /auth/webauthn/register/finish endpoint to complete WebAuthn/Passkey credential creation using the attestation response from the authenticator, with granular error responses for invalid or missing fields (credential ID, credential type, attestation response, session token), attestation verification failures, and user-not-found conditions.

Schema additions for WebAuthn:

• Introduced WebAuthnRegisterStartRequest and WebAuthnRegisterStartResponse to model the initiation of the registration ceremony, including relying party metadata, authenticator selection criteria, and publicKeyCredentialCreationOptions as per the WebAuthn specification, along with a session_token to bind the registration flow.

• Added WebAuthnRegisterFinishRequest to capture the PublicKeyCredential attestation payload (credential IDs, attestation object, clientDataJSON, transports, and authenticator attachment) together with the registration session_token and an optional user-friendly credential_name.

• Defined WebAuthnRegisterFinishResponse to return information about the successfully registered credential, including its credential_id, credential_name, and created_at timestamp.

Related Issue

• Add Passkey-Based Authentication #610

[Copilot]

Pull request overview

This pull request adds WebAuthn (Passkey) credential registration endpoints to the WIP Authentication API specification. The changes introduce a two-step registration flow (start/finish) following the WebAuthn standard, enabling clients to register public-key credentials for passwordless authentication.

Key Changes

• Added /auth/webauthn/register/start and /auth/webauthn/register/finish endpoints for the credential registration ceremony
• Introduced comprehensive request/response schemas that align with the WebAuthn W3C specification
• Defined detailed error responses covering validation failures and attestation verification issues

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.22%. Comparing base (66316d6) to head (6c27f56).
⚠️ Report is 41 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #838      +/-   ##
==========================================
+ Coverage   86.21%   87.22%   +1.00%     
==========================================
  Files         221      302      +81     
  Lines       21414    24052    +2638     
  Branches        0      606     +606     
==========================================
+ Hits        18463    20979    +2516     
+ Misses       1924     1891      -33     
- Partials     1027     1182     +155     

Flag	Coverage Δ
backend-integration-postgres	58.79% <ø> (+0.32%)	⬆️
backend-integration-sqlite	58.75% <ø> (+0.32%)	⬆️
backend-unit	73.28% <ø> (+1.78%)	⬆️
frontend-apps-develop-unit	88.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ThaminduDilshan]

Shall we move this to a separate spec file? Registration shouldn't be in authentication spec

[ThaminduDilshan]

Suggested change

	/auth/webauthn/register/start:
	/register/webauthn/start:

@darshanasbg WDYT about the API path?

[ThaminduDilshan]

Suggested change

	/auth/webauthn/register/finish:
	/register/webauthn/finish:

[ThaminduDilshan]

Suggested change

	WebAuthnRegisterStartRequest:
	WebAuthnRegistrationStartRequest:

[ThaminduDilshan]

Suggested change

	WebAuthnRegisterStartResponse:
	WebAuthnRegistrationStartResponse:

[ThaminduDilshan]

Let's stick to the system wide server error (SSE-5000). Keep in mind for the implementation as well.

thunder/backend/internal/system/error/serviceerror/error.go

Line 57 in e740972

InternalServerError = ServiceError{

[ThaminduDilshan]

Suggested change

	WebAuthnRegisterFinishRequest:
	WebAuthnRegistrationFinishRequest:

[ThaminduDilshan]

Suggested change

	WebAuthnRegisterFinishResponse:
	WebAuthnRegistrationFinishResponse:

[ThaminduDilshan]

We're using both camel case and snake case in the payloads. Is it due to how these fields are returned from the browser APIs? If not, better to stick to a single format.

Applicable to other places as well

[KaveeshaPiumini]

publicKeyCredentialCreationOptions and publicKeyCredential are in camel case because the browser's native function navigator.credentials.create(options) expects a JavaScript object with exact property names defined by the W3C specification.