Add WebAuthn passkey authentication

[akinin]

Summary

Add optional WebAuthn/passkey authentication to HomeUI while keeping the existing password login available as a recovery path.

Registered users can enroll and remove their own passkeys from the user edit dialog. The login page offers passkey authentication when WebAuthn is configured by the administrator. The implementation supports platform authenticators such as Touch ID, Windows Hello, and Android screen lock, as well as hardware security keys.

Motivation

Passkeys provide phishing-resistant authentication without requiring users to enter the controller password on every login. The feature is opt-in and does not change the default behavior of existing installations.

Forum discussion: https://support.wirenboard.com/t/webauthn-passkeys-wiren-board-homeui/41478

Implementation

• add backend registration and authentication ceremonies using python3-fido2;
• persist credentials and one-time challenges in the HomeUI database;
• validate RP ID, origin, challenge lifetime, credential ownership, and signature counters;
• add self-service passkey enrollment and removal to user settings;
• add passkey login with English and Russian UI strings;
• add nginx routes, Debian dependencies, deployment options, and an administrator guide;
• retain password authentication as the recovery method.

Compatibility and deployment

WebAuthn is disabled unless both --webauthn-rp-id and --webauthn-origin are configured. Existing installations therefore keep their current login flow. WebAuthn requires HTTPS and a stable DNS name, as documented in docs/webauthn.md.

Validation

• 210 backend tests passed, including the new WebAuthn test coverage;
• 2413 frontend tests passed;
• TypeScript type check passed;
• ESLint passed;
• frontend production build passed;
• the packages were deployed and registration/login were verified on a Wiren Board controller behind HTTPS.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 129 complexity · 6 duplication

Metric	Results
Complexity	129
Duplication	6

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}