Description
The initial WebAuthn spec wasn't entirely clear about the semantics of name
and displayName
; consequently, there were some inconsistencies in the SDK about what to use and where. While the spec hasn't changed materially, some WWDC sessions in particular have started to add clarity here: user.name
should be what the user would type in a username field during a non-passkey flow (currently called handle), and user.displayName
should be a friendly/given name.
Let's set the names and APIs up for success here.
UserRegistrationInfo
should combine name
and handle
into a single value, probably username
, and keep the client-only management of this data. id
can stay as-is, reserved for future use (though I expect it'll never be used in registration, and only used in signal APIs once they're supported). displayName
is also probably OK as-is.
UserAuthenticationInfo
should rename handle
to whatever UserRegistrationInfo
lands on (e.g. username
).
I could see a simplification of the APIs to avoid fussing with objects, though it tends to provide less validation. Roughly:
interface SDK {
async startRegister(username: string, displayName: string = undefined);
async startAuthByUsername(username: string);
async startAuthById(id: string);
}
Update: the above has been split into #49.