[suggestion] add WebAuthn for authentification

[bendo01]

hello, I think that having support for WebAuthn would very interesting. thank you.

[JuanMarchetto]

WebAuthn fits the Authentication roadmap item, and topcoat-session covers the half that follows a successful ceremony.

Proposed shape: a separate crate (topcoat-webauthn, or a module inside a future topcoat-auth) in the style of the existing integration crates. It wraps webauthn-rs for the ceremonies and leaves storage to the application, the convention topcoat-session uses: the app persists the credential id, public key, and sign counter next to its user record, and the crate holds none of it. A verified assertion ends in session::start(cx), so the existing Token/TokenHash flow, the __Host- cookie TokenStore, and the OriginLayer origin check carry over unchanged.

Router::builder()
    .cookies()
    .sessions(SessionConfig::default())
    .webauthn(WebauthnConfig::new("example.com", "https://example.com"))
    .discover()
    .build();

#[procedure]
async fn login_finish(cx: &Cx, credential: String) -> Result<bool> {
    let credential_id = webauthn::finish_authentication(cx, &credential).await?;
    let session = session::start(cx).await?;
    db(cx).attach(session, credential_id);
    Ok(true)
}

Three questions before I write any of it:

1. Should auth start with WebAuthn and passkeys in their own crate, or wait for a broader topcoat-auth design that covers passwords and OAuth in the same shape?
2. Where does the navigator.credentials glue belong? The ceremonies need create() and get() plus base64url encoding of ArrayBuffers, which the expr! vocabulary has no types for. The crate can ship a browser script through the asset system the way topcoat::runtime::script() does, or the design can treat raw! as the supported path and keep the ceremony data crossing as String.
3. Is webauthn-rs an acceptable dependency? Version 0.5.5 shipped in April 2026 from the Kanidm project and carries 2.1M recent downloads.

I will build it once the direction is set.