[Roadmap] Passkey/WebAuthn support

[danielmx98]

Why
Users will be able to log in to Big-AGI seamlessly and securely without the hassle of remembering passwords or dealing with complex multi-factor authentication flows. Passkeys offer a modern, phishing-resistant authentication method that leverages biometric or device-based security, enhancing both convenience and security for a better overall experience.
Description
Implement Passkey support as an authentication option in Big-AGI, allowing users to register and log in using cryptographic keys tied to their devices (e.g., biometrics like fingerprint or face recognition, or PINs). This would replace or supplement traditional password-based login, providing a faster and more secure way to access the platform.
Requirements
• Passkey Registration Flow
◦ Add an option in the user account settings or onboarding process to enable Passkey authentication.
◦ Integrate with the WebAuthn API to facilitate passkey creation and storage on the user’s device.
◦ Provide a clear UX prompt (e.g., “Set up Passkey”) with fallback options for users without compatible devices.
• Login Integration
◦ Modify the login screen to detect and prompt for Passkey if registered, alongside existing methods (e.g., password or SSO).
◦ Ensure a smooth transition for users switching between devices (e.g., syncing via cloud-backed passkeys where supported).
• Backend Support
◦ Update the authentication architecture to validate Passkey credentials (public-private key pairs) against stored user data.
◦ Implement secure storage for public keys on the server side, adhering to FIDO Alliance standards.
• User Experience
◦ Design a minimalistic UI for Passkey setup and usage (e.g., “Log in with your fingerprint” or “Use your device”).
◦ Include tooltips or a help section explaining what Passkeys are and their benefits.
• Compatibility
◦ Ensure support for major platforms (iOS, Android, Windows, macOS) and browsers (Chrome, Safari, Edge, Firefox) that implement WebAuthn.
◦ Test fallback behavior for non-supported devices or browsers.
• Security Considerations
◦ Validate Passkey implementation against phishing resistance (e.g., domain-bound assertions).
◦ Audit for compliance with privacy standards, ensuring no unnecessary user data is collected.

Let me know if you’d like to tweak anything!