feat(webauthn): Touch ID + Google passkey sign-in via patched from-source CEF

[wenkaifan0720]

What

Adds on-device Touch ID passkeys and Google-account QR/phone-passkey sign-in to the CEF webview, via a patched from-source CEF — Tier-2 (build libcef with a 13-line patch), not a Chromium fork.

Two independent pieces:

1. openAuthWindow op (protocol v3 → v4) — new IPC op 0x39 that opens a windowed Chrome-runtime browser (CEF_RUNTIME_STYLE_CHROME) sharing the OSR tile's cookie jar. The OSR/windowless tile can't host WebAuthn UI; this runs the ceremony in a window that can. Plumbed main.mm → FlutterCefPlugin.swift / CefWebSession.swift / CefProfileHost.swift → cef_web_controller.dart (openAuthWindow(url)).

2. From-source patched CEF — native/build-cef-from-source.sh fetches Chromium+CEF at the pinned rev and applies one 13-line patch (native/patches/campus_webauthn_keychain.patch) that hardcodes the KLAJ5X6PJP team prefix on the WebAuthn keychain-access-group. Unbranded CEF derives it from an empty MAC_TEAM_IDENTIFIER_STRING → .org.chromium.Chromium.webauthn, which no entitlement can match, so Touch ID is unreachable without this.

Why the build config matters

is_official_build=true is load-bearing three ways — don't downgrade to a bare dcheck_always_on=false build:

• matches how the stock Spotify prebuilt is built;
• strips DCHECKs (a plain build crashes at chrome_paths_mac.mm on CEF's Versions/A layout);
• fixes Google-account caBLE/QR passkey sign-in — a non-official build breaks it ("Something went wrong" after the email step); the official build completes the flow.

proprietary_codecs=true ffmpeg_branding="Chrome" add H.264/AAC — royalty-bearing (MPEG-LA / Via-LA). Gate prod distribution on legal sign-off.

No-drift

A patched framework under the same CEF_VERSION would collide with the stock content hash → every consumer silently fetches the unpatched framework. CEF_FRAMEWORK_VARIANT (campus-webauthn-h264) is folded into cef_host_hash.sh's digest so the patched build gets a distinct GCS key, and build_cef_host.sh hard-fails if the marker is non-stock but the framework lacks the patch. The stock digest is byte-identical to before (no republish of the existing stock host).

Testing

Notarized Campus dev build, user-confirmed:

• ✅ webauthn.io Touch ID registration/auth
• ✅ Google-account QR / phone-passkey sign-in completes (reaches Google's "add a passkey" enrollment page)

Note: the -67030 process_requirement.cc log line is a benign red herring — present in the working build too. Ignore it; watch the actual login flow.

Merge / rollout notes

• After merge, publish the patched cef_host prebuilt for its new content hash (make publish-cef-host) so consumers fetch it instead of a ~2 hr local build.
• work_canvas then bumps its pin to this merge SHA (make pin-cef) — companion PR.
• entitlements.browser.plist is a documented hand-apply reference; the work_canvas release script derives browser entitlements from the provisioning profile at sign time.

🤖 Generated with Claude Code

[wenkaifan0720]

Final audit (5-lens adversarial review) — no merge-blockers

Two highest-risk dimensions came back clean: C++/CEF correctness in main.mm (op handling, AuthWindowClient lifetime, threading, URL bounds) and the protocol v3→v4 plumbing (every op-byte/version site agrees across native/Swift/Dart — no silent-frozen-tile risk).

4 low-severity findings, 0 false positives. Fixed 3 in 238b49d:

Finding	Severity	Status
openAuthWindow opens its URL with no scheme check (vs navigate's gate)	low	✅ fixed — http(s)-only guard at the Swift + Dart entry
cef_host_hash.sh omits patches/** + build-cef-from-source.sh → patched-v1↔v2 drift undetected	low	✅ fixed — folded in (non-stock only; stock digest byte-stable; verified)
Comment claims patch.cfg gating that doesn't exist	low	✅ fixed — corrected
Variant guard hard-fails opt-in from-source builds (x86_64/offline/co-dev)	low	⏭️ deferred → #26 (normal fetch-or-skip path unaffected; needs a design call)