feat(webauthn): Touch ID + Google passkey sign-in via patched from-source CEF

[wenkaifan0720]

What

Adds on-device Touch ID passkeys and Google-account QR/phone-passkey sign-in to the CEF webview, via a patched from-source CEF — Tier-2 (build libcef with a 13-line patch), not a Chromium fork.

Two independent pieces:

1. openAuthWindow op (protocol v3 → v4) — new IPC op 0x39 that opens a windowed Chrome-runtime browser (CEF_RUNTIME_STYLE_CHROME) sharing the OSR tile's cookie jar. The OSR/windowless tile can't host WebAuthn UI; this runs the ceremony in a window that can. Plumbed main.mm → FlutterCefPlugin.swift / CefWebSession.swift / CefProfileHost.swift → cef_web_controller.dart (openAuthWindow(url)).

2. From-source patched CEF — native/build-cef-from-source.sh fetches Chromium+CEF at the pinned rev and applies one 13-line patch (native/patches/campus_webauthn_keychain.patch) that hardcodes the KLAJ5X6PJP team prefix on the WebAuthn keychain-access-group. Unbranded CEF derives it from an empty MAC_TEAM_IDENTIFIER_STRING → .org.chromium.Chromium.webauthn, which no entitlement can match, so Touch ID is unreachable without this.

Why the build config matters

is_official_build=true is load-bearing three ways — don't downgrade to a bare dcheck_always_on=false build:

• matches how the stock Spotify prebuilt is built;
• strips DCHECKs (a plain build crashes at chrome_paths_mac.mm on CEF's Versions/A layout);
• fixes Google-account caBLE/QR passkey sign-in — a non-official build breaks it ("Something went wrong" after the email step); the official build completes the flow.

proprietary_codecs=true ffmpeg_branding="Chrome" add H.264/AAC — royalty-bearing (MPEG-LA / Via-LA). Gate prod distribution on legal sign-off.

No-drift

A patched framework under the same CEF_VERSION would collide with the stock content hash → every consumer silently fetches the unpatched framework. CEF_FRAMEWORK_VARIANT (campus-webauthn-h264) is folded into cef_host_hash.sh's digest so the patched build gets a distinct GCS key, and build_cef_host.sh hard-fails if the marker is non-stock but the framework lacks the patch. The stock digest is byte-identical to before (no republish of the existing stock host).

Testing

Notarized Campus dev build, user-confirmed:

• ✅ webauthn.io Touch ID registration/auth
• ✅ Google-account QR / phone-passkey sign-in completes (reaches Google's "add a passkey" enrollment page)

Note: the -67030 process_requirement.cc log line is a benign red herring — present in the working build too. Ignore it; watch the actual login flow.

Merge / rollout notes

• After merge, publish the patched cef_host prebuilt for its new content hash (make publish-cef-host) so consumers fetch it instead of a ~2 hr local build.
• work_canvas then bumps its pin to this merge SHA (make pin-cef) — companion PR.
• entitlements.browser.plist is a documented hand-apply reference; the work_canvas release script derives browser entitlements from the provisioning profile at sign time.

🤖 Generated with Claude Code