feat(mobile): Android Digital Asset Links for passkey domain binding - #590
Open
Osuolale1 wants to merge 1 commit into
Open
feat(mobile): Android Digital Asset Links for passkey domain binding#590Osuolale1 wants to merge 1 commit into
Osuolale1 wants to merge 1 commit into
Conversation
Closes Miracle656#447 Set up the Android equivalent of passkey domain binding via Digital Asset Links, proving the app and website belong to the same entity, self-serve and with no paid account required, unblocking real-device passkey testing on Android ahead of iOS.
|
@Osuolale1 is attempting to deploy a commit to the miracle656's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@Osuolale1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #447
Summary
Set up the Android equivalent of passkey domain binding via Digital Asset Links, proving the app and website belong to the same entity. This is self-serve and needs no paid account, so it lands ahead of iOS and unblocks real-device passkey testing on Android.
frontend/website/public/.well-known/assetlinks.json, served statically by the Next.js website athttps://veil.app/.well-known/assetlinks.json. Declarescom.veil.walletas the linked Android app, withdelegate_permission/common.get_login_creds(required for credential/passkey sharing) alongsidedelegate_permission/common.handle_all_urls.android.package: "com.veil.wallet"and anandroid.intentFiltersentry withautoVerify: trueforhttps://veil.app/*infrontend/mobile/app.json, matching the RP ID (veil.app) already used for passkeys elsewhere in the codebase (frontend/mobile/lib/passkey.ts,frontend/mobile/lib/__tests__/restore.test.ts).sha256_cert_fingerprintsvalue inassetlinks.jsonis a placeholder (REPLACE_WITH_APP_SIGNING_CERT_SHA256_FINGERPRINT) — needs the real signing-cert SHA-256 fingerprint (from the release keystore, or the Play App Signing console report) before the Digital Asset Links validator will pass.Test plan
assetlinks.jsonhttps://veil.app/.well-known/assetlinks.jsonresolvesveil.app/com.veil.walletand confirm it passesveil.app) is accepted and a passkey created on web is usable from the app (or vice versa)