Enhancement: Add Passkeys (WebAuthn) support for Passwordless login & Passkey as 2FA.. (#779)

[chetanupare]

Intro

• Introduces Two_Factor_Passkey extending Two_Factor_Provider.
• Hooks authenticate at priority 20 in Core to allow passwordless login.
• Requires lbuchs/WebAuthn via Composer for PHP 7.2+ compatible CBOR/cryptography.
• Implements frontend JS for navigator.credentials API.
• Adds REST API endpoints for decoupled WebAuthn challenge generation.

Fixes #779

What?

This PR introduces native support for Passkeys (WebAuthn) as a first-class feature for the Two-Factor plugin. Fixes #779

Why?

Passkeys provide phishing-resistant, public-key–based authentication backed by platform authenticators (e.g., Touch ID, Windows Hello). This PR implements both integration models discussed in the original issue:

• Option 1: Passkeys as a Password Replacement: Users can bypass the password step entirely.
• Option 2: Passkeys as an Additional Authentication Method: Passkeys function as a standard Two_Factor_Provider, appearing alongside TOTP and Email.

How?

To support Option 1 (passwordless), the authenticate filter was hooked early (Priority 20) inside Two_Factor_Core. If a passkey assertion is detected, it is validated. If valid, the WP_User is returned directly, bypassing WordPress core's native password validation (Priority 30) and actively unhooking the downstream 2FA enforcement UI.

Use of AI Tools

No

Testing Instructions

1. Run npm install and npm run composer install.
2. Login to wp-admin and navigate to your User Profile.
3. Check the "Enable" box for Passkeys and click "Register New Passkey". Your browser will prompt you to authenticate.
4. Log out.
5. On the login screen, enter your username and click "Login with Passkey" to bypass the password.
6. Alternatively, log in with your password normally, and click "Use Passkey" on the Two-Factor interstitial screen.

Screenshots or screencast

Changelog Entry

Added - Native Passkeys (WebAuthn) support for Passwordless login & Passkey as 2FA.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @AliferSouza.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: AliferSouza.

Co-authored-by: chetanupare <chetanupare@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: r-a-y <r-a-y@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.