+-----------------------------------------------------------------------------------------+
|                  Phishing Vulnerability: Legacy MFA vs Passkeys                         |
+-----------------------------------------------------------------------------------------+

LEGACY PASSWORD + SMS / TOTP MFA (Easily Phished via Evilginx Reverse Proxy):
[Victim] ---> Enters Password & 6-Digit TOTP on 'fake-login.com' ---> [Attacker Proxy] ---> [Real Server]
* Result: Attacker captures session cookie and logs in as victim! Complete Account Takeover!

FIDO2 WEBAUTHN PASSKEYS (100% Cryptographically Phishing-Resistant):
[Victim visits 'fake-login.com'] ---> Browser asks Secure Enclave for Passkey on 'fake-login.com'.
* Secure Enclave checks Origin: Domain mismatch! Refuses to sign challenge!
* Result: Attack FAILS instantly! Phishing is mathematically impossible!

+-----------------------------------------------------------------------------------------+
|                  Synced Passkeys vs Device-Bound Hardware Keys                          |
+-----------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------+
|                  WebAuthn Registration & Authentication Flow                            |
+-----------------------------------------------------------------------------------------+

REGISTRATION FLOW:
1. Client requests registration -> Server generates random 32-byte 'Challenge' nonce.
2. Browser calls 'navigator.credentials.create()' -> Prompts FaceID / TouchID.
3. Secure Enclave generates Private Key (retained in hardware) + Public Key.
4. Client signs Challenge with Private Key -> Sends Attestation + Public Key to Server.
5. Server stores { userId, credentialId, publicKey } in PostgreSQL.

AUTHENTICATION (LOGIN) FLOW:
1. Client requests login -> Server generates random 'Challenge'.
2. Browser calls 'navigator.credentials.get()' -> Prompts FaceID.
3. Secure Enclave signs Challenge with stored Private Key.
4. Server verifies signature using stored Public Key -> Issues Session Cookie!

// server/auth/passkeyService.ts
import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
} from "@simplewebauthn/server";
import type { VerifiedRegistrationResponse, VerifiedAuthenticationResponse } from "@simplewebauthn/server";

const rpName = "MojoStudio Secure Vault";
const rpID = "mojostudio.in"; // Exact domain origin
const origin = `https://${rpID}`;

// In-Memory / Redis Challenge Cache (5-minute TTL)
const challengeStore = new Map<string, string>();

// 1. GENERATE REGISTRATION OPTIONS
export async function getPasskeyRegistrationOptions(user: { id: string; email: string }) {
  const options = await generateRegistrationOptions({
    rpName,
    rpID,
    userID: new TextEncoder().encode(user.id),
    userName: user.email,
    attestationType: "none",
    authenticatorSelection: {
      residentKey: "required",      // Enables true username-less passkey login!
      userVerification: "preferred", // Prompts FaceID / Biometrics
    },
  });

  challengeStore.set(user.id, options.challenge);
  return options;
}

// 2. VERIFY REGISTRATION RESPONSE & SAVE PUBLIC KEY
export async function verifyPasskeyRegistration(user: { id: string }, body: any) {
  const expectedChallenge = challengeStore.get(user.id);
  if (!expectedChallenge) throw new Error("Challenge expired");

  const verification: VerifiedRegistrationResponse = await verifyRegistrationResponse({
    response: body,
    expectedChallenge,
    expectedOrigin: origin,
    expectedRPID: rpID,
  });

  if (verification.verified && verification.registrationInfo) {
    const { credentialID, credentialPublicKey, counter } = verification.registrationInfo;

    // SAVE TO DATABASE:
    // await db.insert(passkeys).values({ userId: user.id, credentialId: credentialID, publicKey: credentialPublicKey, counter });
    challengeStore.delete(user.id);
    return { success: true };
  }
  throw new Error("Passkey verification failed");
}

// 3. GENERATE AUTHENTICATION (LOGIN) OPTIONS
export async function getPasskeyAuthOptions() {
  const options = await generateAuthenticationOptions({
    rpID,
    userVerification: "preferred",
  });
  return options;
}

// hooks/usePasskeyAuth.ts
"use client";

import { startRegistration, startAuthentication } from "@simplewebauthn/browser";

export function usePasskeyAuth() {
  // 1. REGISTER NEW PASSKEY
  const registerPasskey = async (userId: string, email: string) => {
    try {
      const optionsRes = await fetch(`/api/auth/passkey/register-options?userId=`{userId}&email=`{email}`);
      const options = await optionsRes.json();

      // Prompts OS FaceID / TouchID / Windows Hello dialog!
      const registrationResponse = await startRegistration(options);

      const verifyRes = await fetch("/api/auth/passkey/verify-registration", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ userId, response: registrationResponse }),
      });

      if (verifyRes.ok) alert("✅ Passkey registered successfully!");
    } catch (err) {
      console.error("Failed to register passkey", err);
    }
  };

  // 2. ONE-CLICK BIOMETRIC LOGIN (Zero Password Entry!)
  const loginWithPasskey = async () => {
    try {
      const optionsRes = await fetch("/api/auth/passkey/login-options");
      const options = await optionsRes.json();

      // Prompts Biometric Scanner directly
      const authResponse = await startAuthentication(options);

      const verifyRes = await fetch("/api/auth/passkey/verify-login", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify(authResponse),
      });

      if (verifyRes.ok) {
        window.location.href = "/dashboard";
      }
    } catch (err) {
      console.error("Passkey login failed", err);
    }
  };

  return { registerPasskey, loginWithPasskey };
}

       +-------------------------------------------------------------+
       |             Average User Login Duration (Seconds)           |
       +-------------------------------------------------------------+
 Password + SMS 6-Digit OTP           | ==================================== [24.5s]
 Password + Authenticator TOTP Code   | ======================= [15.2s]
 Passkey One-Tap Biometric (FaceID)   | = [1.1s] (22x Faster Login UX!)
                                      +-------------------------------------+
                                      0s      6s      12s     18s     24s