feat: add passkey functionality [WPB-27034]

[e-maad]

WPB-27034 [Web] Passkey login fails in embedded browser on Windows and macOS

Description

• Added macOS browser SSO using ASWebAuthenticationSession, allowing supported browsers to handle passkeys, physical security keys, and mobile authenticators.
• Kept embedded SSO on Windows/Linux, including the shared session and localized, app-styled window.prompt() replacement.
• Added callback validation and secure session-cookie transfer to the requesting account, with cancellation and timeout handling.
• Updated “Click here to continue” to bring the authentication browser forward on macOS.
• Added Jenkins provisioning-profile support, certificate selection, signing diagnostics, and macOS native-module packaging.
• Removed local build helpers and obsolete SSO handling; updated documentation and regression tests.
• Aligned macOS browser SSO with Wire iOS’s existing authentication flow, including callback validation and session-cookie handling.

Test apps:

• MacOS
• Windows

[semgrep-code-wireapp]

Semgrep found 1 path-join-resolve-traversal finding:

• bin/build-tools/lib/build-macos.ts
  • L281 - Triage

🟡 Medium severity issue identified in your code:

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>bin/build-tools/lib/build-macos.ts</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L164 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 164] packagerConfig</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L164 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 164] packagerConfig</a>"]

            v3["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L189 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 189] await</a>"]

            v4["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L189 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 189] ]</a>"]

            v5["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L189 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 189] buildDir</a>"]

            v6["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L193 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 193] appFile</a>"]

            v7["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L201 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 201] manualMacOSSign</a>"]

            v8["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L250 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 250] appFile</a>"]

            v9["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L272 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 272] await</a>"]

            v10["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L272 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 272] addons</a>"]

            v11["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L276 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 276] of</a>"]

            v12["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L276 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 276] addon</a>"]
        end
            v2 --> v3
            v3 --> v4
            v4 --> v5
            v5 --> v6
            v6 --> v7
            v7 --> v8
            v8 --> v9
            v9 --> v10
            v10 --> v11
            v11 --> v12
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/wireapp/wire-desktop/blob/bcd7ca5fa856bc9b27852d4d4f9db4212ee59167/bin/build-tools/lib/build-macos.ts#L281 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 281] addon</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading