Implement: A/B test for allowing F/T setup and authentication on desktop

[jmdembe]

Currently a draft PR to allow setup and authorization on desktops.

[voidlily]

can you rebase this branch to pick up changes to the reviewapp deploy process?

[aduth]

I wouldn't expect to see this code entirely removed, since we still only want to allow devices considered unsupported by isWebauthnPasskeySupported() if the user is part of the A/B test.

[jmdembe]

I wouldn't expect to see this code entirely removed, since we still only want to allow devices considered unsupported by isWebauthnPasskeySupported() if the user is part of the A/B test.

I might be confused but shouldn't a user without a device be an automatic disqualifier for the test?

[aduth]

What I mean is that if we remove the isWebauthnPasskeySupported(), then "Face or touch unlock" will be visible as an option to everyone (all desktop users), not just those who are selected into the A/B test.

[jmdembe]

Ah, gotcha. So the line will be

// if webauthn passkeys  are available, supported, and a part of the A/B test

Okay cool.

[aduth]

More precisely, it'd be something like:

if (((isWebauthnPasskeySupported() || isOptedInToAbTest())  && (await isWebauthnPlatformAuthenticatorAvailable())) {
  // ...
}

[jmdembe]

Then from that, you could still get if supported and available, then show. What if we changed this up a little bit?

if (((isWebauthnPasskeySupported() || isOptedInToAbTest()) && (await isWebauthnPlatformAuthenticatorAvailable())) 
{ 
// ... 
}

Because then if its not available at all, then we can skip over the second check which would automatically be false?

EDIT: Wait, that would be the same logic.