# Kubiy — Biometric (WebAuthn / Passkeys)

Biometric (kidole/uso) kwa usalama zaidi. Kidole/uso **HAUONDOKI kwenye simu** —
server inapata public key tu.

## Faili
- `pwa/biometric.js` — frontend (register + login kwa WebAuthn)
- `laravel/app/Http/Controllers/Api/BiometricController.php` — backend (flow + TODO)
- `preview/kubiy-biometric-preview.html` — muonekano

## Mahitaji
- **HTTPS** (lazima kabisa; localhost inaruhusiwa kwa majaribio)
- Kifaa chenye biometric (fingerprint/Face). Fallback: PIN.

## Backend: TUMIA package (usiandike crypto mwenyewe!)
```bash
composer require laragear/webauthn      # rahisi kwa Laravel
# au: composer require web-auth/webauthn-lib
```
Kisha jaza sehemu za `// TODO` kwenye BiometricController kwa package hiyo.

## Mtiririko
```
Login ya kwanza (PIN/OTP) -> register biometric (public key -> server)
Mara zinazofuata: fungua app -> kidole/uso -> ingia (hakuna password)
Vitendo hatari (mauzo makubwa/kufuta): omba biometric tena
```

## Tabaka za usalama (mapendekezo)
1. Kufungua app: biometric au PIN kila mara.
2. Login: PIN/OTP mara ya kwanza, biometric baadaye.
3. Vitendo vya fedha: biometric tena (step-up).

## Usalama muhimu
- Hifadhi `sign_count` na uikague iongezeke kila login (kuzuia replay).
- `userVerification: required` (lazima biometric ithibitike, si kifaa tu).
- Biometric ni ya kifaa kimoja; ruhusu kusajili vifaa vingi + fallback ya PIN/OTP
  ikiwa mtumiaji atapoteza simu.