Problem

Adds first-class support for passwordless authentication in Amplify Gen 2 backend, enabling developers to configure Email OTP, SMS OTP, and WebAuthn (passkeys) without requiring CDK overrides.

Issue number, if available:

#2276

Changes

Public API Changes:

• Added otpLogin?: boolean property to email and phone login configurations in defineAuth
• Added webAuthn?: WebAuthnLogin property to loginWith configuration
• Added WebAuthnOptions type with relyingPartyId and userVerification settings

Implementation:

• Extended auth-construct to translate passwordless configurations to Cognito User Pool settings
• Added validation logic to prevent invalid configurations (e.g., WebAuthn-only without sign-up method, passwordless + MFA REQUIRED)
• Implemented automatic relying party ID resolution ('AUTO' resolves to localhost in sandbox, Amplify domain in branch mode)
• Added runtime warnings for immutable configuration changes

Testing:

• Added tests to verify correct Cognito User Pool and User Pool Client configuration

Corresponding docs PR, if applicable: N/A

Validation

• Unit tests added for validation logic and configuration translation
• Tests verify:
  • Correct AllowedFirstAuthFactors configuration in User Pool (EMAIL_OTP, SMS_OTP, WEB_AUTHN)
  • ALLOW_USER_AUTH flow enabled in User Pool Client
  • WebAuthn configuration (RelyingPartyId, UserVerification) when applicable
• Manual testing with sample app verified end-to-end passwordless flows

Checklist

• If this PR includes a functional change to the runtime behavior of the code, I have added or updated automated test coverage for this change.
• If this PR requires a change to the Project Architecture README, I have included that update in this PR.
• If this PR requires a docs update, I have linked to that docs PR above.
• If this PR modifies E2E tests, makes changes to resource provisioning, or makes SDK calls, I have run the PR checks with the run-e2e label set.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.