feat(auth): add a default deviceName when remembering device

[ashwinkumar6]

Description of changes

• Add a default deviceName for web and RN when making a ConfirmDevice service call
• The navigator.userAgent API causes a warning in Chrome DevTools (Issues tab) starting with version 92
  • Use navigator.userAgentData (when available) instead of navigator.userAgent

Note:
The navigator.userAgentData API involves introducing randomness by adding a string Not_A_Brand | Not_A Brand | Not A(Brand | ... to prevent user fingerprinting. The deviceName passed to the ConfirmDevice service API is called every time the user signs-in until the rememberDevice API is called, after which it just updates the status. It isn't a concern if the deviceName changes later on.

Device name output / platform

Verified the following devices names on cognito console

Issue #, if available

#12854

Description of how you validated changes

Tested the following flows

MFA: always; DeviceTracking: Opt-in
1. signIn -> confirmSignIn -> signOut
new entry added in "Device tracking log" (cognito console) table each time this is done with "Remembered" as NO

2. signIn -> confirmSignIn -> rememberDevice -> signOut
new entry added in "Device tracking log" table time with "Remembered" as YES. (calling rememberDevice
again has no affect)

3. signIn -> fetchdevices() ->  signOut
device is remembered, able to bypass MFA. 
deviceName is present in new `name` key

Verified fetchDevices returns

[
    {
        "id": "us-west-2...",
        "name": "macOS 14.3.1 arm macOS Not A(Brand/99.0.0.0;Google Chrome/121.0.6167.184;Chromium/121.0.6167.184",
        "attributes": {
            "device_status": "valid",
            "device_name": "macOS 14.3.1 arm macOS Not A(Brand/99.0.0.0;Google Chrome/121.0.6167.184;Chromium/121.0.6167.184",
            "last_ip_used": "240...."
        },
        "createDate": "2024-02-17T01:17:42.046Z",
        "lastModifiedDate": "2024-02-17T01:33:11.770Z",
        "lastAuthenticatedDate": "2024-02-17T01:17:42.000Z"
    }
]

Checklist

• PR description included
• yarn test passes
• Tests are changed or added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[ashwinkumar6]

Blocked by #13015
Once the same is merged we can update the target of this PR

[kvramyasri7]

Great job!!!!!

[ashwinkumar6]

userAgentData is experimental and hence isn't typed but is officially recommended by google.

The support for userAgentData is still limited and so we have a fall back to option to use userAgent

Since userAgentData is experimental can we just use userAgent across all browsers ?

No, using only userAgent would result in chrome triggering Audit usage of navigator.userAgent, navigator.appVersion, and navigator.platform and reopening an old issue.

[israx]

is it needed to assert for this specific device name ?

[ashwinkumar6]

The deviceName is returned by the service call in DeviceAttributes on the device_name attribute. We were doing the same in V5 as well

[jimblanc]

Not opposed to creating our own types, but I wonder if there's a pre-built @types package we could use if it's well-maintained?

[ashwinkumar6]

Took a reference of the types from this package user-agent-data-types but since it was less widely used, added the types directly