passkey existing

apps/server/internal/httpserver/api_handlers_test.go

@@ -301,6 +301,54 @@ func TestTokenCreationUsesDedicatedAccountPage(t *testing.T) {
 	}
 }
 
+func TestPasswordUserCanBeginPasskeyRegistrationFromAccount(t *testing.T) {
+	server := newAPITestServer(t)
+
+	login := httptest.NewRecorder()
+	server.handler.ServeHTTP(login, jsonRequest(http.MethodPost, "/api/auth/login/password", map[string]string{
+		"email":    "editor@example.com",
+		"password": "very secure password",
+	}))
+	if login.Code != http.StatusOK || len(login.Result().Cookies()) == 0 {
+		t.Fatalf("login response = %d %q, want session cookie", login.Code, login.Body.String())
+	}
+	session := cookieByName(t, login.Result().Cookies(), auth.SessionCookieName)
+
+	accountRequest := httptest.NewRequest(http.MethodGet, "/account", nil)
+	accountRequest.AddCookie(session)
+	account := httptest.NewRecorder()
+	server.handler.ServeHTTP(account, accountRequest)
+	if account.Code != http.StatusOK || !bytes.Contains(account.Body.Bytes(), []byte("data-passkey-add")) {
+		t.Fatalf("account page response = %d %q, want add-passkey form", account.Code, account.Body.String())
+	}
+
+	beginRequest := jsonRequest(http.MethodPost, "/api/auth/passkeys/me/register/begin", map[string]any{})
+	beginRequest.AddCookie(session)
+	begin := httptest.NewRecorder()
+	server.handler.ServeHTTP(begin, beginRequest)
+	if begin.Code != http.StatusOK {
+		t.Fatalf("passkey begin response = %d %q", begin.Code, begin.Body.String())
+	}
+	var body struct {
+		ChallengeID string `json:"challengeId"`
+		Options     any    `json:"options"`
+	}
+	if err := json.NewDecoder(begin.Body).Decode(&body); err != nil {
+		t.Fatalf("decode passkey begin response: %v", err)
+	}
+	if body.ChallengeID == "" || body.Options == nil {
+		t.Fatalf("passkey begin body = %#v, want challenge and options", body)
+	}
+
+	publicBegin := httptest.NewRecorder()
+	server.handler.ServeHTTP(publicBegin, jsonRequest(http.MethodPost, "/api/auth/passkeys/register/begin", map[string]string{
+		"email": "editor@example.com",
+	}))
+	if publicBegin.Code == http.StatusOK {
+		t.Fatalf("public passkey begin response = %d %q, want failure for existing account", publicBegin.Code, publicBegin.Body.String())
+	}
+}
+
 func TestAdminUserAccessAndPasswordResetHTTPFlow(t *testing.T) {
 	server := newAPITestServer(t)
 	sender := &testEmailSender{}