sirtimbly/cairnquire
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

passkey existing

Browse Source
This commit is contained in:
Tim Bendt
2026-06-16 17:05:15 -04:00
parent 4655008154
commit b6d2ded141
9 changed files with 188 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
apps/server/internal/auth/service.go
View File

@@ -190,6 +190,57 @@ func (s *Service) FinishPasskeyRegistration(ctx context.Context, challengeID str
return s.repo.GetUserByID(ctx, user.ID)
}
func (s *Service) BeginCurrentUserPasskeyRegistration(ctx context.Context, principal Principal) (any, string, error) {
if principal.UserID == "" {
return nil, "", fmt.Errorf("authentication required")
}
user, err := s.repo.GetUserByID(ctx, principal.UserID)
if err != nil {
return nil, "", err
}
if user.Disabled {
return nil, "", fmt.Errorf("account disabled")
}
creation, session, err := s.webauthn.BeginRegistration(user)
if err != nil {
return nil, "", err
}
challengeID, err := s.repo.SaveChallenge(ctx, user.ID, "webauthn_registration", *session, challengeTTL)
if err != nil {
return nil, "", err
}
return creation, challengeID, nil
}
func (s *Service) FinishCurrentUserPasskeyRegistration(ctx context.Context, principal Principal, challengeID string, r *http.Request) (User, error) {
if principal.UserID == "" {
return User{}, fmt.Errorf("authentication required")
}
session, userID, err := s.repo.ConsumeChallenge(ctx, challengeID, "webauthn_registration")
if err != nil {
return User{}, err
}
if userID != principal.UserID {
return User{}, fmt.Errorf("challenge does not belong to the current user")
}
user, err := s.repo.GetUserByID(ctx, userID)
if err != nil {
return User{}, err
}
if user.Disabled {
return User{}, fmt.Errorf("account disabled")
}
credential, err := s.webauthn.FinishRegistration(user, session, r)
if err != nil {
return User{}, err
}
if err := s.repo.SaveCredential(ctx, user.ID, *credential); err != nil {
return User{}, err
}
s.repo.Audit(ctx, user.ID, "auth.passkey.add", "user", user.ID, clientIP(r), r.UserAgent(), nil)
return s.repo.GetUserByID(ctx, user.ID)
}
func (s *Service) BeginPasskeyLogin(ctx context.Context, email string) (any, string, error) {
user, err := s.repo.GetUserByEmail(ctx, normalizeEmail(email))
if err != nil {

15
apps/server/internal/auth/service_test.go
View File

@@ -315,6 +315,21 @@ func TestPublicRegistrationCannotAttachCredentialsToExistingUser(t *testing.T) {
}
}
func TestCurrentUserCanBeginPasskeyRegistrationForExistingAccount(t *testing.T) {
service := setupAuthTestService(t)
ctx := context.Background()
user := setupInitialAdmin(t, service, false)
principal := principalFromUser(user, "session", "sess:test", "", nil, time.Now().Add(time.Hour))
options, challengeID, err := service.BeginCurrentUserPasskeyRegistration(ctx, principal)
if err != nil {
t.Fatalf("BeginCurrentUserPasskeyRegistration() error = %v", err)
}
if options == nil || challengeID == "" {
t.Fatalf("options = %#v, challengeID = %q; want registration options and challenge", options, challengeID)
}
}
func TestInitialSetupCanDisablePublicRegistration(t *testing.T) {
service := setupAuthTestService(t)
ctx := context.Background()

48
apps/server/internal/httpserver/api_handlers_test.go
View File

@@ -301,6 +301,54 @@ func TestTokenCreationUsesDedicatedAccountPage(t *testing.T) {
}
}
func TestPasswordUserCanBeginPasskeyRegistrationFromAccount(t *testing.T) {
server := newAPITestServer(t)
login := httptest.NewRecorder()
server.handler.ServeHTTP(login, jsonRequest(http.MethodPost, "/api/auth/login/password", map[string]string{
"email": "editor@example.com",
"password": "very secure password",
}))
if login.Code != http.StatusOK || len(login.Result().Cookies()) == 0 {
t.Fatalf("login response = %d %q, want session cookie", login.Code, login.Body.String())
}
session := cookieByName(t, login.Result().Cookies(), auth.SessionCookieName)
accountRequest := httptest.NewRequest(http.MethodGet, "/account", nil)
accountRequest.AddCookie(session)
account := httptest.NewRecorder()
server.handler.ServeHTTP(account, accountRequest)
if account.Code != http.StatusOK || !bytes.Contains(account.Body.Bytes(), []byte("data-passkey-add")) {
t.Fatalf("account page response = %d %q, want add-passkey form", account.Code, account.Body.String())
}
beginRequest := jsonRequest(http.MethodPost, "/api/auth/passkeys/me/register/begin", map[string]any{})
beginRequest.AddCookie(session)
begin := httptest.NewRecorder()
server.handler.ServeHTTP(begin, beginRequest)
if begin.Code != http.StatusOK {
t.Fatalf("passkey begin response = %d %q", begin.Code, begin.Body.String())
}
var body struct {
ChallengeID string `json:"challengeId"`
Options any `json:"options"`
}
if err := json.NewDecoder(begin.Body).Decode(&body); err != nil {
t.Fatalf("decode passkey begin response: %v", err)
}
if body.ChallengeID == "" || body.Options == nil {
t.Fatalf("passkey begin body = %#v, want challenge and options", body)
}
publicBegin := httptest.NewRecorder()
server.handler.ServeHTTP(publicBegin, jsonRequest(http.MethodPost, "/api/auth/passkeys/register/begin", map[string]string{
"email": "editor@example.com",
}))
if publicBegin.Code == http.StatusOK {
t.Fatalf("public passkey begin response = %d %q, want failure for existing account", publicBegin.Code, publicBegin.Body.String())
}
}
func TestAdminUserAccessAndPasswordResetHTTPFlow(t *testing.T) {
server := newAPITestServer(t)
sender := &testEmailSender{}

36
apps/server/internal/httpserver/auth_handlers.go
View File

@@ -334,6 +334,42 @@ func (s *Server) handlePasskeyRegisterFinish(w http.ResponseWriter, r *http.Requ
writeJSON(w, http.StatusOK, map[string]any{"user": publicUser(user)})
}
func (s *Server) handleCurrentUserPasskeyRegisterBegin(w http.ResponseWriter, r *http.Request) {
principal, _ := requirePrincipal(r)
if !requireSessionPrincipal(w, principal) {
return
}
options, challengeID, err := s.auth.BeginCurrentUserPasskeyRegistration(r.Context(), principal)
if err != nil {
writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
return
}
writeJSON(w, http.StatusOK, map[string]any{"challengeId": challengeID, "options": options})
}
func (s *Server) handleCurrentUserPasskeyRegisterFinish(w http.ResponseWriter, r *http.Request) {
principal, _ := requirePrincipal(r)
if !requireSessionPrincipal(w, principal) {
return
}
challengeID := r.URL.Query().Get("challengeId")
if challengeID == "" {
var req passkeyFinishRequest
_ = json.NewDecoder(r.Body).Decode(&req)
challengeID = req.ChallengeID
}
if challengeID == "" {
writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": "challengeId is required"})
return
}
user, err := s.auth.FinishCurrentUserPasskeyRegistration(r.Context(), principal, challengeID, r)
if err != nil {
writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
return
}
writeJSON(w, http.StatusOK, map[string]any{"user": publicUser(user)})
}
func (s *Server) handlePasskeyLoginBegin(w http.ResponseWriter, r *http.Request) {
if !s.allowAuthAttempt(w, r) {
return

2
apps/server/internal/httpserver/middleware.go
View File

@@ -174,7 +174,7 @@ func requiredScopeForPath(r *http.Request) (auth.Scope, bool) {
case path == "/permissions" && method == http.MethodPost:
return auth.ScopeDocsWrite, true
case strings.HasPrefix(path, "/api/auth/"):
if path == "/api/auth/me" || path == "/api/auth/logout" || path == "/api/auth/password/change" || path == "/api/auth/account" {
if path == "/api/auth/me" || path == "/api/auth/logout" || path == "/api/auth/password/change" || path == "/api/auth/account" || strings.HasPrefix(path, "/api/auth/passkeys/me/") {
return auth.ScopeDocsRead, true
}
return "", false

2
apps/server/internal/httpserver/server.go
View File

@@ -124,6 +124,8 @@ func New(deps Dependencies) (http.Handler, error) {
router.Post("/api/auth/logout", server.handleLogout)
router.Post("/api/auth/password/change", server.handleChangePassword)
router.Delete("/api/auth/account", server.handleDeleteAccount)
router.Post("/api/auth/passkeys/me/register/begin", server.handleCurrentUserPasskeyRegisterBegin)
router.Post("/api/auth/passkeys/me/register/finish", server.handleCurrentUserPasskeyRegisterFinish)
router.Post("/api/auth/passkeys/register/begin", server.handlePasskeyRegisterBegin)
router.Post("/api/auth/passkeys/register/finish", server.handlePasskeyRegisterFinish)
router.Post("/api/auth/passkeys/login/begin", server.handlePasskeyLoginBegin)

20
apps/server/internal/httpserver/static/auth.js
View File

@@ -251,6 +251,26 @@
}
});
document.querySelector("[data-passkey-add]")?.addEventListener("submit", async (event) => {
event.preventDefault();
const support = await checkPasskeySupport();
if (!support.supported) {
setStatus("[data-passkey-add-status]", support.reason, true);
return;
}
if (support.reason) {
console.warn("Passkey support:", support.reason);
}
try {
const begin = await postJSON("/api/auth/passkeys/me/register/begin", {});
const credential = await navigator.credentials.create(normalizeCreateOptions(begin.options));
await postJSON(`/api/auth/passkeys/me/register/finish?challengeId=${encodeURIComponent(begin.challengeId)}`, credentialToJSON(credential));
setStatus("[data-passkey-add-status]", "Passkey added. You can use it the next time you sign in.");
} catch (error) {
setStatus("[data-passkey-add-status]", webAuthnErrorMessage(error), true);
}
});
document.querySelector("[data-auth-logout]")?.addEventListener("click", async () => {
try {
await postJSON("/api/auth/logout", {});

2
apps/server/internal/httpserver/static/sw.js
View File

@@ -1,4 +1,4 @@
const STATIC_CACHE = "md-hub-static-v7";
const STATIC_CACHE = "md-hub-static-v8";
const DB_NAME = "md-hub-cache";
const DB_VERSION = 3;
const STORE_PAGES = "pages";

14
apps/server/internal/httpserver/templates/account.gohtml
View File

@@ -66,6 +66,20 @@
</div>
<aside class="account-sidebar">
<section class="account-section">
<header class="account-section__header">
<div>
<p class="account-section__kicker">Security</p>
<h2>Passkeys</h2>
</div>
<p>Add a passkey to sign in with this device, a password manager, or a hardware security key.</p>
</header>
<form class="auth-form" data-passkey-add>
<button type="submit">Add passkey</button>
<p class="form-status" data-passkey-add-status></p>
</form>
</section>
<section class="account-section">
<header class="account-section__header">
<div>