aneurinandClaude Sonnet 5
afdd53ec4c
New library dependency: lbuchs/webauthn (^2.2, MIT, zero transitive deps
beyond PHP+OpenSSL+Mbstring, both already required). 'none' attestation --
this only confirms "the same device that registered", not hardware
provenance, the standard trust model for a public site's own passkey login.
Backend
- migrations/010: `passkeys` (one row per registered credential: owner,
credential_id, public_key, sign_count, label) and `webauthn_challenges`
(short-lived, single-use, bridging each ceremony's "options" and "verify"
calls -- user_id set for a registration, null for a login since who's
signing in isn't known until the credential comes back).
- Config: WEBAUTHN_RP_ID (defaults to APP_URL's host) and WEBAUTHN_RP_NAME.
- PasskeyRepository, WebAuthnChallengeRepository, PasskeyController:
GET/POST /api/passkeys, POST /api/passkeys/options, DELETE
/api/passkeys/{id} (all auth), plus the public POST /api/auth/passkey/
options and /verify for login. Registration always asks for a
discoverable, user-verified credential -- what makes login usernameless:
the browser offers whatever passkeys it has for the site, no email first.
- SessionPayload now also exposes `has_passkey` on every user object
(PasskeyRepository::countForUser() > 0), reused by both the profile page
and the dismissible notice.
- PasskeyTest: auth guards, options response shape, challenge single-use/
expiry/purpose/cross-user rules, malformed-input handling, list/remove
CRUD (seeded rows) -- everything short of a real signature, which isn't
practical from PHPUnit. 73 tests pass.
Frontend
- lib/webauthn.ts: base64url <-> ArrayBuffer conversion and the two
ceremonies (registerPasskey, loginWithPasskey), matching the API's wire
format exactly.
- ProfileView: a Passkeys section -- list with Remove buttons, an "Add a
passkey" form (label pre-filled from a UA guess).
- LoginView: a "Log in with a passkey" button above the email form, shown
only when the browser supports WebAuthn.
- PasskeyNotice.vue: dismissible banner across the top of the page
(`user.has_passkey === false`); dismissal is a week-long localStorage
timestamp.
Verified against the rebuilt container using a Chrome DevTools Protocol
*virtual authenticator* (real ECDSA signing, no human interaction) end to
end: notice shown -> register a passkey -> notice gone (same page and after
navigating) -> log out -> "Log in with a passkey" with no email typed ->
correct account, notice still gone -> remove the passkey -> notice back ->
dismiss -> stays hidden for ~7 days across pages. Along the way, caught and
fixed a real bug: AuthenticatorData::getCredentialId() returns a raw binary
string, not a ByteBuffer like most of this library's other binary fields --
bin2hex() it directly rather than calling ->getHex().
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
66 lines
1.4 KiB
TypeScript
66 lines
1.4 KiB
TypeScript
export interface User {
|
|
id: number
|
|
email: string
|
|
email_verified: boolean
|
|
email_verified_at: string | null
|
|
/** A confirmed-but-not-yet-applied email change is waiting on this address. */
|
|
pending_email: string | null
|
|
/** Whether this user has at least one registered passkey. */
|
|
has_passkey: boolean
|
|
created_at: string | null
|
|
}
|
|
|
|
export interface AuthResponse {
|
|
user: User
|
|
token: string
|
|
expires_at: string
|
|
}
|
|
|
|
export interface Passkey {
|
|
id: number
|
|
label: string
|
|
created_at: string
|
|
last_used_at: string | null
|
|
}
|
|
|
|
export interface Project {
|
|
id: number
|
|
title: string
|
|
description: string
|
|
owner_id: number
|
|
card_count: number
|
|
completed_count: number
|
|
created_at: string
|
|
updated_at: string
|
|
}
|
|
|
|
/** A project-specific card status ("To do", "Doing", "Done", …). */
|
|
export interface CardStatus {
|
|
id: number
|
|
name: string
|
|
}
|
|
|
|
/**
|
|
* A card either sits in its owner's global inbox (project_id and status_id
|
|
* both null) or belongs to one project with a status in it (both set).
|
|
*/
|
|
export interface Card {
|
|
id: number
|
|
project_id: number | null
|
|
text: string
|
|
complete: boolean
|
|
position: number
|
|
status_id: number | null
|
|
status: CardStatus | null
|
|
created_at: string
|
|
updated_at: string
|
|
}
|
|
|
|
/** Shape of every error body returned by the API. */
|
|
export interface ApiErrorBody {
|
|
error: {
|
|
message: string
|
|
details?: Record<string, string[]>
|
|
}
|
|
}
|