03e03d87d9
Replace username/password authentication with FIDO2/WebAuthn passkey-based auth using webauthn-rs. Sessions and bearer tokens are unchanged — only the way they are created changes. - Add webauthn-rs, uuid, open, url deps; remove argon2, rpassword - Add passkey_credentials and registration_tokens tables (migrations 17-18) - Add domain entities, typed IDs, and repository traits for passkeys/tokens - Add SQL repository implementations for passkeys and registration tokens - Add ChallengeStore for in-memory WebAuthn ceremony state - Add WebAuthn route handlers (register/auth start+finish ceremonies) - Add CLI browser handoff for token creation (opens browser, local callback) - Replace login form with "Sign in with Passkey" button - Add registration page for first-user bootstrap via one-time token - Replace BREWLOG_ADMIN_USERNAME/PASSWORD with BREWLOG_RP_ID/RP_ORIGIN - Change default BREWLOG_URL from 127.0.0.1 to localhost (WebAuthn requires it)
34 lines
1.2 KiB
SQL
34 lines
1.2 KiB
SQL
-- Add UUID column to users for WebAuthn user handle
|
|
ALTER TABLE users ADD COLUMN uuid TEXT;
|
|
|
|
-- Backfill existing users with random v4 UUIDs
|
|
UPDATE users SET uuid =
|
|
lower(hex(randomblob(4))) || '-' ||
|
|
lower(hex(randomblob(2))) || '-' ||
|
|
'4' || substr(lower(hex(randomblob(2))), 2) || '-' ||
|
|
substr('89ab', abs(random()) % 4 + 1, 1) || substr(lower(hex(randomblob(2))), 2) || '-' ||
|
|
lower(hex(randomblob(6)));
|
|
|
|
-- Passkey credential storage
|
|
CREATE TABLE passkey_credentials (
|
|
id INTEGER PRIMARY KEY,
|
|
user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
credential_json TEXT NOT NULL,
|
|
name TEXT NOT NULL DEFAULT 'default',
|
|
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
last_used_at TEXT
|
|
);
|
|
|
|
CREATE INDEX idx_passkey_credentials_user_id ON passkey_credentials(user_id);
|
|
|
|
-- One-time registration tokens for bootstrap and invite flows
|
|
CREATE TABLE registration_tokens (
|
|
id INTEGER PRIMARY KEY,
|
|
token_hash TEXT NOT NULL UNIQUE,
|
|
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
|
|
expires_at TEXT NOT NULL,
|
|
used_at TEXT,
|
|
used_by_user_id INTEGER REFERENCES users(id)
|
|
);
|
|
|
|
CREATE INDEX idx_registration_tokens_token_hash ON registration_tokens(token_hash);
|