BuzzbeeSCD/openchamber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add passkey login for protected UI (#845)

Browse Source 
* feat(auth): add passkey login for protected UI

* fix: polish passkey setup and correct WebAuthn user IDs

* feat: improve passkey login management

* build: align passkey deps with upstream main

* refactor: move ui auth out of opencode module

---------

Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
This commit is contained in:
Dave Otero
2026-04-11 22:36:02 +03:00
committed by GitHub
co-authored by Bohdan Triapitsyn
parent 37cf7d9c79
commit 75a10ea66c
15 changed files with 1640 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/web/server/lib/opencode/DOCUMENTATION.md
+16 -16
View File
@@ -1,7 +1,7 @@
# OpenCode Module Documentation
## Purpose
This module provides OpenCode server integration utilities for the web server runtime, including configuration management, provider authentication, and UI authentication with rate limiting.
This module provides OpenCode server integration utilities for the web server runtime, including configuration management and provider authentication.
## Entrypoints and structure
- `packages/web/server/lib/opencode/index.js`: public entrypoint (currently baseline placeholder).
@@ -40,7 +40,8 @@ This module provides OpenCode server integration utilities for the web server ru
- `packages/web/server/lib/opencode/session-runtime.js`: session status/attention/activity runtime for OpenCode SSE events.
- `packages/web/server/lib/opencode/watcher.js`: global SSE watcher runtime for push/session event fanout.
- `packages/web/server/lib/opencode/shared.js`: shared utilities for config, markdown, skills, and git helpers.
- `packages/web/server/lib/opencode/ui-auth.js`: UI session authentication with rate limiting.
- `packages/web/server/lib/ui-auth/ui-auth.js`: UI session authentication runtime (outside OpenCode module).
- `packages/web/server/lib/ui-auth/ui-passkeys.js`: UI passkey storage and WebAuthn registration/authentication helpers (outside OpenCode module).
## Public exports (auth.js)
- `readAuthFile()`: Reads and parses `~/.local/share/opencode/auth.json`.
@@ -67,15 +68,6 @@ This module provides OpenCode server integration utilities for the web server ru
- `resolveSkillSearchDirectories(workingDirectory)`: Returns skill search path order (config, project, home, custom).
- `listSkillSupportingFiles(skillDir)`, `readSkillSupportingFile(skillDir, relativePath)`, `writeSkillSupportingFile(skillDir, relativePath, content)`, `deleteSkillSupportingFile(skillDir, relativePath)`: Skill supporting file management.
## Public exports (ui-auth.js)
- `createUiAuth({ password, cookieName, sessionTtlMs })`: Creates UI auth instance with methods:
- `enabled`: Boolean indicating if auth is configured.
- `requireAuth(req, res, next)`: Express middleware to enforce authentication.
- `handleSessionStatus(req, res)`: Returns authentication status.
- `handleSessionCreate(req, res)`: Handles login with rate limiting.
- `ensureSessionToken(req, res)`: Returns or creates session token.
- `dispose()`: Cleans up timers and state.
## Public exports (routes.js)
- `registerOpenCodeRoutes(app, dependencies)`: Registers OpenCode-owned HTTP routes and internal module runtime:
- `GET /api/config/settings`
@@ -230,11 +222,19 @@ This module provides OpenCode server integration utilities for the web server ru
- `GET /health`
- `POST /api/system/shutdown`
- `GET /api/system/info`
- `registerAuthAndAccessRoutes(app, dependencies)`: registers browser auth/session exchange and API access middleware:
- `GET /auth/session`
- `POST /auth/session`
- `GET /connect`
- `app.use('/api', ...)` auth/tunnel guard
- `registerAuthAndAccessRoutes(app, dependencies)`: registers browser auth/session exchange and API access middleware:
- `GET /auth/session`
- `POST /auth/session`
- `GET /auth/passkey/status`
- `POST /auth/passkey/authenticate/options`
- `POST /auth/passkey/authenticate/verify`
- `POST /auth/passkey/register/options`
- `POST /auth/passkey/register/verify`
- `GET /api/passkeys`
- `DELETE /api/passkeys/:id`
- `POST /api/auth/reset`
- `GET /connect`
- `app.use('/api', ...)` auth/tunnel guard
- `registerSettingsUtilityRoutes(app, dependencies)`: registers small settings utility endpoints:
- `GET /api/config/themes`
- `POST /api/config/reload`