Dave OteroandBohdan Triapitsyn
75a10ea66c
* feat(auth): add passkey login for protected UI * fix: polish passkey setup and correct WebAuthn user IDs * feat: improve passkey login management * build: align passkey deps with upstream main * refactor: move ui auth out of opencode module --------- Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>
39 lines
1.6 KiB
Markdown
39 lines
1.6 KiB
Markdown
# UI Auth Module Documentation
|
|
|
|
## Purpose
|
|
This module owns OpenChamber UI authentication for browser access, including password session auth, WebAuthn passkeys, and trusted-device session handling.
|
|
|
|
## Entrypoints and structure
|
|
- `packages/web/server/lib/ui-auth/ui-auth.js`: UI auth controller runtime, cookie/session issuance, rate limiting, and auth route handlers.
|
|
- `packages/web/server/lib/ui-auth/ui-passkeys.js`: passkey store and WebAuthn registration/authentication verification helpers.
|
|
|
|
## Public exports (ui-auth.js)
|
|
- `createUiAuth({ password, cookieName, sessionTtlMs, readSettingsFromDiskMigrated })`: creates UI auth controller with methods:
|
|
- `enabled`
|
|
- `requireAuth(req, res, next)`
|
|
- `handleSessionStatus(req, res)`
|
|
- `handleSessionCreate(req, res)`
|
|
- `handlePasskeyStatus(req, res)`
|
|
- `handlePasskeyRegistrationOptions(req, res)`
|
|
- `handlePasskeyRegistrationVerify(req, res)`
|
|
- `handlePasskeyAuthenticationOptions(req, res)`
|
|
- `handlePasskeyAuthenticationVerify(req, res)`
|
|
- `handlePasskeyList(req, res)`
|
|
- `handlePasskeyRevoke(req, res)`
|
|
- `handleResetAuth(req, res)`
|
|
- `ensureSessionToken(req, res)`
|
|
- `dispose()`
|
|
|
|
## Public exports (ui-passkeys.js)
|
|
- `createUiPasskeys({ passwordBinding, readSettingsFromDiskMigrated, storeFile, rpName, challengeTtlMs })`: creates passkey runtime with methods:
|
|
- `enabled`
|
|
- `getStatus(req)`
|
|
- `listPasskeys(req)`
|
|
- `revokePasskey(req, passkeyId)`
|
|
- `clearAllPasskeys()`
|
|
- `beginRegistration(req, { label })`
|
|
- `finishRegistration(payload)`
|
|
- `beginAuthentication(req)`
|
|
- `finishAuthentication(payload)`
|
|
- `dispose()`
|