feat(passkeys): Add passkeys support and related UI components

apps/api/.env.example

@@ -9,6 +9,14 @@ VITNODE_WEB_URL=http://localhost:3000
 # storage adapter, so it must match where the server is reachable.
 VITNODE_API_URL=http://localhost:8000
 
+# === Passkeys (WebAuthn) ===
+# Off unless `authorization.passkeys` is set in `vitnode.api.config.ts`.
+# `passkeys: true` binds passkeys to the hostname of `VITNODE_WEB_URL` and only
+# accepts that origin. Browsers allow them on HTTPS or on localhost. To share
+# passkeys between `example.com` and `forum.example.com`, pass
+# `{ rpId: "example.com", origins: [...] }` instead. Changing the RP ID later
+# makes every existing passkey unusable.
+
 # === CRON Secret for Internal API Calls ===
 CRON_SECRET=your-secure-cron-secret-key
 

apps/api/migrations/20260928114540_add_core_users_passkeys/migration.sql

@@ -0,0 +1,36 @@
+CREATE TABLE "core_users_passkey_challenges" (
+	"id" serial PRIMARY KEY,
+	"tokenHash" varchar(64) NOT NULL UNIQUE,
+	"ceremony" varchar(16) NOT NULL,
+	"challenge" varchar(128) NOT NULL,
+	"userId" integer,
+	"webauthnUserId" varchar(128),
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"expiresAt" timestamp NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "core_users_passkey_challenges" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "core_users_passkeys" (
+	"id" serial PRIMARY KEY,
+	"userId" integer NOT NULL,
+	"credentialId" varchar(1024) NOT NULL UNIQUE,
+	"publicKey" text NOT NULL,
+	"counter" bigint DEFAULT 0 NOT NULL,
+	"webauthnUserId" varchar(128) NOT NULL,
+	"transports" varchar(32)[] DEFAULT '{}'::varchar(32)[] NOT NULL,
+	"deviceType" varchar(32) NOT NULL,
+	"backedUp" boolean DEFAULT false NOT NULL,
+	"aaguid" varchar(36),
+	"name" varchar(64) NOT NULL,
+	"createdAt" timestamp DEFAULT now() NOT NULL,
+	"updatedAt" timestamp DEFAULT now() NOT NULL,
+	"lastUsedAt" timestamp
+);
+--> statement-breakpoint
+ALTER TABLE "core_users_passkeys" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE INDEX "core_users_passkey_challenges_expires_at_idx" ON "core_users_passkey_challenges" ("expiresAt");--> statement-breakpoint
+CREATE INDEX "core_users_passkey_challenges_user_id_idx" ON "core_users_passkey_challenges" ("userId");--> statement-breakpoint
+CREATE INDEX "core_users_passkeys_user_id_idx" ON "core_users_passkeys" ("userId");--> statement-breakpoint
+CREATE INDEX "core_users_passkeys_webauthn_user_id_idx" ON "core_users_passkeys" ("webauthnUserId");--> statement-breakpoint
+ALTER TABLE "core_users_passkey_challenges" ADD CONSTRAINT "core_users_passkey_challenges_userId_core_users_id_fkey" FOREIGN KEY ("userId") REFERENCES "core_users"("id") ON DELETE CASCADE;--> statement-breakpoint
+ALTER TABLE "core_users_passkeys" ADD CONSTRAINT "core_users_passkeys_userId_core_users_id_fkey" FOREIGN KEY ("userId") REFERENCES "core_users"("id") ON DELETE CASCADE;