trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement Journal auth: passkeys + magic links, no passwords

Browse source 
Auth flows:
- Passkey registration: email + username → WebAuthn create → account + session
- Passkey login: WebAuthn get → session (instant, no form)
- Magic link fallback: email → token → verify link → session
- Logout via POST /auth/logout

Infrastructure:
- auth.server.ts: WebAuthn (SimpleWebAuthn), magic tokens, cookie sessions
- DB schema: credentials (WebAuthn), magic_tokens tables, no password_hash
- Session middleware via getSessionUser()

Pages:
- /auth/register — email + username + passkey creation
- /auth/login — passkey button + magic link fallback
- /auth/verify — magic link token verification
- /users/:username — public profile page
- Home page shows auth state (register/signin or welcome)

Dynamic imports for @simplewebauthn/browser to avoid SSR issues.
Magic links logged to console in dev (email integration later).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-23 17:38:46 +01:00
parent 3604a2d066
commit b65b61cbc5
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
13 changed files with 1004 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

18
openspec/changes/phase-1-mvp/tasks.md
View file

@ -63,16 +63,16 @@
## 7. Journal — Auth
- [ ] 7.1 Update DB schema: remove password_hash from users, add credentials table (WebAuthn) and magic_tokens table
- [ ] 7.2 Implement passkey registration flow (email + username → WebAuthn create → account created)
- [ ] 7.3 Implement passkey login flow (WebAuthn get → session created)
- [ ] 7.4 Implement magic link request (POST /api/auth/magic-link → send email with token)
- [ ] 7.5 Implement magic link verification (GET /auth/verify?token=... → session created)
- [x] 7.1 Update DB schema: remove password_hash from users, add credentials table (WebAuthn) and magic_tokens table
- [x] 7.2 Implement passkey registration flow (email + username → WebAuthn create → account created)
- [x] 7.3 Implement passkey login flow (WebAuthn get → session created)
- [x] 7.4 Implement magic link request (POST /api/auth/magic-link → send email with token)
- [x] 7.5 Implement magic link verification (GET /auth/verify?token=... → session created)
- [ ] 7.6 Implement "Add passkey" prompt after magic link login on new device
- [ ] 7.7 Implement session middleware (validate cookie, load user in loader context)
- [ ] 7.8 Implement logout (POST /api/auth/logout, invalidate session)
- [ ] 7.9 Implement user profile page (GET /users/:username)
- [ ] 7.10 Store federated identity format (@user@domain) in user record
- [x] 7.7 Implement session middleware (validate cookie, load user in loader context)
- [x] 7.8 Implement logout (POST /api/auth/logout, invalidate session)
- [x] 7.9 Implement user profile page (GET /users/:username)
- [x] 7.10 Store federated identity format (@user@domain) in user record
## 8. Journal — Route Management