hezo/src/shared/ at main · burrito.space/hezo · Tangled

burrito.space / hezo

0

group conversations with models and local files

0

hezo / src / shared /

at main 1 file

dietrich ayala Symmetric auth: passphrase-only accounts can add a passkey 1mo ago

Symmetric auth: passphrase-only accounts can add a passkey Closes the asymmetry from the previous commit. New endpoint /api/auth/passkey/enroll/{begin,finish} lets an already-authenticated user attach a passkey to their account. The new passkey's PRF output derives a wrap key (domain-separated via INFO_PASSKEY_MASTER_WRAP) that wraps the in-memory master; the ciphertext lands in users.wrapped_master_passkey. Future passkey logins unwrap with that key to recover the same master that a passphrase login would yield. - migration v6: ALTER TABLE users ADD COLUMN wrapped_master_passkey BLOB (nullable) - server/auth.ts: makePasskeyEnrollOptions + finishPasskeyEnroll; finishAuthentication now returns wrappedMasterPasskey (null for legacy passkey-first signups whose master IS the PRF result) - server/index.ts: enroll routes + login finish ships the wrap blob - Identity gains hasPasskey, computed everywhere alongside hasPassphrase - crypto.ts: derivePasskeyMasterWrapKey (HKDF info "hezo.passkey-master-wrap.v1") — distinct from the project wrap key so neither leaks the other on compromise - src/lib/auth.ts: loginPasskey unwraps when the server returns a blob, else falls back to master = PRF; enrollPasskey(email, master) runs the ceremony, wraps, and posts - App.tsx: SettingsModal grows a parallel "Enroll passkey on this device" section (visible only when hasPasskey is false); PasskeyNudge banner mirrors PassphraseNudge; on successful enrollment, the in-memory identity is optimistically updated so the banner + section disappear without a server round-trip

1 month ago