Repository navigation
feat(auth): open Lens's other addresses signed in, to add a passkey there - #537
Merged
Merged
Conversation
…here A passkey works only at the address it was made at, so one made at localhost or on the network didn't work at the Remote access or HTTPS address, and getting one there needed a sign-in link from email or an admin. Profile › Passkeys now lists Lens's other addresses (GET /auth/passkeys/elsewhere) with Open signed in (POST): a 15-minute, one-time sign-in link of your own at that address, for people signed in themselves only, leaving other links alone. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CXpr1EWCfUD5tb1SmSwfDa
17 of 23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Before: a passkey works only at the address it was made at, so one made at
localhostor on the network failed at the Remote access (tunnel) or HTTPS address, and getting a passkey there took a sign-in link from email or from an admin. Remote access in the browser worked; signing in there with your passkey did not.After: Profile and sign-in › Passkeys lists Lens's other addresses, each saying whether you have a passkey for it, with Open signed in next to one you don't. It opens that address with a 15-minute, one-time sign-in link of your own, where one fingerprint adds a passkey for it and signs you in. No email, admin or copied link. When a passkey sign-in is cancelled or matches nothing, the sign-in page says a passkey works only where it was made and points to Open signed in.
How:
GET /api/v1/auth/passkeys/elsewherelists the addresses Lens opens at (FRONTEND_URL,server.allowed_hosts, the Remote access and HTTPS addresses) with a per-address passkey check;POSTmints a sign-in link through the existing magic-link code for the signed-in user only (never an API token or app), leaves other links alone and audits it aspasskey.elsewhere. The web app'swebauthn.tsgainspasskeySignInMessagefor the cancelled/no-match hint. Remote access's quick address changes each start, so the docs say to use your own domain to keep a passkey.Motivation and Context
The owner asked whether passkeys work at the remote URL and said he didn't think so. They don't by WebAuthn's design (the RP ID is the host), so this gives the person a one-click way to add one at the other address instead. Follows #402 and #508, which made the file shares and MQTT reachable through Remote access.
Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly.## UnreleasedinCHANGELOG.md.Done questions (AGENTS.md)
GET/POST /api/v1/auth/passkeys/elsewherein the OpenAPI; the mint is for people signed in themselves, by design, since it hands out a sign-in.test_taking_your_sign_in_to_another_address,test_the_addresses_lens_opens_at; webpasskeys-panel.test.tsx,webauthn.test.ts), docs and generated files (make openapi) updated.Local CI (
ci/local-ci.sh): FastAPI, Next.js, pre-commit and PR title pass; after the rebase onto #508 the passkey tests (18 backend, 22 web) and the threat-model validator pass again.Generated by Claude Code