mrhid6 934501f4ec fix(auth): store passkey backup flags so synced passkeys verify ...

go-webauthn refuses an assertion whose Backup Eligible flag differs from
the stored credential's. The flag was never stored, so it compared against
false and every synced passkey (iCloud Keychain, Google Password Manager,
1Password) failed with "Backup Eligible flag inconsistency" - in
passwordless sign-in, second-factor sign-in and step-up alike.

Registration now stores BackupEligible and BackupState. Rows registered
before this have no baseline, so their first verified assertion adopts the
signed flag and records it; a recorded value always stands, so a genuine
change is still refused.

2026-09-16 15:03:54 +00:00

..

cmd

feat(mfa): TOTP secrets, recovery codes and factor lookup

2026-09-16 08:30:55 +00:00

internal

fix(auth): store passkey backup flags so synced passkeys verify

2026-09-16 15:03:54 +00:00

Dockerfile

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

go.mod

feat(mfa): passkey verification as a second factor

2026-09-16 08:48:39 +00:00

go.sum

feat(mfa): passkey verification as a second factor

2026-09-16 08:48:39 +00:00