@k2b/cloud 0.6.0-rc.0

package/src/services/weather/migrate.ts

@@ -0,0 +1,45 @@
+import { sql } from "bun";
+import { backfillWeatherLocationShortIds } from "./short-id";
+
+export const migrate = async (): Promise<void> => {
+  await sql`
+    CREATE TABLE IF NOT EXISTS weather_locations (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      short_id TEXT,
+      user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      state TEXT,
+      lat DOUBLE PRECISION NOT NULL,
+      lon DOUBLE PRECISION NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `.simple();
+  console.log("  ✓ weather_locations table");
+
+  await sql`ALTER TABLE weather_locations ADD COLUMN IF NOT EXISTS short_id TEXT`.simple();
+  await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_weather_locations_short_id ON weather_locations(short_id)`.simple();
+
+  await sql.begin(async (tx) => {
+    await tx`SELECT pg_advisory_xact_lock(hashtext('cloud.weather.location-short-id-backfill'))`;
+    const filled = await backfillWeatherLocationShortIds(tx);
+    if (filled > 0) console.log(`  ✓ weather location short_id backfill: ${filled}`);
+    await tx`ALTER TABLE weather_locations ALTER COLUMN short_id SET NOT NULL`;
+    await tx`ALTER TABLE weather_locations DROP CONSTRAINT IF EXISTS weather_locations_short_id_format`;
+    await tx`
+      ALTER TABLE weather_locations
+      ADD CONSTRAINT weather_locations_short_id_format CHECK (short_id ~ '^[0-9A-Za-z]{6}$')
+    `;
+  });
+
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_weather_locations_user
+    ON weather_locations(user_id)
+  `.simple();
+  console.log("  ✓ weather_locations index");
+
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_weather_locations_user_created
+    ON weather_locations(user_id, created_at, id)
+  `.simple();
+  console.log("  ✓ weather_locations pagination index");
+};

package/src/services/weather/settings.ts

@@ -0,0 +1,66 @@
+export const WEATHER_SETTINGS = {
+  "weather.default_lat": {
+    kind: "string",
+    label: "Default Latitude",
+    default: "",
+    description: "Default latitude shown in weather widgets",
+    placeholder: "e.g. 48.401082 (Ulm)",
+    presentation: {
+      translations: {
+        de: {
+          label: "Standardbreitengrad",
+          description: "In Wetter-Widgets angezeigter Standardbreitengrad",
+          placeholder: "z. B. 48.401082 (Ulm)",
+        },
+      },
+    },
+  },
+  "weather.default_lon": {
+    kind: "string",
+    label: "Default Longitude",
+    default: "",
+    description: "Default longitude shown in weather widgets",
+    placeholder: "e.g. 9.987608 (Ulm)",
+    presentation: {
+      translations: {
+        de: {
+          label: "Standardlängengrad",
+          description: "In Wetter-Widgets angezeigter Standardlängengrad",
+          placeholder: "z. B. 9.987608 (Ulm)",
+        },
+      },
+    },
+  },
+  "weather.cache_minutes": {
+    kind: "number",
+    label: "Cache TTL (minutes)",
+    default: 30,
+    min: 1,
+    max: 1440,
+    description: "How long weather data is cached before fetching fresh data (in minutes)",
+    presentation: {
+      translations: {
+        de: {
+          label: "Cache-TTL (Minuten)",
+          description: "Dauer in Minuten, für die Wetterdaten vor dem nächsten Abruf zwischengespeichert werden",
+        },
+      },
+    },
+  },
+  "weather.geo_url": {
+    kind: "url",
+    label: "Geo API URL",
+    default: "",
+    description: "Geocoding API URL for the location search feature",
+    placeholder: "e.g. https://geocoding.example.com/search",
+    presentation: {
+      translations: {
+        de: {
+          label: "Geo-API-URL",
+          description: "Geocoding-API-URL für die Ortssuche",
+          placeholder: "z. B. https://geocoding.example.com/search",
+        },
+      },
+    },
+  },
+} as const;

package/src/services/weather/short-id.ts

@@ -0,0 +1,57 @@
+import { crypto } from "@k2b/stdlib";
+import { sql } from "bun";
+import { isUniqueViolation } from "../postgres";
+
+export const WEATHER_LOCATION_SHORT_ID_PATTERN = /^[0-9A-Za-z]{6}$/;
+
+const SHORT_ID_LENGTH = 6;
+const MAX_ATTEMPTS = 10;
+const BACKFILL_BATCH_SIZE = 500;
+const UNIQUE_CONSTRAINT = "idx_weather_locations_short_id";
+
+type SqlExecutor = typeof sql;
+
+export const newWeatherLocationShortId = (): string => crypto.common.readableId(SHORT_ID_LENGTH);
+
+export const withWeatherLocationShortId = async <T>(write: (shortId: string) => Promise<T | null>): Promise<T> => {
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    try {
+      const result = await write(newWeatherLocationShortId());
+      if (result !== null) return result;
+    } catch (error) {
+      if (!isUniqueViolation(error, UNIQUE_CONSTRAINT)) throw error;
+    }
+  }
+  throw new Error("Failed to allocate a Weather location short ID");
+};
+
+export const backfillWeatherLocationShortIds = async (db: SqlExecutor = sql): Promise<number> => {
+  let filled = 0;
+  for (;;) {
+    const rows = await db<{ id: string }[]>`
+      SELECT id
+      FROM weather_locations
+      WHERE short_id IS NULL
+      ORDER BY id
+      LIMIT ${BACKFILL_BATCH_SIZE}
+      FOR UPDATE
+    `;
+    if (rows.length === 0) return filled;
+
+    for (const row of rows) {
+      await withWeatherLocationShortId(async (shortId) => {
+        const updated = await db<{ id: string }[]>`
+          UPDATE weather_locations
+          SET short_id = ${shortId}
+          WHERE id = ${row.id}::uuid
+            AND short_id IS NULL
+            AND NOT EXISTS (SELECT 1 FROM weather_locations WHERE short_id = ${shortId})
+          RETURNING id
+        `;
+        if (updated.length === 0) return null;
+        filled++;
+        return updated[0]!;
+      });
+    }
+  }
+};

package/src/services/weather/types.ts

@@ -0,0 +1,61 @@
+/** Weather icon codes from Brightsky API */
+export type WeatherIcon =
+  | "clear-day"
+  | "clear-night"
+  | "partly-cloudy-day"
+  | "partly-cloudy-night"
+  | "cloudy"
+  | "fog"
+  | "wind"
+  | "rain"
+  | "sleet"
+  | "snow"
+  | "hail"
+  | "thunderstorm";
+
+/** Current weather data */
+export type CurrentWeather = {
+  temperature: number; // deg C
+  icon: WeatherIcon;
+  cloudCover: number; // 0-100%
+  windSpeed: number; // km/h
+  windGust: number | null; // km/h
+  windDirection: number | null; // degrees
+  humidity: number | null; // 0-100%
+  precipitation: number; // mm in last hour
+  pressure: number | null; // hPa
+  visibility: number | null; // meters
+  dewPoint: number | null; // deg C
+  sunshine: number | null; // minutes in last hour
+  stationName: string;
+  timestamp: string; // ISO timestamp
+};
+
+/** Hourly forecast entry */
+export type HourlyForecast = {
+  timestamp: string;
+  temperature: number;
+  icon: WeatherIcon;
+  precipitation: number;
+  precipitationProbability: number | null; // 0-100%
+  windSpeed: number;
+  cloudCover: number;
+};
+
+/** Daily forecast summary */
+export type DailyForecast = {
+  date: string; // YYYY-MM-DD
+  tempMin: number;
+  tempMax: number;
+  icon: WeatherIcon;
+  precipitation: number; // total mm
+  precipitationProbability: number | null; // max probability for the day
+  sunshine: number; // total minutes
+};
+
+/** Full weather data with forecasts */
+export type WeatherData = {
+  current: CurrentWeather;
+  hourly: HourlyForecast[];
+  daily: DailyForecast[];
+};

package/src/services/weather/ui.ts

@@ -0,0 +1,50 @@
+import type { WeatherIcon } from "./types";
+
+/** Map Brightsky icon to Tabler icon name. */
+const getTablerIcon = (icon: WeatherIcon): string => {
+  const iconMap: Record<WeatherIcon, string> = {
+    "clear-day": "sun",
+    "clear-night": "moon",
+    "partly-cloudy-day": "sun-moon",
+    "partly-cloudy-night": "sun-moon",
+    cloudy: "cloud",
+    fog: "mist",
+    wind: "wind",
+    rain: "cloud-rain",
+    sleet: "cloud-snow",
+    snow: "snowflake",
+    hail: "cloud-snow",
+    thunderstorm: "cloud-storm",
+  };
+  return iconMap[icon] ?? "cloud";
+};
+
+/** Get Tailwind color class for temperature. */
+const getTempColorClass = (temp: number): string => {
+  if (temp <= 0) return "text-blue-400";
+  if (temp <= 10) return "text-cyan-500";
+  if (temp <= 20) return "text-emerald-500";
+  if (temp <= 25) return "text-amber-500";
+  return "text-red-500";
+};
+
+/** Get temperature color class for an average of min/max. */
+const getAvgTempColorClass = (tempMin: number, tempMax: number): string => {
+  return getTempColorClass((tempMin + tempMax) / 2);
+};
+
+/** Format temperature with degree symbol. */
+const formatTemp = (temp: number): string => `${temp}°`;
+
+/** Format temperature range (e.g., "12° / 5°"). */
+const formatTempRange = (tempMax: number, tempMin: number): string => `${tempMax}° / ${tempMin}°`;
+
+export const weatherUiService = {
+  getTablerIcon,
+  getTempColorClass,
+  getAvgTempColorClass,
+  formatTemp,
+  formatTempRange,
+};
+
+export type WeatherUiService = typeof weatherUiService;

package/src/services/webauthn.ts

@@ -0,0 +1,385 @@
+import {
+  type AuthenticationResponseJSON,
+  type AuthenticatorTransportFuture,
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  type PublicKeyCredentialCreationOptionsJSON,
+  type PublicKeyCredentialRequestOptionsJSON,
+  type RegistrationResponseJSON,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+  type WebAuthnCredential,
+} from "@simplewebauthn/server";
+import { err, fail, ok, type Result } from "@k2b/stdlib";
+import { redis, sql } from "bun";
+import type { User, WebAuthnPasskey } from "../contracts/shared";
+import { accounts } from "./accounts";
+import { audit } from "./audit";
+import { logger } from "./logging";
+import { isUniqueViolation, toPgTextArray } from "./postgres";
+import { coreSettings } from "./settings/api";
+
+const CHALLENGE_TTL_SECONDS = 300;
+const REGISTRATION_CHALLENGE_PREFIX = "webauthn:registration:";
+const AUTHENTICATION_CHALLENGE_PREFIX = "webauthn:authentication:";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{12}$/i;
+const log = logger("auth:webauthn");
+
+type DbPasskeyRow = {
+  id: string;
+  user_id: string;
+  name: string;
+  credential_id: string;
+  public_key: Uint8Array;
+  counter: string | number | bigint;
+  transports: string[];
+  device_type: string | null;
+  backed_up: boolean;
+  created_at: Date;
+  last_used_at: Date | null;
+};
+
+type DbPasskeyWithUserRow = DbPasskeyRow & {
+  user_account_expires: Date | null;
+};
+
+type StoredWebAuthnPasskey = WebAuthnPasskey & {
+  credentialId: string;
+};
+
+export type WebAuthnRp = {
+  rpName: string;
+  rpID: string;
+  origin: string;
+};
+
+export const resolveWebAuthnRp = (config: { appUrl: string; appName: string }): WebAuthnRp => {
+  const rawAppUrl = config.appUrl.trim();
+  const hasProtocol = /^https?:\/\//i.test(rawAppUrl);
+  const parseUrl = (value: string) => new URL(value);
+  const hostname = hasProtocol ? parseUrl(rawAppUrl).hostname : parseUrl(`https://${rawAppUrl}`).hostname;
+  const isBareLocalhost =
+    !hasProtocol && (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]");
+  const withProtocol = hasProtocol ? rawAppUrl : `${isBareLocalhost ? "http" : "https"}://${rawAppUrl}`;
+  const url = new URL(withProtocol);
+  const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) {
+    throw new Error("WebAuthn requires an HTTPS app.url, except for localhost development.");
+  }
+  return {
+    rpName: config.appName.trim() || "Cloud",
+    rpID: url.hostname,
+    origin: url.origin,
+  };
+};
+
+const loadRp = async (): Promise<WebAuthnRp> =>
+  resolveWebAuthnRp({
+    appUrl: await coreSettings.get<string>("app.url"),
+    appName: await coreSettings.get<string>("app.name"),
+  });
+
+const loadRpResult = async (): Promise<Result<WebAuthnRp>> => {
+  try {
+    return ok(await loadRp());
+  } catch (error) {
+    return fail(err.badInput(error instanceof Error ? error.message : "Invalid WebAuthn configuration."));
+  }
+};
+
+const mapStoredPasskey = (row: DbPasskeyRow): StoredWebAuthnPasskey => ({
+  id: row.id,
+  userId: row.user_id,
+  name: row.name,
+  credentialId: row.credential_id,
+  transports: row.transports ?? [],
+  deviceType: row.device_type,
+  backedUp: row.backed_up,
+  createdAt: row.created_at.toISOString(),
+  lastUsedAt: row.last_used_at?.toISOString() ?? null,
+});
+
+const mapPasskey = (row: DbPasskeyRow): WebAuthnPasskey => {
+  const { credentialId: _, ...passkey } = mapStoredPasskey(row);
+  return passkey;
+};
+
+const actorForUser = (user: Pick<User, "id" | "uid" | "provider" | "roles">) => ({
+  userId: user.id,
+  uid: user.uid,
+  provider: user.provider,
+  roles: user.roles,
+});
+
+const challengeKey = (prefix: string, id: string) => `${prefix}${id}`;
+
+const storeRegistrationChallenge = async (userId: string, challenge: string): Promise<void> => {
+  await redis.set(challengeKey(REGISTRATION_CHALLENGE_PREFIX, userId), challenge, "EX", CHALLENGE_TTL_SECONDS);
+};
+
+const consumeRegistrationChallenge = async (userId: string): Promise<string | null> => {
+  return redis.getdel(challengeKey(REGISTRATION_CHALLENGE_PREFIX, userId));
+};
+
+const storeAuthenticationChallenge = async (challenge: string): Promise<void> => {
+  await redis.set(challengeKey(AUTHENTICATION_CHALLENGE_PREFIX, challenge), "1", "EX", CHALLENGE_TTL_SECONDS);
+};
+
+const consumeAuthenticationChallenge = async (challenge: string): Promise<boolean> => {
+  const value = await redis.getdel(challengeKey(AUTHENTICATION_CHALLENGE_PREFIX, challenge));
+  return value === "1";
+};
+
+const userIdToWebAuthnBytes = (userId: string): WebAuthnCredential["publicKey"] =>
+  new TextEncoder().encode(userId) as WebAuthnCredential["publicKey"];
+
+const toCredential = (row: DbPasskeyRow): WebAuthnCredential => ({
+  id: row.credential_id,
+  publicKey: new Uint8Array(row.public_key) as WebAuthnCredential["publicKey"],
+  counter: Number(row.counter),
+  transports: (row.transports ?? []) as AuthenticatorTransportFuture[],
+});
+
+const isExpired = (date: Date | null): boolean => Boolean(date && date.getTime() <= Date.now());
+
+const listStoredForUser = async (params: { userId: string }): Promise<StoredWebAuthnPasskey[]> => {
+  const rows = await sql<DbPasskeyRow[]>`
+    SELECT id, user_id, name, credential_id, public_key, counter, transports, device_type,
+      backed_up, created_at, last_used_at
+    FROM auth.webauthn_credentials
+    WHERE user_id = ${params.userId}::uuid
+    ORDER BY created_at DESC
+  `;
+  return rows.map(mapStoredPasskey);
+};
+
+export const listForUser = async (params: { userId: string }): Promise<WebAuthnPasskey[]> => {
+  const rows = await listStoredForUser(params);
+  return rows.map(({ credentialId: _, ...passkey }) => passkey);
+};
+
+export const beginRegistration = async (params: { user: User }): Promise<Result<PublicKeyCredentialCreationOptionsJSON>> => {
+  const rpResult = await loadRpResult();
+  if (!rpResult.ok) return rpResult;
+  const rp = rpResult.data;
+  const existing = await listStoredForUser({ userId: params.user.id });
+  const options = await generateRegistrationOptions({
+    rpName: rp.rpName,
+    rpID: rp.rpID,
+    userID: userIdToWebAuthnBytes(params.user.id),
+    userName: params.user.mail ?? params.user.uid,
+    userDisplayName: params.user.displayName || params.user.uid,
+    attestationType: "none",
+    authenticatorSelection: {
+      residentKey: "required",
+      userVerification: "required",
+    },
+    excludeCredentials: existing.map((credential) => ({
+      id: credential.credentialId,
+      transports: credential.transports as AuthenticatorTransportFuture[],
+    })),
+  });
+
+  await storeRegistrationChallenge(params.user.id, options.challenge);
+  return ok(options);
+};
+
+export const finishRegistration = async (params: {
+  user: User;
+  name: string;
+  response: RegistrationResponseJSON;
+}): Promise<Result<WebAuthnPasskey>> => {
+  const name = params.name.trim();
+  if (!name) return fail(err.badInput("Passkey name is required."));
+  if (name.length > 120) return fail(err.badInput("Passkey name must be 120 characters or fewer."));
+
+  const expectedChallenge = await consumeRegistrationChallenge(params.user.id);
+  if (!expectedChallenge) return fail(err.badInput("Passkey registration expired. Please try again."));
+
+  const rpResult = await loadRpResult();
+  if (!rpResult.ok) return rpResult;
+  const rp = rpResult.data;
+  const verification = await verifyRegistrationResponse({
+    response: params.response,
+    expectedChallenge,
+    expectedOrigin: rp.origin,
+    expectedRPID: rp.rpID,
+    requireUserVerification: true,
+  }).catch((error) => {
+    log.warn("Passkey registration verification failed", {
+      userId: params.user.id,
+      rpID: rp.rpID,
+      origin: rp.origin,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  });
+  if (!verification) return fail(err.badInput("Passkey registration could not be verified."));
+  if (!verification.verified) return fail(err.badInput("Passkey registration could not be verified."));
+
+  const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+  const transports = params.response.response.transports ?? [];
+
+  try {
+    return sql.begin(async (tx) => {
+      const [row] = await tx<DbPasskeyRow[]>`
+        INSERT INTO auth.webauthn_credentials (
+          user_id,
+          name,
+          credential_id,
+          public_key,
+          counter,
+          transports,
+          device_type,
+          backed_up
+        )
+        VALUES (
+          ${params.user.id}::uuid,
+          ${name},
+          ${credential.id},
+          ${Buffer.from(credential.publicKey)},
+          ${credential.counter},
+          ${toPgTextArray(transports)}::text[],
+          ${credentialDeviceType},
+          ${credentialBackedUp}
+        )
+        RETURNING id, user_id, name, credential_id, public_key, counter, transports, device_type,
+          backed_up, created_at, last_used_at
+      `;
+      const result = row ? ok(mapPasskey(row)) : fail(err.badInput("Passkey could not be saved."));
+      return audit.recordResult({
+        action: "webauthn_credential.create",
+        actor: actorForUser(params.user),
+        target: { type: "webauthn_credential", id: row?.id ?? null, label: name },
+        metadata: {
+          deviceType: credentialDeviceType,
+          backedUp: credentialBackedUp,
+          transports,
+        },
+        result,
+        db: tx,
+      });
+    });
+  } catch (error) {
+    if (isUniqueViolation(error)) return fail(err.conflict("Passkey"));
+    throw error;
+  }
+};
+
+export const beginAuthentication = async (): Promise<Result<PublicKeyCredentialRequestOptionsJSON>> => {
+  const rpResult = await loadRpResult();
+  if (!rpResult.ok) return rpResult;
+  const rp = rpResult.data;
+  const options = await generateAuthenticationOptions({
+    rpID: rp.rpID,
+    userVerification: "required",
+  });
+  await storeAuthenticationChallenge(options.challenge);
+  return ok(options);
+};
+
+const findCredentialForAuthentication = async (credentialId: string): Promise<DbPasskeyWithUserRow | null> => {
+  const [row] = await sql<DbPasskeyWithUserRow[]>`
+    SELECT c.id, c.user_id, c.name, c.credential_id, c.public_key, c.counter, c.transports,
+      c.device_type, c.backed_up, c.created_at, c.last_used_at, u.account_expires AS user_account_expires
+    FROM auth.webauthn_credentials c
+    JOIN auth.users u ON u.id = c.user_id
+    WHERE c.credential_id = ${credentialId}
+    LIMIT 1
+  `;
+  return row ?? null;
+};
+
+export const finishAuthentication = async (params: {
+  response: AuthenticationResponseJSON;
+}): Promise<Result<{ user: User; passkey: WebAuthnPasskey }>> => {
+  const row = await findCredentialForAuthentication(params.response.id);
+  if (!row) return fail(err.unauthenticated("Passkey could not be verified."));
+  if (isExpired(row.user_account_expires)) return fail(err.forbidden("Your account has expired. Contact an administrator."));
+
+  const rpResult = await loadRpResult();
+  if (!rpResult.ok) return rpResult;
+  const rp = rpResult.data;
+  const verification = await verifyAuthenticationResponse({
+    response: params.response,
+    expectedChallenge: consumeAuthenticationChallenge,
+    expectedOrigin: rp.origin,
+    expectedRPID: rp.rpID,
+    credential: toCredential(row),
+    requireUserVerification: true,
+  }).catch((error) => {
+    log.warn("Passkey authentication verification failed", {
+      credentialId: row.id,
+      userId: row.user_id,
+      rpID: rp.rpID,
+      origin: rp.origin,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  });
+  if (!verification) return fail(err.unauthenticated("Passkey could not be verified."));
+  if (!verification.verified) return fail(err.unauthenticated("Passkey could not be verified."));
+
+  const user = await accounts.users.get({ id: row.user_id });
+  if (!user) return fail(err.unauthenticated("Passkey user not found."));
+  if (user.accountExpires && new Date(user.accountExpires).getTime() <= Date.now()) {
+    return fail(err.forbidden("Your account has expired. Contact an administrator."));
+  }
+
+  return sql.begin(async (tx) => {
+    const [updated] = await tx<DbPasskeyRow[]>`
+      UPDATE auth.webauthn_credentials
+      SET counter = ${verification.authenticationInfo.newCounter},
+        device_type = ${verification.authenticationInfo.credentialDeviceType},
+        backed_up = ${verification.authenticationInfo.credentialBackedUp},
+        last_used_at = now()
+      WHERE id = ${row.id}::uuid
+      RETURNING id, user_id, name, credential_id, public_key, counter, transports, device_type,
+        backed_up, created_at, last_used_at
+    `;
+    const passkey = mapPasskey(updated ?? row);
+    const result = ok({ user, passkey });
+    return audit.recordResult({
+      action: "webauthn_credential.authenticate",
+      actor: actorForUser(user),
+      target: { type: "webauthn_credential", id: row.id, label: row.name },
+      metadata: {
+        deviceType: verification.authenticationInfo.credentialDeviceType,
+        backedUp: verification.authenticationInfo.credentialBackedUp,
+      },
+      result,
+      db: tx,
+    });
+  });
+};
+
+export const deleteForUser = async (params: { user: User; id: string }): Promise<Result<void>> => {
+  if (!UUID_PATTERN.test(params.id)) return fail(err.notFound("Passkey"));
+
+  return sql.begin(async (tx) => {
+    const [row] = await tx<Pick<DbPasskeyRow, "id" | "name">[]>`
+      DELETE FROM auth.webauthn_credentials
+      WHERE id = ${params.id}::uuid
+        AND user_id = ${params.user.id}::uuid
+      RETURNING id, name
+    `;
+    const result = row ? ok() : fail(err.notFound("Passkey"));
+    return audit.recordResult({
+      action: "webauthn_credential.delete",
+      actor: actorForUser(params.user),
+      target: { type: "webauthn_credential", id: params.id, label: row?.name ?? null },
+      result,
+      db: tx,
+    });
+  });
+};
+
+export const webauthn = {
+  resolveWebAuthnRp,
+  listForUser,
+  beginRegistration,
+  finishRegistration,
+  beginAuthentication,
+  finishAuthentication,
+  deleteForUser,
+};