@pablozaiden/webapp 0.1.0 → 0.2.0

package/src/server/auth/device-auth.ts

@@ -7,12 +7,13 @@ import {
   type CryptoKey,
   type JWK,
 } from "jose";
-import type { AuthSessionSummary, DeviceAuthorizationResponse, DeviceVerificationDetails, TokenResponse } from "../../contracts";
+import type { AuthSessionSummary, CurrentUser, DeviceAuthorizationResponse, DeviceVerificationDetails, TokenResponse } from "../../contracts";
 import type { RuntimeConfig } from "../runtime-config";
 import type { RefreshSessionRecord, WebAppStore } from "./store";
 import { addSeconds, isExpired, nowIso, randomToken, sha256 } from "./crypto";
 import { getRequestOriginInfo } from "./request-origin";
 import { AuthError, type AccessTokenClaims } from "./types";
+import { toCurrentUser } from "./users";
 
 const ACCESS_TOKEN_TTL_SECONDS = 60 * 10;
 const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
@@ -87,6 +88,7 @@ function issuer(config: RuntimeConfig): string {
 
 async function issueAccessToken(store: WebAppStore, config: RuntimeConfig, input: {
   sessionId: string;
+  user: CurrentUser;
   clientId: string;
   scope: string;
 }): Promise<{ accessToken: string; jti: string }> {
@@ -96,9 +98,11 @@ async function issueAccessToken(store: WebAppStore, config: RuntimeConfig, input
     sid: input.sessionId,
     clientId: input.clientId,
     scope: input.scope,
+    username: input.user.username,
+    role: input.user.role,
   })
     .setProtectedHeader({ alg: key.alg, kid: key.kid })
-    .setSubject(`${config.envPrefix.toLowerCase()}-user`)
+    .setSubject(input.user.id)
     .setJti(jti)
     .setIssuer(issuer(config))
     .setAudience(`${config.envPrefix.toLowerCase()}-api`)
@@ -161,7 +165,7 @@ export function getDeviceVerificationDetails(store: WebAppStore, userCode: strin
   };
 }
 
-export function approveDevice(store: WebAppStore, userCode: string): DeviceVerificationDetails {
+export function approveDevice(store: WebAppStore, userCode: string, userId: string): DeviceVerificationDetails {
   const record = store.getDeviceAuthByUserCode(userCode);
   if (!record || isExpired(record.expiresAt)) {
     throw new AuthError("invalid_user_code", "Device authorization code is invalid or expired", 404);
@@ -169,7 +173,7 @@ export function approveDevice(store: WebAppStore, userCode: string): DeviceVerif
   if (record.status !== "pending" && record.status !== "approved") {
     throw new AuthError("invalid_request", "Device authorization can no longer be approved", 400);
   }
-  store.updateDeviceAuthStatus(userCode, "approved", nowIso());
+  store.updateDeviceAuthStatus(userCode, "approved", nowIso(), userId);
   return getDeviceVerificationDetails(store, userCode, false);
 }
 
@@ -182,7 +186,7 @@ export function denyDevice(store: WebAppStore, userCode: string): DeviceVerifica
   return getDeviceVerificationDetails(store, userCode, false);
 }
 
-function createRefreshRecord(clientId: string, scope: string, familyId: string = crypto.randomUUID()): { token: string; record: RefreshSessionRecord } {
+function createRefreshRecord(userId: string, clientId: string, scope: string, familyId: string = crypto.randomUUID()): { token: string; record: RefreshSessionRecord } {
   const token = randomToken(32);
   const createdAt = nowIso();
   const id = crypto.randomUUID();
@@ -190,6 +194,7 @@ function createRefreshRecord(clientId: string, scope: string, familyId: string =
     token,
     record: {
       id,
+      userId,
       familyId,
       clientId,
       scope,
@@ -221,10 +226,19 @@ export async function exchangeDeviceCode(store: WebAppStore, config: RuntimeConf
   if (record.status === "consumed") {
     throw new AuthError("invalid_grant", "Device code has already been used", 400);
   }
-  const refresh = createRefreshRecord(record.clientId, record.scope);
+  if (!record.approvedByUserId) {
+    throw new AuthError("invalid_grant", "Device authorization was not approved by a user", 400);
+  }
+  const userRecord = store.getUserById(record.approvedByUserId);
+  if (!userRecord) {
+    throw new AuthError("invalid_grant", "Approving user no longer exists", 400);
+  }
+  const user = toCurrentUser(userRecord);
+  const refresh = createRefreshRecord(user.id, record.clientId, record.scope);
   store.saveRefreshSession(refresh.record);
   const access = await issueAccessToken(store, config, {
     sessionId: refresh.record.id,
+    user,
     clientId: record.clientId,
     scope: record.scope,
   });
@@ -248,13 +262,20 @@ export async function exchangeRefreshToken(store: WebAppStore, config: RuntimeCo
   if (clientId && clientId !== session.clientId) {
     throw new AuthError("invalid_client", "client_id does not match refresh session", 400);
   }
-  const next = createRefreshRecord(session.clientId, session.scope, session.familyId);
+  const userRecord = store.getUserById(session.userId);
+  if (!userRecord) {
+    store.revokeRefreshFamily(session.familyId, nowIso());
+    throw new AuthError("invalid_grant", "Refresh token user no longer exists", 400);
+  }
+  const user = toCurrentUser(userRecord);
+  const next = createRefreshRecord(session.userId, session.clientId, session.scope, session.familyId);
   const rotated = store.rotateRefreshSession(hash, next.record, nowIso());
   if (!rotated) {
     throw new AuthError("invalid_grant", "Refresh token is invalid", 400);
   }
   const access = await issueAccessToken(store, config, {
     sessionId: next.record.id,
+    user,
     clientId: next.record.clientId,
     scope: next.record.scope,
   });
@@ -270,6 +291,8 @@ export async function verifyAccessToken(store: WebAppStore, config: RuntimeConfi
   const payload = result.payload;
   return {
     sub: payload.sub ?? "",
+    username: typeof payload["username"] === "string" ? payload["username"] : undefined,
+    role: typeof payload["role"] === "string" ? payload["role"] : undefined,
     jti: payload.jti ?? "",
     sid: String(payload["sid"] ?? ""),
     clientId: String(payload["clientId"] ?? ""),
@@ -277,8 +300,8 @@ export async function verifyAccessToken(store: WebAppStore, config: RuntimeConfi
   };
 }
 
-export function listAuthSessions(store: WebAppStore): AuthSessionSummary[] {
-  return store.listRefreshSessions().map((session) => ({
+export function listAuthSessions(store: WebAppStore, userId: string): AuthSessionSummary[] {
+  return store.listRefreshSessions(userId).map((session) => ({
     id: session.id,
     clientId: session.clientId,
     scope: session.scope,
@@ -291,8 +314,8 @@ export function listAuthSessions(store: WebAppStore): AuthSessionSummary[] {
   }));
 }
 
-export function revokeAuthSession(store: WebAppStore, id: string): boolean {
-  return store.revokeRefreshSession(id, nowIso());
+export function revokeAuthSession(store: WebAppStore, userId: string, id: string): boolean {
+  return store.revokeRefreshSession(id, nowIso(), userId);
 }
 
 export function revokeRefreshToken(store: WebAppStore, refreshToken: string): boolean {

package/src/server/auth/passkeys.ts

@@ -6,19 +6,20 @@ import {
   type AuthenticationResponseJSON,
   type RegistrationResponseJSON,
 } from "@simplewebauthn/server";
+import { isIP } from "node:net";
 import type { PasskeyAuthStatusResponse } from "../../contracts";
 import type { RuntimeConfig } from "../runtime-config";
-import type { WebAppStore } from "./store";
-import { hmacSha256, nowIso, randomToken, secureEqual } from "./crypto";
+import type { UserRecord, WebAppStore } from "./store";
+import { hmacSha256, isExpired, nowIso, randomToken, secureEqual, sha256 } from "./crypto";
 import { getCookiePath, getRequestOriginInfo } from "./request-origin";
 import { AuthError } from "./types";
+import { assertValidUsername, audit, createUserRecord, toCurrentUser } from "./users";
 
 const SESSION_COOKIE = "webapp_passkey_session";
 const CHALLENGE_COOKIE = "webapp_passkey_challenge";
 const SESSION_TTL_SECONDS = 60 * 60 * 24 * 30;
 const CHALLENGE_TTL_SECONDS = 60 * 10;
 const SECRET_KEY = "passkey.secret";
-const VERSION_KEY = "passkey.version";
 
 interface SignedCookiePayload {
   expiresAt: number;
@@ -26,12 +27,16 @@ interface SignedCookiePayload {
 
 interface ChallengePayload extends SignedCookiePayload {
   challenge: string;
-  type: "registration" | "authentication";
+  type: "bootstrap" | "owner-reset" | "setup" | "authentication";
+  userId?: string;
+  username?: string;
+  setupTokenHash?: string;
 }
 
 interface SessionPayload extends SignedCookiePayload {
   nonce: string;
-  version: number;
+  userId: string;
+  authVersion: number;
 }
 
 function getSecret(store: WebAppStore): string {
@@ -44,23 +49,6 @@ function getSecret(store: WebAppStore): string {
   return secret;
 }
 
-function getVersion(store: WebAppStore): number {
-  const raw = store.getPreference(VERSION_KEY);
-  const version = raw ? Number(raw) : 1;
-  if (!Number.isInteger(version) || version <= 0) {
-    store.setPreference(VERSION_KEY, "1");
-    return 1;
-  }
-  if (!raw) {
-    store.setPreference(VERSION_KEY, "1");
-  }
-  return version;
-}
-
-function bumpVersion(store: WebAppStore): void {
-  store.setPreference(VERSION_KEY, String(getVersion(store) + 1));
-}
-
 function encodeSigned(payload: object, secret: string): string {
   const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
   return `${body}.${hmacSha256(body, secret)}`;
@@ -110,12 +98,13 @@ function expiredCookie(req: Request, name: string, secure: boolean): string {
   return cookieHeader(req, name, "", 0, secure);
 }
 
-function setSessionHeaders(req: Request, store: WebAppStore, config: RuntimeConfig): Headers {
+function setSessionHeaders(req: Request, store: WebAppStore, config: RuntimeConfig, user: UserRecord): Headers {
   const origin = getRequestOriginInfo(req, config.publicBaseUrl);
   const secret = getSecret(store);
   const payload: SessionPayload = {
     nonce: randomToken(16),
-    version: getVersion(store),
+    userId: user.id,
+    authVersion: user.authVersion,
     expiresAt: Date.now() + SESSION_TTL_SECONDS * 1000,
   };
   const headers = new Headers();
@@ -144,69 +133,53 @@ function readChallenge(req: Request, store: WebAppStore, type: ChallengePayload[
   return challenge;
 }
 
-export function hasPasskeySession(req: Request, store: WebAppStore): boolean {
-  const secret = store.getPreference(SECRET_KEY);
-  if (!secret) {
-    return false;
-  }
-  const session = decodeSigned<SessionPayload>(getCookie(req, SESSION_COOKIE), secret);
-  return Boolean(session && session.expiresAt > Date.now() && session.version === getVersion(store));
+function registrationUserId(userId: string): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(Buffer.from(userId)) as Uint8Array<ArrayBuffer>;
 }
 
-export function isPasskeyAuthRequired(store: WebAppStore, config: RuntimeConfig): boolean {
-  return !config.passkeyDisabled && store.listPasskeys().length > 0;
-}
-
-export function passkeyStatus(req: Request, store: WebAppStore, config: RuntimeConfig, enabled = true): PasskeyAuthStatusResponse {
-  const passkeyConfigured = store.listPasskeys().length > 0;
-  return {
-    enabled,
-    passkeyConfigured,
-    passkeyDisabled: config.passkeyDisabled,
-    passkeyRequired: enabled && passkeyConfigured && !config.passkeyDisabled,
-    authenticated: !enabled || config.passkeyDisabled || hasPasskeySession(req, store),
-  };
+function webauthnRpId(hostname: string): string {
+  if (isIP(hostname)) {
+    throw new AuthError("invalid_passkey_host", "Passkeys require a hostname such as localhost, not an IP address", 400);
+  }
+  return hostname;
 }
 
-export async function beginRegistration(req: Request, store: WebAppStore, config: RuntimeConfig) {
-  if (store.listPasskeys().length > 0) {
-    throw new AuthError("passkey_exists", "A passkey is already configured", 409);
-  }
+async function beginRegistrationForUser(req: Request, store: WebAppStore, config: RuntimeConfig, user: { id: string; username: string }, type: ChallengePayload["type"], setupTokenHash?: string) {
   const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const rpID = webauthnRpId(origin.hostname);
   const options = await generateRegistrationOptions({
     rpName: config.appName,
-    rpID: origin.hostname,
-    userID: new Uint8Array(Buffer.from(config.envPrefix.toLowerCase())),
-    userName: config.envPrefix.toLowerCase(),
-    userDisplayName: config.appName,
+    rpID,
+    userID: registrationUserId(user.id),
+    userName: user.username,
+    userDisplayName: user.username,
     attestationType: "none",
     authenticatorSelection: {
       residentKey: "preferred",
       userVerification: "preferred",
     },
-  });
-  return { options, headers: setChallengeHeaders(req, store, config, { challenge: options.challenge, type: "registration" }) };
+  } as Parameters<typeof generateRegistrationOptions>[0]);
+  return { options, headers: setChallengeHeaders(req, store, config, { challenge: options.challenge, type, userId: user.id, username: user.username, setupTokenHash }) };
 }
 
-export async function completeRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON) {
-  if (store.listPasskeys().length > 0) {
-    throw new AuthError("passkey_exists", "A passkey is already configured", 409);
-  }
-  const challenge = readChallenge(req, store, "registration");
+async function verifyAndSavePasskey(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON, user: UserRecord, challenge: ChallengePayload): Promise<Headers> {
   const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const rpID = webauthnRpId(origin.hostname);
   const verification = await verifyRegistrationResponse({
     response,
     expectedChallenge: challenge.challenge,
     expectedOrigin: origin.origin,
-    expectedRPID: origin.hostname,
+    expectedRPID: rpID,
     requireUserVerification: false,
   });
   if (!verification.verified || !verification.registrationInfo) {
     throw new AuthError("registration_failed", "Passkey registration failed", 400);
   }
   const info = verification.registrationInfo;
+  const timestamp = nowIso();
   store.savePasskey({
     id: crypto.randomUUID(),
+    userId: user.id,
     name: "Primary passkey",
     credentialId: info.credential.id,
     publicKey: new Uint8Array(info.credential.publicKey) as Uint8Array<ArrayBuffer>,
@@ -214,11 +187,146 @@ export async function completeRegistration(req: Request, store: WebAppStore, con
     deviceType: info.credentialDeviceType,
     backedUp: info.credentialBackedUp,
     transports: info.credential.transports ?? response.response.transports ?? [],
-    createdAt: nowIso(),
-    updatedAt: nowIso(),
+    createdAt: timestamp,
+    updatedAt: timestamp,
   });
-  bumpVersion(store);
-  return setSessionHeaders(req, store, config);
+  store.incrementUserAuthVersion(user.id, timestamp);
+  const updatedUser = store.getUserById(user.id) ?? user;
+  return setSessionHeaders(req, store, config, updatedUser);
+}
+
+export function getPasskeySessionUser(req: Request, store: WebAppStore, config: RuntimeConfig) {
+  if (config.passkeyDisabled) {
+    const owner = store.getOwnerUser();
+    return owner ? toCurrentUser(owner) : undefined;
+  }
+  const secret = store.getPreference(SECRET_KEY);
+  if (!secret) {
+    return undefined;
+  }
+  const session = decodeSigned<SessionPayload>(getCookie(req, SESSION_COOKIE), secret);
+  if (!session || session.expiresAt <= Date.now()) {
+    return undefined;
+  }
+  const user = store.getUserById(session.userId);
+  if (!user || user.disabledAt || user.authVersion !== session.authVersion) {
+    return undefined;
+  }
+  return toCurrentUser(user);
+}
+
+export function hasPasskeySession(req: Request, store: WebAppStore, config: RuntimeConfig): boolean {
+  return Boolean(getPasskeySessionUser(req, store, config));
+}
+
+export function isPasskeyAuthRequired(store: WebAppStore, config: RuntimeConfig): boolean {
+  return !config.passkeyDisabled && store.countUsers() > 0;
+}
+
+export function passkeyStatus(req: Request, store: WebAppStore, config: RuntimeConfig, enabled = true): PasskeyAuthStatusResponse {
+  const users = store.countUsers();
+  const owner = store.getOwnerUser();
+  const passkeyConfigured = store.listPasskeys().length > 0;
+  const ownerPasskeySetupRequired = users > 0 && Boolean(owner && !owner.passkeyConfigured);
+  return {
+    enabled,
+    passkeyConfigured,
+    passkeyDisabled: config.passkeyDisabled,
+    passkeyRequired: enabled && users > 0 && !config.passkeyDisabled,
+    authenticated: !enabled || Boolean(getPasskeySessionUser(req, store, config)),
+    bootstrapRequired: enabled && users === 0,
+    ownerPasskeySetupRequired,
+  };
+}
+
+export async function beginBootstrapRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, username: string) {
+  if (store.countUsers() > 0) {
+    throw new AuthError("owner_exists", "Owner user is already configured", 409);
+  }
+  const normalized = assertValidUsername(username);
+  return beginRegistrationForUser(req, store, config, { id: crypto.randomUUID(), username: normalized }, "bootstrap");
+}
+
+export async function completeBootstrapRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON) {
+  if (store.countUsers() > 0) {
+    throw new AuthError("owner_exists", "Owner user is already configured", 409);
+  }
+  const challenge = readChallenge(req, store, "bootstrap");
+  if (!challenge.userId || !challenge.username) {
+    throw new AuthError("challenge_invalid", "Passkey challenge is invalid or expired", 400);
+  }
+  const owner = createUserRecord({ username: challenge.username, role: "owner" });
+  owner.id = challenge.userId;
+  store.createUser(owner);
+  const headers = await verifyAndSavePasskey(req, store, config, response, owner, challenge);
+  audit(store, { eventType: "owner_created", targetUserId: owner.id });
+  return headers;
+}
+
+export async function beginOwnerPasskeySetup(req: Request, store: WebAppStore, config: RuntimeConfig) {
+  const owner = store.getOwnerUser();
+  if (!owner || owner.passkeyConfigured) {
+    throw new AuthError("owner_setup_unavailable", "Owner passkey setup is not available", 409);
+  }
+  return beginRegistrationForUser(req, store, config, owner, "owner-reset");
+}
+
+export async function completeOwnerPasskeySetup(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON) {
+  const challenge = readChallenge(req, store, "owner-reset");
+  const owner = challenge.userId ? store.getUserById(challenge.userId) : undefined;
+  if (!owner || owner.role !== "owner" || owner.passkeyConfigured) {
+    throw new AuthError("owner_setup_unavailable", "Owner passkey setup is not available", 409);
+  }
+  const headers = await verifyAndSavePasskey(req, store, config, response, owner, challenge);
+  audit(store, { eventType: "owner_passkey_configured", targetUserId: owner.id });
+  return headers;
+}
+
+export function getSetupDetails(store: WebAppStore, token: string) {
+  const link = store.getSetupLinkByTokenHash(sha256(token));
+  if (!link || link.consumedAt || isExpired(link.expiresAt)) {
+    throw new AuthError("setup_link_invalid", "Setup link is invalid or expired", 404);
+  }
+  const user = store.getUserById(link.userId);
+  if (!user) {
+    throw new AuthError("setup_link_invalid", "Setup link is invalid or expired", 404);
+  }
+  return {
+    username: user.username,
+    role: user.role,
+    kind: link.kind === "reset" ? "reset" as const : "invite" as const,
+    expiresAt: link.expiresAt,
+  };
+}
+
+export async function beginSetupRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, token: string) {
+  const tokenHash = sha256(token);
+  const link = store.getSetupLinkByTokenHash(tokenHash);
+  if (!link || link.consumedAt || isExpired(link.expiresAt)) {
+    throw new AuthError("setup_link_invalid", "Setup link is invalid or expired", 404);
+  }
+  const user = store.getUserById(link.userId);
+  if (!user) {
+    throw new AuthError("setup_link_invalid", "Setup link is invalid or expired", 404);
+  }
+  return beginRegistrationForUser(req, store, config, user, "setup", tokenHash);
+}
+
+export async function completeSetupRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, token: string, response: RegistrationResponseJSON) {
+  const tokenHash = sha256(token);
+  const challenge = readChallenge(req, store, "setup");
+  if (challenge.setupTokenHash !== tokenHash || !challenge.userId) {
+    throw new AuthError("challenge_invalid", "Passkey challenge is invalid or expired", 400);
+  }
+  const link = store.getSetupLinkByTokenHash(tokenHash);
+  const user = link ? store.getUserById(link.userId) : undefined;
+  if (!link || !user || link.consumedAt || isExpired(link.expiresAt) || user.id !== challenge.userId) {
+    throw new AuthError("setup_link_invalid", "Setup link is invalid or expired", 404);
+  }
+  const headers = await verifyAndSavePasskey(req, store, config, response, user, challenge);
+  store.consumeSetupLink(link.id, nowIso());
+  audit(store, { eventType: link.kind === "reset" ? "user_reset_completed" : "user_invite_completed", targetUserId: user.id });
+  return headers;
 }
 
 export async function beginAuthentication(req: Request, store: WebAppStore, config: RuntimeConfig) {
@@ -227,29 +335,32 @@ export async function beginAuthentication(req: Request, store: WebAppStore, conf
     throw new AuthError("passkey_missing", "No passkey is configured", 409);
   }
   const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const rpID = webauthnRpId(origin.hostname);
   const options = await generateAuthenticationOptions({
-    rpID: origin.hostname,
+    rpID,
     allowCredentials: passkeys.map((passkey) => ({
       id: passkey.credentialId,
       transports: passkey.transports as AuthenticatorTransport[],
     })),
     userVerification: "preferred",
-  });
+  } as Parameters<typeof generateAuthenticationOptions>[0]);
   return { options, headers: setChallengeHeaders(req, store, config, { challenge: options.challenge, type: "authentication" }) };
 }
 
 export async function completeAuthentication(req: Request, store: WebAppStore, config: RuntimeConfig, response: AuthenticationResponseJSON) {
   const challenge = readChallenge(req, store, "authentication");
   const passkey = store.getPasskeyByCredentialId(response.id);
-  if (!passkey) {
+  const user = passkey ? store.getUserById(passkey.userId) : undefined;
+  if (!passkey || !user) {
     throw new AuthError("passkey_not_found", "Passkey credential is not registered", 404);
   }
   const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const rpID = webauthnRpId(origin.hostname);
   const verification = await verifyAuthenticationResponse({
     response,
     expectedChallenge: challenge.challenge,
     expectedOrigin: origin.origin,
-    expectedRPID: origin.hostname,
+    expectedRPID: rpID,
     credential: {
       id: passkey.credentialId,
       publicKey: passkey.publicKey,
@@ -261,8 +372,11 @@ export async function completeAuthentication(req: Request, store: WebAppStore, c
   if (!verification.verified) {
     throw new AuthError("authentication_failed", "Passkey authentication failed", 401);
   }
-  store.updatePasskeyUsage(passkey.credentialId, verification.authenticationInfo.newCounter, nowIso());
-  return setSessionHeaders(req, store, config);
+  const timestamp = nowIso();
+  store.updatePasskeyUsage(passkey.credentialId, verification.authenticationInfo.newCounter, timestamp);
+  store.markUserLogin(user.id, timestamp);
+  audit(store, { eventType: "user_login", actorUserId: user.id });
+  return setSessionHeaders(req, store, config, user);
 }
 
 export function logoutHeaders(req: Request, config: RuntimeConfig): Headers {
@@ -273,8 +387,12 @@ export function logoutHeaders(req: Request, config: RuntimeConfig): Headers {
   return headers;
 }
 
-export function deletePasskey(req: Request, store: WebAppStore, config: RuntimeConfig): Headers {
-  store.deleteAllPasskeys();
-  bumpVersion(store);
+export function deletePasskey(req: Request, store: WebAppStore, config: RuntimeConfig, userId: string): Headers {
+  const timestamp = nowIso();
+  store.deletePasskeysForUser(userId);
+  store.incrementUserAuthVersion(userId, timestamp);
+  store.deleteApiKeysForUser(userId);
+  store.revokeRefreshSessionsForUser(userId, timestamp);
+  audit(store, { eventType: "passkey_deleted", actorUserId: userId, targetUserId: userId });
   return logoutHeaders(req, config);
 }