@vex-chat/spire 1.3.6 → 1.4.0

package/src/db/schema.ts

@@ -92,10 +92,11 @@ export type NewInvite = Insertable<InvitesTable>;
 export type NewMail = Insertable<MailTable>;
 export type NewOneTimeKey = Insertable<OneTimeKeysTable>;
 
+export type NewPasskey = Insertable<PasskeysTable>;
 export type NewPermission = Insertable<PermissionsTable>;
 export type NewPreKey = Insertable<PreKeysTable>;
-export type NewServer = Insertable<ServersTable>;
 
+export type NewServer = Insertable<ServersTable>;
 export type NewServiceMetric = Insertable<ServiceMetricsTable>;
 export type NewUser = Insertable<UsersTable>;
 export type OneTimeKeyRow = Selectable<OneTimeKeysTable>;
@@ -109,6 +110,21 @@ export interface OneTimeKeysTable {
     userID: string;
 }
 export type OneTimeKeyUpdate = Updateable<OneTimeKeysTable>;
+export type PasskeyRow = Selectable<PasskeysTable>;
+
+export interface PasskeysTable {
+    algorithm: number;
+    createdAt: string;
+    credentialID: string;
+    lastUsedAt: null | string;
+    name: string;
+    passkeyID: string;
+    publicKey: string;
+    signCount: number;
+    transports: string;
+    userID: string;
+}
+export type PasskeyUpdate = Updateable<PasskeysTable>;
 export type PermissionRow = Selectable<PermissionsTable>;
 
 export interface PermissionsTable {
@@ -138,6 +154,7 @@ export interface ServerDatabase {
     invites: InvitesTable;
     mail: MailTable;
     oneTimeKeys: OneTimeKeysTable;
+    passkeys: PasskeysTable;
     permissions: PermissionsTable;
     preKeys: PreKeysTable;
     servers: ServersTable;

package/src/migrations/2026-05-03_passkeys.ts

@@ -0,0 +1,52 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("passkeys").ifExists().execute();
+}
+
+// Passkeys are an administrative second-class credential alongside
+// `devices`. They cannot send/decrypt mail (no ratchet keys), but they
+// can authenticate the owning user, list devices, delete devices, and
+// approve/reject pending device-enrollment requests — i.e. account
+// recovery and provisioning.
+//
+// `credentialID` is the WebAuthn credential id (base64url, opaque), and
+// is unique across all passkeys. `publicKey` is the COSE_Key bytes
+// returned by the authenticator, hex-encoded for storage. `signCount`
+// is the WebAuthn signature counter (monotonic) used to detect cloned
+// authenticators. `transports` is a comma-separated list of hints
+// ("usb,nfc,ble,internal,hybrid") so subsequent assertions can request
+// the right transport.
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createTable("passkeys")
+        .ifNotExists()
+        .addColumn("passkeyID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("userID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("name", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("credentialID", "varchar(512)", (cb) =>
+            cb.unique().notNull(),
+        )
+        .addColumn("publicKey", "text", (cb) => cb.notNull())
+        .addColumn("algorithm", "integer", (cb) => cb.notNull())
+        .addColumn("signCount", "integer", (cb) => cb.notNull().defaultTo(0))
+        .addColumn("transports", "varchar(255)", (cb) =>
+            cb.notNull().defaultTo(""),
+        )
+        .addColumn("createdAt", "text", (cb) => cb.notNull())
+        .addColumn("lastUsedAt", "text")
+        .execute();
+
+    await db.schema
+        .createIndex("passkeys_userID_idx")
+        .ifNotExists()
+        .on("passkeys")
+        .column("userID")
+        .execute();
+}

package/src/server/index.ts

@@ -35,6 +35,8 @@ import { errorHandler } from "./errors.ts";
 import { getFileRouter } from "./file.ts";
 import { getInviteRouter } from "./invite.ts";
 import { setupDocs } from "./openapi.ts";
+import { getPasskeyRouter } from "./passkey.ts";
+import { getPasskeyDeviceRouter } from "./passkeyDevices.ts";
 import {
     hasAnyPermission,
     hasPermission,
@@ -95,6 +97,14 @@ const jwtDevicePayload = z.object({
     }),
 });
 
+const jwtPasskeyPayload = z.object({
+    passkey: z.object({
+        passkeyID: z.string(),
+    }),
+    scope: z.literal("passkey"),
+    user: UserSchema,
+});
+
 /** Extract Bearer token from Authorization header. */
 function extractBearer(req: express.Request): null | string {
     const header = req.headers.authorization;
@@ -107,13 +117,27 @@ const checkAuth: express.RequestHandler = (req, _res, next) => {
     if (token) {
         try {
             const result = jwt.verify(token, getJwtSecret());
-            const parsed = jwtUserPayload.safeParse(result);
-            if (parsed.success) {
-                req.user = parsed.data.user;
-                if (parsed.data.exp !== undefined) {
-                    req.exp = parsed.data.exp;
-                }
+            // Passkey-scoped JWTs share the bearer slot with regular
+            // user JWTs but carry a `scope: "passkey"` discriminator
+            // and a `passkey` claim. Populate `req.passkey` and the
+            // user (so route guards using `req.user` still pass) but
+            // never `req.device`. The actual privilege gate lives at
+            // the route level: passkey-only routes require
+            // `req.passkey`, device-only routes require `req.device`.
+            const passkeyParsed = jwtPasskeyPayload.safeParse(result);
+            if (passkeyParsed.success) {
+                req.user = passkeyParsed.data.user;
+                req.passkey = passkeyParsed.data.passkey;
                 req.bearerToken = token;
+            } else {
+                const parsed = jwtUserPayload.safeParse(result);
+                if (parsed.success) {
+                    req.user = parsed.data.user;
+                    if (parsed.data.exp !== undefined) {
+                        req.exp = parsed.data.exp;
+                    }
+                    req.bearerToken = token;
+                }
             }
         } catch {
             // Token verification failed — continue without auth
@@ -147,6 +171,21 @@ export const protect: express.RequestHandler = (req, res, next) => {
     next();
 };
 
+/**
+ * Restrict a route to passkey-scoped JWTs (used by the parallel
+ * `/user/:id/passkey/devices/...` admin/recovery routes). A
+ * passkey-authenticated caller can list devices, delete devices, and
+ * approve/reject pending enrollments — and nothing else.
+ */
+export const protectPasskey: express.RequestHandler = (req, res, next) => {
+    if (!req.user || !req.passkey) {
+        res.sendStatus(401);
+        return;
+    }
+
+    next();
+};
+
 export const msgpackParser: express.RequestHandler = (req, res, next) => {
     if (req.is("application/msgpack")) {
         try {
@@ -185,6 +224,8 @@ export const initApp = (
     const fileRouter = getFileRouter(db);
     const avatarRouter = getAvatarRouter();
     const inviteRouter = getInviteRouter(db, tokenValidator, notify);
+    const passkeyRouter = getPasskeyRouter(db);
+    const passkeyDeviceRouter = getPasskeyDeviceRouter(db, notify);
 
     // MIDDLEWARE
     // Global per-IP rate limit is the FIRST middleware so a flooded
@@ -854,6 +895,14 @@ export const initApp = (
     );
 
     // COMPLEX RESOURCES
+    // Passkey routes are mounted at the root since they live under
+    // both `/user/:id/passkeys/...` (registration / list / delete by
+    // an authenticated device) and `/auth/passkey/...` (public
+    // sign-in). The router itself defines the full path on each
+    // route handler.
+    api.use(passkeyRouter);
+    api.use(passkeyDeviceRouter);
+
     api.use("/user", userRouter);
 
     api.use("/file", fileRouter);