pgkiln 0.60.0 → 0.61.0

package/src/builder/i18n/nl.ts

@@ -1714,16 +1714,16 @@ export const nl: BuilderMessages = {
   // ------------------------------------------------------------ Security: two-factor sign-in (sprint 126)
   'mfa.menu': 'Aanmelden in twee stappen',
   'mfa.title': 'Beveiliging',
-  'mfa.intro': 'Meld u na uw wachtwoord aan met een code uit een authenticator-app. Met herstelcodes komt u binnen als u de telefoon kwijtraakt.',
-  'mfa.required_you': 'Uw beheerder vereist aanmelden in twee stappen: voeg een authenticator-app toe.',
+  'mfa.intro': 'Bevestig na uw wachtwoord dat u het bent met een passkey (vingerafdruk, gezicht, beveiligingssleutel) of een code uit een authenticator-app. Met herstelcodes komt u binnen als u die kwijtraakt.',
+  'mfa.required_you': 'Uw beheerder vereist aanmelden in twee stappen: voeg een passkey of een authenticator-app toe.',
   'mfa.banner': 'Aanmelden in twee stappen is verplicht. Stel het in vóór {date}: {link}',
   'mfa.set_up_now': 'nu instellen',
-  'mfa.apps': 'Authenticator-apps',
+  'mfa.factors': 'Passkeys en authenticator-apps',
   'mfa.app_name': 'Naam',
   'mfa.app_default': 'Telefoon',
   'mfa.added': 'Toegevoegd',
   'mfa.last_used': 'Laatst gebruikt',
-  'mfa.no_apps': 'Nog geen authenticator-app: u meldt zich alleen met uw wachtwoord aan.',
+  'mfa.no_apps': 'Nog geen tweede factor: u meldt zich alleen met uw wachtwoord aan.',
   'mfa.add_app': 'Authenticator-app toevoegen',
   'mfa.no_key': 'Aanmelden in twee stappen heeft de instantiesleutel (PGKILN_SECRET_KEY) nodig om het geheim van de app op te slaan.',
   'mfa.scan': 'Scan de QR-code met een authenticator-app.',
@@ -1739,28 +1739,28 @@ export const nl: BuilderMessages = {
   'mfa.remove_app': 'Deze app verwijderen',
   'mfa.your_password': 'Uw wachtwoord',
   'mfa.wrong_password': 'Onjuist wachtwoord.',
-  'mfa.cannot_remove_required': 'Aanmelden in twee stappen is voor u verplicht: voeg eerst een andere app toe.',
+  'mfa.cannot_remove_required': 'Aanmelden in twee stappen is voor u verplicht: voeg eerst een andere passkey of app toe.',
   'mfa.cannot_remove_admin': 'Minstens twee beheerders (of alle, als het er minder zijn) moeten aanmelden in twee stappen houden zolang het beleid aan staat.',
   'mfa.keep_admins': 'Nu niet: het beleid vereist minstens twee beheerders met aanmelden in twee stappen (of alle, als het er minder zijn).',
-  'mfa.removed': 'Authenticator-app verwijderd.',
+  'mfa.removed': 'Verwijderd.',
   'mfa.codes_title': 'Herstelcodes',
   'mfa.codes_once': 'Bewaar deze codes op een veilige plek, niet bij uw telefoon. Elke code vervangt één keer een app-code. Ze worden alleen nu getoond.',
   'mfa.codes_saved': 'Ik heb deze codes bewaard',
   'mfa.codes_done': 'Klaar',
   'mfa.codes_kept': 'Herstelcodes bewaard.',
   'mfa.codes_left': 'Ongebruikte herstelcodes: {n}.',
-  'mfa.codes_after': 'U krijgt herstelcodes zodra u een authenticator-app toevoegt.',
+  'mfa.codes_after': 'U krijgt herstelcodes zodra u een passkey of authenticator-app toevoegt.',
   'mfa.codes_low': 'Nog maar weinig herstelcodes: maak nieuwe.',
   'mfa.codes_new': 'Nieuwe herstelcodes',
   'mfa.codes_new_confirm': 'Nieuwe herstelcodes maken? De oude werken dan niet meer.',
   'mfa.expired': 'Het aanmelden duurde te lang: meld u opnieuw aan.',
   'mfa.step_title': 'Aanmelden in twee stappen',
-  'mfa.step_intro': 'Voer de code uit uw authenticator-app voor {user} in.',
+  'mfa.step_intro': 'Bevestig dat u het bent, {user}: gebruik een passkey of voer een code uit uw authenticator-app in.',
   'mfa.code': 'Code',
   'mfa.code_help': '6 cijfers uit de app, of een van uw herstelcodes.',
   'mfa.verify': 'Controleren',
   'mfa.cancel': 'Terug naar aanmelden',
-  'mfa.locked_out': 'Telefoon en codes kwijt? Vraag een beheerder uw aanmelden in twee stappen te resetten.',
+  'mfa.locked_out': 'Telefoon, sleutel en codes kwijt? Vraag een beheerder uw aanmelden in twee stappen te resetten.',
   'mfa.wrong': 'Die code klopt niet of is al gebruikt.',
   'mfa.column': 'Twee stappen',
   'mfa.on': 'aan',
@@ -1784,4 +1784,28 @@ export const nl: BuilderMessages = {
   'mfa.policy_needs_admins': 'Eerst moeten minstens twee beheerders (of alle, als het er minder zijn) aanmelden in twee stappen instellen, zodat niemand alleen buitengesloten raakt.',
   'mfa.without': 'Zonder aanmelden in twee stappen: {list}.',
   'mfa.cli_note': 'Buitengesloten? Op de server: pgkiln admin reset-2fa <developer> of pgkiln admin set-2fa-policy off.',
+  // ------------------------------------------------------------ Security: passkeys and trusted browsers (sprint 127)
+  'mfa.kind': 'Soort',
+  'mfa.kind_passkey': 'Passkeys',
+  'mfa.kind_app': 'Authenticator-apps',
+  'mfa.other_domain': 'voor {domain}',
+  'mfa.other_domain_help': 'Gemaakt voor {domain}: werkt niet op dit adres. Voeg hier een nieuwe passkey toe.',
+  'mfa.passkey_intro': 'Meld u aan met uw vingerafdruk, gezicht, schermvergrendeling of een beveiligingssleutel. Een passkey werkt alleen op deze site.',
+  'mfa.passkey_default': 'Passkey',
+  'mfa.add_passkey': 'Passkey toevoegen',
+  'mfa.passkey_needs_js': 'Een passkey toevoegen vraagt JavaScript; een authenticator-app werkt zonder.',
+  'mfa.passkey_failed': 'De passkey werkte niet. Probeer het opnieuw of gebruik een code.',
+  'mfa.passkey_known': 'Deze passkey is al toegevoegd.',
+  'mfa.passkey_added': 'Passkey toegevoegd: voortaan kunt u zich ermee aanmelden.',
+  'mfa.remove_passkey': 'Deze passkey verwijderen',
+  'mfa.use_passkey': 'Passkey gebruiken',
+  'mfa.trust_browser': 'Deze browser {days} dagen vertrouwen',
+  'mfa.trusted_title': 'Vertrouwde browsers',
+  'mfa.trusted_count': 'Browsers die de tweede stap overslaan: {n} (hoogstens {days} dagen).',
+  'mfa.trusted_off': 'Browsers vertrouwen staat uit.',
+  'mfa.forget_browsers': 'Vertrouwde browsers vergeten',
+  'mfa.browsers_forgotten': 'Elke browser vraagt weer om de tweede stap.',
+  'mfa.trust_days': 'Browser vertrouwen (dagen)',
+  'mfa.trust_days_help': 'Na de tweede stap mag een ontwikkelaar die in die browser zoveel dagen overslaan. 0: nooit.',
+  'mfa.passkey_needs_host': 'Passkeys hebben een hostnaam nodig, geen IP-adres ({host}): open de builder via localhost of de domeinnaam.',
 };

package/src/builder/i18n/pt.ts

@@ -1714,16 +1714,16 @@ export const pt: BuilderMessages = {
   // ------------------------------------------------------------ Security: two-factor sign-in (sprint 126)
   'mfa.menu': 'Login em duas etapas',
   'mfa.title': 'Segurança',
-  'mfa.intro': 'Entre com um código de um aplicativo autenticador depois da senha. Os códigos de recuperação permitem entrar se você perder o telefone.',
-  'mfa.required_you': 'Seu administrador exige login em duas etapas: adicione um aplicativo autenticador.',
+  'mfa.intro': 'Depois da senha, confirme que é você com uma chave de acesso (digital, rosto, chave de segurança) ou um código de um aplicativo autenticador. Os códigos de recuperação permitem entrar se você os perder.',
+  'mfa.required_you': 'Seu administrador exige login em duas etapas: adicione uma chave de acesso ou um aplicativo autenticador.',
   'mfa.banner': 'O login em duas etapas é obrigatório. Configure-o antes de {date}: {link}',
   'mfa.set_up_now': 'configurar agora',
-  'mfa.apps': 'Aplicativos autenticadores',
+  'mfa.factors': 'Chaves de acesso e aplicativos autenticadores',
   'mfa.app_name': 'Nome',
   'mfa.app_default': 'Telefone',
   'mfa.added': 'Adicionado',
   'mfa.last_used': 'Último uso',
-  'mfa.no_apps': 'Nenhum aplicativo autenticador ainda: você entra apenas com sua senha.',
+  'mfa.no_apps': 'Nenhum segundo fator ainda: você entra apenas com sua senha.',
   'mfa.add_app': 'Adicionar um aplicativo autenticador',
   'mfa.no_key': 'O login em duas etapas precisa da chave da instância (PGKILN_SECRET_KEY) para guardar o segredo do aplicativo.',
   'mfa.scan': 'Leia o código QR com um aplicativo autenticador.',
@@ -1739,28 +1739,28 @@ export const pt: BuilderMessages = {
   'mfa.remove_app': 'Remover este aplicativo',
   'mfa.your_password': 'Sua senha',
   'mfa.wrong_password': 'Senha incorreta.',
-  'mfa.cannot_remove_required': 'O login em duas etapas é obrigatório para você: adicione outro aplicativo antes de remover este.',
+  'mfa.cannot_remove_required': 'O login em duas etapas é obrigatório para você: adicione outra chave ou aplicativo antes de remover este.',
   'mfa.cannot_remove_admin': 'Pelo menos dois administradores (ou todos, se forem menos) devem manter o login em duas etapas enquanto a política estiver ativa.',
   'mfa.keep_admins': 'Agora não: a política exige pelo menos dois administradores com login em duas etapas (ou todos, se forem menos).',
-  'mfa.removed': 'Aplicativo autenticador removido.',
+  'mfa.removed': 'Removido.',
   'mfa.codes_title': 'Códigos de recuperação',
   'mfa.codes_once': 'Guarde estes códigos em local seguro, longe do telefone. Cada um substitui uma vez um código do aplicativo. Eles são mostrados só agora.',
   'mfa.codes_saved': 'Guardei estes códigos',
   'mfa.codes_done': 'Concluído',
   'mfa.codes_kept': 'Códigos de recuperação guardados.',
   'mfa.codes_left': 'Códigos de recuperação não usados: {n}.',
-  'mfa.codes_after': 'Você recebe códigos de recuperação ao adicionar um aplicativo autenticador.',
+  'mfa.codes_after': 'Você recebe códigos de recuperação ao adicionar uma chave de acesso ou um aplicativo autenticador.',
   'mfa.codes_low': 'Restam poucos códigos de recuperação: gere novos.',
   'mfa.codes_new': 'Novos códigos de recuperação',
   'mfa.codes_new_confirm': 'Gerar novos códigos de recuperação? Os antigos deixam de funcionar.',
   'mfa.expired': 'O login demorou demais: entre novamente.',
   'mfa.step_title': 'Login em duas etapas',
-  'mfa.step_intro': 'Digite o código do seu aplicativo autenticador para {user}.',
+  'mfa.step_intro': 'Confirme que é você, {user}: use uma chave de acesso ou digite um código do seu aplicativo autenticador.',
   'mfa.code': 'Código',
   'mfa.code_help': '6 dígitos do aplicativo ou um dos seus códigos de recuperação.',
   'mfa.verify': 'Verificar',
   'mfa.cancel': 'Voltar ao login',
-  'mfa.locked_out': 'Perdeu o telefone e os códigos? Peça a um administrador para redefinir seu login em duas etapas.',
+  'mfa.locked_out': 'Perdeu o telefone, a chave e os códigos? Peça a um administrador para redefinir seu login em duas etapas.',
   'mfa.wrong': 'Esse código não está certo ou já foi usado.',
   'mfa.column': 'Duas etapas',
   'mfa.on': 'ativado',
@@ -1784,4 +1784,28 @@ export const pt: BuilderMessages = {
   'mfa.policy_needs_admins': 'Primeiro, pelo menos dois administradores (ou todos, se forem menos) configuram o login em duas etapas, para ninguém ficar bloqueado sozinho.',
   'mfa.without': 'Sem login em duas etapas: {list}.',
   'mfa.cli_note': 'Bloqueado? No servidor: pgkiln admin reset-2fa <developer> ou pgkiln admin set-2fa-policy off.',
+  // ------------------------------------------------------------ Security: passkeys and trusted browsers (sprint 127)
+  'mfa.kind': 'Tipo',
+  'mfa.kind_passkey': 'Chaves de acesso',
+  'mfa.kind_app': 'Aplicativos autenticadores',
+  'mfa.other_domain': 'para {domain}',
+  'mfa.other_domain_help': 'Criada para {domain}: não funciona neste endereço. Adicione aqui uma nova chave.',
+  'mfa.passkey_intro': 'Entre com sua digital, rosto, bloqueio de tela ou uma chave de segurança. Uma chave de acesso só funciona neste site.',
+  'mfa.passkey_default': 'Chave de acesso',
+  'mfa.add_passkey': 'Adicionar uma chave de acesso',
+  'mfa.passkey_needs_js': 'Adicionar uma chave de acesso exige JavaScript; um aplicativo autenticador funciona sem ele.',
+  'mfa.passkey_failed': 'A chave de acesso não funcionou. Tente de novo ou use um código.',
+  'mfa.passkey_known': 'Esta chave de acesso já foi adicionada.',
+  'mfa.passkey_added': 'Chave de acesso adicionada: a partir de agora você pode entrar com ela.',
+  'mfa.remove_passkey': 'Remover esta chave de acesso',
+  'mfa.use_passkey': 'Usar uma chave de acesso',
+  'mfa.trust_browser': 'Confiar neste navegador por {days} dias',
+  'mfa.trusted_title': 'Navegadores confiáveis',
+  'mfa.trusted_count': 'Navegadores que pulam a segunda etapa: {n} (até {days} dias).',
+  'mfa.trusted_off': 'A confiança em navegadores está desativada.',
+  'mfa.forget_browsers': 'Esquecer os navegadores confiáveis',
+  'mfa.browsers_forgotten': 'Todos os navegadores voltam a pedir a segunda etapa.',
+  'mfa.trust_days': 'Confiar em um navegador (dias)',
+  'mfa.trust_days_help': 'Depois da segunda etapa, um desenvolvedor pode pulá-la naquele navegador por estes dias. 0: nunca.',
+  'mfa.passkey_needs_host': 'Chaves de acesso precisam de um nome de host, não de um endereço IP ({host}): abra o construtor em localhost ou no nome de domínio.',
 };

package/src/builder/routes.ts

@@ -27,7 +27,9 @@ import { appFromFileRoutes } from './appfromfile.ts';
 import { clearDevbar } from '../runtime/devbar.ts';
 import { EMAIL } from './find-workspace.ts';
 import { cookieLanguage, LANG_COOKIE, tr, translatorFor, validBuilderLanguage } from './i18n.ts';
-import { checkSecondFactor, codesLeft, hasFactor, leavesTooFewAdmins } from '../mfa.ts';
+import { checkSecondFactor, codesLeft, forgetBrowsers, hasFactor, isTrustedBrowser, leavesTooFewAdmins, passkeysOf, trustBrowser, trustDays, usePasskey } from '../mfa.ts';
+import { giveChallenge, takeChallenge } from './security.ts';
+import { relyingParty, verifyAssertion, WebAuthnError } from '../webauthn.ts';
 import { chooseLanguage, langCookieOptions, languageRoutes, signInLanguageLinks } from './language.ts';
 
 // Builder pages: sign-in, workspace and app home, settings, activity and
@@ -150,8 +152,9 @@ export async function builderRoutes(app: FastifyInstance) {
       flash(s, tx(workspace ? 'signin.invalid_ws' : 'signin.invalid'), 'error');
       return back(reply, s, again);
     }
-    // (sprint 126, SEC-2) a developer with a second factor: the password was right, the session comes after the code
-    if (await hasFactor(dev.username)) {
+    // (sprint 126, SEC-2) a developer with a second factor: the password was right, the session comes after the code;
+    // (sprint 127) unless this browser was trusted after a second factor, for the instance's number of days
+    if ((await hasFactor(dev.username)) && !(await isTrustedBrowser(dev.username, req.cookies?.[TRUST_COOKIE]))) {
       s.state.__MFA = JSON.stringify({ u: dev.username, ws: ws ? String(ws.id) : null, w: workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, at: Date.now() });
       await saveState(s);
       return reply.redirect(`${BASE}/login/2fa`, 303);
@@ -187,8 +190,17 @@ export async function builderRoutes(app: FastifyInstance) {
     return reply.redirect(next, 303);
   }
 
-  // (sprint 126, SEC-2) the second step: a code from the authenticator app, or a recovery code
+  // (sprint 126, SEC-2) the second step: a code from the authenticator app, or a recovery code;
+  // (sprint 127) or a passkey, and "trust this browser" when the instance allows it
   const MFA_SECONDS = 300;
+  const TRUST_COOKIE = 'pgkiln_btrust';
+  const trustThisBrowser = async (req: Req, reply: Parameters<typeof back>[0], username: string) => {
+    const days = await trustDays();
+    if (!days || req.body?.trust !== '1') return;
+    const token = await trustBrowser(username, days, String(req.headers['user-agent'] ?? ''));
+    reply.setCookie(TRUST_COOKIE, token, { path: BASE, httpOnly: true, sameSite: 'lax', maxAge: days * 86400, secure: process.env.COOKIE_SECURE === 'true' });
+    logActivity({ username, event: '2fa_trusted_browser', ip: clientIp(req), detail: `${days} days` });
+  };
   const pendingMfa = (s: { state: Record<string, any> }) => {
     try {
       const p = JSON.parse(String(s.state.__MFA ?? ''));
@@ -209,6 +221,7 @@ export async function builderRoutes(app: FastifyInstance) {
     }
     const error = takeFlash(s, '__ERROR');
     await saveState(s);
+    const [keys, days] = await Promise.all([passkeysOf(p.u, relyingParty(req).rpId), trustDays()]);
     return reply.type('text/html').send(documentShell(
       `${tx('mfa.step_title')} · ${tx('shell.builder')}`,
       html`<main class="signin">
@@ -223,10 +236,14 @@ export async function builderRoutes(app: FastifyInstance) {
             <p class="muted u-mt0">${tx('mfa.step_intro', { user: p.u })}</p>
             ${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
             ${csrf(s)}
+            ${keys.length ? html`<input type="hidden" name="credentialId"><input type="hidden" name="clientDataJSON"><input type="hidden" name="authenticatorData"><input type="hidden" name="signature">
+              <button class="btn btn-hot signin-submit" hidden data-passkey="${BASE}/login/2fa/passkey/options" data-passkey-submit="${BASE}/login/2fa/passkey" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('mfa.use_passkey')}</button>
+              <p class="small" role="status" data-passkey-status></p>` : ''}
             <div class="field signin-field"><label class="label" for="f_code">${tx('mfa.code')}</label>
               <div class="signin-input">${icon('key')}<input id="f_code" name="code" required autocomplete="one-time-code" autofocus maxlength="20" spellcheck="false" autocapitalize="off"></div>
               <small class="help">${tx('mfa.code_help')}</small></div>
-            <button class="btn btn-hot signin-submit">${tx('mfa.verify')}</button>
+            ${days ? html`<label class="check"><input type="checkbox" name="trust" value="1"> ${tx('mfa.trust_browser', { days })}</label>` : ''}
+            <button class="btn${keys.length ? '' : ' btn-hot'} signin-submit">${tx('mfa.verify')}</button>
             <p class="muted small signin-hint"><a href="${BASE}/login">${tx('mfa.cancel')}</a> · ${tx('mfa.locked_out')}</p>
           </form>
         </section>
@@ -265,11 +282,69 @@ export async function builderRoutes(app: FastifyInstance) {
       const left = await codesLeft(p.u);
       await logActivity({ username: p.u, event: '2fa_recovery_used', ip, detail: `${left} left` });
       // to the Security page: one code fewer, maybe time for new ones
+      await trustThisBrowser(req, reply, p.u);
       return finishSignIn(req, reply, s, dev, { ws: p.ws, workspace: p.w, next: `${BASE}/security`, remember: p.remember, weak: p.weak, picked, detail: 'builder 2fa (recovery code)' });
     }
+    await trustThisBrowser(req, reply, p.u);
     return finishSignIn(req, reply, s, dev, { ws: p.ws, workspace: p.w, next: p.next, remember: p.remember, weak: p.weak, picked, detail: 'builder 2fa' });
   });
 
+  // (sprint 127) the second step with a passkey: options for navigator.credentials.get(), then the browser's answer
+  app.post(`${BASE}/login/2fa/passkey/options`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    const p = pendingMfa(s);
+    if (req.body?.__csrf !== s.csrf_token || !p) return reply.code(403).send('Sign in again.');
+    const rp = relyingParty(req);
+    const keys = await passkeysOf(p.u, rp.rpId);
+    if (!keys.length) return reply.code(404).send('No passkey for this site.');
+    const challenge = giveChallenge(s as Parameters<typeof giveChallenge>[0], 'get');
+    await saveState(s);
+    reply.header('cache-control', 'no-store');
+    return reply.send({ mode: 'get', challenge, rpId: rp.rpId, allow: keys.map((k) => ({ id: k.credential_id, transports: k.transports })) });
+  });
+  app.post(`${BASE}/login/2fa/passkey`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    const ip = clientIp(req);
+    const picked = validBuilderLanguage(s.state.__BLANG);
+    const tx = translatorFor(picked ?? cookieLanguage(req));
+    const p = pendingMfa(s);
+    const challenge = takeChallenge(s as Parameters<typeof takeChallenge>[0], 'get');
+    if (req.body?.__csrf !== s.csrf_token || !p) {
+      delete s.state.__MFA;
+      flash(s, tx(p ? 'signin.expired' : 'mfa.expired'), 'error');
+      return back(reply, s, `${BASE}/login`);
+    }
+    if (await loginThrottled(null, p.u, ip)) {
+      logActivity({ username: p.u, event: 'login_locked', ip, detail: 'builder 2fa' });
+      delete s.state.__MFA;
+      flash(s, tx('signin.throttled'), 'error');
+      return back(reply, s, `${BASE}/login`);
+    }
+    const rp = relyingParty(req);
+    const key = (await passkeysOf(p.u, rp.rpId)).find((k) => k.credential_id === String(req.body?.credentialId ?? ''));
+    let why = 'unknown passkey';
+    if (key && challenge) {
+      try {
+        const r = verifyAssertion(
+          { clientDataJSON: String(req.body?.clientDataJSON ?? ''), authenticatorData: String(req.body?.authenticatorData ?? ''), signature: String(req.body?.signature ?? '') },
+          { alg: key.alg, jwk: key.public_key, signCount: Number(key.sign_count) }, { challenge, ...rp });
+        if (await usePasskey(key.id, key.sign_count, r.signCount)) why = '';
+        else why = 'used at the same time elsewhere';
+      } catch (e) {
+        why = e instanceof WebAuthnError ? e.message : 'unreadable answer';
+      }
+    } else if (!challenge) why = 'no or an expired challenge';
+    if (why) {
+      await logActivity({ username: p.u, event: 'login_failed', ip, detail: `builder 2fa passkey: ${why}` });
+      flash(s, tx('mfa.passkey_failed'), 'error');
+      return back(reply, s, `${BASE}/login/2fa`);
+    }
+    const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [p.u]);
+    if (!dev) return back(reply, s, `${BASE}/login`);
+    await trustThisBrowser(req, reply, p.u);
+    return finishSignIn(req, reply, s, dev, { ws: p.ws, workspace: p.w, next: p.next, remember: p.remember, weak: p.weak, picked, detail: 'builder 2fa (passkey)' });
+  });
+
   app.post(`${BASE}/logout`, async (req: Req, reply) => {
     const s = await getSession(req, reply, null, BASE);
     if (req.body?.__csrf === s.csrf_token) {
@@ -865,8 +940,9 @@ export async function builderRoutes(app: FastifyInstance) {
         [s.username, req.body?.current ?? '', req.body?.password],
       );
       if (r.rowCount !== 1) throw new Error(tr(s)('dev.err.current'));
-      // End all other builder sessions of this developer.
+      // End all other builder sessions of this developer, and (sprint 127) forget the browsers they trusted.
       await owner.query('delete from meta.session where app_id is null and username = $1 and id <> $2', [s.username, s.id]);
+      await forgetBrowsers(s.username!);
       delete s.state.__WEAK;
       flash(s, tr(s)('dev.pw_changed'));
     } catch (e) {

package/src/builder/security.ts

@@ -1,14 +1,18 @@
+import { createHash } from 'node:crypto';
+import { isIP } from 'node:net';
 import type { FastifyInstance } from 'fastify';
 import { owner } from '../db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import {
-  addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy, newRecoveryCodes, newTotpSecret,
-  notifyMfa, otpauthUri, policyProblem, requiredFor, resetFactors, setPolicy, unbase32, type MfaPolicy,
+  addPasskey, addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, forgetBrowsers, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy,
+  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requiredFor, resetFactors, setPolicy, setTrustDays, trustDays,
+  trustedBrowsers, unbase32, type MfaPolicy,
 } from '../mfa.ts';
 import { qrSvg } from '../qrcode.ts';
 import { secretKeyConfigured } from '../secrets.ts';
-import { clientIp, logActivity, type Session } from '../session.ts';
+import { clientIp, logActivity, saveState, type Session } from '../session.ts';
+import { ALGORITHMS, b64url, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
@@ -19,6 +23,29 @@ import { back, BASE, csrf, developer, flash, input, region, send, shell, type Re
 // app confirms it, then stored encrypted with the instance key. Recovery codes are shown once; they count
 // only after "I saved them". Removing a factor asks for the password, and is refused when it would leave a
 // developer the policy covers without one, or the instance without enough administrators who have one.
+// (sprint 127) Passkeys (WebAuthn): the browser asks the server for options (a one-time challenge kept in the
+// session for five minutes), calls navigator.credentials.create() and posts the answer in a normal form
+// (public/builder.js, [data-passkey]); without JavaScript the button stays hidden. Trusted browsers can be
+// forgotten here; the instance decides how long a browser may be trusted (0 = never).
+
+const CHALLENGE_SECONDS = 300;
+
+/** A one-time WebAuthn challenge kept in the session (for this purpose only), or null when there is none or it expired. */
+export function takeChallenge(s: Session, purpose: 'create' | 'get'): string | null {
+  try {
+    const p = JSON.parse(String(s.state.__PK ?? ''));
+    delete s.state.__PK;
+    return p && p.purpose === purpose && Date.now() - Number(p.at) < CHALLENGE_SECONDS * 1000 && typeof p.c === 'string' ? p.c : null;
+  } catch {
+    delete s.state.__PK;
+    return null;
+  }
+}
+export function giveChallenge(s: Session, purpose: 'create' | 'get'): string {
+  const c = newChallenge();
+  s.state.__PK = JSON.stringify({ c, purpose, at: Date.now() });
+  return c;
+}
 
 const SECRET_MINUTES = 10;
 
@@ -32,7 +59,8 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!s) return;
     const tx = tr(s);
     const me = s.username!;
-    const [factors, left, pol, admin] = await Promise.all([factorsOf(me), codesLeft(me), mfaPolicy(), isAdmin(me)]);
+    const [factors, left, pol, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), mfaPolicy(), isAdmin(me), trustDays(), trustedBrowsers(me)]);
+    const rp = relyingParty(req);
     const required = requiredFor(pol.policy, admin);
     const pending = (() => {
       try {
@@ -80,18 +108,34 @@ export async function securityRoutes(app: FastifyInstance) {
               <div class="buttons"><button class="btn btn-hot">${tx('mfa.codes_done')}</button></div></form>`, '', 'codes')
         : ''}
       <div class="columns">
-        ${region(tx('mfa.apps'), html`${factors.length
-          ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('mfa.app_name')}</th><th>${tx('mfa.added')}</th><th>${tx('mfa.last_used')}</th><th></th></tr></thead><tbody>
-              ${factors.map((f) => html`<tr><td data-label="${tx('mfa.app_name')}">${icon('key')} ${f.name}</td><td data-label="${tx('mfa.added')}">${when(f.created_at)}</td><td data-label="${tx('mfa.last_used')}">${when(f.last_used_at)}</td>
+        ${region(tx('mfa.factors'), html`${factors.length
+          ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('mfa.app_name')}</th><th>${tx('mfa.kind')}</th><th>${tx('mfa.added')}</th><th>${tx('mfa.last_used')}</th><th></th></tr></thead><tbody>
+              ${factors.map((f) => html`<tr><td data-label="${tx('mfa.app_name')}">${icon(f.kind === 'passkey' ? 'fingerprint' : 'smartphone')} ${f.name}</td>
+                <td data-label="${tx('mfa.kind')}">${f.kind === 'passkey' ? tx('mfa.kind_passkey') : tx('mfa.kind_app')}${f.kind === 'passkey' && f.rp_id !== rp.rpId ? html` <span class="badge badge-warn" title="${tx('mfa.other_domain_help', { domain: f.rp_id ?? '' })}">${tx('mfa.other_domain', { domain: f.rp_id ?? '' })}</span>` : ''}</td>
+                <td data-label="${tx('mfa.added')}">${when(f.created_at)}</td><td data-label="${tx('mfa.last_used')}">${when(f.last_used_at)}</td>
                 <td><details class="menu"><summary class="btn btn-sm">${tx('mfa.remove')}</summary><div class="menu-panel"><form method="post" action="${BASE}/security/factor/${f.id}/delete" class="menu-section">${csrf(s)}
                   ${input(`password_${f.id}`, tx('mfa.your_password'), '', { type: 'password', required: true, auto: 'current-password' })}
-                  <button class="btn btn-sm btn-danger">${tx('mfa.remove_app')}</button></form></div></details></td></tr>`)}
+                  <button class="btn btn-sm btn-danger">${tx(f.kind === 'passkey' ? 'mfa.remove_passkey' : 'mfa.remove_app')}</button></form></div></details></td></tr>`)}
               </tbody></table></div>`
           : html`<p class="muted">${tx('mfa.no_apps')}</p>`}
+          <h3>${tx('mfa.kind_passkey')}</h3>
+          <p class="muted small u-mt0">${tx('mfa.passkey_intro')}</p>
+          <form method="post" action="${BASE}/security/passkey">${csrf(s)}
+            <div class="form-grid">${input('pk_name', tx('mfa.app_name'), tx('mfa.passkey_default'), { required: true })}</div>
+            <input type="hidden" name="clientDataJSON"><input type="hidden" name="attestationObject"><input type="hidden" name="transports">
+            ${isIP(rp.rpId) ? html`<p class="alert alert-info" role="status">${tx('mfa.passkey_needs_host', { host: rp.rpId })}</p>`
+              : html`<div class="buttons"><button class="btn${factors.length ? '' : ' btn-hot'}" hidden data-passkey="${BASE}/security/passkey/options" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('mfa.add_passkey')}</button></div>`}
+            <p class="small" role="status" data-passkey-status></p>
+            <noscript><p class="muted small">${tx('mfa.passkey_needs_js')}</p></noscript>
+          </form>
+          <h3>${tx('mfa.kind_app')}</h3>
           ${setup}`)}
         ${region(tx('mfa.codes_title'), html`<p class="u-mt0">${factors.length || left ? tx('mfa.codes_left', { n: left }) : tx('mfa.codes_after')}</p>
           ${factors.length && left < 3 ? html`<p class="alert alert-warning" role="status">${tx('mfa.codes_low')}</p>` : ''}
-          ${factors.length ? html`<form method="post" action="${BASE}/security/codes">${csrf(s)}<button class="btn" data-confirm="${tx('mfa.codes_new_confirm')}">${tx('mfa.codes_new')}</button></form>` : ''}`)}
+          ${factors.length ? html`<form method="post" action="${BASE}/security/codes">${csrf(s)}<button class="btn" data-confirm="${tx('mfa.codes_new_confirm')}">${tx('mfa.codes_new')}</button></form>` : ''}
+          ${days || trusted ? html`<h3>${tx('mfa.trusted_title')}</h3>
+            <p class="u-mt0">${days ? tx('mfa.trusted_count', { n: trusted, days }) : tx('mfa.trusted_off')}</p>
+            ${trusted ? html`<form method="post" action="${BASE}/security/forget-browsers">${csrf(s)}<button class="btn">${tx('mfa.forget_browsers')}</button></form>` : ''}` : ''}`)}
       </div>`;
     return send(reply, s, shell(s, tx('mfa.title'), [[tx('mfa.title')]], main, 'developers'));
   });
@@ -167,7 +211,7 @@ export async function securityRoutes(app: FastifyInstance) {
     const tx = tr(s);
     const me = s.username!;
     const id = Number(req.params.id);
-    const f = await owner.one('select id from meta.developer_factor where id = $1 and username = $2', [id, me]);
+    const f = await owner.one<{ kind: string }>('select id, kind from meta.developer_factor where id = $1 and username = $2', [id, me]);
     if (!f) return reply.code(404).send('Not found');
     if (!(await verifyPassword(me, String(req.body?.[`password_${id}`] ?? '')))) {
       await logActivity({ username: me, event: 'login_failed', ip: clientIp(req), detail: 'builder (removing a second factor)' });
@@ -193,11 +237,73 @@ export async function securityRoutes(app: FastifyInstance) {
     }
     await owner.query('delete from meta.developer_factor where id = $1 and username = $2', [id, me]);
     if (last) await owner.query('delete from meta.developer_recovery_code where username = $1', [me]);
-    await logActivity({ username: me, event: '2fa_removed', ip: clientIp(req), detail: last ? 'the last authenticator app (recovery codes removed)' : 'an authenticator app' });
+    // a lost phone or key: browsers trusted with it must ask again
+    await forgetBrowsers(me);
+    const what = f.kind === 'passkey' ? 'a passkey' : 'an authenticator app';
+    await logActivity({ username: me, event: '2fa_removed', ip: clientIp(req), detail: last ? `${what}, the last factor (recovery codes removed)` : what });
     flash(s, tx('mfa.removed'));
     return back(reply, s, `${BASE}/security`);
   });
 
+  // (sprint 127) a passkey: the options for navigator.credentials.create(), then the browser's answer
+  app.post(`${BASE}/security/passkey/options`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const me = s.username!;
+    const rp = relyingParty(req);
+    const challenge = giveChallenge(s, 'create');
+    await saveState(s);
+    reply.header('cache-control', 'no-store');
+    return reply.send({
+      mode: 'create', challenge, rp: { id: rp.rpId, name: 'pgkiln' }, algs: ALGORITHMS,
+      // a stable handle that isn't the user name (the authenticator may show it, but it says nothing)
+      user: { id: b64url(createHash('sha256').update(`pgkiln-developer:${me}`).digest().subarray(0, 16)), name: me, displayName: me },
+      exclude: (await passkeysOf(me, rp.rpId)).map((p) => p.credential_id),
+    });
+  });
+
+  app.post(`${BASE}/security/passkey`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const tx = tr(s);
+    const me = s.username!;
+    const challenge = takeChallenge(s, 'create');
+    if (!challenge) {
+      flash(s, tx('mfa.setup_expired'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    const rp = relyingParty(req);
+    let reg;
+    try {
+      reg = verifyRegistration({ clientDataJSON: String(req.body?.clientDataJSON ?? ''), attestationObject: String(req.body?.attestationObject ?? '') }, { challenge, ...rp });
+    } catch (e) {
+      await logActivity({ username: me, event: '2fa_refused', ip: clientIp(req), detail: `passkey: ${e instanceof WebAuthnError ? e.message : 'unreadable answer'}` });
+      flash(s, tx('mfa.passkey_failed'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    const first = !(await hasFactor(me));
+    try {
+      await addPasskey(me, String(req.body?.pk_name ?? ''), { ...reg, rpId: rp.rpId, transports: String(req.body?.transports ?? '').split(',').filter(Boolean) });
+    } catch {
+      flash(s, tx('mfa.passkey_known'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    delete s.state.__MFA_DUE;
+    await logActivity({ username: me, event: '2fa_enrolled', ip: clientIp(req), detail: `passkey (${rp.rpId})` });
+    if (first || !(await codesLeft(me))) s.state.__CODES_NEW = JSON.stringify(await newRecoveryCodes(me));
+    flash(s, tx('mfa.passkey_added'));
+    return back(reply, s, `${BASE}/security${s.state.__CODES_NEW ? '#codes' : ''}`);
+  });
+
+  app.post(`${BASE}/security/forget-browsers`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    await forgetBrowsers(s.username!);
+    await logActivity({ username: s.username, event: '2fa_forget_browsers', ip: clientIp(req) });
+    flash(s, tr(s)('mfa.browsers_forgotten'));
+    return back(reply, s, `${BASE}/security`);
+  });
+
   // (SEC-6) an administrator resets another developer's second factors: logged, the developer and the administrators told
   app.post(`${BASE}/developers/reset-2fa`, async (req: Req, reply) => {
     const s = await developer(req, reply);
@@ -228,13 +334,16 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!(await isAdmin(s.username))) return reply.code(403).send('Only administrators change the policy.');
     const policy = MFA_POLICIES.includes(req.body?.policy as MfaPolicy) ? (req.body!.policy as MfaPolicy) : null;
     const grace = Number(req.body?.grace_days);
-    if (!policy || !Number.isInteger(grace) || grace < 0 || grace > 90) return reply.code(400).send('policy is off, admins or all; grace_days 0 to 90');
+    const trust = Number(req.body?.trust_days ?? 0);
+    if (!policy || !Number.isInteger(grace) || grace < 0 || grace > 90 || !Number.isInteger(trust) || trust < 0 || trust > 90)
+      return reply.code(400).send('policy is off, admins or all; grace_days and trust_days 0 to 90');
     if (await policyProblem(policy)) {
       flash(s, tx('mfa.policy_needs_admins'), 'error');
       return back(reply, s, `${BASE}/instance#mfa`);
     }
     await setPolicy(policy, grace);
-    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days` });
+    await setTrustDays(trust);
+    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days` });
     await notifyMfa(await adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${s.username} set the two-factor policy to ${policy} (grace period ${grace} days).`);
     flash(s, tx('mfa.policy_saved'));
     return back(reply, s, `${BASE}/instance#mfa`);
@@ -244,8 +353,8 @@ export async function securityRoutes(app: FastifyInstance) {
 /** The Instance settings region for the policy (administrators). */
 export async function policyRegion(s: Session): Promise<Raw> {
   const tx = tr(s);
-  const [pol, af, without] = await Promise.all([
-    mfaPolicy(), adminFactors(),
+  const [pol, af, days, without] = await Promise.all([
+    mfaPolicy(), adminFactors(), trustDays(),
     owner.query<{ username: string; is_admin: boolean }>('select username, is_admin from meta.developer d where not exists (select 1 from meta.developer_factor f where f.username = d.username) order by username'),
   ]);
   const opt = (v: MfaPolicy) => html`<option value="${v}"${pol.policy === v ? raw(' selected') : ''}>${tx(({ off: 'mfa.policy_off', admins: 'mfa.policy_admins', all: 'mfa.policy_all' } as const)[v])}</option>`;
@@ -253,6 +362,7 @@ export async function policyRegion(s: Session): Promise<Raw> {
       <div class="form-grid">
         <div class="field"><label class="label" for="f_policy">${tx('mfa.policy_label')}</label><select id="f_policy" name="policy">${MFA_POLICIES.map(opt)}</select></div>
         ${input('grace_days', tx('mfa.grace'), pol.graceDays, { type: 'number', help: tx('mfa.grace_help') })}
+        ${input('trust_days', tx('mfa.trust_days'), days, { type: 'number', help: tx('mfa.trust_days_help') })}
       </div>
       <p class="muted small">${tx('mfa.policy_help', { enrolled: af.enrolled, admins: af.admins })}</p>
       <div class="buttons"><button class="btn btn-hot">${tx('mfa.policy_save')}</button></div></form>

package/src/instance.ts

@@ -108,7 +108,8 @@ export async function saveInstanceSettings(values: Record<string, string | undef
 export const CONFIGURATION: readonly { env: string; secret?: boolean; default: string; help: string }[] = [
   { env: 'PORT', default: '3100', help: 'HTTP port' },
   { env: 'HOST', default: '127.0.0.1', help: 'Address the server listens on' },
-  { env: 'PUBLIC_URL', default: '(none)', help: 'The public address (single sign-on redirects, links)' },
+  { env: 'PUBLIC_URL', default: '(none)', help: 'The public address (single sign-on redirects, links, passkeys)' },
+  { env: 'PGKILN_RP_ID', default: '(the host of PUBLIC_URL)', help: 'A parent domain for developers\' passkeys' },
   { env: 'DATABASE_URL', secret: true, default: '(none)', help: 'Owner connection (migrations, builder, SQL Workshop)' },
   { env: 'RUNTIME_DATABASE_URL', secret: true, default: 'DATABASE_URL', help: 'Least-privilege connection that runs applications' },
   { env: 'COOKIE_SECURE', default: 'false', help: 'Cookies only over HTTPS' },