pgkiln 0.60.0 → 0.62.0

package/src/builder/security.ts

@@ -1,14 +1,17 @@
+import { isIP } from 'node:net';
 import type { FastifyInstance } from 'fastify';
 import { owner } from '../db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import {
-  addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy, newRecoveryCodes, newTotpSecret,
-  notifyMfa, otpauthUri, policyProblem, requiredFor, resetFactors, setPolicy, unbase32, type MfaPolicy,
+  addPasskey, addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, forgetBrowsers, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy,
+  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requirement, resetFactors, setPolicy, setTrustDays, trustDays,
+  trustedBrowsers, unbase32, userHandle, passkeySignin, setPasskeySignin, type MfaPolicy,
 } from '../mfa.ts';
 import { qrSvg } from '../qrcode.ts';
 import { secretKeyConfigured } from '../secrets.ts';
-import { clientIp, logActivity, type Session } from '../session.ts';
+import { clientIp, logActivity, saveState, type Session } from '../session.ts';
+import { ALGORITHMS, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
@@ -19,6 +22,29 @@ import { back, BASE, csrf, developer, flash, input, region, send, shell, type Re
 // app confirms it, then stored encrypted with the instance key. Recovery codes are shown once; they count
 // only after "I saved them". Removing a factor asks for the password, and is refused when it would leave a
 // developer the policy covers without one, or the instance without enough administrators who have one.
+// (sprint 127) Passkeys (WebAuthn): the browser asks the server for options (a one-time challenge kept in the
+// session for five minutes), calls navigator.credentials.create() and posts the answer in a normal form
+// (public/builder.js, [data-passkey]); without JavaScript the button stays hidden. Trusted browsers can be
+// forgotten here; the instance decides how long a browser may be trusted (0 = never).
+
+const CHALLENGE_SECONDS = 300;
+
+/** A one-time WebAuthn challenge kept in the session (for this purpose only), or null when there is none or it expired. */
+export function takeChallenge(s: Session, purpose: 'create' | 'get'): string | null {
+  try {
+    const p = JSON.parse(String(s.state.__PK ?? ''));
+    delete s.state.__PK;
+    return p && p.purpose === purpose && Date.now() - Number(p.at) < CHALLENGE_SECONDS * 1000 && typeof p.c === 'string' ? p.c : null;
+  } catch {
+    delete s.state.__PK;
+    return null;
+  }
+}
+export function giveChallenge(s: Session, purpose: 'create' | 'get'): string {
+  const c = newChallenge();
+  s.state.__PK = JSON.stringify({ c, purpose, at: Date.now() });
+  return c;
+}
 
 const SECRET_MINUTES = 10;
 
@@ -32,8 +58,9 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!s) return;
     const tx = tr(s);
     const me = s.username!;
-    const [factors, left, pol, admin] = await Promise.all([factorsOf(me), codesLeft(me), mfaPolicy(), isAdmin(me)]);
-    const required = requiredFor(pol.policy, admin);
+    const [factors, left, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), isAdmin(me), trustDays(), trustedBrowsers(me)]);
+    const rp = relyingParty(req);
+    const { required } = await requirement(me, admin);
     const pending = (() => {
       try {
         const p = JSON.parse(String(s.state.__TOTP_NEW ?? ''));
@@ -80,18 +107,34 @@ export async function securityRoutes(app: FastifyInstance) {
               <div class="buttons"><button class="btn btn-hot">${tx('mfa.codes_done')}</button></div></form>`, '', 'codes')
         : ''}
       <div class="columns">
-        ${region(tx('mfa.apps'), html`${factors.length
-          ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('mfa.app_name')}</th><th>${tx('mfa.added')}</th><th>${tx('mfa.last_used')}</th><th></th></tr></thead><tbody>
-              ${factors.map((f) => html`<tr><td data-label="${tx('mfa.app_name')}">${icon('key')} ${f.name}</td><td data-label="${tx('mfa.added')}">${when(f.created_at)}</td><td data-label="${tx('mfa.last_used')}">${when(f.last_used_at)}</td>
+        ${region(tx('mfa.factors'), html`${factors.length
+          ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('mfa.app_name')}</th><th>${tx('mfa.kind')}</th><th>${tx('mfa.added')}</th><th>${tx('mfa.last_used')}</th><th></th></tr></thead><tbody>
+              ${factors.map((f) => html`<tr><td data-label="${tx('mfa.app_name')}">${icon(f.kind === 'passkey' ? 'fingerprint' : 'smartphone')} ${f.name}</td>
+                <td data-label="${tx('mfa.kind')}">${f.kind === 'passkey' ? tx('mfa.kind_passkey') : tx('mfa.kind_app')}${f.kind === 'passkey' && f.rp_id !== rp.rpId ? html` <span class="badge badge-warn" title="${tx('mfa.other_domain_help', { domain: f.rp_id ?? '' })}">${tx('mfa.other_domain', { domain: f.rp_id ?? '' })}</span>` : ''}</td>
+                <td data-label="${tx('mfa.added')}">${when(f.created_at)}</td><td data-label="${tx('mfa.last_used')}">${when(f.last_used_at)}</td>
                 <td><details class="menu"><summary class="btn btn-sm">${tx('mfa.remove')}</summary><div class="menu-panel"><form method="post" action="${BASE}/security/factor/${f.id}/delete" class="menu-section">${csrf(s)}
                   ${input(`password_${f.id}`, tx('mfa.your_password'), '', { type: 'password', required: true, auto: 'current-password' })}
-                  <button class="btn btn-sm btn-danger">${tx('mfa.remove_app')}</button></form></div></details></td></tr>`)}
+                  <button class="btn btn-sm btn-danger">${tx(f.kind === 'passkey' ? 'mfa.remove_passkey' : 'mfa.remove_app')}</button></form></div></details></td></tr>`)}
               </tbody></table></div>`
           : html`<p class="muted">${tx('mfa.no_apps')}</p>`}
+          <h3>${tx('mfa.kind_passkey')}</h3>
+          <p class="muted small u-mt0">${tx('mfa.passkey_intro')}</p>
+          <form method="post" action="${BASE}/security/passkey">${csrf(s)}
+            <div class="form-grid">${input('pk_name', tx('mfa.app_name'), tx('mfa.passkey_default'), { required: true })}</div>
+            <input type="hidden" name="clientDataJSON"><input type="hidden" name="attestationObject"><input type="hidden" name="transports">
+            ${isIP(rp.rpId) ? html`<p class="alert alert-info" role="status">${tx('mfa.passkey_needs_host', { host: rp.rpId })}</p>`
+              : html`<div class="buttons"><button class="btn${factors.length ? '' : ' btn-hot'}" hidden data-passkey="${BASE}/security/passkey/options" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('mfa.add_passkey')}</button></div>`}
+            <p class="small" role="status" data-passkey-status></p>
+            <noscript><p class="muted small">${tx('mfa.passkey_needs_js')}</p></noscript>
+          </form>
+          <h3>${tx('mfa.kind_app')}</h3>
           ${setup}`)}
         ${region(tx('mfa.codes_title'), html`<p class="u-mt0">${factors.length || left ? tx('mfa.codes_left', { n: left }) : tx('mfa.codes_after')}</p>
           ${factors.length && left < 3 ? html`<p class="alert alert-warning" role="status">${tx('mfa.codes_low')}</p>` : ''}
-          ${factors.length ? html`<form method="post" action="${BASE}/security/codes">${csrf(s)}<button class="btn" data-confirm="${tx('mfa.codes_new_confirm')}">${tx('mfa.codes_new')}</button></form>` : ''}`)}
+          ${factors.length ? html`<form method="post" action="${BASE}/security/codes">${csrf(s)}<button class="btn" data-confirm="${tx('mfa.codes_new_confirm')}">${tx('mfa.codes_new')}</button></form>` : ''}
+          ${days || trusted ? html`<h3>${tx('mfa.trusted_title')}</h3>
+            <p class="u-mt0">${days ? tx('mfa.trusted_count', { n: trusted, days }) : tx('mfa.trusted_off')}</p>
+            ${trusted ? html`<form method="post" action="${BASE}/security/forget-browsers">${csrf(s)}<button class="btn">${tx('mfa.forget_browsers')}</button></form>` : ''}` : ''}`)}
       </div>`;
     return send(reply, s, shell(s, tx('mfa.title'), [[tx('mfa.title')]], main, 'developers'));
   });
@@ -167,7 +210,7 @@ export async function securityRoutes(app: FastifyInstance) {
     const tx = tr(s);
     const me = s.username!;
     const id = Number(req.params.id);
-    const f = await owner.one('select id from meta.developer_factor where id = $1 and username = $2', [id, me]);
+    const f = await owner.one<{ kind: string }>('select id, kind from meta.developer_factor where id = $1 and username = $2', [id, me]);
     if (!f) return reply.code(404).send('Not found');
     if (!(await verifyPassword(me, String(req.body?.[`password_${id}`] ?? '')))) {
       await logActivity({ username: me, event: 'login_failed', ip: clientIp(req), detail: 'builder (removing a second factor)' });
@@ -178,7 +221,7 @@ export async function securityRoutes(app: FastifyInstance) {
     if (last) {
       const pol = await mfaPolicy();
       const admin = await isAdmin(me);
-      if (requiredFor(pol.policy, admin)) {
+      if ((await requirement(me, admin)).required) {
         flash(s, tx('mfa.cannot_remove_required'), 'error');
         return back(reply, s, `${BASE}/security`);
       }
@@ -193,11 +236,73 @@ export async function securityRoutes(app: FastifyInstance) {
     }
     await owner.query('delete from meta.developer_factor where id = $1 and username = $2', [id, me]);
     if (last) await owner.query('delete from meta.developer_recovery_code where username = $1', [me]);
-    await logActivity({ username: me, event: '2fa_removed', ip: clientIp(req), detail: last ? 'the last authenticator app (recovery codes removed)' : 'an authenticator app' });
+    // a lost phone or key: browsers trusted with it must ask again
+    await forgetBrowsers(me);
+    const what = f.kind === 'passkey' ? 'a passkey' : 'an authenticator app';
+    await logActivity({ username: me, event: '2fa_removed', ip: clientIp(req), detail: last ? `${what}, the last factor (recovery codes removed)` : what });
     flash(s, tx('mfa.removed'));
     return back(reply, s, `${BASE}/security`);
   });
 
+  // (sprint 127) a passkey: the options for navigator.credentials.create(), then the browser's answer
+  app.post(`${BASE}/security/passkey/options`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const me = s.username!;
+    const rp = relyingParty(req);
+    const challenge = giveChallenge(s, 'create');
+    await saveState(s);
+    reply.header('cache-control', 'no-store');
+    return reply.send({
+      mode: 'create', challenge, rp: { id: rp.rpId, name: 'pgkiln' }, algs: ALGORITHMS,
+      // a stable handle that isn't the user name (the authenticator may show it, but it says nothing)
+      user: { id: userHandle(me), name: me, displayName: me },
+      exclude: (await passkeysOf(me, rp.rpId)).map((p) => p.credential_id),
+    });
+  });
+
+  app.post(`${BASE}/security/passkey`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const tx = tr(s);
+    const me = s.username!;
+    const challenge = takeChallenge(s, 'create');
+    if (!challenge) {
+      flash(s, tx('mfa.setup_expired'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    const rp = relyingParty(req);
+    let reg;
+    try {
+      reg = verifyRegistration({ clientDataJSON: String(req.body?.clientDataJSON ?? ''), attestationObject: String(req.body?.attestationObject ?? '') }, { challenge, ...rp });
+    } catch (e) {
+      await logActivity({ username: me, event: '2fa_refused', ip: clientIp(req), detail: `passkey: ${e instanceof WebAuthnError ? e.message : 'unreadable answer'}` });
+      flash(s, tx('mfa.passkey_failed'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    const first = !(await hasFactor(me));
+    try {
+      await addPasskey(me, String(req.body?.pk_name ?? ''), { ...reg, rpId: rp.rpId, transports: String(req.body?.transports ?? '').split(',').filter(Boolean) });
+    } catch {
+      flash(s, tx('mfa.passkey_known'), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+    delete s.state.__MFA_DUE;
+    await logActivity({ username: me, event: '2fa_enrolled', ip: clientIp(req), detail: `passkey (${rp.rpId})` });
+    if (first || !(await codesLeft(me))) s.state.__CODES_NEW = JSON.stringify(await newRecoveryCodes(me));
+    flash(s, tx('mfa.passkey_added'));
+    return back(reply, s, `${BASE}/security${s.state.__CODES_NEW ? '#codes' : ''}`);
+  });
+
+  app.post(`${BASE}/security/forget-browsers`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    await forgetBrowsers(s.username!);
+    await logActivity({ username: s.username, event: '2fa_forget_browsers', ip: clientIp(req) });
+    flash(s, tr(s)('mfa.browsers_forgotten'));
+    return back(reply, s, `${BASE}/security`);
+  });
+
   // (SEC-6) an administrator resets another developer's second factors: logged, the developer and the administrators told
   app.post(`${BASE}/developers/reset-2fa`, async (req: Req, reply) => {
     const s = await developer(req, reply);
@@ -228,13 +333,18 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!(await isAdmin(s.username))) return reply.code(403).send('Only administrators change the policy.');
     const policy = MFA_POLICIES.includes(req.body?.policy as MfaPolicy) ? (req.body!.policy as MfaPolicy) : null;
     const grace = Number(req.body?.grace_days);
-    if (!policy || !Number.isInteger(grace) || grace < 0 || grace > 90) return reply.code(400).send('policy is off, admins or all; grace_days 0 to 90');
+    const trust = Number(req.body?.trust_days ?? 0);
+    if (!policy || !Number.isInteger(grace) || grace < 0 || grace > 90 || !Number.isInteger(trust) || trust < 0 || trust > 90)
+      return reply.code(400).send('policy is off, admins or all; grace_days and trust_days 0 to 90');
     if (await policyProblem(policy)) {
       flash(s, tx('mfa.policy_needs_admins'), 'error');
       return back(reply, s, `${BASE}/instance#mfa`);
     }
+    const alone = req.body?.passkey_signin === '1';
     await setPolicy(policy, grace);
-    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days` });
+    await setTrustDays(trust);
+    await setPasskeySignin(alone);
+    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days, passkey sign-in ${alone ? 'on' : 'off'}` });
     await notifyMfa(await adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${s.username} set the two-factor policy to ${policy} (grace period ${grace} days).`);
     flash(s, tx('mfa.policy_saved'));
     return back(reply, s, `${BASE}/instance#mfa`);
@@ -244,8 +354,8 @@ export async function securityRoutes(app: FastifyInstance) {
 /** The Instance settings region for the policy (administrators). */
 export async function policyRegion(s: Session): Promise<Raw> {
   const tx = tr(s);
-  const [pol, af, without] = await Promise.all([
-    mfaPolicy(), adminFactors(),
+  const [pol, af, days, alone, without] = await Promise.all([
+    mfaPolicy(), adminFactors(), trustDays(), passkeySignin(),
     owner.query<{ username: string; is_admin: boolean }>('select username, is_admin from meta.developer d where not exists (select 1 from meta.developer_factor f where f.username = d.username) order by username'),
   ]);
   const opt = (v: MfaPolicy) => html`<option value="${v}"${pol.policy === v ? raw(' selected') : ''}>${tx(({ off: 'mfa.policy_off', admins: 'mfa.policy_admins', all: 'mfa.policy_all' } as const)[v])}</option>`;
@@ -253,7 +363,10 @@ export async function policyRegion(s: Session): Promise<Raw> {
       <div class="form-grid">
         <div class="field"><label class="label" for="f_policy">${tx('mfa.policy_label')}</label><select id="f_policy" name="policy">${MFA_POLICIES.map(opt)}</select></div>
         ${input('grace_days', tx('mfa.grace'), pol.graceDays, { type: 'number', help: tx('mfa.grace_help') })}
+        ${input('trust_days', tx('mfa.trust_days'), days, { type: 'number', help: tx('mfa.trust_days_help') })}
       </div>
+      <div class="field"><label class="check"><input type="checkbox" name="passkey_signin" value="1"${alone ? raw(' checked') : ''}> ${tx('mfa.passkey_signin')}</label>
+        <small class="help">${tx('mfa.passkey_signin_help')}</small></div>
       <p class="muted small">${tx('mfa.policy_help', { enrolled: af.enrolled, admins: af.admins })}</p>
       <div class="buttons"><button class="btn btn-hot">${tx('mfa.policy_save')}</button></div></form>
     ${without.rows.length ? html`<p class="small">${tx('mfa.without', { list: without.rows.map((d) => `${d.username}${d.is_admin ? ' (admin)' : ''}`).join(', ') })}</p>` : ''}

package/src/builder/ui.ts

@@ -12,7 +12,7 @@ import { ensureDevbar } from '../runtime/devbar.ts';
 import { noteChange } from './app-updates.ts';
 import { clientTexts, tr } from './i18n.ts';
 import { languageMenu, loadLanguage } from './language.ts';
-import { enrolmentDue } from '../mfa.ts';
+import { enrolmentDue, requirement } from '../mfa.ts';
 
 // Shared building blocks of the builder UI.
 
@@ -323,9 +323,19 @@ export async function developer(req: Req, reply: FastifyReply) {
   if (s.state.__BLANG === undefined) await loadLanguage(s);
   // (sprint 126, SEC-2) the two-factor policy: a banner during the grace period, then only the Security page until they enrol
   delete s.state.__MFA_DUE;
-  const due = await enrolmentDue(s.username, await isAdmin(s.username));
+  const admin = await isAdmin(s.username);
+  // (sprint 128) signed in with the default password while a second factor is required: change it first
+  // (on Developers), then the enrolment below
+  const weakFirst = !!s.state.__WEAK && (await requirement(s.username, admin)).required;
+  if (weakFirst && !/^\/builder\/(developers|logout|language|theme)(?:[/?#]|$)/.test(req.url)) {
+    flash(s, tr(s)('mfa.weak_required'), 'error');
+    await saveState(s);
+    reply.redirect(`${BASE}/developers`);
+    return null;
+  }
+  const due = await enrolmentDue(s.username, admin);
   if (due?.due === 'grace') s.state.__MFA_DUE = due.until.toISOString();
-  else if (due && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
+  else if (due && !weakFirst && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
     reply.redirect(`${BASE}/security`);
     return null;
   }

package/src/builder/workspaces.ts

@@ -8,6 +8,7 @@ import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type BuilderWorkspace, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
+import { setWorkspaceRequired } from '../mfa.ts';
 import { back, BANNER_COLORS, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // Workspaces (064; APEX: workspaces). A workspace groups applications and the
@@ -215,7 +216,7 @@ function serviceRegion(s: Session, w: { id: number; message: string | null; bann
 }
 
 /** (093) Workspace preferences: the SQL Workshop and the applications' REST modules on or off. */
-function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null }) {
+function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null; mfa_required_since: Date | null }, without: string[]) {
   const check = (name: string, on: boolean, label: string, help: string) =>
     html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label><small class="help">${help}</small></div>`;
   const tx = tr(s);
@@ -223,7 +224,12 @@ function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; r
       ${check('sql_workshop', w.sql_workshop, tx('wsp.sql_on'), tx('wsp.sql_on_help'))}
       ${check('rest_services', w.rest_services, tx('wsp.rest_on'), tx('wsp.rest_on_help', { path: '/a/<alias>/rest/…' }))}
       ${select('builder_home', tx('wsp.builder_home'), w.builder_home === 'home' ? 'home' : 'apps', [['apps', tx('wsp.home.apps')], ['home', tx('wsp.home.home')]], tx('wsp.builder_home_help'))}
-      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>`, '', 'preferences');
+      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>
+    <h3 id="mfa">${tx('wsp.mfa')}</h3>
+    <form method="post" action="${BASE}/workspaces/${w.id}/mfa">${csrf(s)}
+      ${check('required', !!w.mfa_required_since, tx('wsp.mfa_required'), tx('wsp.mfa_required_help'))}
+      ${w.mfa_required_since ? html`<p class="small">${tx('wsp.mfa_since', { date: new Date(w.mfa_required_since).toISOString().slice(0, 10) })}${without.length ? html` ${tx('wsp.mfa_without', { list: without.join(', ') })}` : ''}</p>` : ''}
+      <div class="buttons"><button class="btn">${tx('wsp.mfa_save')}</button></div></form>`, '', 'preferences');
 }
 
 /** (093) Extension links: links to other tools in the builder's Extensions menu. */
@@ -341,6 +347,10 @@ export async function workspaceRoutes(app: FastifyInstance) {
     ]);
     const roles = rolesQ;
     const links = (await owner.query('select id, label, url, description, position from meta.workspace_link where workspace_id = $1 order by position, lower(label)', [w.id])).rows;
+    // (sprint 128) the members still without a second factor
+    const without = (await owner.query<{ username: string }>(
+      `select m.username from meta.workspace_member m where m.workspace_id = $1
+          and not exists (select 1 from meta.developer_factor f where f.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -365,7 +375,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
       </div>
       ${serviceRegion(s, w)}
       ${region(tx('wsp.mail_net'), html`<p class="u-mt0">${tx.rich('wsp.mail_net_text', { mail: html`<a href="${BASE}/workspaces/${w.id}/mail">${tx('wsp.mail_service')}</a>`, network: html`<a href="${BASE}/network?ws=${w.id}">${tx('wsp.network')}</a>`, queue: html`<a href="${BASE}/mail-queue${full ? `?ws=${w.id}` : ''}">${tx('wsp.queue')}</a>` })}</p>`, '', 'mail-network')}
-      <div class="columns">${preferencesRegion(s, w)}${linksRegion(s, w, links)}</div>
+      <div class="columns">${preferencesRegion(s, w, without)}${linksRegion(s, w, links)}</div>
       ${full ? isolationRegion(s, w, roles.rows) : region(tx('wsp.isolation'), html`<p class="u-mt0">${w.isolated ? tx('wsp.iso_short_on') : tx('wsp.iso_short_off')} ${tx('wsp.admins_change')}</p>`)}
       ${!full ? '' : region(tx('wsp.applications'), html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>${tx('wsp.application')}</th><th>${tx('wsp.move_to')}</th></tr></thead>
@@ -559,6 +569,17 @@ export async function workspaceRoutes(app: FastifyInstance) {
     return back(reply, s, `${BASE}/workspaces/${req.params.id}`);
   });
 
+  // (sprint 128, SEC-2) a workspace requires a second factor of its developers (the instance's grace period from now)
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/mfa`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const on = req.body?.required === 'true';
+    if (!(await setWorkspaceRequired(Number(req.params.id), on))) return reply.code(404).send('Not found');
+    await logActivity({ appId: null, username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `workspace ${req.params.id}: two-factor sign-in ${on ? 'required' : 'not required'}` });
+    flash(s, tr(s)(on ? 'wsp.mfa_on' : 'wsp.mfa_off'));
+    return back(reply, s, `${BASE}/workspaces/${req.params.id}#mfa`);
+  });
+
   // (093) extension links
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/links`, async (req: Req, reply) => {
     const s = await developer(req, reply);

package/src/cli/main.ts

@@ -477,9 +477,9 @@ const COMMANDS: Record<string, Command> = {
       'pgkiln admin reset-2fa <developer> [--reason <text>]\n' +
       'pgkiln admin set-2fa-policy off|admins|all [--grace <days>]\n\n' +
       "reset-2fa removes the developer's authenticator apps and recovery codes and ends their builder\n" +
-      'sessions; they sign in with the password and set up an app again. set-2fa-policy off always works;\n' +
-      'admins and all need at least two administrators with two-factor sign-in (or every one, when there\n' +
-      'are fewer). Both are written to the activity log and mailed to the administrators.',
+      'sessions; they sign in with the password and set up an app again. set-2fa-policy off always works\n' +
+      "(and clears the workspaces' own two-factor rules); admins and all need at least two administrators\n" +
+      'with two-factor sign-in (or every one, when there are fewer). Both are written to the activity log and mailed to the administrators.',
     options: { reason: { type: 'string' }, grace: { type: 'string' } },
     optionHelp: [
       ['--reason <text>', 'reset-2fa: why (in the activity log and the mail)'],
@@ -509,9 +509,11 @@ const COMMANDS: Record<string, Command> = {
           const policy = arg as 'off' | 'admins' | 'all';
           if (await mfa.policyProblem(policy)) throw new Error('at least two administrators (or every one, when there are fewer) need two-factor sign-in first');
           await mfa.setPolicy(policy, grace);
-          await logActivity({ event: '2fa_policy', ip: 'cli', detail: `${policy}, grace ${grace} days (${by})` });
+          // (sprint 128) off means off: no workspace requires a second factor either
+          const cleared = policy === 'off' ? await mfa.clearWorkspaceRequirements() : 0;
+          await logActivity({ event: '2fa_policy', ip: 'cli', detail: `${policy}, grace ${grace} days${cleared ? `, ${cleared} workspace rule(s) cleared` : ''} (${by})` });
           const sent = await mfa.notifyMfa(await mfa.adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${by} set the two-factor policy to ${policy} on the server.`);
-          out(`Two-factor policy: ${policy}${policy === 'off' ? '' : `, grace ${grace} days`}.${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
+          out(`Two-factor policy: ${policy}${policy === 'off' ? '' : `, grace ${grace} days`}.${cleared ? ` ${cleared} workspace(s) no longer require it.` : ''}${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
           return EXIT.ok;
         }
         throw new UsageError(`unknown action ${action}: use reset-2fa or set-2fa-policy`);

package/src/instance.ts

@@ -108,7 +108,8 @@ export async function saveInstanceSettings(values: Record<string, string | undef
 export const CONFIGURATION: readonly { env: string; secret?: boolean; default: string; help: string }[] = [
   { env: 'PORT', default: '3100', help: 'HTTP port' },
   { env: 'HOST', default: '127.0.0.1', help: 'Address the server listens on' },
-  { env: 'PUBLIC_URL', default: '(none)', help: 'The public address (single sign-on redirects, links)' },
+  { env: 'PUBLIC_URL', default: '(none)', help: 'The public address (single sign-on redirects, links, passkeys)' },
+  { env: 'PGKILN_RP_ID', default: '(the host of PUBLIC_URL)', help: 'A parent domain for developers\' passkeys' },
   { env: 'DATABASE_URL', secret: true, default: '(none)', help: 'Owner connection (migrations, builder, SQL Workshop)' },
   { env: 'RUNTIME_DATABASE_URL', secret: true, default: 'DATABASE_URL', help: 'Least-privilege connection that runs applications' },
   { env: 'COOKIE_SECURE', default: 'false', help: 'Cookies only over HTTPS' },

package/src/mfa.ts

@@ -9,6 +9,10 @@ import { decryptSecret, encryptSecret } from './secrets.ts';
 // setting; it can only be required while two administrators (or every administrator, when there are fewer)
 // have a working second factor, so it never locks the instance out. The command line resets a developer's
 // factors and turns the policy off without signing in (src/cli/main.ts, `pgkiln admin`).
+// (sprint 127) Passkeys and security keys (WebAuthn, src/webauthn.ts) are the second kind of factor, and a
+// developer may trust a browser for a number of days (meta.setting mfa_trust_days; 0 = never).
+// (sprint 128) A passkey the authenticator verified the developer with may stand in for both the password and
+// the second factor (mfa_passkey_signin), and a workspace may require a second factor of its developers.
 
 export const TOTP_STEP = 30;
 export const TOTP_DIGITS = 6;
@@ -92,10 +96,10 @@ export const hashCode = (code: string) => createHash('sha256').update(normaliseC
 
 // ---------------------------------------------------------------- the developer's factors
 
-export interface Factor { id: number; kind: 'totp'; name: string; created_at: string; last_used_at: string | null }
+export interface Factor { id: number; kind: 'totp' | 'passkey'; name: string; created_at: string; last_used_at: string | null; rp_id: string | null }
 
 export async function factorsOf(username: string, db: Pick<pg.ClientBase, 'query'> = owner.pool): Promise<Factor[]> {
-  return (await db.query<Factor>('select id, kind, name, created_at, last_used_at from meta.developer_factor where username = $1 order by id', [username])).rows;
+  return (await db.query<Factor>('select id, kind, name, created_at, last_used_at, rp_id from meta.developer_factor where username = $1 order by kind desc, id', [username])).rows;
 }
 
 /** Recovery codes left (confirmed, unused). */
@@ -116,6 +120,96 @@ export async function addTotp(username: string, name: string, secret: string, st
   );
 }
 
+// ---------------------------------------------------------------- passkeys (sprint 127)
+
+export interface Passkey { id: number; name: string; credential_id: string; public_key: Record<string, string>; alg: number; sign_count: string; transports: string[] }
+
+/** Add a passkey (after src/webauthn.ts checked the browser's answer). */
+export async function addPasskey(username: string, name: string, p: { credentialId: string; jwk: Record<string, string>; alg: number; signCount: number; rpId: string; transports: string[] }) {
+  await owner.query(
+    `insert into meta.developer_factor (username, kind, name, credential_id, public_key, alg, sign_count, rp_id, transports, last_used_at)
+     values ($1, 'passkey', $2, $3, $4, $5, $6, $7, $8, now())`,
+    [username, name.trim().slice(0, 60) || 'Passkey', p.credentialId, JSON.stringify(p.jwk), p.alg, p.signCount, p.rpId,
+     p.transports.filter((t) => /^[a-z-]{1,20}$/.test(t)).slice(0, 8)],
+  );
+}
+
+/** The developer's passkeys for this relying party (a passkey only works on the domain it was made for). */
+export async function passkeysOf(username: string, rpId: string): Promise<Passkey[]> {
+  return (await owner.query<Passkey>(
+    `select id, name, credential_id, public_key, alg, sign_count, transports from meta.developer_factor
+      where username = $1 and kind = 'passkey' and rp_id = $2 order by id`, [username, rpId])).rows;
+}
+
+/** (sprint 128) The passkey with this credential id for this relying party, and whose it is (sign-in without a user name). */
+export async function passkeyByCredential(credentialId: string, rpId: string): Promise<(Passkey & { username: string }) | null> {
+  if (!credentialId || credentialId.length > 1400) return null;
+  return (await owner.one<Passkey & { username: string }>(
+    `select id, username, name, credential_id, public_key, alg, sign_count, transports from meta.developer_factor
+      where kind = 'passkey' and credential_id = $1 and rp_id = $2`, [credentialId, rpId])) ?? null;
+}
+
+/** The user handle a developer's passkeys carry: stable, and not the user name. */
+export const userHandle = (username: string) => createHash('sha256').update(`pgkiln-developer:${username}`).digest().subarray(0, 16).toString('base64url');
+
+/** (sprint 128) Whether a passkey alone (user verified) may sign a developer in. */
+export async function passkeySignin(): Promise<boolean> {
+  return (await owner.one<{ value: string }>(`select value from meta.setting where name = 'mfa_passkey_signin'`))?.value !== 'off';
+}
+
+export async function setPasskeySignin(on: boolean) {
+  await owner.query(`insert into meta.setting (name, value) values ('mfa_passkey_signin', $1) on conflict (name) do update set value = excluded.value`, [on ? 'on' : 'off']);
+}
+
+/** Record a sign-in with a passkey; false when another sign-in moved the counter first (a replay or a clone). */
+export async function usePasskey(id: number, oldCount: string, newCount: number): Promise<boolean> {
+  return !!(await owner.query(
+    'update meta.developer_factor set sign_count = $3, last_used_at = now() where id = $1 and sign_count = $2::bigint',
+    [id, oldCount, newCount])).rowCount;
+}
+
+// ---------------------------------------------------------------- trusted browsers (sprint 127)
+
+/** Days a browser may skip the second step after one (0 = never). */
+export async function trustDays(): Promise<number> {
+  const v = Number((await owner.one<{ value: string }>(`select value from meta.setting where name = 'mfa_trust_days'`))?.value);
+  return Number.isInteger(v) && v >= 0 && v <= 90 ? v : 0;
+}
+
+export async function setTrustDays(days: number) {
+  await owner.query(`insert into meta.setting (name, value) values ('mfa_trust_days', $1) on conflict (name) do update set value = excluded.value`, [String(days)]);
+  if (days === 0) await owner.query('delete from meta.developer_trusted_browser');
+  else await owner.query(`delete from meta.developer_trusted_browser where expires_at > now() + make_interval(days => $1)`, [days]);
+}
+
+const tokenHash = (token: string) => createHash('sha256').update(token).digest('hex');
+
+/** Trust this browser: a random token for the cookie (only its hash is stored). */
+export async function trustBrowser(username: string, days: number, userAgent: string): Promise<string> {
+  const token = randomBytes(32).toString('base64url');
+  await owner.query(
+    `insert into meta.developer_trusted_browser (token_hash, username, expires_at, user_agent) values ($1, $2, now() + make_interval(days => $3), $4)`,
+    [tokenHash(token), username, days, userAgent.slice(0, 200)]);
+  return token;
+}
+
+/** Whether this browser's token is trusted for this developer (and trusting is still on). */
+export async function isTrustedBrowser(username: string, token: string | undefined): Promise<boolean> {
+  if (!token || token.length > 100) return false;
+  return !!(await owner.one(
+    `select 1 as ok from meta.developer_trusted_browser t where token_hash = $1 and username = $2 and expires_at > now()
+        and exists (select 1 from meta.setting where name = 'mfa_trust_days' and value <> '0')`,
+    [tokenHash(token), username]));
+}
+
+export async function trustedBrowsers(username: string): Promise<number> {
+  return (await owner.one<{ n: number }>('select count(*)::int as n from meta.developer_trusted_browser where username = $1 and expires_at > now()', [username]))!.n;
+}
+
+export async function forgetBrowsers(username: string) {
+  await owner.query('delete from meta.developer_trusted_browser where username = $1', [username]);
+}
+
 /** New recovery codes (the old ones stop working); shown once, counted only when confirmed. */
 export async function newRecoveryCodes(username: string): Promise<string[]> {
   const codes = Array.from({ length: RECOVERY_CODES }, newRecoveryCode);
@@ -212,14 +306,47 @@ export async function setPolicy(policy: MfaPolicy, graceDays: number) {
   });
 }
 
+/**
+ * (sprint 128) Whether a second factor is required of this developer, by the instance's policy or by one of
+ * their workspaces, and since when (the grace period counts from the earliest).
+ */
+export async function requirement(username: string, isAdmin: boolean): Promise<{ required: boolean; since: Date | null; graceDays: number; workspaces: string[] }> {
+  const [{ policy, since, graceDays }, ws] = await Promise.all([
+    mfaPolicy(),
+    owner.query<{ name: string; since: Date }>(
+      `select w.name, w.mfa_required_since as since from meta.workspace w join meta.workspace_member m on m.workspace_id = w.id
+        where m.username = $1 and w.mfa_required_since is not null order by w.mfa_required_since`, [username]),
+  ]);
+  const byInstance = requiredFor(policy, isAdmin);
+  const times = [...(byInstance ? [since ?? new Date()] : []), ...ws.rows.map((r) => new Date(r.since))];
+  return {
+    required: times.length > 0,
+    since: times.length ? new Date(Math.min(...times.map((t) => t.getTime()))) : null,
+    graceDays,
+    workspaces: ws.rows.map((r) => r.name),
+  };
+}
+
+/** (sprint 128) Require a second factor of a workspace's developers (from now), or stop requiring it. */
+export async function setWorkspaceRequired(workspaceId: number, on: boolean): Promise<boolean> {
+  return !!(await owner.query(
+    `update meta.workspace set mfa_required_since = case when $2 then coalesce(mfa_required_since, now()) end where id = $1`,
+    [workspaceId, on])).rowCount;
+}
+
+/** The command line's "off": no workspace requires a second factor either. */
+export async function clearWorkspaceRequirements(): Promise<number> {
+  return (await owner.query('update meta.workspace set mfa_required_since = null where mfa_required_since is not null')).rowCount ?? 0;
+}
+
 /**
  * A developer without a factor while the policy requires one: 'grace' until the grace period ends (a
  * banner), then 'enrol' (only the Security page and signing out until they enrol); null otherwise.
  */
 export async function enrolmentDue(username: string, isAdmin: boolean): Promise<{ due: 'grace' | 'enrol'; until: Date } | null> {
-  const { policy, since, graceDays } = await mfaPolicy();
-  if (!requiredFor(policy, isAdmin) || (await hasFactor(username))) return null;
-  const until = new Date((since ?? new Date()).getTime() + graceDays * 86_400_000);
+  const r = await requirement(username, isAdmin);
+  if (!r.required || (await hasFactor(username))) return null;
+  const until = new Date((r.since ?? new Date()).getTime() + r.graceDays * 86_400_000);
   return { due: Date.now() < until.getTime() ? 'grace' : 'enrol', until };
 }
 
@@ -230,6 +357,7 @@ export async function resetFactors(username: string): Promise<boolean> {
     if (!known) return false;
     await c.query('delete from meta.developer_factor where username = $1', [username]);
     await c.query('delete from meta.developer_recovery_code where username = $1', [username]);
+    await c.query('delete from meta.developer_trusted_browser where username = $1', [username]);
     await c.query('delete from meta.session where app_id is null and username = $1', [username]);
     return true;
   });