pgkiln 0.61.0 → 0.62.0

package/SECURITY.md

@@ -114,6 +114,7 @@ first version (MVP). Every finding below has a regression test in
 | Builder texts in the browser (sprint 123) | The builder's JavaScript gets its texts as JSON in an attribute (`<div id="builder-texts" data-texts>`), escaped like any attribute value, so builder pages still have no inline script. The texts are the fixed message files, never data; scripts put them into the page with `textContent` and attributes, not as HTML. |
 | Two-factor sign-in for developers (0.60.0) | TOTP secrets (RFC 6238, 160 bits) are encrypted with `PGKILN_SECRET_KEY` and stored only after a code from the app confirms them; recovery codes (10 × 50 bits) are stored as SHA-256 and used up atomically; a code is accepted once (the last step is updated atomically) and only one 30-second step either side. The password step leaves only a pending sign-in in the session (5 minutes, no session for the developer yet); wrong codes count with wrong passwords for the per-user and per-IP lockout. Removing an app needs the password; another developer's factors can only be reset by an administrator, with a reason, which ends that developer's builder sessions. The require policy can only be turned on, and stays enforceable, with at least two administrators (or every one) holding an app; there is no setting, URL or variable that skips the second step: recovery is `pgkiln admin reset-2fa` / `set-2fa-policy off` on the server with the owner connection. Every enrolment, removal, reset, policy change and used recovery code is in the activity log; resets and policy changes are mailed to the administrators. The factor tables are closed to the runtime role. |
 | Passkeys and trusted browsers (0.61.0) | Passkeys (WebAuthn) are checked in `src/webauthn.ts` without a library: a 32-byte one-time challenge per purpose (registration or sign-in) kept in the session for five minutes and used up on the first answer, the `clientDataJSON` type, challenge and origin (`PUBLIC_URL`'s, else the browser's own), the SHA-256 of the relying party id in the authenticator data, user presence, an ES256, EdDSA or RS256 signature over the authenticator data and the client data hash, and a signature counter that must go up (updated atomically, so a replayed or cloned key is refused). The CBOR reader takes only definite lengths, at most 16 levels and 1,000 entries. Credentials are public keys (no secret to leak, independent of the instance key); attestation is *none*. `PGKILN_RP_ID` is only honoured when it is the host or a parent domain of it. The sign-in options (the developer's credential ids) are only given after the password step, with the CSRF token. Trusted browsers (off by default) are a random 256-bit cookie token (`HttpOnly`, `SameSite=Lax`, `Secure` with `COOKIE_SECURE`, path `/builder`) of which only the SHA-256 is stored; the cookie is only looked at after a correct password, for that developer, and ends with its days, a new password, removing a factor, a reset, *Forget trusted browsers* or turning trust off (which removes every trusted browser at once). |
+| Passkey sign-in without a password, workspace rule (0.62.0) | *Sign in with a passkey* asks the browser for any passkey of this site (empty allow list) with `userVerification: required`, and the server refuses an answer whose authenticator data lacks the user-verified flag, so the passkey alone stands for possession plus a fingerprint, face or PIN. The credential id is looked up for this relying party only; a user handle, when the browser sends one, must be the developer's (a SHA-256-derived handle, not the user name). The same one-time challenge, origin, RP ID hash, signature and counter checks as at the second step apply; failures are logged as `login_failed` with the developer's name when the key is known and count for the per-user and per-IP lockout. Administrators turn it off in Instance settings. A workspace's rule (administrators and its own administrators only, CSRF-checked) can only add a requirement; `pgkiln admin set-2fa-policy off` clears every workspace's rule. While a second factor is required of a developer, a sign-in with the default password leads only to the password change. |
 
 ## Findings of the MVP review and their fixes
 
@@ -236,4 +237,4 @@ A second full review, mainly of what end users and API callers can reach. Regres
 8. With REST data sources: list only the hosts you need in `PGKILN_REST_ALLOWED_HOSTS` (avoid `*`), set a long random `PGKILN_SECRET_KEY` (32+ characters) kept outside the database and its backups, and use `PGKILN_REST_PRIVATE_HOSTS` only for internal services you mean to reach. Narrow it further per workspace under Administration → Network access (sprint 118).
 9. With header authentication: list only your proxy's addresses in `PGKILN_AUTH_HEADER_PROXIES`, make sure users can't reach pgkiln directly, and have the proxy remove any incoming copy of the header.
 10. With database-account authentication: list exact roles or use a dedicated membership role, and limit what those roles may connect to in `pg_hba.conf` (they can reach the database with their password outside pgkiln too).
-11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have a passkey or an authenticator app; set `PUBLIC_URL` to the address developers use (passkeys belong to its host name), keep *Trust a browser* short or at 0 on shared machines, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.
+11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have a passkey or an authenticator app; set `PUBLIC_URL` to the address developers use (passkeys belong to its host name), require it per workspace where the instance policy is too broad, keep *Trust a browser* short or at 0 on shared machines, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.

package/db/migrations/130_passkey_signin_workspace_mfa.sql

@@ -0,0 +1,20 @@
+-- ---------------------------------------------------------------------
+-- 130: passkey sign-in and a workspace two-factor rule (sprint 128,
+-- SEC-2 part 3; beyond APEX).
+--
+-- meta.workspace.mfa_required_since: when set, every developer of the
+-- workspace needs a second factor, with the instance's grace period
+-- (mfa_grace_days) counted from this moment; null = the instance policy
+-- alone decides. Administrators of the instance are covered only where they
+-- are members. `pgkiln admin set-2fa-policy off` clears it everywhere.
+--
+-- meta.setting mfa_passkey_signin ('on', the default, or 'off'): a
+-- developer may sign in with a passkey alone, without the password, when
+-- the authenticator verified them (fingerprint, face, PIN). It counts as
+-- both factors.
+-- ---------------------------------------------------------------------
+alter table meta.workspace add column mfa_required_since timestamptz;
+
+comment on column meta.workspace.mfa_required_since is 'Two-factor sign-in required for this workspace''s developers since (null = not by the workspace) (130).';
+
+insert into meta.setting (name, value) values ('mfa_passkey_signin', 'on') on conflict (name) do nothing;

package/docs/apex-feature-parity.md

@@ -138,7 +138,7 @@ the 26.2 comparison.)
 | APEX accounts | ✅ | Instance-wide user directory, bcrypt, session rotation, idle and absolute timeouts |
 | Application Access Control (roles per app, any-user switch) | ✅ | Access control per application |
 | Social sign-in / OpenID Connect | ✅ | Any OIDC provider (Entra ID, Google, Okta, Keycloak, …): PKCE, group → role mapping, account linking, automatic accounts |
-| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–127): the builder itself has two-factor sign-in with passkeys (WebAuthn), authenticator apps (TOTP) and recovery codes, trusted browsers, a policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); two-factor for application users follows (SEC-3) |
+| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); two-factor for application users follows (SEC-3) |
 | Change own password | ✅ | A built-in *My account* page (APEX offers the API `CHANGE_CURRENT_USER_PW`) |
 | Password expiry, change on first use, admin reset, complexity | ✅ | Lifetime in days, expire/unexpire, admin reset, length and letters+digits rules, unlock |
 | Lockout after failed sign-ins | ✅ | Per user and per IP, time-based (APEX: until an administrator unlocks) |
@@ -296,8 +296,9 @@ Small but real differences, for teams comparing the two:
 - Responsive layouts verified automatically at four screen sizes.
 - The theme follows the device's light/dark setting automatically, and the choice is saved per user.
 - A built-in *My account* page (own password, theme, language).
-- (sprints 126–127) **Two-factor sign-in for the builder** without an identity provider: passkeys (WebAuthn), authenticator apps (TOTP),
-  recovery codes, a policy for administrators or all developers with a grace period, and lockout recovery on the
+- (sprints 126–128) **Two-factor sign-in for the builder** without an identity provider: passkeys (WebAuthn; sign-in with a
+  passkey alone), authenticator apps (TOTP), recovery codes, a policy for administrators, all developers or a
+  workspace's developers with a grace period, and lockout recovery on the
   command line ([chapter 3](guide/03-builder.md#two-factor-sign-in)). APEX relies on the identity provider.
 - One RLS policy set protects both the web UI and the REST API.
 - An import can be checked before it commits (`pgkiln import --check`): SQL that names a missing

package/docs/guide/03-builder.md

@@ -68,6 +68,13 @@ one passkey on several sub-domains, set `PGKILN_RP_ID` to the parent domain (`ex
 instance key changes. pgkiln accepts any authenticator (attestation *none*), checks the signature, the address and
 the relying party on every sign-in, and refuses a key whose signature counter goes back (a copied key).
 
+**A passkey alone** (0.62): the sign-in page has **Sign in with a passkey** next to the password form. The browser
+offers the passkeys it holds for this site, and you choose one; no user name, no password. It only works when the
+device verified you (fingerprint, face or PIN), so the passkey counts as both factors; a workspace typed in the form
+still applies. Administrators can turn it off in Instance settings → *Two-factor sign-in* (*Developers may sign in
+with a passkey alone*, on by default). A security key without a PIN, or a passkey made before 0.61 that the browser
+doesn't offer, still works at the second step after the password.
+
 The app's secret is stored encrypted with the instance key (`PGKILN_SECRET_KEY`, [chapter 1](01-installation.md));
 without the key the page says so and you can't add an app. Recovery codes are stored as SHA-256 hashes, so they keep
 working if the key is lost. Wrong codes count with wrong passwords for the [sign-in lockout](08-security.md#what-sign-in-protects-against).
@@ -77,6 +84,15 @@ sign-in*: **Nobody** (optional, the default), **Administrators** or **All develo
 (default 7 days). During the grace period a developer without an app sees a reminder on every page; after it, they
 see only their Security page until they add one. The region lists the developers who have no app yet.
 
+**Per workspace** (0.62): a workspace's page (Workspace utilities → Workspaces → the workspace, *Preferences*) has
+*Require two-factor sign-in of this workspace's developers*, for administrators and the workspace's own
+administrators. It adds to the instance's policy: the workspace's developers get the instance's grace period from the
+moment it was turned on, then only their Security page. The page lists the members who have no factor yet.
+
+**The default password** (0.62): a developer who signs in with the default password (`admin`, or their user name)
+while two-factor sign-in is required of them sees only **Developers**, to change it, before anything else (then the
+grace period or the Security page as above).
+
 **Trusted browsers** (0.61): *Trust a browser (days)* in the same region (0, the default: never) adds *Trust this
 browser for N days* to the second step. A trusted browser skips the second step for that developer until the days
 are over; only a hash of the cookie's random token is stored. The developer's Security page shows how many browsers
@@ -103,7 +119,7 @@ setting the days to 0 stops every trusted browser at once.
 | Lost phone, keys and codes | Ask another administrator to reset your two-factor sign-in on Developers |
 | A passkey no longer works after a move to another domain | Sign in with an app code or a recovery code and add a new passkey ([above](#two-factor-sign-in)) |
 | No administrator can sign in | On the server: `pgkiln admin reset-2fa <developer> --reason "…"` ([chapter 18](18-cli.md)), then sign in with the password |
-| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` |
+| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` (also clears the workspaces' own rules) |
 | Codes are always wrong | Check the time on the phone and on the server (codes allow 30 seconds either way) |
 | The instance key was lost or changed | The apps' secrets can't be read: reset the developers (`pgkiln admin reset-2fa`); recovery codes still work |
 

package/docs/guide/18-cli.md

@@ -53,7 +53,7 @@ any (see [what is not exported](03-builder.md#export-format)).
 | `pgkiln users add <username> [--developer] [--app <alias> --roles a,b] [--name …] [--email …]` | Adds an account (optionally with access to an application) or a builder developer |
 | `pgkiln users password <username> [--developer]` | Sets a password and ends that user's sessions |
 | `pgkiln admin reset-2fa <developer> [--reason <text>]` | (0.60) Removes a developer's authenticator apps and recovery codes and ends their builder sessions: [locked out?](03-builder.md#locked-out) |
-| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works, the others need two administrators with an app |
+| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works (and, 0.62, clears every workspace's own rule), the others need two administrators with an app |
 
 `users` reads the password from standard input (the first line, e.g. from a secret store:
 `printf '%s\n' "$PW" | pgkiln users add ops --developer`) or asks for it twice on a terminal. It is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -675,6 +675,7 @@ kbd { display: inline-block; padding: 0 0.35em; border: 1px solid var(--border);
 .signin-reveal { flex: none; border: 0; background: none; color: var(--accent); cursor: pointer; font-size: 0.85rem; padding: 0.25rem; }
 .signin-remember { font-size: 0.9rem; }
 .signin-submit { padding: 0.75rem; font-size: 1rem; border-radius: var(--radius); }
+[data-passkey-status]:empty { display: none; }
 .signin-hint { margin: 0; text-align: center; }
 .signin-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.5rem 1.5rem; margin-top: 1rem; padding-top: 1rem; border-top: 1px solid var(--border); }
 .signin-actions a { display: inline-flex; align-items: center; gap: 0.4rem; color: var(--gold); text-decoration: none; }

package/public/builder.js

@@ -1337,6 +1337,7 @@ document.querySelectorAll('input[data-filter-tree]').forEach((el) => {
 // (sprint 127) Passkeys: a [data-passkey] button asks the server (its URL) for WebAuthn options, calls
 // navigator.credentials.create() (Security page) or .get() (the second sign-in step) and posts the answer in
 // its own form, to data-passkey-submit when set, so the server answers with a redirect as for any form.
+// (sprint 128) On the sign-in page the list of allowed passkeys is empty: the browser offers the ones it holds.
 // Without WebAuthn or JavaScript the buttons stay hidden; codes keep working.
 (() => {
   'use strict';
@@ -1377,13 +1378,14 @@ document.querySelectorAll('input[data-filter-tree]').forEach((el) => {
           set('transports', (c.response.getTransports ? c.response.getTransports() : []).join(','));
         } else {
           const c = await navigator.credentials.get({ publicKey: {
-            challenge: bytes(o.challenge), rpId: o.rpId, userVerification: 'preferred', timeout: 120000,
+            challenge: bytes(o.challenge), rpId: o.rpId, userVerification: o.uv || 'preferred', timeout: 120000,
             allowCredentials: o.allow.map((a) => ({ type: 'public-key', id: bytes(a.id), transports: a.transports })),
           } });
           set('credentialId', b64(c.rawId));
           set('clientDataJSON', b64(c.response.clientDataJSON));
           set('authenticatorData', b64(c.response.authenticatorData));
           set('signature', b64(c.response.signature));
+          if (c.response.userHandle) set('userHandle', b64(c.response.userHandle));
         }
         if (btn.dataset.passkeySubmit) form.action = btn.dataset.passkeySubmit;
         form.submit();

package/src/builder/i18n/de.ts

@@ -1808,4 +1808,16 @@ export const de: BuilderMessages = {
   'mfa.trust_days': 'Browser vertrauen (Tage)',
   'mfa.trust_days_help': 'Nach dem zweiten Schritt darf ein Entwickler ihn in diesem Browser so viele Tage überspringen. 0: nie.',
   'mfa.passkey_needs_host': 'Passkeys brauchen einen Hostnamen, keine IP-Adresse ({host}): Öffnen Sie den Builder über localhost oder seinen Domainnamen.',
+  'signin.passkey': 'Mit einem Passkey anmelden',
+  'mfa.passkey_signin': 'Entwickler dürfen sich nur mit einem Passkey anmelden (ohne Passwort)',
+  'mfa.passkey_signin_help': 'Nur wenn das Gerät den Entwickler geprüft hat (Fingerabdruck, Gesicht oder PIN): Dann zählt der Passkey als beide Faktoren.',
+  'mfa.weak_required': 'Zwei-Faktor-Anmeldung ist erforderlich: Ändern Sie das Standardpasswort, bevor Sie fortfahren.',
+  'wsp.mfa': 'Zwei-Faktor-Anmeldung',
+  'wsp.mfa_required': 'Zwei-Faktor-Anmeldung für die Entwickler dieses Workspace verlangen',
+  'wsp.mfa_required_help': 'Zusätzlich zur Richtlinie der Instanz. Entwickler ohne Passkey oder Authenticator-App erhalten die Übergangsfrist der Instanz, danach nur ihre Sicherheitsseite.',
+  'wsp.mfa_since': 'Erforderlich seit {date}.',
+  'wsp.mfa_without': 'Noch nicht eingerichtet: {list}.',
+  'wsp.mfa_save': 'Zwei-Faktor-Regel speichern',
+  'wsp.mfa_on': 'Die Entwickler dieses Workspace brauchen die Zwei-Faktor-Anmeldung.',
+  'wsp.mfa_off': 'Der Workspace verlangt keine Zwei-Faktor-Anmeldung mehr (die Richtlinie der Instanz gilt weiter).',
 };

package/src/builder/i18n/en.ts

@@ -1811,4 +1811,16 @@ export const en = {
   'mfa.trust_days': 'Trust a browser (days)',
   'mfa.trust_days_help': 'After the second step a developer may skip it in that browser for this many days. 0: never.',
   'mfa.passkey_needs_host': 'Passkeys need a host name, not an IP address ({host}): open the builder at localhost or its domain name.',
+  'signin.passkey': 'Sign in with a passkey',
+  'mfa.passkey_signin': 'Developers may sign in with a passkey alone (no password)',
+  'mfa.passkey_signin_help': 'Only when the device checked the developer (fingerprint, face or PIN): the passkey then counts as both factors.',
+  'mfa.weak_required': 'Two-factor sign-in is required: change the default password before you continue.',
+  'wsp.mfa': 'Two-factor sign-in',
+  'wsp.mfa_required': 'Require two-factor sign-in of this workspace’s developers',
+  'wsp.mfa_required_help': 'On top of the instance’s policy. Developers without a passkey or authenticator app get the instance’s grace period, then only their Security page.',
+  'wsp.mfa_since': 'Required since {date}.',
+  'wsp.mfa_without': 'Not set up yet: {list}.',
+  'wsp.mfa_save': 'Save two-factor rule',
+  'wsp.mfa_on': 'This workspace’s developers need two-factor sign-in.',
+  'wsp.mfa_off': 'The workspace no longer requires two-factor sign-in (the instance’s policy still applies).',
 } as const;

package/src/builder/i18n/es.ts

@@ -1808,4 +1808,16 @@ export const es: BuilderMessages = {
   'mfa.trust_days': 'Confiar en un navegador (días)',
   'mfa.trust_days_help': 'Tras el segundo paso, un desarrollador puede omitirlo en ese navegador durante estos días. 0: nunca.',
   'mfa.passkey_needs_host': 'Las llaves de acceso necesitan un nombre de host, no una dirección IP ({host}): abra el constructor en localhost o en su nombre de dominio.',
+  'signin.passkey': 'Iniciar sesión con una llave de acceso',
+  'mfa.passkey_signin': 'Los desarrolladores pueden iniciar sesión solo con una llave de acceso (sin contraseña)',
+  'mfa.passkey_signin_help': 'Solo cuando el dispositivo verificó al desarrollador (huella, rostro o PIN): la llave cuenta entonces como ambos factores.',
+  'mfa.weak_required': 'El inicio de sesión en dos pasos es obligatorio: cambie la contraseña predeterminada antes de continuar.',
+  'wsp.mfa': 'Inicio de sesión en dos pasos',
+  'wsp.mfa_required': 'Exigir el inicio de sesión en dos pasos a los desarrolladores de este espacio de trabajo',
+  'wsp.mfa_required_help': 'Además de la política de la instancia. Los desarrolladores sin llave de acceso ni app de autenticación tienen el periodo de gracia de la instancia y después solo su página de seguridad.',
+  'wsp.mfa_since': 'Obligatorio desde {date}.',
+  'wsp.mfa_without': 'Aún sin configurar: {list}.',
+  'wsp.mfa_save': 'Guardar la regla de dos pasos',
+  'wsp.mfa_on': 'Los desarrolladores de este espacio de trabajo necesitan el inicio de sesión en dos pasos.',
+  'wsp.mfa_off': 'El espacio de trabajo ya no exige el inicio de sesión en dos pasos (la política de la instancia sigue vigente).',
 };

package/src/builder/i18n/fr.ts

@@ -1808,4 +1808,16 @@ export const fr: BuilderMessages = {
   'mfa.trust_days': 'Faire confiance à un navigateur (jours)',
   'mfa.trust_days_help': 'Après la seconde étape, un développeur peut la passer dans ce navigateur pendant ce nombre de jours. 0 : jamais.',
   'mfa.passkey_needs_host': 'Les clés d’accès ont besoin d’un nom d’hôte, pas d’une adresse IP ({host}) : ouvrez le builder sur localhost ou son nom de domaine.',
+  'signin.passkey': 'Se connecter avec une clé d’accès',
+  'mfa.passkey_signin': 'Les développeurs peuvent se connecter avec une clé d’accès seule (sans mot de passe)',
+  'mfa.passkey_signin_help': 'Seulement quand l’appareil a vérifié le développeur (empreinte, visage ou code PIN) : la clé compte alors pour les deux facteurs.',
+  'mfa.weak_required': 'La connexion à deux facteurs est obligatoire : changez le mot de passe par défaut avant de continuer.',
+  'wsp.mfa': 'Connexion à deux facteurs',
+  'wsp.mfa_required': 'Exiger la connexion à deux facteurs des développeurs de cet espace de travail',
+  'wsp.mfa_required_help': 'En plus de la politique de l’instance. Les développeurs sans clé d’accès ni application d’authentification ont le délai de grâce de l’instance, puis seulement leur page Sécurité.',
+  'wsp.mfa_since': 'Obligatoire depuis le {date}.',
+  'wsp.mfa_without': 'Pas encore configuré : {list}.',
+  'wsp.mfa_save': 'Enregistrer la règle à deux facteurs',
+  'wsp.mfa_on': 'Les développeurs de cet espace de travail ont besoin de la connexion à deux facteurs.',
+  'wsp.mfa_off': 'L’espace de travail n’exige plus la connexion à deux facteurs (la politique de l’instance s’applique toujours).',
 };

package/src/builder/i18n/nl.ts

@@ -1808,4 +1808,16 @@ export const nl: BuilderMessages = {
   'mfa.trust_days': 'Browser vertrouwen (dagen)',
   'mfa.trust_days_help': 'Na de tweede stap mag een ontwikkelaar die in die browser zoveel dagen overslaan. 0: nooit.',
   'mfa.passkey_needs_host': 'Passkeys hebben een hostnaam nodig, geen IP-adres ({host}): open de builder via localhost of de domeinnaam.',
+  'signin.passkey': 'Aanmelden met een passkey',
+  'mfa.passkey_signin': 'Ontwikkelaars mogen alleen met een passkey aanmelden (zonder wachtwoord)',
+  'mfa.passkey_signin_help': 'Alleen als het apparaat de ontwikkelaar heeft gecontroleerd (vingerafdruk, gezicht of pincode): de passkey telt dan als beide factoren.',
+  'mfa.weak_required': 'Tweestapsaanmelding is verplicht: wijzig het standaardwachtwoord voordat u verdergaat.',
+  'wsp.mfa': 'Tweestapsaanmelding',
+  'wsp.mfa_required': 'Tweestapsaanmelding verplichten voor de ontwikkelaars van deze werkruimte',
+  'wsp.mfa_required_help': 'Bovenop het beleid van de instantie. Ontwikkelaars zonder passkey of authenticator-app krijgen de overgangstermijn van de instantie, daarna alleen hun beveiligingspagina.',
+  'wsp.mfa_since': 'Verplicht sinds {date}.',
+  'wsp.mfa_without': 'Nog niet ingesteld: {list}.',
+  'wsp.mfa_save': 'Tweestapsregel opslaan',
+  'wsp.mfa_on': 'De ontwikkelaars van deze werkruimte hebben tweestapsaanmelding nodig.',
+  'wsp.mfa_off': 'De werkruimte verplicht geen tweestapsaanmelding meer (het beleid van de instantie blijft gelden).',
 };

package/src/builder/i18n/pt.ts

@@ -1808,4 +1808,16 @@ export const pt: BuilderMessages = {
   'mfa.trust_days': 'Confiar em um navegador (dias)',
   'mfa.trust_days_help': 'Depois da segunda etapa, um desenvolvedor pode pulá-la naquele navegador por estes dias. 0: nunca.',
   'mfa.passkey_needs_host': 'Chaves de acesso precisam de um nome de host, não de um endereço IP ({host}): abra o construtor em localhost ou no nome de domínio.',
+  'signin.passkey': 'Entrar com uma chave de acesso',
+  'mfa.passkey_signin': 'Os desenvolvedores podem entrar só com uma chave de acesso (sem senha)',
+  'mfa.passkey_signin_help': 'Só quando o dispositivo verificou o desenvolvedor (impressão digital, rosto ou PIN): a chave conta então como os dois fatores.',
+  'mfa.weak_required': 'O login em duas etapas é obrigatório: altere a senha padrão antes de continuar.',
+  'wsp.mfa': 'Login em duas etapas',
+  'wsp.mfa_required': 'Exigir login em duas etapas dos desenvolvedores deste espaço de trabalho',
+  'wsp.mfa_required_help': 'Além da política da instância. Desenvolvedores sem chave de acesso ou app autenticador têm o período de carência da instância e depois só a página de segurança.',
+  'wsp.mfa_since': 'Obrigatório desde {date}.',
+  'wsp.mfa_without': 'Ainda não configurado: {list}.',
+  'wsp.mfa_save': 'Salvar a regra de duas etapas',
+  'wsp.mfa_on': 'Os desenvolvedores deste espaço de trabalho precisam do login em duas etapas.',
+  'wsp.mfa_off': 'O espaço de trabalho já não exige login em duas etapas (a política da instância continua valendo).',
 };

package/src/builder/routes.ts

@@ -27,7 +27,8 @@ import { appFromFileRoutes } from './appfromfile.ts';
 import { clearDevbar } from '../runtime/devbar.ts';
 import { EMAIL } from './find-workspace.ts';
 import { cookieLanguage, LANG_COOKIE, tr, translatorFor, validBuilderLanguage } from './i18n.ts';
-import { checkSecondFactor, codesLeft, forgetBrowsers, hasFactor, isTrustedBrowser, leavesTooFewAdmins, passkeysOf, trustBrowser, trustDays, usePasskey } from '../mfa.ts';
+import { checkSecondFactor, codesLeft, forgetBrowsers, hasFactor, isTrustedBrowser, leavesTooFewAdmins, passkeyByCredential, passkeySignin, passkeysOf, trustBrowser, trustDays, usePasskey, userHandle } from '../mfa.ts';
+import { isIP } from 'node:net';
 import { giveChallenge, takeChallenge } from './security.ts';
 import { relyingParty, verifyAssertion, WebAuthnError } from '../webauthn.ts';
 import { chooseLanguage, langCookieOptions, languageRoutes, signInLanguageLinks } from './language.ts';
@@ -67,6 +68,8 @@ export async function builderRoutes(app: FastifyInstance) {
     await saveState(s);
     const r = remembered(req);
     const next = safeNext(req.query?.next);
+    // (sprint 128) a passkey alone, when the instance allows it and the address is a host name
+    const alone = (await passkeySignin()) && !isIP(relyingParty(req).rpId);
     const field = (name: string, label: string, ic: string, value: string, opts: { type?: string; required?: boolean; auto?: string; placeholder?: string; reveal?: boolean }) =>
       html`<div class="field signin-field"><label class="sr-only" for="f_${name}">${label}</label>
         <div class="signin-input">${icon(ic)}<input id="f_${name}" name="${name}" type="${opts.type ?? 'text'}" value="${value}" placeholder="${opts.placeholder ?? label}"${opts.required ? raw(' required') : ''}${opts.auto ? raw(` autocomplete="${opts.auto}"`) : ''}>
@@ -92,6 +95,9 @@ export async function builderRoutes(app: FastifyInstance) {
               ${field('password', tx('signin.password'), 'key', '', { type: 'password', required: true, auto: 'current-password', reveal: true })}
               <label class="check signin-remember"><input type="checkbox" name="remember" value="1"${r ? raw(' checked') : ''}> ${tx('signin.remember')}</label>
               <button class="btn btn-hot signin-submit">${tx('signin.submit')}</button>
+              ${alone ? html`<input type="hidden" name="credentialId"><input type="hidden" name="clientDataJSON"><input type="hidden" name="authenticatorData"><input type="hidden" name="signature"><input type="hidden" name="userHandle">
+                <button class="btn signin-submit signin-passkey" hidden data-passkey="${BASE}/login/passkey/options" data-passkey-submit="${BASE}/login/passkey" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('signin.passkey')}</button>
+                <p class="small" role="status" data-passkey-status></p>` : ''}
               <p class="muted small signin-hint">${tx('signin.hint')}</p>
               <nav class="signin-actions" aria-label="${tx('signin.quick')}">
                 <a href="${BASE}/find-workspace">${icon('search')} ${tx('signin.find_ws')}</a>
@@ -138,15 +144,7 @@ export async function builderRoutes(app: FastifyInstance) {
       [username, password],
     );
     // a workspace, when given, must be one of the developer's (administrators: any); the same answer otherwise
-    const ws = dev && workspace
-      ? await owner.one<{ id: number }>(
-          `select w.id from meta.workspace w
-            where lower(w.name) = lower($1)
-              and (exists (select 1 from meta.developer d where d.username = $2 and d.is_admin)
-                   or exists (select 1 from meta.workspace_member m where m.workspace_id = w.id and m.username = $2))`,
-          [workspace, dev.username],
-        )
-      : undefined;
+    const ws = dev && workspace ? await workspaceOf(workspace, dev.username) : undefined;
     if (!dev || (workspace && !ws)) {
       await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: workspace ? 'builder (workspace)' : 'builder' });
       flash(s, tx(workspace ? 'signin.invalid_ws' : 'signin.invalid'), 'error');
@@ -162,6 +160,75 @@ export async function builderRoutes(app: FastifyInstance) {
     return finishSignIn(req, reply, s, { username: dev.username, language: dev.language }, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, picked, detail: 'builder' });
   });
 
+  /** A workspace by name, when it is one of the developer's (administrators: any). */
+  const workspaceOf = (workspace: string, username: string) =>
+    owner.one<{ id: number }>(
+      `select w.id from meta.workspace w
+        where lower(w.name) = lower($1)
+          and (exists (select 1 from meta.developer d where d.username = $2 and d.is_admin)
+               or exists (select 1 from meta.workspace_member m where m.workspace_id = w.id and m.username = $2))`,
+      [workspace, username],
+    );
+
+  // (sprint 128, SEC-2) signing in with a passkey alone: no user name, no password. The browser offers the
+  // passkeys it holds for this site (discoverable credentials); the authenticator must verify the developer
+  // (fingerprint, face, PIN), so the passkey counts as both factors. Failures count with wrong passwords.
+  app.post(`${BASE}/login/passkey/options`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    if (req.body?.__csrf !== s.csrf_token) return reply.code(403).send('Reload the page.');
+    if (!(await passkeySignin())) return reply.code(404).send('Passkey sign-in is off.');
+    const challenge = giveChallenge(s as Parameters<typeof giveChallenge>[0], 'get');
+    await saveState(s);
+    reply.header('cache-control', 'no-store');
+    return reply.send({ mode: 'get', challenge, rpId: relyingParty(req).rpId, allow: [], uv: 'required' });
+  });
+  app.post(`${BASE}/login/passkey`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    const ip = clientIp(req);
+    const picked = validBuilderLanguage(s.state.__BLANG);
+    const tx = translatorFor(picked ?? cookieLanguage(req));
+    const workspace = String(req.body?.workspace ?? '').trim().slice(0, 60);
+    const next = safeNext(req.body?.next);
+    const again = next === `${BASE}/home` ? `${BASE}/login` : `${BASE}/login?next=${encodeURIComponent(next)}`;
+    const challenge = takeChallenge(s as Parameters<typeof takeChallenge>[0], 'get');
+    if (req.body?.__csrf !== s.csrf_token || !(await passkeySignin())) {
+      flash(s, tx('signin.expired'), 'error');
+      return back(reply, s, again);
+    }
+    const rp = relyingParty(req);
+    const key = await passkeyByCredential(String(req.body?.credentialId ?? ''), rp.rpId);
+    const who = key?.username ?? '';
+    if (await loginThrottled(null, who, ip)) {
+      logActivity({ username: who, event: 'login_locked', ip, detail: 'builder passkey' });
+      flash(s, tx('signin.throttled'), 'error');
+      return back(reply, s, again);
+    }
+    let why = key ? '' : 'unknown passkey';
+    if (key && !challenge) why = 'no or an expired challenge';
+    else if (key && req.body?.userHandle && req.body.userHandle !== userHandle(key.username)) why = 'the user handle does not match';
+    else if (key && challenge) {
+      try {
+        const r = verifyAssertion(
+          { clientDataJSON: String(req.body?.clientDataJSON ?? ''), authenticatorData: String(req.body?.authenticatorData ?? ''), signature: String(req.body?.signature ?? '') },
+          { alg: key.alg, jwk: key.public_key, signCount: Number(key.sign_count) }, { challenge, ...rp });
+        if (!r.userVerified) why = 'the authenticator did not verify the user';
+        else if (!(await usePasskey(key.id, key.sign_count, r.signCount))) why = 'used at the same time elsewhere';
+      } catch (e) {
+        why = e instanceof WebAuthnError ? e.message : 'unreadable answer';
+      }
+    }
+    const ws = !why && workspace ? await workspaceOf(workspace, who) : undefined;
+    if (!why && workspace && !ws) why = 'not a workspace of the developer';
+    if (why) {
+      await logActivity({ username: who.slice(0, 100), event: 'login_failed', ip, detail: `builder passkey: ${why}` });
+      flash(s, tx(why === 'not a workspace of the developer' ? 'signin.invalid_ws' : 'mfa.passkey_failed'), 'error');
+      return back(reply, s, again);
+    }
+    const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [who]);
+    if (!dev) return back(reply, s, again);
+    return finishSignIn(req, reply, s, dev, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: false, picked, detail: 'builder passkey' });
+  });
+
   /** The session after a successful sign-in (password, and the second factor when the developer has one). */
   async function finishSignIn(req: Req, reply: Parameters<typeof back>[0], s: Awaited<ReturnType<typeof getSession>>, dev: { username: string; language: string | null },
     o: { ws: string | null; workspace: string; next: string; remember: boolean; weak: boolean; picked: ReturnType<typeof validBuilderLanguage>; detail: string }) {

package/src/builder/security.ts

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { isIP } from 'node:net';
 import type { FastifyInstance } from 'fastify';
 import { owner } from '../db.ts';
@@ -6,13 +5,13 @@ import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import {
   addPasskey, addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, forgetBrowsers, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy,
-  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requiredFor, resetFactors, setPolicy, setTrustDays, trustDays,
-  trustedBrowsers, unbase32, type MfaPolicy,
+  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requirement, resetFactors, setPolicy, setTrustDays, trustDays,
+  trustedBrowsers, unbase32, userHandle, passkeySignin, setPasskeySignin, type MfaPolicy,
 } from '../mfa.ts';
 import { qrSvg } from '../qrcode.ts';
 import { secretKeyConfigured } from '../secrets.ts';
 import { clientIp, logActivity, saveState, type Session } from '../session.ts';
-import { ALGORITHMS, b64url, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
+import { ALGORITHMS, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
@@ -59,9 +58,9 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!s) return;
     const tx = tr(s);
     const me = s.username!;
-    const [factors, left, pol, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), mfaPolicy(), isAdmin(me), trustDays(), trustedBrowsers(me)]);
+    const [factors, left, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), isAdmin(me), trustDays(), trustedBrowsers(me)]);
     const rp = relyingParty(req);
-    const required = requiredFor(pol.policy, admin);
+    const { required } = await requirement(me, admin);
     const pending = (() => {
       try {
         const p = JSON.parse(String(s.state.__TOTP_NEW ?? ''));
@@ -222,7 +221,7 @@ export async function securityRoutes(app: FastifyInstance) {
     if (last) {
       const pol = await mfaPolicy();
       const admin = await isAdmin(me);
-      if (requiredFor(pol.policy, admin)) {
+      if ((await requirement(me, admin)).required) {
         flash(s, tx('mfa.cannot_remove_required'), 'error');
         return back(reply, s, `${BASE}/security`);
       }
@@ -257,7 +256,7 @@ export async function securityRoutes(app: FastifyInstance) {
     return reply.send({
       mode: 'create', challenge, rp: { id: rp.rpId, name: 'pgkiln' }, algs: ALGORITHMS,
       // a stable handle that isn't the user name (the authenticator may show it, but it says nothing)
-      user: { id: b64url(createHash('sha256').update(`pgkiln-developer:${me}`).digest().subarray(0, 16)), name: me, displayName: me },
+      user: { id: userHandle(me), name: me, displayName: me },
       exclude: (await passkeysOf(me, rp.rpId)).map((p) => p.credential_id),
     });
   });
@@ -341,9 +340,11 @@ export async function securityRoutes(app: FastifyInstance) {
       flash(s, tx('mfa.policy_needs_admins'), 'error');
       return back(reply, s, `${BASE}/instance#mfa`);
     }
+    const alone = req.body?.passkey_signin === '1';
     await setPolicy(policy, grace);
     await setTrustDays(trust);
-    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days` });
+    await setPasskeySignin(alone);
+    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days, passkey sign-in ${alone ? 'on' : 'off'}` });
     await notifyMfa(await adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${s.username} set the two-factor policy to ${policy} (grace period ${grace} days).`);
     flash(s, tx('mfa.policy_saved'));
     return back(reply, s, `${BASE}/instance#mfa`);
@@ -353,8 +354,8 @@ export async function securityRoutes(app: FastifyInstance) {
 /** The Instance settings region for the policy (administrators). */
 export async function policyRegion(s: Session): Promise<Raw> {
   const tx = tr(s);
-  const [pol, af, days, without] = await Promise.all([
-    mfaPolicy(), adminFactors(), trustDays(),
+  const [pol, af, days, alone, without] = await Promise.all([
+    mfaPolicy(), adminFactors(), trustDays(), passkeySignin(),
     owner.query<{ username: string; is_admin: boolean }>('select username, is_admin from meta.developer d where not exists (select 1 from meta.developer_factor f where f.username = d.username) order by username'),
   ]);
   const opt = (v: MfaPolicy) => html`<option value="${v}"${pol.policy === v ? raw(' selected') : ''}>${tx(({ off: 'mfa.policy_off', admins: 'mfa.policy_admins', all: 'mfa.policy_all' } as const)[v])}</option>`;
@@ -364,6 +365,8 @@ export async function policyRegion(s: Session): Promise<Raw> {
         ${input('grace_days', tx('mfa.grace'), pol.graceDays, { type: 'number', help: tx('mfa.grace_help') })}
         ${input('trust_days', tx('mfa.trust_days'), days, { type: 'number', help: tx('mfa.trust_days_help') })}
       </div>
+      <div class="field"><label class="check"><input type="checkbox" name="passkey_signin" value="1"${alone ? raw(' checked') : ''}> ${tx('mfa.passkey_signin')}</label>
+        <small class="help">${tx('mfa.passkey_signin_help')}</small></div>
       <p class="muted small">${tx('mfa.policy_help', { enrolled: af.enrolled, admins: af.admins })}</p>
       <div class="buttons"><button class="btn btn-hot">${tx('mfa.policy_save')}</button></div></form>
     ${without.rows.length ? html`<p class="small">${tx('mfa.without', { list: without.rows.map((d) => `${d.username}${d.is_admin ? ' (admin)' : ''}`).join(', ') })}</p>` : ''}

package/src/builder/ui.ts

@@ -12,7 +12,7 @@ import { ensureDevbar } from '../runtime/devbar.ts';
 import { noteChange } from './app-updates.ts';
 import { clientTexts, tr } from './i18n.ts';
 import { languageMenu, loadLanguage } from './language.ts';
-import { enrolmentDue } from '../mfa.ts';
+import { enrolmentDue, requirement } from '../mfa.ts';
 
 // Shared building blocks of the builder UI.
 
@@ -323,9 +323,19 @@ export async function developer(req: Req, reply: FastifyReply) {
   if (s.state.__BLANG === undefined) await loadLanguage(s);
   // (sprint 126, SEC-2) the two-factor policy: a banner during the grace period, then only the Security page until they enrol
   delete s.state.__MFA_DUE;
-  const due = await enrolmentDue(s.username, await isAdmin(s.username));
+  const admin = await isAdmin(s.username);
+  // (sprint 128) signed in with the default password while a second factor is required: change it first
+  // (on Developers), then the enrolment below
+  const weakFirst = !!s.state.__WEAK && (await requirement(s.username, admin)).required;
+  if (weakFirst && !/^\/builder\/(developers|logout|language|theme)(?:[/?#]|$)/.test(req.url)) {
+    flash(s, tr(s)('mfa.weak_required'), 'error');
+    await saveState(s);
+    reply.redirect(`${BASE}/developers`);
+    return null;
+  }
+  const due = await enrolmentDue(s.username, admin);
   if (due?.due === 'grace') s.state.__MFA_DUE = due.until.toISOString();
-  else if (due && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
+  else if (due && !weakFirst && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
     reply.redirect(`${BASE}/security`);
     return null;
   }

package/src/builder/workspaces.ts

@@ -8,6 +8,7 @@ import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type BuilderWorkspace, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
+import { setWorkspaceRequired } from '../mfa.ts';
 import { back, BANNER_COLORS, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // Workspaces (064; APEX: workspaces). A workspace groups applications and the
@@ -215,7 +216,7 @@ function serviceRegion(s: Session, w: { id: number; message: string | null; bann
 }
 
 /** (093) Workspace preferences: the SQL Workshop and the applications' REST modules on or off. */
-function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null }) {
+function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null; mfa_required_since: Date | null }, without: string[]) {
   const check = (name: string, on: boolean, label: string, help: string) =>
     html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label><small class="help">${help}</small></div>`;
   const tx = tr(s);
@@ -223,7 +224,12 @@ function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; r
       ${check('sql_workshop', w.sql_workshop, tx('wsp.sql_on'), tx('wsp.sql_on_help'))}
       ${check('rest_services', w.rest_services, tx('wsp.rest_on'), tx('wsp.rest_on_help', { path: '/a/<alias>/rest/…' }))}
       ${select('builder_home', tx('wsp.builder_home'), w.builder_home === 'home' ? 'home' : 'apps', [['apps', tx('wsp.home.apps')], ['home', tx('wsp.home.home')]], tx('wsp.builder_home_help'))}
-      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>`, '', 'preferences');
+      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>
+    <h3 id="mfa">${tx('wsp.mfa')}</h3>
+    <form method="post" action="${BASE}/workspaces/${w.id}/mfa">${csrf(s)}
+      ${check('required', !!w.mfa_required_since, tx('wsp.mfa_required'), tx('wsp.mfa_required_help'))}
+      ${w.mfa_required_since ? html`<p class="small">${tx('wsp.mfa_since', { date: new Date(w.mfa_required_since).toISOString().slice(0, 10) })}${without.length ? html` ${tx('wsp.mfa_without', { list: without.join(', ') })}` : ''}</p>` : ''}
+      <div class="buttons"><button class="btn">${tx('wsp.mfa_save')}</button></div></form>`, '', 'preferences');
 }
 
 /** (093) Extension links: links to other tools in the builder's Extensions menu. */
@@ -341,6 +347,10 @@ export async function workspaceRoutes(app: FastifyInstance) {
     ]);
     const roles = rolesQ;
     const links = (await owner.query('select id, label, url, description, position from meta.workspace_link where workspace_id = $1 order by position, lower(label)', [w.id])).rows;
+    // (sprint 128) the members still without a second factor
+    const without = (await owner.query<{ username: string }>(
+      `select m.username from meta.workspace_member m where m.workspace_id = $1
+          and not exists (select 1 from meta.developer_factor f where f.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -365,7 +375,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
       </div>
       ${serviceRegion(s, w)}
       ${region(tx('wsp.mail_net'), html`<p class="u-mt0">${tx.rich('wsp.mail_net_text', { mail: html`<a href="${BASE}/workspaces/${w.id}/mail">${tx('wsp.mail_service')}</a>`, network: html`<a href="${BASE}/network?ws=${w.id}">${tx('wsp.network')}</a>`, queue: html`<a href="${BASE}/mail-queue${full ? `?ws=${w.id}` : ''}">${tx('wsp.queue')}</a>` })}</p>`, '', 'mail-network')}
-      <div class="columns">${preferencesRegion(s, w)}${linksRegion(s, w, links)}</div>
+      <div class="columns">${preferencesRegion(s, w, without)}${linksRegion(s, w, links)}</div>
       ${full ? isolationRegion(s, w, roles.rows) : region(tx('wsp.isolation'), html`<p class="u-mt0">${w.isolated ? tx('wsp.iso_short_on') : tx('wsp.iso_short_off')} ${tx('wsp.admins_change')}</p>`)}
       ${!full ? '' : region(tx('wsp.applications'), html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>${tx('wsp.application')}</th><th>${tx('wsp.move_to')}</th></tr></thead>
@@ -559,6 +569,17 @@ export async function workspaceRoutes(app: FastifyInstance) {
     return back(reply, s, `${BASE}/workspaces/${req.params.id}`);
   });
 
+  // (sprint 128, SEC-2) a workspace requires a second factor of its developers (the instance's grace period from now)
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/mfa`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const on = req.body?.required === 'true';
+    if (!(await setWorkspaceRequired(Number(req.params.id), on))) return reply.code(404).send('Not found');
+    await logActivity({ appId: null, username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `workspace ${req.params.id}: two-factor sign-in ${on ? 'required' : 'not required'}` });
+    flash(s, tr(s)(on ? 'wsp.mfa_on' : 'wsp.mfa_off'));
+    return back(reply, s, `${BASE}/workspaces/${req.params.id}#mfa`);
+  });
+
   // (093) extension links
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/links`, async (req: Req, reply) => {
     const s = await developer(req, reply);

package/src/cli/main.ts

@@ -477,9 +477,9 @@ const COMMANDS: Record<string, Command> = {
       'pgkiln admin reset-2fa <developer> [--reason <text>]\n' +
       'pgkiln admin set-2fa-policy off|admins|all [--grace <days>]\n\n' +
       "reset-2fa removes the developer's authenticator apps and recovery codes and ends their builder\n" +
-      'sessions; they sign in with the password and set up an app again. set-2fa-policy off always works;\n' +
-      'admins and all need at least two administrators with two-factor sign-in (or every one, when there\n' +
-      'are fewer). Both are written to the activity log and mailed to the administrators.',
+      'sessions; they sign in with the password and set up an app again. set-2fa-policy off always works\n' +
+      "(and clears the workspaces' own two-factor rules); admins and all need at least two administrators\n" +
+      'with two-factor sign-in (or every one, when there are fewer). Both are written to the activity log and mailed to the administrators.',
     options: { reason: { type: 'string' }, grace: { type: 'string' } },
     optionHelp: [
       ['--reason <text>', 'reset-2fa: why (in the activity log and the mail)'],
@@ -509,9 +509,11 @@ const COMMANDS: Record<string, Command> = {
           const policy = arg as 'off' | 'admins' | 'all';
           if (await mfa.policyProblem(policy)) throw new Error('at least two administrators (or every one, when there are fewer) need two-factor sign-in first');
           await mfa.setPolicy(policy, grace);
-          await logActivity({ event: '2fa_policy', ip: 'cli', detail: `${policy}, grace ${grace} days (${by})` });
+          // (sprint 128) off means off: no workspace requires a second factor either
+          const cleared = policy === 'off' ? await mfa.clearWorkspaceRequirements() : 0;
+          await logActivity({ event: '2fa_policy', ip: 'cli', detail: `${policy}, grace ${grace} days${cleared ? `, ${cleared} workspace rule(s) cleared` : ''} (${by})` });
           const sent = await mfa.notifyMfa(await mfa.adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${by} set the two-factor policy to ${policy} on the server.`);
-          out(`Two-factor policy: ${policy}${policy === 'off' ? '' : `, grace ${grace} days`}.${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
+          out(`Two-factor policy: ${policy}${policy === 'off' ? '' : `, grace ${grace} days`}.${cleared ? ` ${cleared} workspace(s) no longer require it.` : ''}${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
           return EXIT.ok;
         }
         throw new UsageError(`unknown action ${action}: use reset-2fa or set-2fa-policy`);

package/src/mfa.ts

@@ -11,6 +11,8 @@ import { decryptSecret, encryptSecret } from './secrets.ts';
 // factors and turns the policy off without signing in (src/cli/main.ts, `pgkiln admin`).
 // (sprint 127) Passkeys and security keys (WebAuthn, src/webauthn.ts) are the second kind of factor, and a
 // developer may trust a browser for a number of days (meta.setting mfa_trust_days; 0 = never).
+// (sprint 128) A passkey the authenticator verified the developer with may stand in for both the password and
+// the second factor (mfa_passkey_signin), and a workspace may require a second factor of its developers.
 
 export const TOTP_STEP = 30;
 export const TOTP_DIGITS = 6;
@@ -139,6 +141,26 @@ export async function passkeysOf(username: string, rpId: string): Promise<Passke
       where username = $1 and kind = 'passkey' and rp_id = $2 order by id`, [username, rpId])).rows;
 }
 
+/** (sprint 128) The passkey with this credential id for this relying party, and whose it is (sign-in without a user name). */
+export async function passkeyByCredential(credentialId: string, rpId: string): Promise<(Passkey & { username: string }) | null> {
+  if (!credentialId || credentialId.length > 1400) return null;
+  return (await owner.one<Passkey & { username: string }>(
+    `select id, username, name, credential_id, public_key, alg, sign_count, transports from meta.developer_factor
+      where kind = 'passkey' and credential_id = $1 and rp_id = $2`, [credentialId, rpId])) ?? null;
+}
+
+/** The user handle a developer's passkeys carry: stable, and not the user name. */
+export const userHandle = (username: string) => createHash('sha256').update(`pgkiln-developer:${username}`).digest().subarray(0, 16).toString('base64url');
+
+/** (sprint 128) Whether a passkey alone (user verified) may sign a developer in. */
+export async function passkeySignin(): Promise<boolean> {
+  return (await owner.one<{ value: string }>(`select value from meta.setting where name = 'mfa_passkey_signin'`))?.value !== 'off';
+}
+
+export async function setPasskeySignin(on: boolean) {
+  await owner.query(`insert into meta.setting (name, value) values ('mfa_passkey_signin', $1) on conflict (name) do update set value = excluded.value`, [on ? 'on' : 'off']);
+}
+
 /** Record a sign-in with a passkey; false when another sign-in moved the counter first (a replay or a clone). */
 export async function usePasskey(id: number, oldCount: string, newCount: number): Promise<boolean> {
   return !!(await owner.query(
@@ -284,14 +306,47 @@ export async function setPolicy(policy: MfaPolicy, graceDays: number) {
   });
 }
 
+/**
+ * (sprint 128) Whether a second factor is required of this developer, by the instance's policy or by one of
+ * their workspaces, and since when (the grace period counts from the earliest).
+ */
+export async function requirement(username: string, isAdmin: boolean): Promise<{ required: boolean; since: Date | null; graceDays: number; workspaces: string[] }> {
+  const [{ policy, since, graceDays }, ws] = await Promise.all([
+    mfaPolicy(),
+    owner.query<{ name: string; since: Date }>(
+      `select w.name, w.mfa_required_since as since from meta.workspace w join meta.workspace_member m on m.workspace_id = w.id
+        where m.username = $1 and w.mfa_required_since is not null order by w.mfa_required_since`, [username]),
+  ]);
+  const byInstance = requiredFor(policy, isAdmin);
+  const times = [...(byInstance ? [since ?? new Date()] : []), ...ws.rows.map((r) => new Date(r.since))];
+  return {
+    required: times.length > 0,
+    since: times.length ? new Date(Math.min(...times.map((t) => t.getTime()))) : null,
+    graceDays,
+    workspaces: ws.rows.map((r) => r.name),
+  };
+}
+
+/** (sprint 128) Require a second factor of a workspace's developers (from now), or stop requiring it. */
+export async function setWorkspaceRequired(workspaceId: number, on: boolean): Promise<boolean> {
+  return !!(await owner.query(
+    `update meta.workspace set mfa_required_since = case when $2 then coalesce(mfa_required_since, now()) end where id = $1`,
+    [workspaceId, on])).rowCount;
+}
+
+/** The command line's "off": no workspace requires a second factor either. */
+export async function clearWorkspaceRequirements(): Promise<number> {
+  return (await owner.query('update meta.workspace set mfa_required_since = null where mfa_required_since is not null')).rowCount ?? 0;
+}
+
 /**
  * A developer without a factor while the policy requires one: 'grace' until the grace period ends (a
  * banner), then 'enrol' (only the Security page and signing out until they enrol); null otherwise.
  */
 export async function enrolmentDue(username: string, isAdmin: boolean): Promise<{ due: 'grace' | 'enrol'; until: Date } | null> {
-  const { policy, since, graceDays } = await mfaPolicy();
-  if (!requiredFor(policy, isAdmin) || (await hasFactor(username))) return null;
-  const until = new Date((since ?? new Date()).getTime() + graceDays * 86_400_000);
+  const r = await requirement(username, isAdmin);
+  if (!r.required || (await hasFactor(username))) return null;
+  const until = new Date((r.since ?? new Date()).getTime() + r.graceDays * 86_400_000);
   return { due: Date.now() < until.getTime() ? 'grace' : 'enrol', until };
 }