feat: audit passkey enrollment (Closes #513)

src/main.py

@@ -1158,6 +1158,24 @@ async def verify_passkey_registration(payload: PasskeyCeremony, request: Request
         )
         devices = await dashboard_auth.active_devices(request.state.dashboard_session)
         current = next(device for device in devices if device.current)
+    except dashboard_auth.SessionStoreError:
+        raise HTTPException(status_code=503, detail="Passkey registry is temporarily unavailable")
+    except Exception as exc:
+        raise HTTPException(status_code=400, detail="Passkey verification failed") from exc
+    journal = _security_event_store()
+    try:
+        operation_id = await asyncio.to_thread(
+            journal.reserve,
+            "passkey_enrolled",
+            method="passkey",
+            device_label=current.device_label,
+            target="passkey",
+        )
+    except SecurityEventStoreError:
+        raise HTTPException(
+            status_code=503, detail="Security activity is temporarily unavailable"
+        )
+    try:
         await asyncio.to_thread(
             store.register,
             credential_id=verified.credential_id,
@@ -1167,9 +1185,17 @@ async def verify_passkey_registration(payload: PasskeyCeremony, request: Request
             management_id=current.management_id,
         )
     except dashboard_auth.SessionStoreError:
-        raise HTTPException(status_code=503, detail="Passkey registry is temporarily unavailable")
-    except Exception as exc:
-        raise HTTPException(status_code=400, detail="Passkey verification failed") from exc
+        try:
+            await asyncio.to_thread(journal.discard, operation_id)
+        except SecurityEventStoreError:
+            pass
+        raise HTTPException(
+            status_code=503, detail="Passkey registry is temporarily unavailable"
+        )
+    try:
+        await asyncio.to_thread(journal.finalize, operation_id)
+    except SecurityEventStoreError:
+        pass
     return JSONResponse(
         {"enrolled": True}, status_code=201, headers={"Cache-Control": "no-store"}
     )