stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Add device passkeys for sign-in and fresh authorization #485

New Issue
Closed
opened 2026-08-10 12:49:20 +00:00 by timmy · 0 comments
timmy commented 2026-08-10 12:49:20 +00:00
Owner
Copy Link

Evidence

The dashboard currently requires the same reusable operator token for every sign-in and every high-impact fresh-authorization prompt. Active-device revocation, short-lived sessions, throttling, and exact action/target grants reduce exposure, but do not remove repeated handling of the shared bearer secret. Current origin/main has no WebAuthn/passkey implementation, and no historical issue or recent commit covers passkeys.

User impact

After one token bootstrap, an operator can enroll a device passkey, then use biometric/PIN verification for future sign-in and exact-action fresh authorization. The token remains an explicit recovery fallback. Revoking a device also removes its credential.

Acceptance criteria

  • Enroll a passkey only from an authenticated, freshly authorized session using a one-time expiring challenge bound to RP ID and expected origin.
  • Sign in with an enrolled passkey without submitting the shared access token and receive the existing secure session cookie.
  • Satisfy merge/close/device-revocation fresh authorization with a passkey assertion bound to exact action and target; reject wrong-target, expired, and replayed assertions.
  • Revoking a managed device removes its active sessions and enrolled credential; unrelated devices remain active.
  • Browsers without WebAuthn and operators without credentials retain the throttled token recovery path.
  • Responses remain no-store and credential/token material is not exposed in logs or errors.
  • Behavioral backend/frontend tests cover enrollment, sign-in, step-up, replay rejection, revocation, and fallback.
## Evidence The dashboard currently requires the same reusable operator token for every sign-in and every high-impact fresh-authorization prompt. Active-device revocation, short-lived sessions, throttling, and exact action/target grants reduce exposure, but do not remove repeated handling of the shared bearer secret. Current `origin/main` has no WebAuthn/passkey implementation, and no historical issue or recent commit covers passkeys. ## User impact After one token bootstrap, an operator can enroll a device passkey, then use biometric/PIN verification for future sign-in and exact-action fresh authorization. The token remains an explicit recovery fallback. Revoking a device also removes its credential. ## Acceptance criteria - Enroll a passkey only from an authenticated, freshly authorized session using a one-time expiring challenge bound to RP ID and expected origin. - Sign in with an enrolled passkey without submitting the shared access token and receive the existing secure session cookie. - Satisfy merge/close/device-revocation fresh authorization with a passkey assertion bound to exact action and target; reject wrong-target, expired, and replayed assertions. - Revoking a managed device removes its active sessions and enrolled credential; unrelated devices remain active. - Browsers without WebAuthn and operators without credentials retain the throttled token recovery path. - Responses remain no-store and credential/token material is not exposed in logs or errors. - Behavioral backend/frontend tests cover enrollment, sign-in, step-up, replay rejection, revocation, and fallback.
timmy self-assigned this 2026-08-10 12:49:20 +00:00
timmy closed this issue 2026-08-10 13:16:22 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#485
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?