Documentation
¶
Overview ¶
Package passkey wraps go-webauthn for airlock's human login. It builds the relying-party instance from the deployment's public URL and adapts an airlock user to the webauthn.User interface. The ceremony state, credential storage, and HTTP handlers live in service/passkeys and api — this package is the thin library binding with no airlock dependencies.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func New ¶
New builds the WebAuthn relying party from airlock's public URL. The RP ID is the URL host without scheme or port; the sole permitted origin is the public URL's scheme://host[:port]. Both are baked into every credential at registration, so PUBLIC_URL's host must stay stable for a deployment — a host change invalidates all enrolled passkeys.
Discoverable (resident) keys and user verification are required: resident keys enable usernameless "sign in with a passkey", and user verification means the authenticator proves presence with a biometric or PIN, not mere possession.
Types ¶
type User ¶
type User struct {
// contains filtered or unexported fields
}
User adapts an airlock user and its stored credentials to webauthn.User. The WebAuthn id is the user's UUID bytes — stable across email/display-name changes and used as the discoverable-login user handle. Build one with the user's full credential set so go-webauthn can match and exclude correctly.
func NewUser ¶
func NewUser(id []byte, name, displayName string, creds []webauthn.Credential) *User
NewUser constructs the webauthn.User adapter. id is the user UUID bytes, name is the email, displayName is the human name, and creds are the user's mapped credentials (nil for a user with none yet).
func (*User) WebAuthnCredentials ¶
func (u *User) WebAuthnCredentials() []webauthn.Credential
Source Files