[webauthn] initial support - #32
Merged
Merged
Conversation
|
Warning Review limit reached
Next review available in: 57 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (29)
📝 WalkthroughWalkthroughAdds end-to-end WebAuthn passkey support: configuration, cache-backed sessions, credential persistence, registration/login APIs, JWT integration, and frontend login and security-management interfaces. ChangesWebAuthn / Passkey Authentication
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🤖 Pull request artifacts
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/lib/pages/settings/security.svelte`:
- Around line 163-170: The icon-only action buttons in the passkey edit flow are
missing accessible names, so screen readers announce them as unnamed controls.
Update the Button instances in the security.svelte passkey rename/delete
actions, including the save/cancel controls in the edit block and the
delete-related buttons elsewhere in the same flow, by adding clear accessible
labels or equivalent text for each icon-only action. Use the existing Button
component and the surrounding handlers like saveEdit and cancelEdit to locate
and update all affected icon-only controls.
In `@frontend/src/pages/login.svelte`:
- Around line 133-139: The passkey login control in the login form is missing an
explicit button type, so it may submit the surrounding form when clicked. Update
the Button used by handlePasskeyLogin to include type="button" while keeping the
existing onclick and disabled behavior, so WebAuthn starts without triggering a
form submit.
In `@go.mod`:
- Around line 102-103: The go.mod dependencies for go.opentelemetry.io/otel and
go.opentelemetry.io/otel/trace are still pinned to the vulnerable v1.40.0
release. Update both module requirements together to v1.41.0 or later so the
OpenTelemetry packages stay in sync and the patched version is used.
In `@internal/server/auth/handler.go`:
- Around line 224-231: Malformed WebAuthn request payloads from
FinishRegistration and FinishLogin are currently treated as internal errors
instead of bad requests. Update the handler flow in authHandler methods that
call h.waSvc.FinishRegistration and h.waSvc.FinishLogin to surface
request-parse/validation failures as a shared sentinel error, then teach
errorsHandler to recognize that sentinel and return fiber.StatusBadRequest. Keep
the existing empty-body check, but ensure malformed client payloads from the
WebAuthn library no longer fall through as 500s.
- Around line 311-319: The RenamePasskeyRequest validation in auth handler only
rejects empty names, so add a 255-character max check before calling
h.waSvc.RenameCredential. Either extend the existing request validation on
RenamePasskeyRequest with the shared validator max=255 rule or add an explicit
length guard alongside the current name required check, and return a bad request
when the limit is exceeded.
- Around line 312-313: The auth handler has shadowed inner err variables that
trip govet with shadow.strict enabled. In the relevant flow in handler.go,
rename each short-lived error variable used in the json.Unmarshal, rename, and
delete checks to unmarshalErr, renameErr, and deleteErr so they no longer shadow
the outer err from strconv.ParseInt, and update the corresponding conditionals
to use the new names.
In `@internal/webauthn/domain.go`:
- Around line 50-53: The Authenticator reconstruction in domain.go is using the
stored AAGUID string as raw bytes, which produces ASCII bytes instead of the
original 16-byte identifier. Update the credential rebuild logic in the code
that constructs webauthn.Authenticator inside the relevant domain-to-WebAuthn
conversion so it decodes the stored AAGUID string back into its binary UUID form
before assigning it, keeping the round-trip consistent with formatAAGUID and
newWebAuthnUser.
In `@internal/webauthn/module.go`:
- Around line 16-18: The fx provider wrapper is unnecessary and triggers the
unlambda lint; replace the inline anonymous function in module setup with a
direct reference to NewService. Keep the existing dependencies and return type
unchanged so fx.Provide continues to construct the Service through NewService
without the extra lambda.
In `@internal/webauthn/repository.go`:
- Around line 20-23: The Create method in Repository currently wraps all insert
failures as a generic error, so duplicate credential inserts are not mapped to
the package’s ErrDuplicateCredential. Update the insert error handling in
Repository.Create to detect unique-key violations from the credential_id
constraint and return ErrDuplicateCredential in that case, while preserving the
existing generic wrapped error path for all other failures.
In `@internal/webauthn/service.go`:
- Around line 150-162: The sign counter update in the passkey login flow is
incrementing the stored value instead of persisting the authenticator’s returned
counter. In the login path inside the WebAuthn service method that calls
ValidatePasskeyLogin and then UpdateSignCount, use
credential.Authenticator.SignCount from the successful assertion when updating
the repo record, and keep the existing error handling/logging around the repo
call unchanged.
In `@internal/webauthn/session.go`:
- Around line 10-13: The in-memory challenge store in sessionStore is unbounded
and can grow under request floods on the unauthenticated WebAuthn path; add a
fixed capacity/eviction bound to the sessions map and enforce it in the
sessionStore methods that insert and track entries. Update the sessionStore
handling in internal/webauthn/session.go (including the logic around the
sessionEntry lifecycle) so old or excess challenges are evicted or rejected
instead of accumulating indefinitely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f85d7ceb-ffbc-4fcb-b4fe-fc6b4ebbff58
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (25)
.env.examplefrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/encoding.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/session.go
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/session.go`:
- Around line 67-68: Avoid evicting an existing session when updating the same
key in session management. In the session store logic around evictLocked and the
map write in session.go, first check whether the key already exists in
s.sessions and skip eviction for in-place updates; only call evictLocked when
inserting a brand-new key and capacity would otherwise be exceeded.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7d58083d-6c9d-4356-b8da-020666cbed6b
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (11)
.golangci.ymlfrontend/src/lib/pages/settings/security.sveltego.modinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/session.go
🚧 Files skipped from review as they are similar to previous changes (8)
- internal/webauthn/errors.go
- internal/server/auth/dto.go
- internal/webauthn/domain.go
- internal/webauthn/repository.go
- frontend/src/lib/pages/settings/security.svelte
- internal/webauthn/service.go
- internal/webauthn/models.go
- internal/server/auth/handler.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
June 26, 2026 10:08
e083872 to
1fe4a95
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 32-37: The Service constructor still wires in the in-memory
session store via newSessionStore, which keeps session state only on one
process. Replace the sessionStore implementation in internal/webauthn/session.go
and the Service initialization in Service to use a distributed backing store
(for example Redis) so BeginRegistration/FinishRegistration can share sessions
across instances and restarts. Keep the same sessionStore/sessionEntry behavior
and ErrSessionNotFound semantics, but back the store with shared persistence
instead of the local map and cleanup goroutine.
- Around line 105-107: The passwordless login flow in BeginLogin currently
relies on BeginDiscoverableLogin() defaults, which leaves user verification as
preferred instead of required. Update the BeginDiscoverableLogin call in
Service.BeginLogin to pass explicit options that require user verification, so
passwordless authentication cannot succeed with possession-only authenticators.
Use the existing BeginLogin and BeginDiscoverableLogin symbols to locate the
change and keep the rest of the login/session handling unchanged.
- Around line 49-50: Update the registration flow in service.go so
`s.webAuthn.BeginRegistration(wuser)` uses authenticator selection that պահանջs
discoverable/resident credentials, matching the discoverable login path.
Configure this through `webauthn.WithAuthenticatorSelection` on the WebAuthn
setup used by `BeginRegistration`, rather than relying on a non-existent
resident-key option, and ensure the registration options explicitly require a
resident/discoverable credential.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 016a6e2b-9af0-43cd-b932-7294db0c1f4c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (26)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/encoding.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/session.go
✅ Files skipped from review due to trivial changes (1)
- frontend/src/lib/pages/profile.svelte
🚧 Files skipped from review as they are similar to previous changes (23)
- internal/webauthn/encoding.go
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- frontend/src/App.svelte
- internal/webauthn/errors.go
- internal/webauthn/config.go
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/commands/serve/serve.go
- .golangci.yml
- internal/webauthn/module.go
- internal/webauthn/models.go
- frontend/src/lib/types/api.ts
- frontend/src/lib/pages/settings/security.svelte
- internal/webauthn/repository.go
- frontend/src/pages/login.svelte
- internal/server/auth/handler.go
- frontend/src/lib/stores/auth.svelte.ts
- internal/config/module.go
- internal/server/auth/dto.go
- internal/webauthn/session.go
- go.mod
- internal/webauthn/domain.go
- internal/config/config.go
- frontend/src/lib/api/passkey.ts
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/webauthn/service.go (1)
64-64: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winFail the begin step when session persistence fails.
storeSessiononly logsSetfailures, so both begin flows can return a challenge that was never persisted. The very next finish call then degrades intoErrSessionNotFoundinstead of surfacing the real server-side failure. MakestoreSessionreturn an error and propagate it from both begin methods.Suggested change
-func (s *Service) storeSession(data *webauthn.SessionData) { - if err := s.session.Set( - context.Background(), +func (s *Service) storeSession(ctx context.Context, data *webauthn.SessionData) error { + return s.session.Set( + ctx, data.Challenge, &sessionEntry{SessionData: data}, cache.WithTTL(sessionTTL), - ); err != nil { - s.logger.Error("failed to store session", zap.Error(err)) - } + ) }- s.storeSession(sessionData) + if err := s.storeSession(ctx, sessionData); err != nil { + return nil, fmt.Errorf("failed to store session: %w", err) + }Also applies to: 123-123, 196-205
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/service.go` at line 64, The begin flows in the WebAuthn service can return a challenge even when session persistence fails because storeSession only logs errors and does not stop execution. Update storeSession in the service.go flow to return an error when the session cannot be saved, then propagate that error from both begin methods that call it so the begin step fails immediately instead of later surfacing ErrSessionNotFound. Use the existing begin and storeSession methods in the WebAuthn service to wire the error through both code paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@internal/webauthn/service.go`:
- Line 64: The begin flows in the WebAuthn service can return a challenge even
when session persistence fails because storeSession only logs errors and does
not stop execution. Update storeSession in the service.go flow to return an
error when the session cannot be saved, then propagate that error from both
begin methods that call it so the begin step fails immediately instead of later
surfacing ErrSessionNotFound. Use the existing begin and storeSession methods in
the WebAuthn service to wire the error through both code paths.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e1c63aee-e2b2-4bd0-bc38-f865b98ad4e8
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (8)
.env.examplego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/webauthn/module.gointernal/webauthn/service.gointernal/webauthn/session.go
✅ Files skipped from review due to trivial changes (1)
- .env.example
🚧 Files skipped from review as they are similar to previous changes (1)
- go.mod
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 64-65: Thread the caller context through session persistence by
updating the registration/login flows and `storeSession` so cache writes no
longer use `context.Background()`. Fix the new `govet` shadow warnings by
renaming any reused `err` variables in the affected call sites, and wrap the
underlying cache error returned from `storeSession` instead of exposing it
directly so `wrapcheck` passes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 05171e2b-2d06-4d39-9f5a-eeb279f83ea3
📒 Files selected for processing (1)
internal/webauthn/service.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
June 28, 2026 11:54
ef3e8df to
fdaacd1
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 213-218: The loadSession helper is swallowing all cache Get
failures by using context.Background() and returning nil, which hides
cancellations and operational cache errors as missing sessions. Update
loadSession in Service to accept the request context and return both session
data and an error, so only a real cache miss maps to ErrSessionNotFound while
other session.Get failures are propagated to the caller. Then adjust the callers
that use loadSession to handle the returned error explicitly and preserve
existing missing-session behavior only for true misses.
- Around line 221-224: The deleteSession helper in Service currently only logs
cache delete failures, which lets FinishRegistration and FinishLogin continue
even if the challenge was not consumed. Change deleteSession to return an error
when session.Delete fails, then update the FinishRegistration and FinishLogin
success paths to check that result and abort the ceremony if challenge
consumption fails. Keep the failure handling close to the existing
deleteSession, FinishRegistration, and FinishLogin flow so a session can’t be
reused when deletion does not succeed.
- Around line 56-59: Registration in WebAuthnService.BeginRegistration only sets
resident-key requirements, so it can create credentials that do not meet the
passwordless login policy enforced by BeginLogin. Update the authenticator
selection passed to s.webAuthn.BeginRegistration to also require user
verification by adding protocol.VerificationRequired alongside the existing
resident-key requirement, so new credentials can satisfy the login flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3d86165e-f3a2-4639-a846-19816e9665b2
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (26)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/encoding.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/session.go
✅ Files skipped from review due to trivial changes (1)
- internal/server/middlewares/jwtauth/jwtauth.go
🚧 Files skipped from review as they are similar to previous changes (23)
- internal/webauthn/config.go
- internal/webauthn/encoding.go
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- internal/webauthn/errors.go
- internal/webauthn/session.go
- internal/config/module.go
- frontend/src/App.svelte
- frontend/src/lib/pages/profile.svelte
- internal/server/auth/dto.go
- frontend/src/lib/types/api.ts
- .golangci.yml
- internal/webauthn/models.go
- internal/commands/serve/serve.go
- internal/webauthn/module.go
- frontend/src/lib/pages/settings/security.svelte
- internal/webauthn/domain.go
- frontend/src/lib/stores/auth.svelte.ts
- internal/config/config.go
- frontend/src/lib/api/passkey.ts
- frontend/src/pages/login.svelte
- go.mod
- internal/webauthn/repository.go
- internal/server/auth/handler.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
June 29, 2026 07:12
12644cf to
bff6fb7
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 84-90: The WebAuthn finish flows in `service.go` currently call
`loadSession()` and `deleteSession()` separately, which allows concurrent
requests with the same challenge to reuse the same session. Replace this
two-step pattern with a single atomic consume helper in `Service` (for example,
using backend `GETDEL`, a transaction/Lua script, or a per-challenge lock) that
loads and deletes the session in one operation, and update both finish paths to
use that helper instead of `loadSession()` followed by `deleteSession()`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1f594e5d-ab1e-47ee-a36a-76e1036dad94
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (26)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/encoding.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/session.go
🚧 Files skipped from review as they are similar to previous changes (24)
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- internal/webauthn/errors.go
- frontend/src/lib/pages/profile.svelte
- internal/webauthn/encoding.go
- internal/webauthn/session.go
- frontend/src/lib/types/api.ts
- internal/webauthn/module.go
- internal/webauthn/config.go
- frontend/src/App.svelte
- internal/server/auth/dto.go
- internal/webauthn/models.go
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/commands/serve/serve.go
- frontend/src/lib/pages/settings/security.svelte
- internal/config/config.go
- frontend/src/lib/stores/auth.svelte.ts
- frontend/src/pages/login.svelte
- .golangci.yml
- internal/server/auth/handler.go
- internal/config/module.go
- internal/webauthn/repository.go
- frontend/src/lib/api/passkey.ts
- internal/webauthn/domain.go
- go.mod
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/webauthn/models.go (1)
36-43: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winUse the domain field name in this mapping.
internal/webauthn/domain.goexposes the slice asTransports []string, soTransport:does not match the current domain contract here. This breaks the model-to-domain conversion path.🛠️ Suggested fix
return &Credential{ ID: m.ID, UserID: m.UserID, CredentialID: m.CredentialID, PublicKey: m.PublicKey, AttestationType: m.AttestationType, - Transport: m.Transport, + Transports: append([]string(nil), m.Transport...), AAGUID: m.AAGUID, Flags: m.Flags, SignCount: m.SignCount,🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 36 - 43, The model-to-domain mapping in the credential conversion logic is using the wrong field name for the transport slice. Update the Credential conversion in models.go to map to the domain field exposed by internal/webauthn/domain.go, using the Transports field instead of Transport so the mapping matches the current domain contract and preserves the conversion path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 177-179: The sign-count update in s.credentials.UpdateSignCount is
currently treated as best-effort, which lets login continue with stale
credential state. Change the webauthn login flow in the service method that
handles the assertion so that a failure from UpdateSignCount is treated as a
hard error and aborts the operation instead of only logging a warning. Keep the
update tied to the existing credential/sign-in path by using the same
credModel.ID and credential.Authenticator.SignCount values, but return or
propagate the update error from the surrounding handler instead of swallowing
it.
---
Outside diff comments:
In `@internal/webauthn/models.go`:
- Around line 36-43: The model-to-domain mapping in the credential conversion
logic is using the wrong field name for the transport slice. Update the
Credential conversion in models.go to map to the domain field exposed by
internal/webauthn/domain.go, using the Transports field instead of Transport so
the mapping matches the current domain contract and preserves the conversion
path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c0d826ff-48db-4660-8189-404af1a97518
📒 Files selected for processing (5)
internal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/service.gointernal/webauthn/sessions.go
🚧 Files skipped from review as they are similar to previous changes (2)
- internal/webauthn/errors.go
- internal/webauthn/domain.go
There was a problem hiding this comment.
♻️ Duplicate comments (1)
internal/webauthn/service.go (1)
56-63: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRequire user verification for passwordless passkey auth.
VerificationPreferredcan allow possession-only authentication. SinceFinishLoginreturns a fully authenticated user without a password step, useprotocol.VerificationRequiredfor both registration policy and discoverable login.🔐 Suggested fix
RequireResidentKey: protocol.ResidentKeyRequired(), ResidentKey: protocol.ResidentKeyRequirementRequired, - UserVerification: protocol.VerificationPreferred, + UserVerification: protocol.VerificationRequired, }),options, sessionData, err := s.webAuthn.BeginDiscoverableLogin( - webauthn.WithUserVerification(protocol.VerificationPreferred), + webauthn.WithUserVerification(protocol.VerificationRequired), )This repeats earlier UV-policy feedback, but the current code explicitly sets
preferred. Verify the option names against the pinnedgithub.com/go-webauthn/webauthnversion if needed.github.com/go-webauthn/webauthn v0.17.4 BeginDiscoverableLogin WithUserVerification VerificationRequiredAlso applies to: 120-123
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/service.go` around lines 56 - 63, Update the WebAuthn UV policy in the registration and discoverable login flow so passwordless passkey auth requires user verification instead of allowing possession-only auth. In the `BeginRegistration` authenticator selection and the discoverable login setup used with `FinishLogin`, replace the current `protocol.VerificationPreferred` setting with the correct required-verification option for the pinned `github.com/go-webauthn/webauthn` version, and verify the exact option names in the related `BeginDiscoverableLogin`/`WithUserVerification` calls.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@internal/webauthn/service.go`:
- Around line 56-63: Update the WebAuthn UV policy in the registration and
discoverable login flow so passwordless passkey auth requires user verification
instead of allowing possession-only auth. In the `BeginRegistration`
authenticator selection and the discoverable login setup used with
`FinishLogin`, replace the current `protocol.VerificationPreferred` setting with
the correct required-verification option for the pinned
`github.com/go-webauthn/webauthn` version, and verify the exact option names in
the related `BeginDiscoverableLogin`/`WithUserVerification` calls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3fe33841-fcc4-4c0f-a8a5-d982a369ceed
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (6)
go.modinternal/commands/serve/serve.gointernal/webauthn/domain.gointernal/webauthn/models.gointernal/webauthn/repository.gointernal/webauthn/service.go
💤 Files with no reviewable changes (1)
- go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- internal/webauthn/repository.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
June 30, 2026 07:22
ed7be6c to
734245d
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/repository.go`:
- Around line 74-90: Update Repository.UpdateSignCount so the write is monotonic
by adding an atomic condition that only updates when the stored sign_count is
less than or equal to the new signCount, using the existing Update/Where flow in
updateSignCount. Then adjust the post-update handling to return
ErrCredentialNotFound only when no credential row exists, not when the row was
skipped because a newer sign_count was already present; keep the existing error
wrapping for Exec and RowsAffected in Repository.UpdateSignCount.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ed3c84dc-63b3-443c-9fd3-60a54f2daa96
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (25)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (2)
- frontend/src/lib/pages/profile.svelte
- internal/webauthn/errors.go
🚧 Files skipped from review as they are similar to previous changes (19)
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/server/auth/dto.go
- internal/webauthn/config.go
- internal/config/module.go
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- frontend/src/lib/types/api.ts
- frontend/src/App.svelte
- internal/webauthn/module.go
- .golangci.yml
- internal/webauthn/sessions.go
- frontend/src/lib/pages/settings/security.svelte
- internal/config/config.go
- frontend/src/lib/stores/auth.svelte.ts
- internal/commands/serve/serve.go
- frontend/src/pages/login.svelte
- go.mod
- internal/server/auth/handler.go
- internal/webauthn/models.go
- frontend/src/lib/api/passkey.ts
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 2, 2026 02:20
b7cb029 to
b4b5c2a
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
internal/webauthn/service.go (1)
56-64: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRequire
VerificationRequiredfor passkey registration and loginBoth passkey ceremonies still use
protocol.VerificationPreferred, which allows possession-only authenticators to complete a passwordless login without PIN/biometric confirmation. Switch both call sites toVerificationRequiredunless weaker UV support is intentional.Suggested fix
- UserVerification: protocol.VerificationPreferred, + UserVerification: protocol.VerificationRequired,- webauthn.WithUserVerification(protocol.VerificationPreferred), + webauthn.WithUserVerification(protocol.VerificationRequired),🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/service.go` around lines 56 - 64, The passkey WebAuthn ceremonies are still using protocol.VerificationPreferred, which should be tightened to protocol.VerificationRequired for user verification. Update the authenticator selection passed from s.webAuthn.BeginRegistration and the matching login ceremony call site to require verification, keeping the rest of the WebAuthn options unchanged unless weaker UV is intentionally needed.
🧹 Nitpick comments (1)
internal/webauthn/service.go (1)
148-175: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winRedundant credential lookup in
FinishLogin.The discovery
handler(line 149) already loads the credential row byrawIDviaGetByCredentialID, but line 172 fetches it again bycredential.IDafterValidatePasskeyLoginsucceeds. Sincecredential.IDis the same ID used inside the handler, this is an avoidable extra DB round-trip on every login.♻️ Suggested fix — capture the credential fetched inside the handler
+ var credModel *Credential handler := func(rawID, _ []byte) (webauthn.User, error) { - cred, getErr := s.credentials.GetByCredentialID(ctx, rawID) + cred, getErr := s.credentials.GetByCredentialID(ctx, rawID) if getErr != nil { return nil, fmt.Errorf("credential not found: %w", getErr) } + credModel = cred user, getErr := s.usersSvc.GetByID(ctx, cred.UserID) ... } _, credential, err := s.webAuthn.ValidatePasskeyLogin(handler, *sessionData, parsedResponse) if err != nil { return nil, fmt.Errorf("failed to validate login: %w", err) } - - credModel, err := s.credentials.GetByCredentialID(ctx, credential.ID) - if err != nil { - return nil, fmt.Errorf("failed to get stored credential: %w", err) - }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/service.go` around lines 148 - 175, The `FinishLogin` flow is doing a redundant credential lookup after `ValidatePasskeyLogin` even though the `handler` already fetches the credential with `GetByCredentialID` using the same ID. Update `FinishLogin` so it reuses the credential loaded inside the discovery `handler` (or otherwise returns it from the handler/validation path) instead of calling `s.credentials.GetByCredentialID` again for `credential.ID`, while keeping the existing `newWebAuthnUser`, `ValidatePasskeyLogin`, and login validation flow intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@internal/webauthn/service.go`:
- Around line 56-64: The passkey WebAuthn ceremonies are still using
protocol.VerificationPreferred, which should be tightened to
protocol.VerificationRequired for user verification. Update the authenticator
selection passed from s.webAuthn.BeginRegistration and the matching login
ceremony call site to require verification, keeping the rest of the WebAuthn
options unchanged unless weaker UV is intentionally needed.
---
Nitpick comments:
In `@internal/webauthn/service.go`:
- Around line 148-175: The `FinishLogin` flow is doing a redundant credential
lookup after `ValidatePasskeyLogin` even though the `handler` already fetches
the credential with `GetByCredentialID` using the same ID. Update `FinishLogin`
so it reuses the credential loaded inside the discovery `handler` (or otherwise
returns it from the handler/validation path) instead of calling
`s.credentials.GetByCredentialID` again for `credential.ID`, while keeping the
existing `newWebAuthnUser`, `ValidatePasskeyLogin`, and login validation flow
intact.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d85d1180-00a1-43e2-b621-9515dd232ff6
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (25)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (4)
- frontend/src/lib/pages/profile.svelte
- internal/webauthn/config.go
- internal/webauthn/errors.go
- frontend/src/lib/types/api.ts
🚧 Files skipped from review as they are similar to previous changes (19)
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- internal/config/module.go
- frontend/src/App.svelte
- frontend/src/lib/pages/settings/security.svelte
- internal/webauthn/module.go
- internal/config/config.go
- internal/webauthn/sessions.go
- frontend/src/lib/stores/auth.svelte.ts
- frontend/src/pages/login.svelte
- internal/commands/serve/serve.go
- frontend/src/lib/api/passkey.ts
- internal/server/auth/dto.go
- internal/webauthn/repository.go
- .golangci.yml
- internal/webauthn/domain.go
- internal/webauthn/models.go
- internal/server/auth/handler.go
- go.mod
- internal/server/middlewares/jwtauth/jwtauth.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 3, 2026 00:22
63b8613 to
c5b50ac
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.env.example (1)
189-217: 🚀 Performance & Scalability | 🔵 TrivialDocument the CACHE__URL dependency for multi-instance WebAuthn deployments.
WebAuthn registration/login sessions are backed by this same cache (per the stack's "cache-backed session storage"). With the documented
CACHE__URL=memory://default, multi-instance/HA deployments will break passkey ceremonies since session state won't be shared across instances. Consider adding a note here (or near the CACHE block) thatCACHE__URLmust point to Redis whenever WebAuthn is enabled in a multi-instance deployment.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.env.example around lines 189 - 217, Document the WebAuthn dependency on shared cache storage: in the WebAuthn section around WEBAUTHN__RP_DISPLAY_NAME, WEBAUTHN__RP_ID, and WEBAUTHN__RP_ORIGINS, add a note that CACHE__URL must use a shared backend such as Redis for multi-instance or HA deployments when WebAuthn is enabled, since the passkey ceremony/session state is cache-backed and memory:// will not work across instances. Keep the guidance near the existing cache/WebAuthn configuration so the dependency is easy to find.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/service.go`:
- Around line 56-67: The WebAuthn registration and login ceremonies are
currently using protocol.VerificationPreferred, which can allow authenticator
use without PIN/biometric verification. Update the authenticator selection in
the registration flow in internal/webauthn/service.go and the corresponding
login flow so both use protocol.VerificationRequired, keeping the change
localized around the BeginRegistration and BeginLogin calls and their WebAuthn
options.
---
Nitpick comments:
In @.env.example:
- Around line 189-217: Document the WebAuthn dependency on shared cache storage:
in the WebAuthn section around WEBAUTHN__RP_DISPLAY_NAME, WEBAUTHN__RP_ID, and
WEBAUTHN__RP_ORIGINS, add a note that CACHE__URL must use a shared backend such
as Redis for multi-instance or HA deployments when WebAuthn is enabled, since
the passkey ceremony/session state is cache-backed and memory:// will not work
across instances. Keep the guidance near the existing cache/WebAuthn
configuration so the dependency is easy to find.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b3797528-c762-4fcd-b571-8b85ccd8b308
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (25)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
🚧 Files skipped from review as they are similar to previous changes (23)
- frontend/src/App.svelte
- frontend/src/lib/pages/profile.svelte
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/webauthn/sessions.go
- internal/config/module.go
- internal/webauthn/config.go
- internal/webauthn/module.go
- internal/commands/serve/serve.go
- internal/webauthn/errors.go
- frontend/src/lib/types/api.ts
- frontend/src/lib/pages/settings/security.svelte
- internal/server/auth/dto.go
- internal/config/config.go
- frontend/src/lib/stores/auth.svelte.ts
- internal/webauthn/domain.go
- .golangci.yml
- frontend/src/pages/login.svelte
- internal/webauthn/repository.go
- internal/webauthn/models.go
- internal/server/auth/handler.go
- frontend/src/lib/api/passkey.ts
- go.mod
- internal/db/migrations/20260623000000_webauthn_credentials.sql
There was a problem hiding this comment.
🧹 Nitpick comments (3)
internal/webauthn/models.go (3)
186-206: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueScan lacks nil-source handling, unlike sibling
Transports.Scan.The
notnullconstraint on theaaguidcolumn (line 26) makes this unreachable today, but if that constraint ever changes, a NULL value here would error with "unexpected type" rather than being handled likeTransports.Scandoes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 186 - 206, Update AAGUID.Scan to handle a nil src the same way Transports.Scan does instead of treating it as an unexpected type. Add a nil case in the type switch in AAGUID.Scan, return the zero/empty AAGUID value for NULL input, and keep the existing string/[]byte hex decoding behavior unchanged.
167-183: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winSilent data loss when AAGUID length is unexpected.
String()returns""wheneverlen(a) != 16, andValue()persists that empty string with no error. If an authenticator ever returns a non-16-byte AAGUID (corruption/bug), the raw bytes are silently discarded on write instead of surfacing the anomaly.♻️ Proposed fix to fail loudly on unexpected length
func (a *AAGUID) Value() (driver.Value, error) { if a == nil { return nil, nil //nolint:nilnil //empty value } - - return a.String(), nil + const aaguidLen = 16 + if len(*a) != 0 && len(*a) != aaguidLen { + return nil, fmt.Errorf("invalid aaguid length: %d", len(*a)) + } + return a.String(), nil }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 167 - 183, The AAGUID serialization path is silently dropping invalid data because AAGUID.String() returns an empty string for non-16-byte values and (*AAGUID).Value() persists that result without error. Update AAGUID.String() and/or (*AAGUID).Value() so unexpected lengths are treated as an error instead of being converted to "". Make the failure explicit at the Value() boundary, returning an error when the AAGUID length is not exactly 16 bytes, while keeping the nil receiver behavior unchanged.
165-183: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winReplace
formatAAGUIDwithAAGUID(credential.Authenticator.AAGUID).String()
internal/webauthn/service.gostill duplicates the same dashed-hex AAGUID formatting logic; using the sharedAAGUID.String()method would keep the device-name lookup and string representation aligned.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 165 - 183, The AAGUID formatting logic is duplicated in the WebAuthn service, so update the credential/device-name lookup in service.go to use the shared AAGUID.String() method instead of the local formatAAGUID helper. Locate the call site using credential.Authenticator.AAGUID and replace the manual dashed-hex formatting with AAGUID(credential.Authenticator.AAGUID).String() so the string representation stays consistent with the AAGUID type in models.go.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@internal/webauthn/models.go`:
- Around line 186-206: Update AAGUID.Scan to handle a nil src the same way
Transports.Scan does instead of treating it as an unexpected type. Add a nil
case in the type switch in AAGUID.Scan, return the zero/empty AAGUID value for
NULL input, and keep the existing string/[]byte hex decoding behavior unchanged.
- Around line 167-183: The AAGUID serialization path is silently dropping
invalid data because AAGUID.String() returns an empty string for non-16-byte
values and (*AAGUID).Value() persists that result without error. Update
AAGUID.String() and/or (*AAGUID).Value() so unexpected lengths are treated as an
error instead of being converted to "". Make the failure explicit at the Value()
boundary, returning an error when the AAGUID length is not exactly 16 bytes,
while keeping the nil receiver behavior unchanged.
- Around line 165-183: The AAGUID formatting logic is duplicated in the WebAuthn
service, so update the credential/device-name lookup in service.go to use the
shared AAGUID.String() method instead of the local formatAAGUID helper. Locate
the call site using credential.Authenticator.AAGUID and replace the manual
dashed-hex formatting with AAGUID(credential.Authenticator.AAGUID).String() so
the string representation stays consistent with the AAGUID type in models.go.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7ab46e7b-329b-4258-a600-7f3854727808
📒 Files selected for processing (2)
internal/webauthn/domain.gointernal/webauthn/models.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 6, 2026 04:52
22b9e1d to
6d8b1a2
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
internal/webauthn/models.go (1)
208-223: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winHoist the AAGUID lookup map to a package-level variable.
namesis reconstructed on everyDeviceName()call. If this runs per-credential (e.g., rendering a list of passkeys in settings UI), it's needless repeated allocation.♻️ Proposed refactor
+var aaguidDeviceNames = map[string]string{ + "00000000-0000-0000-0000-000000000000": "Unknown Device", + "adce0002-35bc-c60a-648b-0b25f1f05503": "Chrome on Mac", + "089b7b64-0f30-4f8c-8838-666944e5c09e": "Touch ID", + "6028b017-b1d4-4c02-b4b3-afcd7c96e1c1": "Windows Hello", + "dd3ec08a-88f2-4e0b-b3f2-0ab636182cf5": "iCloud Keychain", + "fdb141b2-5d98-4b6c-8d4e-45c0a3e1c7a8": "Google Password Manager", + "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4": "Android Passkey", + "50757fe4-208c-4cbb-a72b-05b48def77b7": "1Password", +} + func (a AAGUID) DeviceName() string { - names := map[string]string{ - "00000000-0000-0000-0000-000000000000": "Unknown Device", - "adce0002-35bc-c60a-648b-0b25f1f05503": "Chrome on Mac", - "089b7b64-0f30-4f8c-8838-666944e5c09e": "Touch ID", - "6028b017-b1d4-4c02-b4b3-afcd7c96e1c1": "Windows Hello", - "dd3ec08a-88f2-4e0b-b3f2-0ab636182cf5": "iCloud Keychain", - "fdb141b2-5d98-4b6c-8d4e-45c0a3e1c7a8": "Google Password Manager", - "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4": "Android Passkey", - "50757fe4-208c-4cbb-a72b-05b48def77b7": "1Password", - } - if name, ok := names[a.String()]; ok { + if name, ok := aaguidDeviceNames[a.String()]; ok { return name } return "Passkey" }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 208 - 223, Hoist the AAGUID-to-device-name lookup out of AAGUID.DeviceName() into a package-level variable so the map is not rebuilt on every call. Move the current names map to a shared package-level declaration in internal/webauthn/models.go and have DeviceName() reuse it while keeping the existing lookup and fallback behavior unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@internal/webauthn/models.go`:
- Around line 208-223: Hoist the AAGUID-to-device-name lookup out of
AAGUID.DeviceName() into a package-level variable so the map is not rebuilt on
every call. Move the current names map to a shared package-level declaration in
internal/webauthn/models.go and have DeviceName() reuse it while keeping the
existing lookup and fallback behavior unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 53e0c53e-64b4-442f-9127-44f8a8b5881f
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (25)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (2)
- internal/webauthn/config.go
- frontend/src/lib/types/api.ts
🚧 Files skipped from review as they are similar to previous changes (21)
- frontend/src/App.svelte
- internal/config/module.go
- internal/webauthn/module.go
- internal/server/auth/dto.go
- .golangci.yml
- internal/webauthn/sessions.go
- internal/webauthn/errors.go
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/commands/serve/serve.go
- frontend/src/lib/pages/profile.svelte
- frontend/src/pages/login.svelte
- frontend/src/lib/pages/settings/security.svelte
- internal/config/config.go
- internal/webauthn/repository.go
- internal/webauthn/domain.go
- frontend/src/lib/api/passkey.ts
- frontend/src/lib/stores/auth.svelte.ts
- internal/server/auth/handler.go
- internal/webauthn/service.go
- go.mod
There was a problem hiding this comment.
🧹 Nitpick comments (2)
internal/server/passkey/dto.go (1)
5-9: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRename to avoid stutter flagged by lint.
revivereportspasskey.PasskeyCredentialResponsestutters. Renaming toCredentialResponsealso requires updating the two usages inhandler.go.🔧 Proposed fix
-type PasskeyCredentialResponse struct { +type CredentialResponse struct { ID int64 `json:"id"` Name string `json:"name"` CreatedAt time.Time `json:"created_at"` }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/server/passkey/dto.go` around lines 5 - 9, Rename PasskeyCredentialResponse to CredentialResponse to remove the stutter reported by revive, and update all references to the new type name, including the two usages in handler.go and any constructors or return signatures that currently mention PasskeyCredentialResponse.Source: Linters/SAST tools
internal/server/passkey/handler.go (1)
186-205: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winWrap the error to satisfy
wrapcheck.Line 203 returns the error from
c.Next()(external packagefiber) unwrapped, which the Lint check flags.🔧 Proposed fix
default: - return err + return fmt.Errorf("passkey request failed: %w", err) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/server/passkey/handler.go` around lines 186 - 205, The errorsHandler method returns the raw error from c.Next() in the default branch, which triggers wrapcheck because an external error is being passed through unwrapped. Update errorsHandler so the default case wraps the returned error with local context before returning it, while keeping the existing error mappings for webauthn.ErrSessionNotFound, webauthn.ErrCredentialNotFound, webauthn.ErrInvalidWebAuthnPayload, and jwt.ErrInvalidConfig unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@internal/server/passkey/dto.go`:
- Around line 5-9: Rename PasskeyCredentialResponse to CredentialResponse to
remove the stutter reported by revive, and update all references to the new type
name, including the two usages in handler.go and any constructors or return
signatures that currently mention PasskeyCredentialResponse.
In `@internal/server/passkey/handler.go`:
- Around line 186-205: The errorsHandler method returns the raw error from
c.Next() in the default branch, which triggers wrapcheck because an external
error is being passed through unwrapped. Update errorsHandler so the default
case wraps the returned error with local context before returning it, while
keeping the existing error mappings for webauthn.ErrSessionNotFound,
webauthn.ErrCredentialNotFound, webauthn.ErrInvalidWebAuthnPayload, and
jwt.ErrInvalidConfig unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 04b1a5d7-cbbd-4a37-8168-9e1d694b920d
📒 Files selected for processing (5)
internal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/module.gointernal/server/passkey/dto.gointernal/server/passkey/handler.go
✅ Files skipped from review due to trivial changes (1)
- internal/server/module.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 7, 2026 07:47
ccea28f to
d0dfe5a
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
internal/webauthn/models.go (1)
208-223: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueHoist the device-name lookup table to a package-level variable.
namesis reconstructed on everyDeviceName()call; move it to a package-levelvarso it is only allocated once.♻️ Proposed refactor
+var aaguidDeviceNames = map[string]string{ + "00000000-0000-0000-0000-000000000000": "Unknown Device", + "adce0002-35bc-c60a-648b-0b25f1f05503": "Chrome on Mac", + "089b7b64-0f30-4f8c-8838-666944e5c09e": "Touch ID", + "6028b017-b1d4-4c02-b4b3-afcd7c96e1c1": "Windows Hello", + "dd3ec08a-88f2-4e0b-b3f2-0ab636182cf5": "iCloud Keychain", + "fdb141b2-5d98-4b6c-8d4e-45c0a3e1c7a8": "Google Password Manager", + "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4": "Android Passkey", + "50757fe4-208c-4cbb-a72b-05b48def77b7": "1Password", +} + func (a AAGUID) DeviceName() string { - names := map[string]string{ - "00000000-0000-0000-0000-000000000000": "Unknown Device", - "adce0002-35bc-c60a-648b-0b25f1f05503": "Chrome on Mac", - "089b7b64-0f30-4f8c-8838-666944e5c09e": "Touch ID", - "6028b017-b1d4-4c02-b4b3-afcd7c96e1c1": "Windows Hello", - "dd3ec08a-88f2-4e0b-b3f2-0ab636182cf5": "iCloud Keychain", - "fdb141b2-5d98-4b6c-8d4e-45c0a3e1c7a8": "Google Password Manager", - "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4": "Android Passkey", - "50757fe4-208c-4cbb-a72b-05b48def77b7": "1Password", - } - if name, ok := names[a.String()]; ok { + if name, ok := aaguidDeviceNames[a.String()]; ok { return name } return "Passkey" }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 208 - 223, Move the device-name lookup map out of AAGUID.DeviceName() into a package-level variable so it is allocated once instead of on every call. Keep the lookup logic in DeviceName() the same, but reference the shared map variable when resolving a.String() to a friendly name.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@internal/webauthn/models.go`:
- Around line 208-223: Move the device-name lookup map out of
AAGUID.DeviceName() into a package-level variable so it is allocated once
instead of on every call. Keep the lookup logic in DeviceName() the same, but
reference the shared map variable when resolving a.String() to a friendly name.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 440b110c-c31d-4513-939f-17da052ed365
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (28)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/server/module.gointernal/server/passkey/dto.gointernal/server/passkey/handler.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (2)
- internal/server/passkey/dto.go
- frontend/src/lib/types/api.ts
🚧 Files skipped from review as they are similar to previous changes (24)
- internal/server/module.go
- internal/webauthn/config.go
- frontend/src/App.svelte
- internal/webauthn/errors.go
- internal/webauthn/module.go
- internal/commands/serve/serve.go
- internal/server/auth/dto.go
- frontend/src/lib/pages/profile.svelte
- internal/config/config.go
- frontend/src/lib/pages/settings/security.svelte
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- frontend/src/lib/stores/auth.svelte.ts
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/webauthn/domain.go
- internal/config/module.go
- .golangci.yml
- frontend/src/lib/api/passkey.ts
- internal/webauthn/repository.go
- internal/server/auth/handler.go
- frontend/src/pages/login.svelte
- internal/webauthn/sessions.go
- go.mod
- internal/server/passkey/handler.go
- internal/webauthn/service.go
capcom6
marked this pull request as ready for review
July 8, 2026 01:19
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 8, 2026 01:19
d0dfe5a to
531f8b3
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
internal/webauthn/models.go (1)
55-74: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove redundant zero-value assignments in
newCredentialModel.
bun.BaseModel{}andID: 0are already zero values and don't need explicit assignment. This is a minor readability nit.♻️ Proposed refactor
func newCredentialModel(userID int64, cred *webauthn.Credential, transports []string, name string) *credentialModel { now := time.Now() return &credentialModel{ - BaseModel: bun.BaseModel{}, - - ID: 0, UserID: userID, CredentialID: CredentialID(cred.ID), PublicKey: cred.PublicKey,🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/webauthn/models.go` around lines 55 - 74, In newCredentialModel, remove the redundant zero-value initialization for the credentialModel fields that are already defaulted by Go. Keep the meaningful assignments like UserID, CredentialID, PublicKey, and timestamps, and drop the explicit bun.BaseModel{} and ID: 0 entries so the constructor is cleaner and easier to scan.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/webauthn/models.go`:
- Around line 140-159: Handle nil src consistently in the custom Scan methods:
CredentialID.Scan and AAGUID.Scan should mirror Transports.Scan by returning nil
when the database value is NULL instead of falling through to ErrUnexpectedType.
Update the Scan switch in both methods to check for a nil src before
type-switching, and keep the existing base64 decode / assignment behavior
unchanged for non-nil values.
---
Nitpick comments:
In `@internal/webauthn/models.go`:
- Around line 55-74: In newCredentialModel, remove the redundant zero-value
initialization for the credentialModel fields that are already defaulted by Go.
Keep the meaningful assignments like UserID, CredentialID, PublicKey, and
timestamps, and drop the explicit bun.BaseModel{} and ID: 0 entries so the
constructor is cleaner and easier to scan.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4cdd0fe6-3727-4df0-8ae7-00382fb88ee9
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (28)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/server/module.gointernal/server/passkey/dto.gointernal/server/passkey/handler.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
🚧 Files skipped from review as they are similar to previous changes (26)
- internal/server/module.go
- frontend/src/App.svelte
- internal/db/migrations/20260623000000_webauthn_credentials.sql
- frontend/src/lib/pages/profile.svelte
- frontend/src/lib/types/api.ts
- frontend/src/lib/stores/auth.svelte.ts
- internal/server/passkey/dto.go
- internal/webauthn/module.go
- internal/config/module.go
- internal/webauthn/errors.go
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/server/auth/dto.go
- internal/webauthn/config.go
- frontend/src/pages/login.svelte
- .golangci.yml
- internal/webauthn/domain.go
- internal/webauthn/sessions.go
- internal/webauthn/repository.go
- internal/server/auth/handler.go
- internal/config/config.go
- frontend/src/lib/pages/settings/security.svelte
- frontend/src/lib/api/passkey.ts
- internal/commands/serve/serve.go
- internal/server/passkey/handler.go
- go.mod
- internal/webauthn/service.go
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 9, 2026 00:49
905db77 to
d0ccd21
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.env.example:
- Line 216: Wrap the WEBAUTHN__RP_ORIGINS environment value in single quotes in
the example config so the JSON array is preserved verbatim by dotenv parsers.
Update the .env.example entry for WEBAUTHN__RP_ORIGINS to keep the inner double
quotes intact and avoid invalid origin parsing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f704dc78-b718-4de3-b153-cf74625bfc4e
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (28)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260623000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/server/module.gointernal/server/passkey/dto.gointernal/server/passkey/handler.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (1)
- internal/db/migrations/20260623000000_webauthn_credentials.sql
🚧 Files skipped from review as they are similar to previous changes (25)
- frontend/src/App.svelte
- internal/server/passkey/dto.go
- frontend/src/lib/pages/profile.svelte
- internal/webauthn/module.go
- internal/commands/serve/serve.go
- internal/webauthn/errors.go
- internal/server/module.go
- internal/config/config.go
- internal/webauthn/sessions.go
- internal/server/middlewares/jwtauth/jwtauth.go
- frontend/src/lib/types/api.ts
- internal/server/auth/handler.go
- internal/webauthn/config.go
- internal/config/module.go
- internal/server/auth/dto.go
- frontend/src/lib/stores/auth.svelte.ts
- internal/webauthn/repository.go
- go.mod
- internal/webauthn/service.go
- .golangci.yml
- frontend/src/pages/login.svelte
- internal/webauthn/domain.go
- frontend/src/lib/api/passkey.ts
- frontend/src/lib/pages/settings/security.svelte
- internal/server/passkey/handler.go
capcom6
force-pushed
the
auth/passkey-support
branch
2 times, most recently
from
July 10, 2026 02:34
7a8f7c3 to
0814d46
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/lib/pages/settings/security.svelte`:
- Around line 154-157: Add an explicit aria-label to the edit-mode Input bound
to editName, clearly identifying it as the passkey name field; retain the
existing placeholder for visual guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 973ffef3-4485-47d3-982d-806115fb0d20
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (28)
.env.example.golangci.ymlfrontend/src/App.sveltefrontend/src/lib/api/passkey.tsfrontend/src/lib/pages/profile.sveltefrontend/src/lib/pages/settings/security.sveltefrontend/src/lib/stores/auth.svelte.tsfrontend/src/lib/types/api.tsfrontend/src/pages/login.sveltego.modinternal/commands/serve/serve.gointernal/config/config.gointernal/config/module.gointernal/db/migrations/20260710000000_webauthn_credentials.sqlinternal/server/auth/dto.gointernal/server/auth/handler.gointernal/server/middlewares/jwtauth/jwtauth.gointernal/server/module.gointernal/server/passkey/dto.gointernal/server/passkey/handler.gointernal/webauthn/config.gointernal/webauthn/domain.gointernal/webauthn/errors.gointernal/webauthn/models.gointernal/webauthn/module.gointernal/webauthn/repository.gointernal/webauthn/service.gointernal/webauthn/sessions.go
✅ Files skipped from review due to trivial changes (3)
- internal/webauthn/errors.go
- internal/db/migrations/20260710000000_webauthn_credentials.sql
- frontend/src/lib/types/api.ts
🚧 Files skipped from review as they are similar to previous changes (22)
- frontend/src/lib/pages/profile.svelte
- internal/webauthn/config.go
- internal/server/passkey/dto.go
- frontend/src/App.svelte
- internal/config/module.go
- internal/server/middlewares/jwtauth/jwtauth.go
- internal/webauthn/module.go
- internal/server/auth/dto.go
- internal/server/module.go
- internal/webauthn/sessions.go
- internal/server/auth/handler.go
- .golangci.yml
- internal/commands/serve/serve.go
- frontend/src/lib/api/passkey.ts
- frontend/src/lib/stores/auth.svelte.ts
- frontend/src/pages/login.svelte
- internal/config/config.go
- internal/webauthn/domain.go
- internal/webauthn/repository.go
- internal/server/passkey/handler.go
- internal/webauthn/service.go
- go.mod
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 10, 2026 03:28
0814d46 to
4a5be1d
Compare
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 10, 2026 23:48
4a5be1d to
e20abfd
Compare
capcom6
force-pushed
the
auth/passkey-support
branch
from
July 10, 2026 23:50
e20abfd to
fda8d60
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit