Experimental configuration toggle for passkeys

Author: tonkku107

crates/cli/src/util.rs

@@ -214,6 +214,7 @@ pub fn site_config_from_config(
         captcha,
         minimum_password_complexity: password_config.minimum_complexity(),
         session_expiration,
+        passkeys_enabled: experimental_config.passkeys,
     })
 }
 

crates/config/src/sections/experimental.rs

@@ -75,6 +75,12 @@ pub struct ExperimentalConfig {
     /// Disabled by default
     #[serde(skip_serializing_if = "Option::is_none")]
     pub inactive_session_expiration: Option<InactiveSessionExpirationConfig>,
+
+    /// Experimental passkey support
+    ///
+    /// Disabled by default
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub passkeys: bool,
 }
 
 impl Default for ExperimentalConfig {
@@ -83,6 +89,7 @@ impl Default for ExperimentalConfig {
             access_token_ttl: default_token_ttl(),
             compat_token_ttl: default_token_ttl(),
             inactive_session_expiration: None,
+            passkeys: false,
         }
     }
 }
@@ -92,6 +99,7 @@ impl ExperimentalConfig {
         is_default_token_ttl(&self.access_token_ttl)
             && is_default_token_ttl(&self.compat_token_ttl)
             && self.inactive_session_expiration.is_none()
+            && !self.passkeys
     }
 }
 

crates/data-model/src/site_config.rs

@@ -87,4 +87,7 @@ pub struct SiteConfig {
     pub minimum_password_complexity: u8,
 
     pub session_expiration: Option<SessionExpirationConfig>,
+
+    /// Whether passkeys are enabled
+    pub passkeys_enabled: bool,
 }

crates/handlers/src/graphql/model/site_config.rs

@@ -53,6 +53,9 @@ pub struct SiteConfig {
     /// The exact scorer (including dictionaries and other data tables)
     /// in use is <https://crates.io/crates/zxcvbn>.
     minimum_password_complexity: u8,
+
+    /// Whether passkeys are enabled
+    passkeys_enabled: bool,
 }
 
 #[derive(SimpleObject)]
@@ -98,6 +101,7 @@ impl SiteConfig {
             password_registration_enabled: data_model.password_registration_enabled,
             account_deactivation_allowed: data_model.account_deactivation_allowed,
             minimum_password_complexity: data_model.minimum_password_complexity,
+            passkeys_enabled: data_model.passkeys_enabled,
         }
     }
 }

crates/handlers/src/test_utils.rs

@@ -141,6 +141,7 @@ pub fn test_site_config() -> SiteConfig {
         captcha: None,
         minimum_password_complexity: 1,
         session_expiration: None,
+        passkeys_enabled: false,
     }
 }
 

crates/handlers/src/views/login.rs

@@ -89,9 +89,10 @@ pub(crate) async fn get(
 
     let providers = repo.upstream_oauth_provider().all_enabled().await?;
 
-    // If password-based login is disabled, and there is only one upstream provider,
+    // If password-based login and passkeys are disabled, and there is only one upstream provider,
     // we can directly start an authorization flow
-    if !site_config.password_login_enabled && providers.len() == 1 {
+    if !site_config.password_login_enabled && !site_config.passkeys_enabled && providers.len() == 1
+    {
         let provider = providers.into_iter().next().unwrap();
 
         let mut destination = UpstreamOAuth2Authorize::new(provider.id);

crates/templates/src/context/ext.rs

@@ -47,6 +47,7 @@ impl SiteConfigExt for SiteConfig {
             password_registration: self.password_registration_enabled,
             password_login: self.password_login_enabled,
             account_recovery: self.account_recovery_allowed,
+            passkeys_enabled: self.passkeys_enabled,
         }
     }
 }

crates/templates/src/context/features.rs

@@ -13,6 +13,7 @@ use minijinja::{
 
 /// Site features information.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[allow(clippy::struct_excessive_bools)]
 pub struct SiteFeatures {
     /// Whether local password-based registration is enabled.
     pub password_registration: bool,
@@ -22,6 +23,9 @@ pub struct SiteFeatures {
 
     /// Whether email-based account recovery is enabled.
     pub account_recovery: bool,
+
+    /// Whether passkeys are enabled
+    pub passkeys_enabled: bool,
 }
 
 impl Object for SiteFeatures {
@@ -30,6 +34,7 @@ impl Object for SiteFeatures {
             "password_registration" => Some(Value::from(self.password_registration)),
             "password_login" => Some(Value::from(self.password_login)),
             "account_recovery" => Some(Value::from(self.account_recovery)),
+            "passkeys_enabled" => Some(Value::from(self.passkeys_enabled)),
             _ => None,
         }
     }
@@ -39,6 +44,7 @@ impl Object for SiteFeatures {
             "password_registration",
             "password_login",
             "account_recovery",
+            "passkeys_enabled",
         ])
     }
 }

crates/templates/src/lib.rs

@@ -487,6 +487,7 @@ mod tests {
             password_login: true,
             password_registration: true,
             account_recovery: true,
+            passkeys_enabled: true,
         };
         let vite_manifest_path =
             Utf8Path::new(env!("CARGO_MANIFEST_DIR")).join("../../frontend/dist/manifest.json");

docs/config.schema.json

@@ -2495,6 +2495,10 @@
               "$ref": "#/definitions/InactiveSessionExpirationConfig"
             }
           ]
+        },
+        "passkeys": {
+          "description": "Experimental passkey support\n\nDisabled by default",
+          "type": "boolean"
         }
       }
     },