Experimental configuration toggle for passkeys

Author: tonkku107

crates/cli/src/util.rs

@@ -222,6 +222,10 @@ pub fn site_config_from_config(
         minimum_password_complexity: password_config.minimum_complexity(),
         session_expiration,
         login_with_email_allowed: account_config.login_with_email_allowed,
+        passkeys_enabled: experimental_config
+            .passkeys
+            .as_ref()
+            .is_some_and(|c| c.enabled),
     })
 }
 

crates/config/src/sections/experimental.rs

@@ -45,6 +45,15 @@ pub struct InactiveSessionExpirationConfig {
     pub expire_user_sessions: bool,
 }
 
+/// Configuration options for passkeys
+#[serde_as]
+#[derive(Clone, Debug, Deserialize, JsonSchema, Serialize)]
+pub struct PasskeysConfig {
+    /// Whether passkeys are enabled or not
+    #[serde(default)]
+    pub enabled: bool,
+}
+
 /// Configuration sections for experimental options
 ///
 /// Do not change these options unless you know what you are doing.
@@ -75,6 +84,12 @@ pub struct ExperimentalConfig {
     /// Disabled by default
     #[serde(skip_serializing_if = "Option::is_none")]
     pub inactive_session_expiration: Option<InactiveSessionExpirationConfig>,
+
+    /// Experimental passkey support
+    ///
+    /// Disabled by default
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub passkeys: Option<PasskeysConfig>,
 }
 
 impl Default for ExperimentalConfig {
@@ -83,6 +98,7 @@ impl Default for ExperimentalConfig {
             access_token_ttl: default_token_ttl(),
             compat_token_ttl: default_token_ttl(),
             inactive_session_expiration: None,
+            passkeys: None,
         }
     }
 }
@@ -92,6 +108,7 @@ impl ExperimentalConfig {
         is_default_token_ttl(&self.access_token_ttl)
             && is_default_token_ttl(&self.compat_token_ttl)
             && self.inactive_session_expiration.is_none()
+            && self.passkeys.is_none()
     }
 }
 

crates/data-model/src/site_config.rs

@@ -90,4 +90,7 @@ pub struct SiteConfig {
 
     /// Whether users can log in with their email address.
     pub login_with_email_allowed: bool,
+
+    /// Whether passkeys are enabled
+    pub passkeys_enabled: bool,
 }

crates/handlers/src/graphql/model/site_config.rs

@@ -56,6 +56,9 @@ pub struct SiteConfig {
 
     /// Whether users can log in with their email address.
     login_with_email_allowed: bool,
+
+    /// Whether passkeys are enabled
+    passkeys_enabled: bool,
 }
 
 #[derive(SimpleObject)]
@@ -102,6 +105,7 @@ impl SiteConfig {
             account_deactivation_allowed: data_model.account_deactivation_allowed,
             minimum_password_complexity: data_model.minimum_password_complexity,
             login_with_email_allowed: data_model.login_with_email_allowed,
+            passkeys_enabled: data_model.passkeys_enabled,
         }
     }
 }

crates/handlers/src/test_utils.rs

@@ -145,6 +145,7 @@ pub fn test_site_config() -> SiteConfig {
         minimum_password_complexity: 1,
         session_expiration: None,
         login_with_email_allowed: true,
+        passkeys_enabled: false,
     }
 }
 

crates/handlers/src/views/login.rs

@@ -99,9 +99,10 @@ pub(crate) async fn get(
 
     let providers = repo.upstream_oauth_provider().all_enabled().await?;
 
-    // If password-based login is disabled, and there is only one upstream provider,
-    // we can directly start an authorization flow
-    if !site_config.password_login_enabled && providers.len() == 1 {
+    // If password-based login and passkeys are disabled, and there is only one
+    // upstream provider, we can directly start an authorization flow
+    if !site_config.password_login_enabled && !site_config.passkeys_enabled && providers.len() == 1
+    {
         let provider = providers.into_iter().next().unwrap();
 
         let mut destination = UpstreamOAuth2Authorize::new(provider.id);

crates/templates/src/context/ext.rs

@@ -48,6 +48,7 @@ impl SiteConfigExt for SiteConfig {
             password_login: self.password_login_enabled,
             account_recovery: self.account_recovery_allowed,
             login_with_email_allowed: self.login_with_email_allowed,
+            passkeys_enabled: self.passkeys_enabled,
         }
     }
 }

crates/templates/src/context/features.rs

@@ -26,6 +26,9 @@ pub struct SiteFeatures {
 
     /// Whether users can log in with their email address.
     pub login_with_email_allowed: bool,
+
+    /// Whether passkeys are enabled
+    pub passkeys_enabled: bool,
 }
 
 impl Object for SiteFeatures {
@@ -35,6 +38,7 @@ impl Object for SiteFeatures {
             "password_login" => Some(Value::from(self.password_login)),
             "account_recovery" => Some(Value::from(self.account_recovery)),
             "login_with_email_allowed" => Some(Value::from(self.login_with_email_allowed)),
+            "passkeys_enabled" => Some(Value::from(self.passkeys_enabled)),
             _ => None,
         }
     }
@@ -45,6 +49,7 @@ impl Object for SiteFeatures {
             "password_login",
             "account_recovery",
             "login_with_email_allowed",
+            "passkeys_enabled",
         ])
     }
 }

crates/templates/src/lib.rs

@@ -494,6 +494,7 @@ mod tests {
             password_registration: true,
             account_recovery: true,
             login_with_email_allowed: true,
+            passkeys_enabled: true,
         };
         let vite_manifest_path =
             Utf8Path::new(env!("CARGO_MANIFEST_DIR")).join("../../frontend/dist/manifest.json");

docs/config.schema.json

@@ -2561,6 +2561,14 @@
               "$ref": "#/definitions/InactiveSessionExpirationConfig"
             }
           ]
+        },
+        "passkeys": {
+          "description": "Experimental passkey support\n\nDisabled by default",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PasskeysConfig"
+            }
+          ]
         }
       }
     },
@@ -2594,6 +2602,17 @@
           "type": "boolean"
         }
       }
+    },
+    "PasskeysConfig": {
+      "description": "Configuration options for passkeys",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "Whether passkeys are enabled or not",
+          "default": false,
+          "type": "boolean"
+        }
+      }
     }
   }
 }