passwordless login + proper migrations

src/http.rs

@@ -259,11 +259,13 @@ struct PasskeyRegisterFinishForm {
 
 #[derive(Debug, Deserialize)]
 struct PasskeyLoginStartForm {
+    #[serde(default)]
     email: String,
 }
 
 #[derive(Debug, Deserialize)]
 struct PasskeyLoginFinishForm {
+    token: String,
     response: webauthn_rs::proto::PublicKeyCredential,
 }
 
@@ -480,15 +482,28 @@ async fn passkey_login_start(
     Json(form): Json<PasskeyLoginStartForm>,
 ) -> Result<Response, AppError> {
     let email = form.email.trim().to_lowercase();
-    let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
-        return Err(AppError::NotFound);
+    let (challenge, token) = if email.is_empty() {
+        // Userless sign-in: no email needed, the authenticator selects a
+        // discoverable credential and returns a user handle.
+        state
+            .webauthn
+            .start_userless_authentication()
+            .await
+            .map_err(AppError::Database)?
+    } else {
+        let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
+            return Err(AppError::NotFound);
+        };
+        state
+            .webauthn
+            .start_authentication(user.id)
+            .await
+            .map_err(AppError::Database)?
     };
-    let challenge = state
-        .webauthn
-        .start_authentication(user.id)
-        .await
-        .map_err(AppError::Database)?;
-    Ok(Json(challenge).into_response())
+    Ok(
+        Json(serde_json::json!({ "token": token, "publicKey": challenge.public_key }))
+            .into_response(),
+    )
 }
 
 async fn passkey_login_finish(
@@ -497,11 +512,7 @@ async fn passkey_login_finish(
 ) -> Result<Response, AppError> {
     let user_id = state
         .webauthn
-        .resolve_user_id_for_assertion(&form.response)
-        .await?;
-    state
-        .webauthn
-        .finish_authentication(user_id, form.response)
+        .finish_authentication(form.token, form.response)
         .await?;
     let (session_token, _) = state.auth.create_session_for_user(user_id).await?;
     let mut response = Redirect::to("/lists").into_response();