add passkey support

src/domain.rs

@@ -21,6 +21,15 @@ pub struct User {
     pub display_name: String,
 }
 
+#[derive(Clone, Debug)]
+pub struct Passkey {
+    pub id: i64,
+    pub user_id: i64,
+    pub credential_id: String,
+    pub credential: String,
+    pub counter: i64,
+}
+
 #[derive(Clone, Debug)]
 pub struct SessionUser {
     pub user: User,

src/http.rs

@@ -5,7 +5,7 @@ use std::time::Duration;
 use axum::{
     Router,
     extract::{
-        Form, FromRequest, FromRequestParts, Path, Query, Request, State,
+        Form, FromRequest, FromRequestParts, Json, Path, Query, Request, State,
         ws::{Message, WebSocket, WebSocketUpgrade},
     },
     http::{HeaderMap, HeaderValue, StatusCode, header, request::Parts},
@@ -27,6 +27,7 @@ use crate::domain::{DomainError, SessionUser};
 use crate::ports::{HubEvent, RealtimeNotifier};
 use crate::services::{AuthService, InvitationService, ListService, MealService};
 use crate::views;
+use crate::webauthn::WebAuthnService;
 
 #[derive(Clone)]
 pub struct AppState {
@@ -34,6 +35,7 @@ pub struct AppState {
     pub lists: Arc<ListService>,
     pub meals: Arc<MealService>,
     pub invitations: Arc<InvitationService>,
+    pub webauthn: Arc<WebAuthnService>,
     pub realtime: Arc<dyn RealtimeNotifier>,
     pub cookie_secure: bool,
     pub public_base_url: String,
@@ -52,10 +54,13 @@ pub enum AppError {
 impl IntoResponse for AppError {
     fn into_response(self) -> Response {
         match self {
-            AppError::Database(_) => status_html_response(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                views::error_page("500", "Something went wrong."),
-            ),
+            AppError::Database(error) => {
+                error!(%error, "request failed");
+                status_html_response(
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    views::error_page("500", "Something went wrong."),
+                )
+            }
             AppError::BadRequest(message) => {
                 status_html_response(StatusCode::BAD_REQUEST, views::error_page("400", &message))
             }
@@ -73,6 +78,18 @@ pub fn build_router(state: AppState) -> Router {
         .route("/login", get(login_page).post(login))
         .route("/register", get(register_page).post(register))
         .route("/logout", post(logout))
+        .route("/account", get(account_page))
+        .route("/auth/passkey/register/start", post(passkey_register_start))
+        .route(
+            "/auth/passkey/register/finish",
+            post(passkey_register_finish),
+        )
+        .route("/auth/passkey/login/start", post(passkey_login_start))
+        .route("/auth/passkey/login/finish", post(passkey_login_finish))
+        .route(
+            "/account/passkeys/{passkey_id}/delete",
+            post(delete_passkey),
+        )
         .route("/lists", get(lists_page).post(create_list))
         .route("/lists/{list_id}", get(list_page))
         .route("/lists/{list_id}/items", post(add_item))
@@ -235,6 +252,32 @@ struct CategoryForm {
     csrf: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct PasskeyRegisterStartForm {
+    csrf: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct PasskeyRegisterFinishForm {
+    csrf: String,
+    response: webauthn_rs::proto::RegisterPublicKeyCredential,
+}
+
+#[derive(Debug, Deserialize)]
+struct PasskeyLoginStartForm {
+    email: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct PasskeyLoginFinishForm {
+    response: webauthn_rs::proto::PublicKeyCredential,
+}
+
+#[derive(Debug, Deserialize)]
+struct DeletePasskeyForm {
+    csrf: String,
+}
+
 #[derive(Debug, Deserialize)]
 struct MealForm {
     name: String,
@@ -389,6 +432,92 @@ async fn logout(State(state): State<AppState>, user: CurrentUser) -> Result<Resp
     Ok(response)
 }
 
+async fn account_page(
+    State(state): State<AppState>,
+    user: CurrentUser,
+) -> Result<Response, AppError> {
+    let passkeys = state.webauthn.list_passkeys(user.session.user.id).await?;
+    Ok(html_response(views::account_page(
+        &user.session.user,
+        &passkeys,
+        &user.session.csrf_token,
+    )))
+}
+
+async fn passkey_register_start(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Json(form): Json<PasskeyRegisterStartForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    let challenge = state
+        .webauthn
+        .start_registration(&user.session.user)
+        .map_err(AppError::Database)?;
+    Ok(Json(challenge).into_response())
+}
+
+async fn passkey_register_finish(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Json(form): Json<PasskeyRegisterFinishForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    state
+        .webauthn
+        .finish_registration(&user.session.user, form.response)
+        .await?;
+    Ok(Redirect::to("/account").into_response())
+}
+
+async fn passkey_login_start(
+    State(state): State<AppState>,
+    Json(form): Json<PasskeyLoginStartForm>,
+) -> Result<Response, AppError> {
+    let email = form.email.trim().to_lowercase();
+    let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
+        return Err(AppError::NotFound);
+    };
+    let challenge = state
+        .webauthn
+        .start_authentication(user.id)
+        .await
+        .map_err(AppError::Database)?;
+    Ok(Json(challenge).into_response())
+}
+
+async fn passkey_login_finish(
+    State(state): State<AppState>,
+    Json(form): Json<PasskeyLoginFinishForm>,
+) -> Result<Response, AppError> {
+    let user_id = state
+        .webauthn
+        .resolve_user_id_for_assertion(&form.response)
+        .await?;
+    state
+        .webauthn
+        .finish_authentication(user_id, form.response)
+        .await?;
+    let (session_token, _) = state.auth.create_session_for_user(user_id).await?;
+    let mut response = Redirect::to("/lists").into_response();
+    set_session_cookie(&mut response, &session_token, state.cookie_secure);
+    Ok(response)
+}
+
+async fn delete_passkey(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(passkey_id): Path<i64>,
+    LoggedForm(form): LoggedForm<DeletePasskeyForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    state
+        .webauthn
+        .delete_passkey(user.session.user.id, passkey_id)
+        .await?;
+    Ok(Redirect::to("/account").into_response())
+}
+
 async fn lists_page(
     State(state): State<AppState>,
     user: CurrentUser,

src/main.rs

@@ -7,6 +7,7 @@ mod seed;
 mod services;
 mod sqlite;
 mod views;
+mod webauthn;
 
 use std::env;
 use std::path::Path as FilePath;
@@ -19,16 +20,17 @@ use crate::http::{AppState, build_router};
 use crate::hub::InMemoryHub;
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealIngredientRepository, MealRepository, PasswordHasher, RealtimeNotifier, SessionRepository,
-    TokenGenerator, UserRepository,
+    MealIngredientRepository, MealRepository, PasskeyRepository, PasswordHasher, RealtimeNotifier,
+    SessionRepository, TokenGenerator, UserRepository,
 };
 use crate::security::{Argon2PasswordHasher, RandomTokenGenerator};
 use crate::services::{AuthService, InvitationService, ListService, MealService, RegistrationMode};
 use crate::sqlite::{
     SqliteCategoryRepository, SqliteDatabase, SqliteInvitationRepository, SqliteItemRepository,
     SqliteListRepository, SqliteMealIngredientRepository, SqliteMealRepository,
-    SqliteSessionRepository, SqliteUserRepository,
+    SqlitePasskeyRepository, SqliteSessionRepository, SqliteUserRepository,
 };
+use crate::webauthn::{AppWebauthnConfig, WebAuthnService};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -40,8 +42,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let database_path = env::var("DATABASE_PATH").unwrap_or_else(|_| "sustenance.db".into());
     let bind_address = env::var("BIND_ADDRESS").unwrap_or_else(|_| "127.0.0.1:3000".into());
-    let public_base_url =
-        env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| format!("http://{}", bind_address));
+    // For loopback hosts, advertise `localhost` so WebAuthn works locally (browsers
+    // reject IP addresses as RP IDs). Access the app via http://localhost:PORT.
+    let bind_host = bind_address.split(':').next().unwrap_or("127.0.0.1");
+    let is_loopback = bind_host == "127.0.0.1" || bind_host == "::1" || bind_host == "localhost";
+    let public_host = if is_loopback { "localhost" } else { bind_host };
+    let public_base_url = env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| {
+        let port = bind_address.rsplit(':').next().unwrap_or("3000");
+        format!("http://{}:{}", public_host, port)
+    });
     let cookie_secure = env::var("COOKIE_SECURE")
         .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
         .unwrap_or(false);
@@ -69,6 +78,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let meal_ingredients: Arc<dyn MealIngredientRepository> =
         Arc::new(SqliteMealIngredientRepository);
     let invitations: Arc<dyn InvitationRepository> = Arc::new(SqliteInvitationRepository);
+    let passkeys: Arc<dyn PasskeyRepository> = Arc::new(SqlitePasskeyRepository);
     let hasher: Arc<dyn PasswordHasher> = Arc::new(Argon2PasswordHasher);
     let tokens: Arc<dyn TokenGenerator> = Arc::new(RandomTokenGenerator);
     let realtime: Arc<dyn RealtimeNotifier> = Arc::new(InMemoryHub::default());
@@ -102,6 +112,29 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         Arc::clone(&realtime),
     ));
 
+    // WebAuthn config from env vars. RP_ID must match the host users access the site from.
+    let rp_id = env::var("RP_ID").unwrap_or_else(|_| {
+        let host = public_base_url
+            .trim_start_matches("http://")
+            .trim_start_matches("https://")
+            .split('/')
+            .next()
+            .unwrap_or("localhost")
+            .split(':')
+            .next()
+            .unwrap_or("localhost")
+            .to_owned();
+        host
+    });
+    let rp_name = env::var("RP_NAME").unwrap_or_else(|_| "Sustenance".into());
+    let origin =
+        url::Url::parse(&public_base_url).map_err(|e| format!("invalid PUBLIC_BASE_URL: {e}"))?;
+    let webauthn_service = Arc::new(WebAuthnService::new(
+        db.clone(),
+        AppWebauthnConfig::new(rp_id, rp_name, origin),
+        Arc::clone(&passkeys),
+    ));
+
     let seed_path = env::var("SEED_CONFIG").unwrap_or_else(|_| "seed.json".into());
     seed::seed_if_needed(&db, &users, &hasher, FilePath::new(&seed_path)).await;
 
@@ -110,6 +143,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         lists: lists_service,
         meals: meals_service,
         invitations: invitations_service,
+        webauthn: webauthn_service,
         realtime,
         cookie_secure,
         public_base_url,

src/ports.rs

@@ -2,8 +2,8 @@ use async_trait::async_trait;
 use sqlx::SqliteConnection;
 
 use crate::domain::{
-    Category, DomainResult, GroceryList, Item, Meal, MealIngredient, PresenceUser, SessionUser,
-    User,
+    Category, DomainResult, GroceryList, Item, Meal, MealIngredient, Passkey, PresenceUser,
+    SessionUser, User,
 };
 
 /// Repositories take `&mut SqliteConnection` (which a `Transaction` derefs to),
@@ -27,6 +27,34 @@ pub trait UserRepository: Send + Sync {
     async fn has_users(&self, txn: &mut SqliteConnection) -> DomainResult<bool>;
 }
 
+#[async_trait]
+pub trait PasskeyRepository: Send + Sync {
+    async fn create_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        credential_id: String,
+        credential: String,
+        counter: i64,
+    ) -> DomainResult<Passkey>;
+    async fn find_by_credential_id(
+        &self,
+        txn: &mut SqliteConnection,
+        credential_id: String,
+    ) -> DomainResult<Option<Passkey>>;
+    async fn list_for_user(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+    ) -> DomainResult<Vec<Passkey>>;
+    async fn delete_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        passkey_id: i64,
+    ) -> DomainResult<()>;
+}
+
 #[async_trait]
 pub trait SessionRepository: Send + Sync {
     async fn create_session(

src/services.rs

@@ -125,6 +125,20 @@ impl AuthService {
             .await
     }
 
+    pub async fn find_user_by_email(&self, email: String) -> DomainResult<Option<(User, String)>> {
+        let users = Arc::clone(&self.users);
+        self.db
+            .run(move |txn| Box::pin(async move { users.find_user_by_email(txn, email).await }))
+            .await
+    }
+
+    pub async fn create_session_for_user(&self, user_id: i64) -> DomainResult<(String, String)> {
+        let sessions = Arc::clone(&self.sessions);
+        self.db
+            .run(move |txn| Box::pin(async move { sessions.create_session(txn, user_id).await }))
+            .await
+    }
+
     pub async fn logout(&self, session_token: String) -> DomainResult<()> {
         let sessions = Arc::clone(&self.sessions);
         self.db

src/sqlite.rs

@@ -7,11 +7,13 @@ use sha2::{Digest, Sha256};
 use sqlx::{Connection, Row, SqliteConnection, SqlitePool, sqlite::SqliteConnectOptions};
 
 use crate::domain::{
-    Category, DomainError, DomainResult, GroceryList, Item, Meal, MealIngredient, SessionUser, User,
+    Category, DomainError, DomainResult, GroceryList, Item, Meal, MealIngredient, Passkey,
+    SessionUser, User,
 };
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealIngredientRepository, MealRepository, NewItem, SessionRepository, UserRepository,
+    MealIngredientRepository, MealRepository, NewItem, PasskeyRepository, SessionRepository,
+    UserRepository,
 };
 
 #[derive(Clone)]
@@ -105,6 +107,14 @@ async fn migrate(pool: &SqlitePool) -> DomainResult<()> {
             csrf_token TEXT NOT NULL,
             expires_at INTEGER NOT NULL
         );
+        CREATE TABLE IF NOT EXISTS passkeys (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            credential_id TEXT NOT NULL UNIQUE,
+            credential TEXT NOT NULL,
+            counter INTEGER NOT NULL DEFAULT 0,
+            created_at INTEGER NOT NULL
+        );
         CREATE TABLE IF NOT EXISTS lists (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             name TEXT NOT NULL,
@@ -257,6 +267,117 @@ impl UserRepository for SqliteUserRepository {
     }
 }
 
+#[derive(Clone, Copy)]
+pub struct SqlitePasskeyRepository;
+
+#[async_trait]
+impl PasskeyRepository for SqlitePasskeyRepository {
+    async fn create_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        credential_id: String,
+        credential: String,
+        counter: i64,
+    ) -> DomainResult<Passkey> {
+        let result = sqlx::query(
+            "INSERT INTO passkeys (user_id, credential_id, credential, counter, created_at)
+             VALUES (?1, ?2, ?3, ?4, ?5)",
+        )
+        .bind(user_id)
+        .bind(&credential_id)
+        .bind(&credential)
+        .bind(counter)
+        .bind(now())
+        .execute(&mut *txn)
+        .await;
+        match result {
+            Ok(_) => {
+                let id = sqlx::query("SELECT last_insert_rowid()")
+                    .fetch_one(&mut *txn)
+                    .await
+                    .map_err(db_error)?
+                    .get::<i64, _>(0);
+                Ok(Passkey {
+                    id,
+                    user_id,
+                    credential_id,
+                    credential,
+                    counter,
+                })
+            }
+            Err(error) if is_unique_violation(&error) => Err(DomainError::Conflict),
+            Err(error) => Err(db_error(error)),
+        }
+    }
+
+    async fn find_by_credential_id(
+        &self,
+        txn: &mut SqliteConnection,
+        credential_id: String,
+    ) -> DomainResult<Option<Passkey>> {
+        let row = sqlx::query(
+            "SELECT id, user_id, credential_id, credential, counter
+             FROM passkeys WHERE credential_id = ?1",
+        )
+        .bind(&credential_id)
+        .fetch_optional(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(row.map(|row| Passkey {
+            id: row.get(0),
+            user_id: row.get(1),
+            credential_id: row.get(2),
+            credential: row.get(3),
+            counter: row.get(4),
+        }))
+    }
+
+    async fn list_for_user(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+    ) -> DomainResult<Vec<Passkey>> {
+        let rows = sqlx::query(
+            "SELECT id, user_id, credential_id, credential, counter
+             FROM passkeys WHERE user_id = ?1 ORDER BY id ASC",
+        )
+        .bind(user_id)
+        .fetch_all(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(rows
+            .into_iter()
+            .map(|row| Passkey {
+                id: row.get(0),
+                user_id: row.get(1),
+                credential_id: row.get(2),
+                credential: row.get(3),
+                counter: row.get(4),
+            })
+            .collect())
+    }
+
+    async fn delete_passkey(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        passkey_id: i64,
+    ) -> DomainResult<()> {
+        let changed = sqlx::query("DELETE FROM passkeys WHERE id = ?1 AND user_id = ?2")
+            .bind(passkey_id)
+            .bind(user_id)
+            .execute(&mut *txn)
+            .await
+            .map_err(db_error)?
+            .rows_affected();
+        if changed == 0 {
+            return Err(DomainError::NotFound);
+        }
+        Ok(())
+    }
+}
+
 #[derive(Clone, Copy)]
 pub struct SqliteSessionRepository;
 
@@ -2012,4 +2133,106 @@ mod tests {
             .await;
         assert!(matches!(result, Err(DomainError::NotFound)));
     }
+
+    // ---- PasskeyRepository ----
+
+    #[tokio::test]
+    async fn passkey_crud_roundtrip() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+
+        let created = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    passkeys
+                        .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+        assert!(created.id > 0);
+        assert_eq!(created.user_id, user.id);
+        assert_eq!(created.credential_id, "cred-1");
+
+        let found = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.find_by_credential_id(txn, "cred-1".into()).await })
+            })
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(found.id, created.id);
+
+        let listed = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.list_for_user(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert_eq!(listed.len(), 1);
+
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move { passkeys.delete_passkey(txn, user.id, created.id).await })
+        })
+        .await
+        .unwrap();
+
+        let after = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.list_for_user(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert!(after.is_empty());
+    }
+
+    #[tokio::test]
+    async fn duplicate_passkey_credential_id_conflicts() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move {
+                passkeys
+                    .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                    .await
+            })
+        })
+        .await
+        .unwrap();
+
+        let result = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    passkeys
+                        .create_passkey(txn, user.id, "cred-1".into(), "{}".into(), 0)
+                        .await
+                })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::Conflict)));
+    }
+
+    #[tokio::test]
+    async fn delete_missing_passkey_fails() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let passkeys = SqlitePasskeyRepository;
+        let result = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.delete_passkey(txn, user.id, 9999).await })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::NotFound)));
+    }
 }

src/views.rs

@@ -3,7 +3,7 @@ use pulldown_cmark::{Options, Parser, html as cmark_html};
 
 use crate::{
     domain::PresenceUser,
-    domain::{Category, GroceryList, Item, Meal, MealIngredient, User},
+    domain::{Category, GroceryList, Item, Meal, MealIngredient, Passkey, User},
 };
 
 pub fn login_page(error: Option<&str>, invite: Option<&str>) -> Markup {
@@ -28,8 +28,11 @@ pub fn login_page(error: Option<&str>, invite: Option<&str>) -> Markup {
                     input id="password" name="password" type="password" autocomplete="current-password" required;
                     button class="button button-primary" type="submit" { "Sign in" }
                 }
+                div class="auth-divider" { span { "or" } }
+                button id="passkey-login" class="button button-secondary" type="button" { "Sign in with a passkey" }
                 p class="auth-switch" { "Need an account? " a href="/register" { "Create one" } }
             }
+            script src="/static/passkey-login.js" {}
         },
     )
 }
@@ -79,6 +82,51 @@ pub fn registration_closed_page() -> Markup {
     )
 }
 
+pub fn account_page(user: &User, passkeys: &[Passkey], csrf_token: &str) -> Markup {
+    page(
+        "Account",
+        Some(user),
+        html! {
+            div class="page-heading" {
+                div {
+                    p class="eyebrow" { "ACCOUNT" }
+                    h1 { "Account" }
+                    p class="lede" { "Manage your sign-in methods." }
+                }
+            }
+            div class="dashboard-grid" {
+                section class="panel" {
+                    div class="panel-heading" {
+                        h2 { "Passkeys" }
+                        span class="count-badge" { (passkeys.len()) }
+                    }
+                    p { "Passkeys let you sign in without a password using your device." }
+                    @if passkeys.is_empty() {
+                        p class="muted" { "You have no passkeys yet." }
+                    } @else {
+                        div class="passkey-list" {
+                            @for passkey in passkeys {
+                                div class="passkey-row" {
+                                    div class="item-copy" {
+                                        strong { "Passkey" }
+                                        small { (passkey.credential_id) }
+                                    }
+                                    form method="post" action=(format!("/account/passkeys/{}/delete", passkey.id)) {
+                                        input type="hidden" name="csrf" value=(csrf_token);
+                                        button class="danger-link" type="submit" { "Remove" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    button id="add-passkey" class="button button-primary" type="button" data-csrf=(csrf_token) { "Add a passkey" }
+                }
+            }
+            script src="/static/passkey-register.js" {}
+        },
+    )
+}
+
 pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Markup {
     page(
         "Your lists",
@@ -907,7 +955,7 @@ fn page(title: &str, user: Option<&User>, content: Markup) -> Markup {
                             a href="/meals" { "Meals" }
                         }
                         div class="account-nav" {
-                            span class="user-name" { (user.display_name) }
+                            a class="user-name" href="/account" { (user.display_name) }
                             form method="post" action="/logout" {
                                 button class="text-button" type="submit" { "Sign out" }
                             }

src/webauthn.rs

@@ -0,0 +1,271 @@
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+
+use webauthn_rs::{
+    Webauthn,
+    core::{AuthenticationState, RegistrationState, WebauthnConfig},
+    error::WebauthnError as WanError,
+    proto::{
+        CreationChallengeResponse, Credential, PublicKeyCredential, RegisterPublicKeyCredential,
+        RequestChallengeResponse,
+    },
+};
+
+use crate::domain::{DomainError, DomainResult, Passkey as DbPasskey, User};
+use crate::ports::PasskeyRepository;
+use crate::sqlite::SqliteDatabase;
+
+/// Site-specific WebAuthn configuration, derived from env vars.
+pub struct AppWebauthnConfig {
+    rp_id: String,
+    rp_name: String,
+    origin: url::Url,
+}
+
+impl AppWebauthnConfig {
+    pub fn new(rp_id: String, rp_name: String, origin: url::Url) -> Self {
+        Self {
+            rp_id,
+            rp_name,
+            origin,
+        }
+    }
+}
+
+impl WebauthnConfig for AppWebauthnConfig {
+    fn get_relying_party_name(&self) -> &str {
+        &self.rp_name
+    }
+    fn get_origin(&self) -> &url::Url {
+        &self.origin
+    }
+    fn get_relying_party_id(&self) -> &str {
+        &self.rp_id
+    }
+}
+
+/// A single-use, in-memory challenge store keyed by user id.
+#[derive(Default)]
+struct ChallengeStore {
+    registrations: HashMap<i64, RegistrationState>,
+    authentications: HashMap<i64, AuthenticationState>,
+}
+
+pub struct WebAuthnService {
+    db: SqliteDatabase,
+    webauthn: Webauthn<AppWebauthnConfig>,
+    passkeys: Arc<dyn PasskeyRepository>,
+    challenges: Mutex<ChallengeStore>,
+}
+
+impl WebAuthnService {
+    pub fn new(
+        db: SqliteDatabase,
+        config: AppWebauthnConfig,
+        passkeys: Arc<dyn PasskeyRepository>,
+    ) -> Self {
+        let webauthn = Webauthn::new(config);
+        Self {
+            db,
+            webauthn,
+            passkeys,
+            challenges: Mutex::new(ChallengeStore::default()),
+        }
+    }
+
+    /// Start a passkey registration ceremony for an authenticated user.
+    pub fn start_registration(&self, user: &User) -> DomainResult<CreationChallengeResponse> {
+        let (challenge, state) = self
+            .webauthn
+            .generate_challenge_register(&user.display_name, true)
+            .map_err(webauthn_error)?;
+        self.challenges
+            .lock()
+            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
+            .registrations
+            .insert(user.id, state);
+        Ok(challenge)
+    }
+
+    /// Finish a passkey registration ceremony and persist the credential.
+    pub async fn finish_registration(
+        &self,
+        user: &User,
+        response: RegisterPublicKeyCredential,
+    ) -> DomainResult<()> {
+        let state = self
+            .challenges
+            .lock()
+            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
+            .registrations
+            .remove(&user.id)
+            .ok_or(DomainError::NotFound)?;
+
+        let passkeys = Arc::clone(&self.passkeys);
+        let credential_id = response.raw_id.0.clone();
+        let user_id = user.id;
+        let credential = self
+            .webauthn
+            .register_credential(&response, &state, |_| Ok(false))
+            .map_err(webauthn_error)?;
+
+        let serialized = serde_json::to_string(&credential.0)
+            .map_err(|e| DomainError::Database(e.to_string()))?;
+        let credential_id_b64 = base64_url(&credential_id);
+        let counter = credential.0.counter as i64;
+
+        self.db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    passkeys
+                        .create_passkey(txn, user_id, credential_id_b64, serialized, counter)
+                        .await?;
+                    Ok(())
+                })
+            })
+            .await
+    }
+
+    /// Start a passkey authentication ceremony for a user.
+    pub async fn start_authentication(
+        &self,
+        user_id: i64,
+    ) -> DomainResult<RequestChallengeResponse> {
+        let passkeys = Arc::clone(&self.passkeys);
+        let db = self.db.clone();
+        let credentials: Vec<Credential> = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    let rows = passkeys.list_for_user(txn, user_id).await?;
+                    let mut creds = Vec::new();
+                    for row in rows {
+                        let cred: Credential = serde_json::from_str(&row.credential)
+                            .map_err(|e| DomainError::Database(e.to_string()))?;
+                        creds.push(cred);
+                    }
+                    Ok(creds)
+                })
+            })
+            .await?;
+        if credentials.is_empty() {
+            return Err(DomainError::NotFound);
+        }
+        let (challenge, state) = self
+            .webauthn
+            .generate_challenge_authenticate(credentials)
+            .map_err(webauthn_error)?;
+        self.challenges
+            .lock()
+            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
+            .authentications
+            .insert(user_id, state);
+        Ok(challenge)
+    }
+
+    /// Finish a passkey authentication ceremony.
+    pub async fn finish_authentication(
+        &self,
+        user_id: i64,
+        response: PublicKeyCredential,
+    ) -> DomainResult<()> {
+        let state = self
+            .challenges
+            .lock()
+            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
+            .authentications
+            .remove(&user_id)
+            .ok_or(DomainError::NotFound)?;
+
+        let (cred_id, auth_data) = self
+            .webauthn
+            .authenticate_credential(&response, &state)
+            .map_err(|e| {
+                tracing::error!(%e, "webauthn authenticate_credential failed");
+                webauthn_error(e)
+            })?;
+
+        let passkeys = Arc::clone(&self.passkeys);
+        let db = self.db.clone();
+        let credential_id_b64 = base64_url(cred_id);
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move {
+                let stored = passkeys
+                    .find_by_credential_id(txn, credential_id_b64)
+                    .await?
+                    .ok_or(DomainError::NotFound)?;
+                let mut cred: Credential = serde_json::from_str(&stored.credential)
+                    .map_err(|e| DomainError::Database(e.to_string()))?;
+                cred.counter = auth_data.counter;
+                let serialized = serde_json::to_string(&cred)
+                    .map_err(|e| DomainError::Database(e.to_string()))?;
+                sqlx::query("UPDATE passkeys SET credential = ?1 WHERE id = ?2")
+                    .bind(&serialized)
+                    .bind(stored.id)
+                    .execute(&mut *txn)
+                    .await
+                    .map_err(db_error)?;
+                Ok(())
+            })
+        })
+        .await
+    }
+
+    /// List the passkeys registered to a user.
+    pub async fn list_passkeys(&self, user_id: i64) -> DomainResult<Vec<DbPasskey>> {
+        let passkeys = Arc::clone(&self.passkeys);
+        self.db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.list_for_user(txn, user_id).await })
+            })
+            .await
+    }
+
+    /// Delete a passkey owned by a user.
+    pub async fn delete_passkey(&self, user_id: i64, passkey_id: i64) -> DomainResult<()> {
+        let passkeys = Arc::clone(&self.passkeys);
+        self.db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move { passkeys.delete_passkey(txn, user_id, passkey_id).await })
+            })
+            .await
+    }
+
+    /// Resolve the user id that owns the credential in an assertion response.
+    pub async fn resolve_user_id_for_assertion(
+        &self,
+        response: &PublicKeyCredential,
+    ) -> DomainResult<i64> {
+        let passkeys = Arc::clone(&self.passkeys);
+        let db = self.db.clone();
+        let credential_id_b64 = base64_url(&response.raw_id.0);
+        db.run(move |txn| {
+            let passkeys = passkeys.clone();
+            Box::pin(async move {
+                let stored = passkeys
+                    .find_by_credential_id(txn, credential_id_b64)
+                    .await?
+                    .ok_or(DomainError::NotFound)?;
+                Ok(stored.user_id)
+            })
+        })
+        .await
+    }
+}
+
+fn base64_url(bytes: &[u8]) -> String {
+    use base64::Engine;
+    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
+}
+
+fn webauthn_error(error: WanError) -> DomainError {
+    DomainError::Database(error.to_string())
+}
+
+fn db_error(error: sqlx::Error) -> DomainError {
+    DomainError::Database(error.to_string())
+}