Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

feat(auth): add passkeys (WebAuthn) like monk

Aperta
  • Qualcosa non va?
#87 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
go, javascript, sqlite
Ambito
api, authentication, frontend

Direzione di ricerca

Inizia esaminando internal/api/auth.go, il package proposto internal/auth/webauthn.go, le migrazioni Atlas e i file di riferimento monk WebAuthn. Conferma le questioni aperte relative alla policy degli account, a più passkey e alla UX di rinomina/revoca prima dell’implementazione. Il lavoro è completato quando i flussi di registrazione, accesso, elenco, rinomina e revoca funzionano in LoginPage e SettingsPage e i test di ceremony, replay e counter-rollback hanno esito positivo.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Goal

Bring Fanout to parity with monk's auth stack: offer passkeys (WebAuthn / FIDO2) as a primary login method alongside the existing email-code flow.

Reference implementation: monk/server/src/monk/auth/webauthn.py + @simplewebauthn/browser on the client. ~440 lines of auth code total.

Why

  • Phishing-resistant by design (origin-bound credentials)
  • No password / OTP to type or intercept — users tap Touch ID / Windows Hello / security key
  • Platform support is now universal (Safari 16+, Chrome, Firefox, Edge, iOS 16+, Android)
  • Monk already ships it; feature parity is the bar

Proposed scope

Go side (est. ~400 LOC)
  • Library: github.com/go-webauthn/webauthn (FIDO2-compliant, maintained)
  • New SQLite tables (Atlas migration):
    • webauthn_credentials(id, user_id, credential_id, public_key, sign_count, aaguid, transports, created_at, last_used_at, name)
    • webauthn_challenges(id, user_id, challenge, purpose, expires_at) — ephemeral, 5 min TTL
  • New package: internal/auth/webauthn.go — helpers for registration + authentication ceremonies
  • New API endpoints in internal/api/auth.go:
    • POST /api/auth/passkey/register/options (admin-authenticated — starts registration)
    • POST /api/auth/passkey/register/verify (completes registration, persists credential)
    • POST /api/auth/passkey/login/options (anonymous — returns challenge for existing user)
    • POST /api/auth/passkey/login/verify (completes authentication, issues JWTs)
    • GET /api/auth/passkeys (list registered passkeys for current user)
    • DELETE /api/auth/passkeys/:id (revoke a passkey)
Config (env vars)
  • WEBAUTHN_RP_ID — Relying Party ID, e.g. fanout.labstack.com
  • WEBAUTHN_RP_NAME — display name, e.g. Fanout
  • Origins derived from HTTP_ADDR + WEBAUTHN_RP_ID
Client side (est. ~200 LOC)
  • Dep: @simplewebauthn/browser (already used by monk)
  • LoginPage: "Sign in with a passkey" button alongside the email input. If localStorage has a "prefer passkey" flag from a prior login, auto-launch the ceremony.
  • SettingsPage: new "Passkeys" section — list existing credentials, allow rename + revoke, "Add a passkey" button that triggers the registration ceremony.
Tests
  • Unit tests for the registration/authentication helpers
  • API tests for the four ceremony endpoints (challenge issuance, verification, replay rejection, counter-rollback detection)

Non-goals

  • Cross-device sign-in — out of scope for v1; default to platform authenticators
  • Passwordless-only mode (forcing passkey + disabling email codes) — keep both paths available
  • Account recovery via passkey — email codes remain the recovery path

Monk reference files (for implementation guidance)

  • monk/server/src/monk/auth/webauthn.py — ceremony helpers (89 lines)
  • monk/server/src/monk/auth/models.py — credential model (50 lines)
  • monk/server/src/monk/auth/dependencies.py — FastAPI auth deps (146 lines)
  • monk/web/src/... — client-side registration + login components

Open questions

  • Should passkey be required for new admin accounts (strict) or opt-in after email setup (flexible)?
  • Do we allow multiple passkeys per user from day one? (Monk does; recommended.)
  • Rename / revoke UX — simple list + buttons, or dedicated manage-passkeys page?
Lingua principale
HTML
Stelle
6
Fork
0
Merge medio
2h 25m
PR unite (30g)
25

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di labstack/fanout

Tutte le issue di labstack/fanout

Issue simili

Altre issue su Backend & API Design

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.