Passkey (WebAuthn) support: registration, login, and management

[lr00rl]

What

Native passkey (WebAuthn) support for the Lattice control plane: operators can register passkeys (stored by Apple Passwords / iCloud Keychain or any platform/roaming authenticator) and sign in with them.

New endpoints:

• Registration (interactive session): POST /api/security/webauthn/register/{begin,finish}
• Management (interactive session): GET /api/security/webauthn/credentials, POST /api/security/webauthn/credentials/{rename,delete}
• Login (pre-auth, usernameless/discoverable): POST /api/auth/webauthn/login/{begin,finish}

Data layer: auth.WebAuthnCredential (persisted plaintext — public keys/credential ids are not secret) and a short-lived, single-use, IP-bound auth.WebAuthnChallenge, both following the existing TOTP-challenge/store conventions. Per-user credential cap of 10; sweep-on-write bounded challenge set.

Why / security decisions

• Library choice — github.com/go-webauthn/webauthn (v0.17.4). Hand-rolling CBOR/COSE/attestation parsing and assertion verification is a security anti-pattern; the repo already carries vetted third-party auth deps (go-oidc). Dependency surface is kept minimal: attestation conveyance none, no MDS/TPM/Apple attestation verification paths. github.com/descope/virtualwebauthn is a test-only dependency used to drive real begin→finish ceremonies.
• RP identity — derived from PublicURL (the same canonical external-URL config that anchors OIDC): RPID = host (no scheme/port), RPOrigin = scheme://host[:port]. For https://lattice.roobli.org → RPID=lattice.roobli.org, origin https://lattice.roobli.org, zero Apple-specific config. With no PublicURL, passkey endpoints return 503 unless the new opt-in WebAuthnAllowHostFallback is set (derives RP identity from the request Host — development only; an arbitrary Host is never trusted silently). Config field chosen: reuse Options.PublicURL; default no fallback.
• Step-up gating. Registering and deleting a login-capable credential require a fresh 60s StepUpGrant (the existing sensitive-action verb, passed as step_up_grant) when the account has TOTP enrolled. Rename is not gated. Delete blocks removing the last sign-in method only if the account has no password — password always exists here, so removing all passkeys is allowed.
• Login = full session. Finish resolves the user from the authenticator user handle and issues the same session the password+TOTP path issues; a user-verified passkey is possession + inherence, so no separate second factor. ResidentKey=required, UserVerification=required. Login begin/finish share the existing per-IP login rate limiter; challenges are ≤5 min, single-use, IP-bound.
• Sign-count policy. A zero / non-incrementing counter is tolerated (synced passkeys such as Apple's always report 0). Only a regression from a previously non-zero counter is logged as a possible-clone warning; login is never hard-failed on the counter.

Test evidence

• gofmt -l clean; go vet ./... clean.
• go test ./internal/... — all packages pass, including new tests:
  • internal/store: credential CRUD + per-user cap, ownership-scoped rename/delete/touch, challenge lifecycle (single-use / expiry / IP bind).
  • internal/server: full register→login round trip (virtual authenticator), bad origin, bad RPID, challenge reuse, IP binding, sign-count regression warns-but-allows, step-up gating on register + delete, passkeys unavailable without PublicURL, bearer PAT rejected from management.

Manual test plan (browser flows can't be E2E-verified headlessly here)

1. Serve the dashboard over HTTPS at the RP-ID host with PublicURL set.
2. In Safari on macOS, go to Settings → Security → Passkeys → Add a passkey → complete Touch ID / Face ID. Confirm the passkey appears in Apple Passwords (System Settings → Passwords) and syncs via iCloud Keychain.
3. Rename and delete a passkey; with TOTP enrolled, confirm the step-up code prompt appears for add/delete but not rename.
4. Sign out; on the login screen click Sign in with a passkey, authenticate, and confirm you land signed-in with no second-factor prompt.

Related

Dashboard PR: LatticeNet/lattice-dashboard#5

https://claude.ai/code/session_014jDcsi9xQEcy7DJQVksJac