Marc-André Bombeck 86ac1e1d12 feat(auth): complete login with a security-key second factor ...

When a password is accepted for an account with a second factor, the
login response carries a single-use ticket instead of a session. The
login page now renders a second step: a TOTP or recovery code, or a
WebAuthn security-key assertion scoped to the account's registered keys.
A WebAuthn-only account (no TOTP) is recognised at the password step and
offered the security-key path.

The security-key verify endpoints validate the open ticket, verify the
assertion against the user's second-factor credentials, and only then
mint the session through the shared login tail, so no session exists
before the factor passes. The login page also arms passkey conditional-UI
autofill on the username field.

2026-06-27 20:40:45 +02:00

..

mfa-login-step.test.tsx

feat(auth): complete login with a security-key second factor

2026-06-27 20:40:45 +02:00