passkeys

backend/src/auth/passkeys.rs

@@ -2,7 +2,7 @@ use std::sync::Arc;
 
 use anyhow::{Context, Result};
 use chrono::{Duration as ChronoDuration, NaiveDateTime, Utc};
-use diesel::prelude::*;
+use diesel::{dsl::count_star, prelude::*};
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 use uuid::Uuid;
@@ -325,6 +325,19 @@ impl PasskeyService {
         Ok(passkeys.into_iter().map(PasskeySummary::from).collect())
     }
 
+    pub fn active_passkey_count(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+    ) -> AppResult<i64> {
+        let count: i64 = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user_id))
+            .filter(passkey_dsl::revoked_at.is_null())
+            .select(count_star())
+            .first(conn)?;
+        Ok(count)
+    }
+
     pub fn revoke_passkey(
         &self,
         conn: &mut PgConnection,

backend/src/routes/profile.rs

@@ -130,6 +130,13 @@ pub async fn delete_passkey(
         .as_ref()
         .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
 
+    let active_count = service.active_passkey_count(&mut conn, user_id)?;
+    if active_count <= 1 {
+        return Err(AppError::bad_request(
+            "cannot revoke the last remaining passkey",
+        ));
+    }
+
     service.revoke_passkey(&mut conn, user_id, passkey_id, query.reason)?;
     no_content()
 }