passkeys

backend/src/routes/profile.rs

@@ -130,6 +130,13 @@ pub async fn delete_passkey(
         .as_ref()
         .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
 
+    let active_count = service.active_passkey_count(&mut conn, user_id)?;
+    if active_count <= 1 {
+        return Err(AppError::bad_request(
+            "cannot revoke the last remaining passkey",
+        ));
+    }
+
     service.revoke_passkey(&mut conn, user_id, passkey_id, query.reason)?;
     no_content()
 }