feat(auth): add WebAuthn passkey support with migrations, routes, and tests

backend/src/routes/profile.rs

@@ -1,9 +1,14 @@
-use axum::{extract::Path, http::StatusCode, Json};
+use axum::{
+    extract::{Path, Query, State},
+    http::StatusCode,
+    Json,
+};
 use chrono::{DateTime, NaiveDateTime};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
 
 use crate::auth::{
+    passkeys::PasskeySummary,
     webdav_tokens::{
         create_webdav_token as issue_token, list_webdav_tokens as load_tokens,
         revoke_webdav_token as revoke_token,
@@ -12,6 +17,7 @@ use crate::auth::{
 };
 use crate::error::{AppError, AppResult};
 use crate::models::WebdavToken;
+use crate::state::AppState;
 use crate::utils::{db::no_content, time::to_iso};
 
 #[derive(Debug, Serialize)]
@@ -37,6 +43,27 @@ pub struct CreateWebdavTokenRequest {
     pub expires_at: Option<String>,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct RevokePasskeyQuery {
+    #[serde(default)]
+    pub reason: Option<String>,
+}
+
+pub async fn list_passkeys(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+) -> AppResult<Json<Vec<PasskeySummary>>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let passkeys = service.list_for_user(&mut conn, user_id)?;
+    Ok(Json(passkeys))
+}
+
 pub async fn list_webdav_tokens(
     TenantScopedConn {
         mut conn,
@@ -90,6 +117,23 @@ pub async fn delete_webdav_token(
     no_content()
 }
 
+pub async fn delete_passkey(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+    Path(passkey_id): Path<Uuid>,
+    Query(query): Query<RevokePasskeyQuery>,
+) -> AppResult<StatusCode> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    service.revoke_passkey(&mut conn, user_id, passkey_id, query.reason)?;
+    no_content()
+}
+
 fn webdav_token_to_response(token: WebdavToken) -> WebdavTokenResponse {
     WebdavTokenResponse {
         id: token.id,