feat: Implement passkey authentication with admin dashboard

[ib823]

Summary

Complete implementation of passwordless authentication using WebAuthn passkeys, replacing NextAuth.js with a custom authentication system.

Key Features

Authentication Flow:

1. Admin approves email addresses (no immediate code generation)
2. When approved user tries to login first time → System auto-sends 6-digit code via email
3. User enters code → Registers passkey (biometric/device authentication)
4. Future logins → Passkey only (no code needed)

Admin Dashboard:

• Approve new user emails
• View all users with status (active/pending/expired)
• User management actions:
  • Delete user
  • Extend access (+7 days)
  • Toggle exception (never expires)
• Track user metrics:
  • First login time
  • Last login time
  • Timelines generated

Security & UX:

• Minimal Steve Jobs-inspired login UI
• Shake animation on invalid login (no error messages - enumeration-safe)
• Session expiry: 15min for users, 1hr for admins
• Email delivery via Resend
• Fixed admin code: 123456

Technical Implementation

• WebAuthn/Passkeys: SimpleWebAuthn v13
• Session Management: JWT with jose library
• Database: PostgreSQL with Prisma ORM
• Email Service: Resend integration
• Framework: Next.js 15 App Router with async params support

Database Changes

Added to User model:

• exception (Boolean) - Never expires flag
• accessExpiresAt (DateTime) - Access expiry timestamp
• firstLoginAt, lastLoginAt (DateTime) - Login tracking
• timelinesGenerated (Int) - Usage tracking

New models:

• Authenticator - WebAuthn credentials
• EmailApproval - Approved email addresses with code hashes
• AuditEvent - User activity logs

Files Changed

Removed:

• src/lib/auth.ts (NextAuth config)
• src/app/api/auth/[...nextauth]/route.ts

Added:

• src/app/login/page.tsx - Minimal login UI
• src/app/admin/page.tsx - Admin dashboard
• src/lib/session.ts - JWT session management
• src/lib/webauthn.ts - WebAuthn utilities
• src/lib/email.ts - Resend email service
• src/app/api/auth/begin-login/route.ts
• src/app/api/auth/begin-register/route.ts
• src/app/api/auth/finish-login/route.ts
• src/app/api/auth/finish-register/route.ts
• src/app/api/auth/admin-login/route.ts
• src/app/api/admin/approve-email/route.ts
• src/app/api/admin/users/route.ts
• src/app/api/admin/users/[id]/route.ts (DELETE)
• src/app/api/admin/users/[id]/extend/route.ts
• src/app/api/admin/users/[id]/exception/route.ts

Modified:

• src/middleware.ts - Auth check with new session system
• src/app/api/projects/route.ts - Use new session management
• prisma/schema.prisma - User tracking fields + passkey models

Testing Notes

✅ Build passes locally (npm run build)
✅ Database schema synced (npx prisma db push)
✅ All TypeScript types valid
✅ Next.js 15 async params compatibility

Environment Variables Required

SESSION_SECRET=<32+ char random string>
WEBAUTHN_RP_ID=localhost
WEBAUTHN_ORIGIN=http://localhost:3000
ADMIN_EMAILS=admin@admin.com
RESEND_API_KEY=<your-key>
FROM_EMAIL=noreply@yourdomain.com

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
cockpit	Error			Oct 6, 2025 11:38pm