@@ -258,6 +266,21 @@ export default function UserActionsMenu({ user, currentUsername }: UserActionsMe
)}
+ {user.passwordless_enabled && (
+
+ )}
+
{/* Disable / Enable Account */}
diff --git a/frontend/src/components/admin/UserDetailSection.tsx b/frontend/src/components/admin/UserDetailSection.tsx
index f5b8e09..49d7de8 100644
--- a/frontend/src/components/admin/UserDetailSection.tsx
+++ b/frontend/src/components/admin/UserDetailSection.tsx
@@ -193,6 +193,18 @@ export default function UserDetailSection({ userId, onClose }: UserDetailSection
/>
}
/>
+
+ Enabled
+
+ ) : (
+ Off
+ )
+ }
+ />
!!window.PublicKeyCredential);
const inputRef = useRef(null);
- // Focus password input when lock activates
+ // Derive from auth query — has_passkeys covers both owners and any registered passkey
+ const userHasPasskeys = authStatus?.has_passkeys ?? hasPasskeys;
+ const showPasskeyButton = userHasPasskeys && supportsWebAuthn;
+ // When passwordless is enabled: passkey is the primary unlock method
+ // When passwordless is disabled: show password form, optionally with passkey secondary
+ const showPasswordForm = !passwordlessEnabled;
+
+ // Focus password input when lock activates (only when password form is visible)
useEffect(() => {
- if (isLocked) {
+ if (isLocked && showPasswordForm) {
setPassword('');
- // Small delay to let the overlay render
const t = setTimeout(() => inputRef.current?.focus(), 100);
return () => clearTimeout(t);
}
- }, [isLocked]);
+ }, [isLocked, showPasswordForm]);
+
+ // Auto-trigger passkey unlock when passwordless mode is enabled
+ useEffect(() => {
+ if (isLocked && passwordlessEnabled && supportsWebAuthn && !isPasskeyUnlocking) {
+ handlePasskeyUnlock();
+ }
+ // eslint-disable-next-line react-hooks/exhaustive-deps
+ }, [isLocked, passwordlessEnabled]);
if (!isLocked) return null;
@@ -50,6 +67,29 @@ export default function LockOverlay() {
}
};
+ const handlePasskeyUnlock = async () => {
+ setIsPasskeyUnlocking(true);
+ try {
+ const { startAuthentication } = await import('@simplewebauthn/browser');
+ const { data: beginResp } = await api.post('/auth/passkeys/login/begin', {});
+ const credential = await startAuthentication(beginResp.options);
+ await api.post('/auth/passkeys/login/complete', {
+ credential: JSON.stringify(credential),
+ challenge_token: beginResp.challenge_token,
+ unlock: true,
+ });
+ unlockWithPasskey();
+ } catch (error) {
+ if (error instanceof Error && error.name === 'NotAllowedError') {
+ toast.error('Passkey not recognized');
+ } else if (error instanceof Error && error.name !== 'AbortError') {
+ toast.error(getErrorMessage(error, 'Unlock failed'));
+ }
+ } finally {
+ setIsPasskeyUnlocking(false);
+ }
+ };
+
const handleSwitchAccount = async () => {
await logout();
navigate('/login');
@@ -75,29 +115,87 @@ export default function LockOverlay() {
)}