Add passkey authentication support

[NicoM77]

No description provided.

[Copilot]

Pull request overview

Adds passkey (WebAuthn) authentication support to the existing Better Auth–based auth system, including database persistence and UI surfaces for managing credentials.

Changes:

• Add @better-auth/passkey dependency and wire passkey plugins into server (betterAuth) and client (createAuthClient).
• Introduce Drizzle schema + migration for a new passkey table and relations to usersTable.
• Add Settings UI for listing/adding/renaming/deleting passkeys and enable passkey autofill sign-in on the login page.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
package.json	Adds passkey package dependency.
bun.lock	Locks passkey + transitive deps and bumps Better Auth core version.
app/server/lib/auth.ts	Enables the Better Auth passkey plugin with RP config derived from BASE_URL.
app/server/db/schema.ts	Adds passkey table schema.
app/server/db/relations.ts	Adds user↔passkey relations.
app/drizzle/20260428161759_productive_namor/snapshot.json	Captures updated schema snapshot including passkey table.
app/drizzle/20260428161759_productive_namor/migration.sql	Creates passkey table and indexes.
app/client/modules/settings/routes/settings.tsx	Adds Passkeys section to Settings page.
app/client/modules/settings/components/passkeys-section.tsx	New UI for passkey CRUD operations.
app/client/modules/auth/routes/login.tsx	Attempts conditional WebAuthn autofill sign-in on login.
app/client/lib/auth-client.ts	Registers passkey client plugin.

[Copilot]

credential_id is indexed but not unique. Since credential IDs are expected to be unique in WebAuthn, add a UNIQUE constraint/index here to prevent duplicates and ambiguous credential lookups.

Suggested change

	CREATE INDEX `passkey_credentialID_idx` ON `passkey` (`credential_id`);
	CREATE UNIQUE INDEX `passkey_credentialID_idx` ON `passkey` (`credential_id`);

[Copilot]

handleRename doesn’t guard the authClient.$fetch call with try/finally (or try/catch). If the request throws (network error, non-JSON response, etc.), isRenaming will remain true and the dialog will be stuck in a loading state. Wrap the request in try/finally and ensure setIsRenaming(false) runs even on exceptions (and optionally surface a toast).

Suggested change

	const { error } = await authClient.$fetch("/passkey/update-passkey", {
	method: "POST",
	body: { id: renameTarget.id, name },
	});
	setIsRenaming(false);
	if (error) {
	logger.error(error);
	toast.error("Failed to rename passkey", { description: error.message });
	return;
	}
	toast.success("Passkey renamed");
	setRenameTarget(null);
	setRenameValue("");
	await refetch();
	try {
	const { error } = await authClient.$fetch("/passkey/update-passkey", {
	method: "POST",
	body: { id: renameTarget.id, name },
	});
	if (error) {
	logger.error(error);
	toast.error("Failed to rename passkey", { description: error.message });
	return;
	}
	toast.success("Passkey renamed");
	setRenameTarget(null);
	setRenameValue("");
	await refetch();
	} catch (err) {
	logger.error(err);
	toast.error("Failed to rename passkey", {
	description: err instanceof Error ? err.message : "Unknown error",
	});
	} finally {
	setIsRenaming(false);
	}

[Copilot]

Manual refetch() here is doing explicit invalidation on the client. The repo relies on automatic invalidation after mutations (AGENTS.md:64-67). Prefer using the standard mutation pattern so the list refreshes automatically without calling refetch().

[Copilot]

The rename action button is icon-only, but it doesn’t provide an accessible label. Add an aria-label (and optionally a tooltip/title) so screen readers can announce what the control does.

[Copilot]

The delete action button is icon-only and currently has no accessible label. Add an aria-label (and optionally a tooltip/title) to make the action discoverable to assistive technologies.

[Copilot]

handleDelete has the same issue as rename: if authClient.$fetch throws, isDeleting never gets reset and the confirmation dialog remains disabled. Use try/finally (and/or try/catch) around the request so state is always restored.

Suggested change

	const { error } = await authClient.$fetch("/passkey/delete-passkey", {
	method: "POST",
	body: { id: deleteTarget.id },
	});
	setIsDeleting(false);
	if (error) {
	logger.error(error);
	toast.error("Failed to delete passkey", { description: error.message });
	return;
	}
	toast.success("Passkey deleted");
	setDeleteTarget(null);
	await refetch();
	try {
	const { error } = await authClient.$fetch("/passkey/delete-passkey", {
	method: "POST",
	body: { id: deleteTarget.id },
	});
	if (error) {
	logger.error(error);
	toast.error("Failed to delete passkey", { description: error.message });
	return;
	}
	toast.success("Passkey deleted");
	setDeleteTarget(null);
	await refetch();
	} catch (err) {
	logger.error(err);
	toast.error("Failed to delete passkey", {
	description: err instanceof Error ? err.message : "Unknown error",
	});
	} finally {
	setIsDeleting(false);
	}

[Copilot]

This manual refetch() is implementing client-side invalidation logic. Per repo guidance, invalidation is handled automatically after mutations (see AGENTS.md:64-67). Prefer using the existing mutation/invalidation pattern (e.g., a typed passkey mutation hook/client method that triggers the automatic invalidation) instead of explicitly refetching here.

[Copilot]

Manual refetch() here adds client-side invalidation logic. The repo’s convention is to rely on the automatic invalidation setup after mutations (AGENTS.md:64-67). Consider switching this rename flow to the standard mutation path so the cache updates without explicit refetching.

[Copilot]

credentialID is not constrained to be unique. WebAuthn credential IDs should be globally unique; allowing duplicates can cause ambiguous lookups during assertion and potentially authenticate the wrong account if duplicates ever occur. Add a uniqueness constraint (e.g., unique index on credentialID, or on (userId, credentialID) depending on the expected model) and reflect it in the generated migration.