Passkeys as an optional sign-in method

[pataniaeli]

Ticket: AUTH-T105 · Epic: E3 Authentication Core · Phase: Phase 4 — Aplio, SenatePath, retention
Priority: Medium · Estimate: 5 points · Labels: epic:auth-core, phase:4, backend, frontend, security, better-auth

Depends on:

• Email + password sign-in and self-sign-up restricted to northeastern.edu #29 — AUTH-T17 Email + password sign-in and self-sign-up restricted to northeastern.edu
• Re-authentication (sudo mode) for sensitive actions #44 — AUTH-T32 Re-authentication (sudo mode) for sensitive actions
• Account security page: change password, MFA enrollment, backup codes #66 — AUTH-T54 Account security page: change password, MFA enrollment, backup codes
• TOTP multi-factor authentication (optional for users, required for admins and the Primary Admin) #79 — AUTH-T67 TOTP multi-factor authentication (optional for users, required for admins and the Primary Admin)

Suggested by Benedikt and accepted: add the Better Auth passkey plugin (WebAuthn) as an optional, per-user sign-in method. Passkeys cost no email, resist phishing, and suit students who prefer not to manage passwords.

• Enrollment from /account/security after fresh re-auth (AUTH-T32); users may register several passkeys and name/remove them. Relying-party ID is auth.northeasternsga.com (dev: auth-dev.northeasternsga.com), so passkeys are only usable on SGAuth's own login page; products never see WebAuthn.
• Sign-in: the login page offers 'Sign in with a passkey' alongside email + password, including conditional UI (browser autofill) where supported. A successful passkey sign-in creates the same parent-domain session as a password sign-in.
• Password stays as the account's fallback and for recovery; passkeys do not replace the password in v1.
• MFA: a passkey does not satisfy the admin TOTP requirement in v1 (admins still enroll TOTP); revisit later.
• Lockout counters (AUTH-T64) are unaffected by passkey attempts; failed WebAuthn ceremonies are rate-limited (AUTH-T63).
• Schema: plugin's Passkey table via Prisma; audit PASSKEY_ADDED / PASSKEY_REMOVED / LOGIN_SUCCESS with method=passkey.
• Tombstoning (AUTH-T78) and admin deactivation remove passkeys.

Acceptance criteria

• A user can enroll a passkey after re-auth, sign out, and sign back in with the passkey in Chrome, Safari, and Firefox (platform authenticator and a security key).
• A passkey sign-in yields a session that products resolve exactly like a password sign-in (session endpoint contract test).
• Removing a passkey or deactivating the user prevents its further use; audit events are emitted.
• An admin who signs in with a passkey is still required to have TOTP enrolled for admin actions.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}