+ What's a passkey?
+ A passwordless login using your device's biometrics (fingerprint, face) or security key. More secure than
+ passwords, no typing required.
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/index.ts b/src/index.ts
new file mode 100644
index 0000000..3117c44
--- /dev/null
+++ b/src/index.ts
@@ -0,0 +1,56 @@
+import { env } from "bun";
+import { db } from "./db";
+import indexHTML from "./html/index.html";
+import loginHTML from "./html/login.html";
+import { canRegister, registerOptions, registerVerify, loginOptions, loginVerify } from "./routes/auth";
+import { hello } from "./routes/api";
+
+(() => {
+ const required = ["ORIGIN", "RP_ID"];
+
+ const missing = required.filter((key) => !process.env[key]);
+
+ if (missing.length > 0) {
+ console.warn(
+ `[Startup] Missing required envivonment variables: ${missing.join(", ")}`,
+ );
+ process.exit(1);
+ }
+})();
+
+const server = Bun.serve({
+ port: env.PORT ? Number.parseInt(env.PORT, 10) : 3000,
+ routes: {
+ "/": indexHTML,
+ "/login": loginHTML,
+ // API endpoints
+ "/api/hello": hello,
+ "/auth/can-register": canRegister,
+ "/auth/register/options": registerOptions,
+ "/auth/register/verify": registerVerify,
+ "/auth/login/options": loginOptions,
+ "/auth/login/verify": loginVerify,
+ },
+ development: process.env.NODE_ENV === "dev",
+});
+
+console.log("[Indiko] running on", env.ORIGIN);
+
+let is_shutting_down = false;
+function shutdown(sig: string) {
+ if (is_shutting_down) return;
+ is_shutting_down = true;
+
+ console.log(`[Shutdown] triggering shutdown due to ${sig}`);
+
+ server.stop();
+ console.log("[Shutdown] stopped server");
+
+ db.close();
+ console.log("[Shutdown] closed db");
+
+ process.exit(0);
+}
+
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+process.on("SIGINT", () => shutdown("SIGINT"));
diff --git a/src/migrations/001_init.sql b/src/migrations/001_init.sql
new file mode 100644
index 0000000..33a2c73
--- /dev/null
+++ b/src/migrations/001_init.sql
@@ -0,0 +1,58 @@
+-- Full schema for indiko
+CREATE TABLE IF NOT EXISTS users (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ username TEXT NOT NULL UNIQUE,
+ name TEXT NOT NULL,
+ email TEXT,
+ photo TEXT,
+ url TEXT,
+ is_admin INTEGER NOT NULL DEFAULT 0,
+ created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+);
+
+CREATE TABLE IF NOT EXISTS credentials (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id INTEGER NOT NULL,
+ credential_id BLOB NOT NULL UNIQUE,
+ public_key BLOB NOT NULL,
+ counter INTEGER NOT NULL DEFAULT 0,
+ created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+ FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ token TEXT NOT NULL UNIQUE,
+ user_id INTEGER NOT NULL,
+ expires_at INTEGER NOT NULL,
+ created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+ FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS challenges (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ challenge TEXT NOT NULL UNIQUE,
+ username TEXT NOT NULL,
+ type TEXT NOT NULL CHECK(type IN ('registration', 'authentication')),
+ expires_at INTEGER NOT NULL,
+ created_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+);
+
+CREATE TABLE IF NOT EXISTS invites (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ code TEXT NOT NULL UNIQUE,
+ created_by INTEGER NOT NULL,
+ used INTEGER NOT NULL DEFAULT 0,
+ used_by INTEGER,
+ used_at INTEGER,
+ created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+ FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE CASCADE,
+ FOREIGN KEY (used_by) REFERENCES users(id) ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
+CREATE INDEX IF NOT EXISTS idx_challenges_challenge ON challenges(challenge);
+CREATE INDEX IF NOT EXISTS idx_challenges_expires_at ON challenges(expires_at);
+CREATE INDEX IF NOT EXISTS idx_credentials_user_id ON credentials(user_id);
+CREATE INDEX IF NOT EXISTS idx_invites_code ON invites(code);
diff --git a/src/routes/api.ts b/src/routes/api.ts
new file mode 100644
index 0000000..aabb8b3
--- /dev/null
+++ b/src/routes/api.ts
@@ -0,0 +1,38 @@
+import { db } from "../db";
+
+export function hello(req: Request): Response {
+ const authHeader = req.headers.get("Authorization");
+
+ if (!authHeader || !authHeader.startsWith("Bearer ")) {
+ return Response.json({ error: "Unauthorized" }, { status: 401 });
+ }
+
+ const token = authHeader.substring(7);
+
+ // Look up session
+ const session = db
+ .query(
+ `SELECT s.expires_at, u.username, u.is_admin
+ FROM sessions s
+ JOIN users u ON s.user_id = u.id
+ WHERE s.token = ?`,
+ )
+ .get(token) as
+ | { expires_at: number; username: string; is_admin: number }
+ | undefined;
+
+ if (!session) {
+ return Response.json({ error: "Invalid session" }, { status: 401 });
+ }
+
+ const now = Math.floor(Date.now() / 1000);
+ if (session.expires_at < now) {
+ return Response.json({ error: "Session expired" }, { status: 401 });
+ }
+
+ return Response.json({
+ message: `Hello ${session.username}! You're authenticated with passkeys.`,
+ username: session.username,
+ isAdmin: session.is_admin === 1,
+ });
+}
diff --git a/src/routes/auth.ts b/src/routes/auth.ts
new file mode 100644
index 0000000..daa4693
--- /dev/null
+++ b/src/routes/auth.ts
@@ -0,0 +1,390 @@
+import { db } from "../db";
+import {
+ generateRegistrationOptions,
+ verifyRegistrationResponse,
+ generateAuthenticationOptions,
+ verifyAuthenticationResponse,
+ type VerifiedRegistrationResponse,
+ type VerifiedAuthenticationResponse,
+ type PublicKeyCredentialCreationOptionsJSON,
+ type RegistrationResponseJSON,
+ type PublicKeyCredentialRequestOptionsJSON,
+ type AuthenticationResponseJSON,
+} from "@simplewebauthn/server";
+
+const RP_NAME = "Indiko";
+
+export function canRegister(req: Request): Response {
+ const userCount = db
+ .query("SELECT COUNT(*) as count FROM users")
+ .get() as { count: number };
+
+ return Response.json({
+ canRegister: userCount.count === 0,
+ bootstrapMode: userCount.count === 0,
+ });
+}
+
+export async function registerOptions(req: Request): Promise {
+ try {
+ const body = await req.json();
+ const { username } = body;
+
+ if (!username || typeof username !== "string") {
+ return Response.json({ error: "Username required" }, { status: 400 });
+ }
+
+ // Check if username already exists
+ const existingUser = db
+ .query("SELECT id FROM users WHERE username = ?")
+ .get(username);
+
+ if (existingUser) {
+ return Response.json(
+ { error: "Username already taken" },
+ { status: 400 },
+ );
+ }
+
+ // Check if this is bootstrap (first user)
+ const userCount = db
+ .query("SELECT COUNT(*) as count FROM users")
+ .get() as { count: number };
+
+ const isBootstrap = userCount.count === 0;
+
+ if (!isBootstrap) {
+ return Response.json({ error: "Registration closed" }, { status: 403 });
+ }
+
+ // Generate WebAuthn registration options
+ const options: PublicKeyCredentialCreationOptionsJSON =
+ await generateRegistrationOptions({
+ rpName: RP_NAME,
+ rpID: process.env.RP_ID!,
+ userName: username,
+ userDisplayName: username,
+ attestationType: "none",
+ authenticatorSelection: {
+ residentKey: "required",
+ userVerification: "required",
+ authenticatorAttachment: "platform",
+ },
+ });
+
+ // Store challenge
+ const expiresAt = Math.floor(Date.now() / 1000) + 300; // 5 minutes
+ db.query(
+ "INSERT INTO challenges (challenge, username, type, expires_at) VALUES (?, ?, 'registration', ?)",
+ ).run(options.challenge, username, expiresAt);
+
+ return Response.json(options);
+ } catch (error) {
+ console.error("Registration options error:", error);
+ return Response.json({ error: "Internal server error" }, { status: 500 });
+ }
+}
+
+export async function registerVerify(req: Request): Promise {
+ try {
+ const body = await req.json();
+ const { username, response, challenge: expectedChallenge } = body as {
+ username: string;
+ response: RegistrationResponseJSON;
+ challenge?: string;
+ };
+
+ if (!username || !response) {
+ return Response.json(
+ { error: "Username and response required" },
+ { status: 400 },
+ );
+ }
+
+ // Check if username already exists
+ const existingUser = db
+ .query("SELECT id FROM users WHERE username = ?")
+ .get(username);
+
+ if (existingUser) {
+ return Response.json(
+ { error: "Username already taken" },
+ { status: 400 },
+ );
+ }
+
+ // Verify challenge exists and is valid
+ const challenge = db
+ .query(
+ "SELECT challenge, expires_at FROM challenges WHERE challenge = ? AND username = ? AND type = 'registration'",
+ )
+ .get(expectedChallenge, username) as
+ | { challenge: string; expires_at: number }
+ | undefined;
+
+ if (!challenge) {
+ return Response.json({ error: "Invalid challenge" }, { status: 400 });
+ }
+
+ const now = Math.floor(Date.now() / 1000);
+ if (challenge.expires_at < now) {
+ return Response.json({ error: "Challenge expired" }, { status: 400 });
+ }
+
+ // Check if this is bootstrap (first user)
+ const userCount = db
+ .query("SELECT COUNT(*) as count FROM users")
+ .get() as { count: number };
+
+ const isBootstrap = userCount.count === 0;
+
+ if (!isBootstrap) {
+ return Response.json({ error: "Registration closed" }, { status: 403 });
+ }
+
+ // Verify WebAuthn response
+ let verification: VerifiedRegistrationResponse;
+ try {
+ verification = await verifyRegistrationResponse({
+ response,
+ expectedChallenge: challenge.challenge,
+ expectedOrigin: process.env.ORIGIN!,
+ expectedRPID: process.env.RP_ID!,
+ });
+ } catch (error) {
+ console.error("WebAuthn verification failed:", error);
+ return Response.json(
+ { error: "Verification failed" },
+ { status: 400 },
+ );
+ }
+
+ if (!verification.verified || !verification.registrationInfo) {
+ return Response.json(
+ { error: "Verification failed" },
+ { status: 400 },
+ );
+ }
+
+ const { credential } = verification.registrationInfo;
+
+ // Create user (bootstrap is always admin)
+ const insertUser = db.query(
+ "INSERT INTO users (username, name, is_admin) VALUES (?, ?, 1) RETURNING id",
+ );
+ const user = insertUser.get(username, username) as {
+ id: number;
+ };
+
+ // Store credential
+ // credential.id is a Uint8Array, convert to Buffer for storage
+ db.query(
+ "INSERT INTO credentials (user_id, credential_id, public_key, counter) VALUES (?, ?, ?, ?)",
+ ).run(
+ user.id,
+ Buffer.from(credential.id),
+ Buffer.from(credential.publicKey),
+ credential.counter,
+ );
+
+ // Delete challenge
+ db.query("DELETE FROM challenges WHERE challenge = ?").run(
+ challenge.challenge,
+ );
+
+ // Create session
+ const token = crypto.randomUUID();
+ const expiresAt = Math.floor(Date.now() / 1000) + 86400; // 24 hours
+ db.query(
+ "INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)",
+ ).run(token, user.id, expiresAt);
+
+ return Response.json({
+ token,
+ username,
+ isAdmin: true,
+ });
+ } catch (error) {
+ console.error("Registration verify error:", error);
+ return Response.json({ error: "Internal server error" }, { status: 500 });
+ }
+}
+
+export async function loginOptions(req: Request): Promise {
+ try {
+ const body = await req.json();
+ const { username } = body;
+
+ if (!username || typeof username !== "string") {
+ return Response.json({ error: "Username required" }, { status: 400 });
+ }
+
+ // Check if user exists
+ const user = db
+ .query("SELECT id FROM users WHERE username = ?")
+ .get(username) as { id: number } | undefined;
+
+ if (!user) {
+ return Response.json({ error: "User not found" }, { status: 404 });
+ }
+
+ // Get user's credentials (just to verify they exist)
+ const credentials = db
+ .query("SELECT credential_id FROM credentials WHERE user_id = ?")
+ .all(user.id) as { credential_id: Buffer }[];
+
+ if (credentials.length === 0) {
+ return Response.json(
+ { error: "No credentials found" },
+ { status: 404 },
+ );
+ }
+
+ // Generate authentication options
+ // For discoverable credentials, omit allowCredentials to let password managers
+ // show all available passkeys for this RP ID
+ const options: PublicKeyCredentialRequestOptionsJSON =
+ await generateAuthenticationOptions({
+ rpID: process.env.RP_ID!,
+ userVerification: "required",
+ });
+
+ // Store challenge
+ const expiresAt = Math.floor(Date.now() / 1000) + 300; // 5 minutes
+ db.query(
+ "INSERT INTO challenges (challenge, username, type, expires_at) VALUES (?, ?, 'authentication', ?)",
+ ).run(options.challenge, username, expiresAt);
+
+ return Response.json(options);
+ } catch (error) {
+ console.error("Login options error:", error);
+ return Response.json({ error: "Internal server error" }, { status: 500 });
+ }
+}
+
+export async function loginVerify(req: Request): Promise {
+ try {
+ const body = await req.json();
+ const { username, response } = body as {
+ username: string;
+ response: AuthenticationResponseJSON;
+ };
+
+ if (!username || !response) {
+ return Response.json(
+ { error: "Username and response required" },
+ { status: 400 },
+ );
+ }
+
+ // Look up credential by ID
+ // Current database has credential_id stored as Buffer containing ASCII text of base64url string
+ // So we need to compare the string value, not decode it
+ const credentialIdString = response.id; // This is the base64url string like "rHvdOyMkR-6nxGBcDmtV4g"
+
+ const credentialWithUser = db
+ .query(
+ "SELECT c.credential_id, c.public_key, c.counter, c.user_id, u.username FROM credentials c JOIN users u ON c.user_id = u.id WHERE c.credential_id = ?",
+ )
+ .get(Buffer.from(credentialIdString)) as
+ | { credential_id: Buffer; public_key: Buffer; counter: number; user_id: number; username: string }
+ | undefined;
+
+ if (!credentialWithUser) {
+ return Response.json(
+ { error: "Credential not found" },
+ { status: 404 },
+ );
+ }
+
+ // Verify the username matches (if provided)
+ if (username && credentialWithUser.username !== username) {
+ return Response.json(
+ { error: "Credential does not belong to this user" },
+ { status: 403 },
+ );
+ }
+
+ const credential = {
+ credential_id: credentialWithUser.credential_id,
+ public_key: credentialWithUser.public_key,
+ counter: credentialWithUser.counter,
+ };
+ const user = { id: credentialWithUser.user_id };
+
+ // Verify challenge exists and is valid
+ // Use the discovered username from the credential
+ const challenge = db
+ .query(
+ "SELECT challenge, expires_at FROM challenges WHERE username = ? AND type = 'authentication' ORDER BY created_at DESC LIMIT 1",
+ )
+ .get(credentialWithUser.username) as
+ | { challenge: string; expires_at: number }
+ | undefined;
+
+ if (!challenge) {
+ return Response.json({ error: "Invalid challenge" }, { status: 400 });
+ }
+
+ const now = Math.floor(Date.now() / 1000);
+ if (challenge.expires_at < now) {
+ return Response.json({ error: "Challenge expired" }, { status: 400 });
+ }
+
+ // Verify authentication response
+ let verification: VerifiedAuthenticationResponse;
+ try {
+ verification = await verifyAuthenticationResponse({
+ response,
+ expectedChallenge: challenge.challenge,
+ expectedOrigin: process.env.ORIGIN!,
+ expectedRPID: process.env.RP_ID!,
+ credential: {
+ id: credential.credential_id,
+ publicKey: credential.public_key,
+ counter: credential.counter,
+ },
+ });
+ } catch (error) {
+ console.error("WebAuthn verification failed:", error);
+ return Response.json(
+ { error: "Verification failed" },
+ { status: 400 },
+ );
+ }
+
+ if (!verification.verified) {
+ return Response.json(
+ { error: "Verification failed" },
+ { status: 400 },
+ );
+ }
+
+ // Update credential counter
+ db.query("UPDATE credentials SET counter = ? WHERE user_id = ? AND credential_id = ?").run(
+ verification.authenticationInfo.newCounter,
+ user.id,
+ credential.credential_id,
+ );
+
+ // Delete challenge
+ db.query("DELETE FROM challenges WHERE challenge = ?").run(
+ challenge.challenge,
+ );
+
+ // Create session
+ const token = crypto.randomUUID();
+ const expiresAt = Math.floor(Date.now() / 1000) + 86400; // 24 hours
+ db.query(
+ "INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)",
+ ).run(token, user.id, expiresAt);
+
+ return Response.json({
+ token,
+ username,
+ });
+ } catch (error) {
+ console.error("Login verify error:", error);
+ return Response.json({ error: "Internal server error" }, { status: 500 });
+ }
+}
diff --git a/tsconfig.json b/tsconfig.json
new file mode 100644
index 0000000..1e1c5c9
--- /dev/null
+++ b/tsconfig.json
@@ -0,0 +1,33 @@
+{
+ "compilerOptions": {
+ // Environment setup & latest features
+ "lib": ["ESNext", "DOM", "DOM.Iterable"],
+ "target": "ESNext",
+ "module": "Preserve",
+ "moduleDetection": "force",
+ "jsx": "preserve",
+ "allowJs": true,
+
+ // Bundler mode
+ "moduleResolution": "bundler",
+ "allowImportingTsExtensions": true,
+ "verbatimModuleSyntax": true,
+ "noEmit": true,
+
+ // Decorators
+ "experimentalDecorators": true,
+ "useDefineForClassFields": false,
+
+ // Best practices
+ "strict": true,
+ "skipLibCheck": true,
+ "noFallthroughCasesInSwitch": true,
+ "noUncheckedIndexedAccess": true,
+ "noImplicitOverride": true,
+
+ // Some stricter flags (disabled by default)
+ "noUnusedLocals": false,
+ "noUnusedParameters": false,
+ "noPropertyAccessFromIndexSignature": false
+ }
+}
diff --git a/types/env.d.ts b/types/env.d.ts
new file mode 100644
index 0000000..77dd371
--- /dev/null
+++ b/types/env.d.ts
@@ -0,0 +1,8 @@
+declare module "bun" {
+ interface Env {
+ ORIGIN: string;
+ RP_ID: string;
+ NODE_ENV?: "dev" | "production";
+ PORT?: string;
+ }
+}
+