From 6a4c8c1a9424420369ec1560da1c26db7fbff4e4 Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sun, 18 Oct 2026 16:55:33 -0700
Subject: Completely overhaul the auth again

Now we're all in on passkeys (ooh fancy)
---
 templates/login.html.template | 46 +++++++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

(limited to 'templates/login.html.template')

diff --git a/templates/login.html.template b/templates/login.html.template
index 279927b..ae0874a 100644
--- a/templates/login.html.template
+++ b/templates/login.html.template
@@ -17,25 +17,29 @@
   -- <https://www.gnu.org/licenses/>.
   -->
 
-<title>Login</title>
+<!doctype html>
 
-<section>
-{{- if .Error}}
-	<p class="login-error"><img class="inline" width="150" height="163" src="/static/angry.webp">Incorrect password
-{{- end}}
-	<form class="password-form" method="post">
-		<table>
-		{{- if not .Quick}}
-			<tr class="password-form-row">
-				<td><label class="password-label" for="password">Enter password</label>
-				<td><input id="password" class="password" type="password" name="password" autofocus>
-		{{- end}}
-			<tr class="password-form-row">
-				<td><label class="password-label" for="auth">Google authenticator code</label>
-				<td><input id="auth" class="password" name="auth">
-			<tr>
-				<td>
-				<td><input type="image" width="100" height="71" class="submit" src="/static/point.webp" alt="Submit">
-		</table>
-	</form>
-</section>
+<form id="form" method="post">
+	<input id="user"        type="hidden" name="user">
+	<input id="auth-data"   type="hidden" name="auth-data">
+	<input id="client-data" type="hidden" name="client-data">
+	<input id="sig"         type="hidden" name="sig">
+</form>
+
+<script>
+async function main() {
+	const publicKeyCredential = await navigator.credentials.get({publicKey: {
+		challenge: Uint8Array.fromBase64("{{.Challenge}}").buffer,
+	}});
+	const rsp = publicKeyCredential.response;
+	document.getElementById("user").value = new Uint8Array(rsp.userHandle).toBase64();
+	document.getElementById("auth-data").value = new Uint8Array(rsp.authenticatorData).toBase64();
+	document.getElementById("client-data").value = new Uint8Array(rsp.clientDataJSON).toBase64();
+	document.getElementById("sig").value = new Uint8Array(rsp.signature).toBase64();
+	document.getElementById("form").submit();
+}
+
+main();
+</script>
+
+This page requires JavaScript™ to be enabled
-- 
cgit v1.3.1