From 6a4c8c1a9424420369ec1560da1c26db7fbff4e4 Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sun, 18 Oct 2026 16:55:33 -0700
Subject: Completely overhaul the auth again

Now we're all in on passkeys (ooh fancy)
---
 templates/register/register-success.html.template | 28 ++++++++++
 templates/register/register.html.template         | 62 +++++++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 templates/register/register-success.html.template
 create mode 100644 templates/register/register.html.template

(limited to 'templates/register')

diff --git a/templates/register/register-success.html.template b/templates/register/register-success.html.template
new file mode 100644
index 0000000..847f97a
--- /dev/null
+++ b/templates/register/register-success.html.template
@@ -0,0 +1,28 @@
+<!-- Copyright 2026 Rose Hogenson <r@roseh.moe>
+  --
+  -- This file is part of roseh.moe.
+  --
+  -- roseh.moe is free software: you can redistribute it and/or modify
+  -- it under the terms of the GNU Affero General Public License
+  -- as published by the Free Software Foundation, either version 3 of
+  -- the License, or (at your option) any later version.
+  --
+  -- roseh.moe is distributed in the hope that it will be useful,
+  -- but WITHOUT ANY WARRANTY; without even the implied warranty
+  -- of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+  -- GNU Affero General Public License for more details.
+  --
+  -- You should have received a copy of the GNU Affero General Public
+  -- License along with roseh.moe. If not, see
+  -- <https://www.gnu.org/licenses/>.
+  -->
+
+<title>Registered</title>
+
+<section>
+	<h1>Registered!</h1>
+	<p>A device key has been generated, but it must be authorized on
+	the server:</p>
+	<pre>	&lt;Passkey ID="{{.ID | xmlEscape}}"
+	         Key="{{.Key | xmlEscape}}"/&gt;</pre>
+</section>
diff --git a/templates/register/register.html.template b/templates/register/register.html.template
new file mode 100644
index 0000000..3b4d959
--- /dev/null
+++ b/templates/register/register.html.template
@@ -0,0 +1,62 @@
+<!-- Copyright 2026 Rose Hogenson <r@roseh.moe>
+  --
+  -- This file is part of roseh.moe.
+  --
+  -- roseh.moe is free software: you can redistribute it and/or modify
+  -- it under the terms of the GNU Affero General Public License
+  -- as published by the Free Software Foundation, either version 3 of
+  -- the License, or (at your option) any later version.
+  --
+  -- roseh.moe is distributed in the hope that it will be useful,
+  -- but WITHOUT ANY WARRANTY; without even the implied warranty
+  -- of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+  -- GNU Affero General Public License for more details.
+  --
+  -- You should have received a copy of the GNU Affero General Public
+  -- License along with roseh.moe. If not, see
+  -- <https://www.gnu.org/licenses/>.
+  -->
+
+<title>Register</title>
+
+<section>
+	<form id="form" class="password-form" method="post">
+		<input id="id" type="hidden" name="id" value="{{.ID}}">
+		<input id="key" type="hidden" name="key">
+		<table>
+			<tr class="password-form-row">
+				<td><label class="password-label" for="name">Enter a name for this passkey</label>
+				<td><input id="name" class="password" name="name">
+			<tr>
+				<td>
+				<td>
+					<img width="100" height="71" class="submit" src="/static/point.webp" alt="Submit"
+							onClick="generateKey()">
+		</table>
+	</form>
+</section>
+
+<script>
+async function generateKey() {
+	const name = document.getElementById("name").value;
+	const publicKeyCredential = await navigator.credentials.create({publicKey: {
+		challenge: Uint8Array.fromBase64("{{.Challenge}}").buffer,
+		pubKeyCredParams: [
+			{alg: -9,   type: "public-key"},
+			{alg: -257, type: "public-key"},
+			{alg: -7,   type: "public-key"},
+			{alg: -8,   type: "public-key"},
+		],
+		rp: {
+			name: "roseh.moe",
+		},
+		user: {
+			displayName: name,
+			id: Uint8Array.fromBase64(document.getElementById("id").value).buffer,
+			name: name,
+		},
+	}});
+	document.getElementById("key").value = new Uint8Array(publicKeyCredential.response.getPublicKey()).toBase64();
+	document.getElementById("form").submit();
+}
+</script>
-- 
cgit v1.3.1