Passkey: 账户设置绑定 + 免密登录(WebAuthn)

- 引入 go-webauthn, Passkey 表存凭据, challenge 会话内存存储(带过期)
- API: /webauthn/register|login begin/complete, /webauthn/passkeys 列表/删除
- 配置 OT_WEBAUTHN_RP_ID/RP_ORIGIN/RP_NAME;登录成功发 JWT+refresh cookie
- 前端 lib/webauthn(编解码+凭据序列化+安全上下文检测), 账户设置绑定区, 登录页免密按钮
- 需 HTTPS 或 localhost(安全上下文)

Co-Authored-By: Claude <noreply@anthropic.com>

web/src/lib/webauthn.ts

@@ -0,0 +1,76 @@
+// WebAuthn（passkey）浏览器侧工具：选项编解码 + 凭据序列化。
+// go-webauthn 返回的 challenge/id 为 base64url 字符串，浏览器需要 ArrayBuffer；
+// 回调的 credential 需要把 ArrayBuffer 字段转回 base64url。
+
+export function bufToB64url(buf: ArrayBuffer): string {
+  const bytes = new Uint8Array(buf)
+  let s = ''
+  for (const b of bytes) s += String.fromCharCode(b)
+  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '')
+}
+
+export function b64urlToBuf(s: string): ArrayBuffer {
+  const t = s.replace(/-/g, '+').replace(/_/g, '/')
+  const pad = t.length % 4 === 0 ? '' : '='.repeat(4 - (t.length % 4))
+  const bin = atob(t + pad)
+  const bytes = new Uint8Array(bin.length)
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i)
+  return bytes.buffer
+}
+
+interface CredentialId {
+  type?: string
+  id: string
+}
+
+function prepareIds(list?: CredentialId[]): { type?: string; id: ArrayBuffer }[] | undefined {
+  if (!list) return undefined
+  return list.map((c) => ({ ...c, id: b64urlToBuf(c.id) }))
+}
+
+// registerPasskey 调用 navigator.credentials.create，返回可提交后端的 JSON。
+export async function registerPasskey(options: Record<string, any>): Promise<Record<string, any>> {
+  const pk: Record<string, any> = { ...options.publicKey }
+  pk.challenge = b64urlToBuf(pk.challenge)
+  if (pk.user?.id) pk.user = { ...pk.user, id: b64urlToBuf(pk.user.id) }
+  pk.excludeCredentials = prepareIds(pk.excludeCredentials)
+
+  const cred = (await navigator.credentials.create({ publicKey: pk as PublicKeyCredentialCreationOptions })) as PublicKeyCredential
+  const resp = cred.response as AuthenticatorAttestationResponse
+  return {
+    id: cred.id,
+    rawId: bufToB64url(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: bufToB64url(resp.clientDataJSON),
+      attestationObject: bufToB64url(resp.attestationObject),
+      transports: (resp as unknown as { getTransports?: () => string[] }).getTransports?.() ?? [],
+    },
+  }
+}
+
+// loginPasskey 调用 navigator.credentials.get，返回可提交后端的 JSON。
+export async function loginPasskey(options: Record<string, any>): Promise<Record<string, any>> {
+  const pk: Record<string, any> = { ...options.publicKey }
+  pk.challenge = b64urlToBuf(pk.challenge)
+  pk.allowCredentials = prepareIds(pk.allowCredentials)
+
+  const cred = (await navigator.credentials.get({ publicKey: pk as PublicKeyCredentialRequestOptions })) as PublicKeyCredential
+  const resp = cred.response as AuthenticatorAssertionResponse
+  return {
+    id: cred.id,
+    rawId: bufToB64url(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: bufToB64url(resp.clientDataJSON),
+      authenticatorData: bufToB64url(resp.authenticatorData),
+      signature: bufToB64url(resp.signature),
+      userHandle: resp.userHandle ? bufToB64url(resp.userHandle) : null,
+    },
+  }
+}
+
+// isWebAuthnSupported 是否处于安全上下文（passkey 需要 HTTPS 或 localhost）。
+export function isWebAuthnSupported(): boolean {
+  return typeof navigator !== 'undefined' && !!navigator.credentials && window.isSecureContext
+}