vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Offer passkeys through conditional UI and require discoverable credentials

ad79b7abded893d0771eaf80de555a1236f17474 · Keenan Nemetz · 3d ago · parent 25343521

Offer passkeys through conditional UI and require discoverable credentials

Start a usernameless ceremony when the login page advertises conditional
mediation, so the browser can offer a saved passkey in the account field. The
assertion resolves the account from the credential id and user handle;
username-first sign-in stays for browsers without autofill and for passkeys
created before discoverable credentials were required.

Register each new passkey with residentKey required, and record the autofill
flow and fallback in the account documentation.

Refs #213 (01M6SAK9STFGJ7PECY7ET8277N).

docs/accounts-and-access.md +8

@@ -152,6 +152,14 @@ WebAuthn ceremony without a canonical secure origin.
	152	152	4. From Account, the person can register another passkey, add or remove SSH
	153	153	keys, or review their sessions.
	154	154
		155	The account field opts into WebAuthn conditional UI (`autocomplete="username
		156	webauthn"`), so a supporting browser can offer a saved passkey while the field is
		157	focused. The username-first form remains for browsers without autofill and for a
		158	passkey created before discoverable credentials were required. New passkeys are
		159	registered as discoverable credentials (resident keys) and require user
		160	verification; that is what lets the browser find one without being told which
		161	account it belongs to.
		162
	155	163	A link is single-use and expires. Issuing a new link invalidates the previous
	156	164	one. If the person loses every passkey, an instance admin issues a new link; there
	157	165	is no password reset to phish. Retiring an account deletes its sessions