Add WebAuthn credential registration

.air.toml

@@ -5,7 +5,7 @@ tmp_dir = "tmp"
 [build]
   args_bin = []
   bin = "./tmp/main"
-  cmd = "swag init && go build -o ./tmp/main ."
+  cmd = "swag init --parseDependency && go build -o ./tmp/main ."
   delay = 1000
   exclude_dir = ["assets", "tmp", "vendor", "testdata", "docs", "misc"]
   exclude_file = []

.env.example

@@ -11,3 +11,4 @@ OPAQUE_PUBLIC_KEY=98584585210c1f310e9d0aeb9ac1384b7d51808cfaf21b17b5e3dc8d35dbfb
 PASSWORD_AUTH_ENABLED=true
 DEV_ENDPOINTS_ENABLED=true
 ENVIRONMENT=development
+WEBAUTHN_ORIGINS=http://localhost:8081

.github/workflows/checks.yaml

@@ -31,13 +31,13 @@ jobs:
       with:
         go-version: '1.25'
     - name: Generate swagger
-      run: go install github.com/swaggo/swag/cmd/swag@latest && swag init
+      run: go install github.com/swaggo/swag/cmd/swag@latest && swag init --parseDependency
     - name: Install dependencies
       run: go get .
     - name: Lint
       uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa # v7.0.1
       with:
-        version: v2.0
+        version: latest
         args: --timeout=10m
     - name: Test
       run: go test -p 1 -v ./...

Makefile

@@ -7,7 +7,7 @@ clear-emails:
 
 # Run `go install github.com/swaggo/swag/cmd/swag@latest` to use this
 update-swagger:
-	swag init
+	swag init --parseDependency
 
 # Only works if EMAIL_AUTH_ENABLED is set to true
 get-email-auth-token:
@@ -23,14 +23,12 @@ get-email-auth-token:
 lint:
 	golangci-lint run
 
-run:
+run: update-swagger
 	docker compose up -d postgres localstack
-	swag init
 	go run .
 
-test:
+test: update-swagger
 	docker compose up -d postgres localstack
-	swag init
 	go test -p 1 -v ./...
 
 # Run `go install github.com/air-verse/air@latest` to use this

README.md

@@ -45,5 +45,9 @@ View API documentation at http://localhost:8080/swagger/index.html.
 | KEY_SERVICE_URL | No | Use the key service for deriving OPRF seeds and signing JWTs |
 | KEY_SERVICE_SECRET | No | Secret to use for key service requests |
 | KEY_SERVICE_DATABASE_URL | No | PostgreSQL database connection URL for key service |
+| TWOFA_ISSUER | No | Issuer name for TOTP 2FA (default: "Brave Account") |
+| TOTP_QR_SIZE | No | Size in pixels for TOTP QR codes (default: 256) |
+| WEBAUTHN_RP_ID | No | WebAuthn Relying Party ID (default: domain extracted from BASE_URL) |
+| WEBAUTHN_ORIGINS | No | Comma-separated list of allowed WebAuthn origins (default: BASE_URL) |
 | TEST_DATABASE_URL | No | Database URL to use for tests |
 | TEST_KEY_SERVICE_DATABASE_URL | No | Database URL to use for tests involving the key service |