<?php

// Manage the passkeys that can sign in to this site. Registration happens in

// the browser against passkey-api.php; this page is the list and the delete.

require_once __DIR__ . '/inc/webauthn.php';

require_once __DIR__ . '/inc/layout.php';

header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');

header('Pragma: no-cache');

header('Expires: 0');

cache_buster_redirect();

require_login();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    check_csrf();

    if (($_POST['action'] ?? '') === 'delete') {

        $st = db()->prepare('SELECT label FROM passkeys WHERE id = ?');

        $st->execute([(int)($_POST['id'] ?? 0)]);

        $label = $st->fetchColumn();

        if ($label !== false) {

            backup_db();

            db()->prepare('DELETE FROM passkeys WHERE id = ?')->execute([(int)$_POST['id']]);

            flash('Removed the passkey "' . $label . '".');

        }

    }

    header('Location: passkeys.php');

    exit;

}

$rp = webauthn_rp_id();

// Passkeys are bound to the host they were created on, so one made on

// localhost cannot sign in to the live domain. Listing the other hosts'

// keys separately explains why they are not usable here rather than

// hiding them and looking like they were lost.

$mine = db()->prepare('SELECT * FROM passkeys WHERE rp_id = ? ORDER BY id DESC');

$mine->execute([$rp]);

$mine = $mine->fetchAll();

$others = db()->prepare('SELECT rp_id, COUNT(*) n FROM passkeys WHERE rp_id <> ? GROUP BY rp_id ORDER BY rp_id');

$others->execute([$rp]);

$others = $others->fetchAll();

page_header('Passkeys');

?>

<h1>Passkeys</h1>

<p class="muted">

  A passkey signs you in with your device’s fingerprint, face, or screen lock instead of the password.

  The password keeps working — keep it somewhere safe as the way back in if you lose your devices.

</p>

<?php if (!webauthn_available()): ?>

<p class="error">

  Passkeys need a secure connection. This page was loaded over plain HTTP from

  <strong><?= e($rp) ?></strong>, so the browser will not allow them here. Load the site over HTTPS

  (or via <code>localhost</code>) and this page will work.

</p>

<?php else: ?>

<script type="application/json" id="pkCfg"><?= json_encode(['csrf' => csrf_token()], JSON_HEX_TAG | JSON_HEX_AMP) ?></script>

<label for="pkLabel">Name this device (optional)</label>

<input id="pkLabel" maxlength="60" placeholder="iPhone, work laptop…">

<div class="actions">

  <button type="button" id="pkAdd">Add a passkey</button>

  <a class="btn secondary" href="index.php">Done</a>

</div>

<p class="muted" id="pkMsg">Passkeys added here work on <strong><?= e($rp) ?></strong>.</p>

<?php endif; ?>

<?php if ($mine): ?>

<h1>Registered</h1>

<?php foreach ($mine as $k): ?>

<div class="card row">

  <div class="grow">

    <strong><?= e((string)$k['label']) ?></strong>

    <div class="muted">

      Added <?= e(substr((string)$k['created_at'], 0, 10)) ?> ·

      <?= $k['last_used_at'] ? e(rel_time($k['last_used_at'])) : 'never used' ?>

    </div>

  </div>

  <div class="rowlinks">

    <form method="post" onsubmit="return confirm('Remove this passkey? That device will no longer be able to sign in.')">

      <?= csrf_field() ?>

      <input type="hidden" name="action" value="delete">

      <input type="hidden" name="id" value="<?= (int)$k['id'] ?>">

      <button class="danger btn-sm">Remove</button>

    </form>

  </div>

</div>

<?php endforeach; ?>

<?php else: ?>

<p class="muted">No passkeys registered for <?= e($rp) ?> yet.</p>

<?php endif; ?>

<?php if ($others): ?>

<p class="muted">

  You also have passkeys registered for

  <?php $bits = [];

  foreach ($others as $o) {

      $bits[] = $o['n'] . ' on ' . $o['rp_id'];

  }

  echo e(implode(', ', $bits)); ?>.

  Those only work when you visit the site at that address.

</p>

<?php endif; ?>

<?php

page_footer(['assets/passkey.js']);