05/18 Enhanced codes and functionalities 5

app/config.py

@@ -11,6 +11,22 @@ _INSECURE_SECRET_DEFAULTS = {'dev-secret-change-me', 'jwt-secret-change-me', '',
 class BaseConfig:
     SECRET_KEY = os.environ.get('SECRET_KEY', 'dev-secret-change-me')
     JWT_SECRET_KEY = os.environ.get('JWT_SECRET_KEY', 'jwt-secret-change-me')
+
+    # WebAuthn / Passkey
+    # RP_ID must be the effective domain of the site (no scheme, no port).
+    # In development this is "localhost"; in production use your actual domain.
+    WEBAUTHN_RP_ID = os.environ.get('WEBAUTHN_RP_ID', 'localhost')
+    WEBAUTHN_RP_NAME = os.environ.get('WEBAUTHN_RP_NAME', 'PassKeeper')
+    # Allowed origins for WebAuthn ceremonies (comma-separated in env).
+    # Must include the full origin (scheme + host + optional port).
+    WEBAUTHN_ORIGINS = [
+        o.strip()
+        for o in os.environ.get(
+            'WEBAUTHN_ORIGINS',
+            'http://localhost:5000,https://localhost',
+        ).split(',')
+        if o.strip()
+    ]
     JWT_ACCESS_TOKEN_EXPIRES = timedelta(minutes=15)
     JWT_REFRESH_TOKEN_EXPIRES = timedelta(days=7)