05/18 Enhanced codes and functionalities 7

README.md

@@ -18,6 +18,7 @@ A self-hosted, zero-knowledge password manager — web app and Chrome/Firefox ex
 - **Security dashboard** — weak / reused / old / **no 2FA saved** / **HaveIBeenPwned breach check** (k-anonymity — passwords never transmitted)
 - **Import / Export** — encrypted JSON backup; CSV export (plaintext, handle carefully); import from Chrome, Bitwarden, and 1Password CSV formats (RFC 4180 compliant parser)
 - **Account MFA** — TOTP-based login (Google Authenticator / Authy); single-use code enforcement prevents replay attacks
+- **Passkeys / WebAuthn** — register device biometrics or hardware keys as a sign-in method; master password still required to unlock vault (zero-knowledge preserved); manage passkeys in Account Settings
 - **Master password change** — atomic zero-knowledge re-encryption of entire vault including item names
 - **Account recovery** — 128-bit recovery code; server never stores it; challenge-response proof prevents forgery
 - **Audit log** — server-side trail of all create/edit/delete/import/export actions; no plaintext names ever logged
@@ -76,6 +77,7 @@ Sharing:  ECDH(Alice_priv, Bob_pub) ──► sharedKey ──► AES-256-GCM(en
 - **folder_id ownership** — all create/update/import operations validate folder belongs to current user
 - **Audit log privacy** — item names and shared item names never appear in server-side audit logs
 - **Extension fingerprinting** — `web_accessible_resources: []` blocks external pages from probing extension files
+- **Passkey / WebAuthn** — FIDO2 assertion proves identity to the server without a password; vault key still derived from master password client-side; `sign_count` updated on each use for clone detection
 
 A database breach exposes only encrypted ciphertext. The server cannot read vault names, passwords, tags, or shared item names.
 
@@ -88,7 +90,7 @@ A database breach exposes only encrypted ciphertext. The server cannot read vaul
 | Backend | Python 3.12, Flask 3.x |
 | Database | MySQL 8.x |
 | Frontend | Vanilla JS, Web Crypto API, Jinja2 |
-| Auth | Argon2id + PBKDF2 + JWT (HS256) |
+| Auth | Argon2id + PBKDF2 + JWT (HS256) + WebAuthn (FIDO2) |
 | Encryption | AES-256-GCM (client-side) |
 | Extension | Chrome MV3 / Firefox MV2 |
 | Web server | Nginx + Gunicorn + systemd |
@@ -198,6 +200,9 @@ flask db upgrade && sudo systemctl reload passkeeper
 | `TOTP_ENCRYPTION_KEY` | Server-side AES key for TOTP secrets (64-char hex) |
 | `RATELIMIT_STORAGE_URI` | Redis URI — required in production (`redis://127.0.0.1:6379/0`) |
 | `CORS_ORIGINS` | Allowed origins (`*` in dev, domain in prod) |
+| `WEBAUTHN_RP_ID` | Passkey relying party ID — effective domain, no scheme (`pwkeeper.ngodanguyen.tech`) |
+| `WEBAUTHN_RP_NAME` | Passkey relying party display name (`PassKeeper`) |
+| `WEBAUTHN_ORIGINS` | Comma-separated allowed origins for WebAuthn (`https://pwkeeper.ngodanguyen.tech`) |
 
 ---
 
@@ -249,6 +254,12 @@ All vault/folder endpoints require `Authorization: Bearer <access_token>`.
 | POST | `/api/emergency` | Create emergency access grant |
 | POST | `/api/auth/change-password` | Atomic vault re-encryption |
 | POST | `/api/auth/recover` | Account recovery (one-time) |
+| POST | `/api/webauthn/register/begin` | Start passkey registration |
+| POST | `/api/webauthn/register/complete` | Finish passkey registration |
+| POST | `/api/webauthn/authenticate/begin` | Start passkey login |
+| POST | `/api/webauthn/authenticate/complete` | Complete passkey login → tokens |
+| GET | `/api/webauthn/credentials` | List registered passkeys |
+| DELETE | `/api/webauthn/credentials/<id>` | Remove a passkey |
 
 ---