7103366047
Instead of hardcoding rpId to "rspace.online" (which requires Related Origins support), derive the RP ID from the request's Origin header. Each r* app (rmaps.online, rnotes.online, etc.) now gets its own RP ID matching its domain, so passkeys work natively without browser support for Related Origin Requests. - Added resolveRpId() helper that maps Origin → hostname for allowed origins - Registration creates passkeys with the caller's domain as RP ID - Authentication uses the caller's domain as RP ID - Added rp_id column to credentials table for per-credential RP ID tracking - rspace.online subdomains still use rspace.online as shared RP ID Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| backlog | ||
| docs | ||
| lib | ||
| public/.well-known | ||
| server | ||
| src | ||
| website | ||
| .dockerignore | ||
| .gitignore | ||
| Dockerfile | ||
| Dockerfile.encryptid | ||
| MODULE_SPEC.md | ||
| bun.lock | ||
| docker-compose.encryptid.yml | ||
| docker-compose.yml | ||
| package.json | ||
| tsconfig.json | ||
| vite.config.ts | ||