feat(auth): add passkey support via better-auth

packages/server/src/db/schema/account.ts

@@ -223,6 +223,36 @@ export const twoFactor = pgTable("two_factor", {
 	lockedUntil: timestamp("locked_until"),
 });
 
+export const passkey = pgTable(
+	"passkey",
+	{
+		id: text("id").primaryKey(),
+		name: text("name"),
+		publicKey: text("public_key").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		credentialID: text("credential_id").notNull(),
+		counter: integer("counter").notNull(),
+		deviceType: text("device_type").notNull(),
+		backedUp: boolean("backed_up").notNull(),
+		transports: text("transports"),
+		createdAt: timestamp("created_at"),
+		aaguid: text("aaguid"),
+	},
+	(table) => [
+		index("passkey_userId_idx").on(table.userId),
+		index("passkey_credentialID_idx").on(table.credentialID),
+	],
+);
+
+export const passkeyRelations = relations(passkey, ({ one }) => ({
+	user: one(user, {
+		fields: [passkey.userId],
+		references: [user.id],
+	}),
+}));
+
 export const apikey = pgTable("apikey", {
 	id: text("id").primaryKey(),
 	name: text("name"),

packages/server/src/lib/auth-cli.ts

@@ -1,4 +1,5 @@
 import { apiKey } from "@better-auth/api-key";
+import { passkey } from "@better-auth/passkey";
 import { scim } from "@better-auth/scim";
 import { sso } from "@better-auth/sso";
 import { betterAuth } from "better-auth";
@@ -33,6 +34,7 @@ export const auth = betterAuth({
 		apiKey({ enableMetadata: true, references: "user" }),
 		sso(),
 		twoFactor(),
+		passkey(),
 		organization({
 			ac,
 			roles: { owner: ownerRole, admin: adminRole, member: memberRole },

packages/server/src/lib/auth.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage } from "node:http";
 import { apiKey } from "@better-auth/api-key";
+import { passkey } from "@better-auth/passkey";
 import { scim } from "@better-auth/scim";
 import { sso } from "@better-auth/sso";
 import * as bcrypt from "bcrypt";
@@ -374,6 +375,7 @@ const createBetterAuth = () =>
 		session: {
 			expiresIn: 60 * 60 * 24 * 3,
 			updateAge: 60 * 60 * 24,
+			freshAge: 0,
 		},
 		user: {
 			modelName: "user",
@@ -435,6 +437,7 @@ const createBetterAuth = () =>
 				},
 			}),
 			twoFactor(),
+			passkey(),
 			organization({
 				ac,
 				roles: {