[markusressel]

Follow-up to #70 after backend #39 (TOTP, account) and #40 (passkeys) reached master.

Live checks against backend master (5f5a133)

I built backend master locally with rateLimits.disabled: true, webauthn.rpId, the CI debug package in webauthn.android, and clientUrl. All opt-in live tests pass:

• LiveAuthTest (3): login, sessions, sign out other devices, logout, wrong password.
• LiveAccountTest (new):
  • GET/PATCH /account/ and the password change
  • TOTP enrolment, with the code computed from the otpauth:// URI like an authenticator app; a wrong code gives 400; confirming again gives 409
  • login with the second factor: a TOTP code pasted with a space, and a recovery code (the remaining count drops to 9)
  • step-up with password and code, then new recovery codes
  • passkeys: add (provider reported as "Bitwarden", synced), discoverable login, step-up with a passkey, rename, delete
  • at the end the test removes TOTP and puts the old password and display name back
• LiveLinkTest (new): an admin creates invites. AuthLinkParser reads the invite URL, and new accounts are created with a password and with a passkey only. The passkey account then signs in with its passkey.

The passkeys come from SoftwareAuthenticator, a port of the backend's passkeytest package. It sends the JSON Credential Manager returns, with the Android origin of the CI debug build (android:apk-key-hash:dKdF-sJKv73wpzCDGHH-pt4kbGvS4_hiSSQnH8TTcEg). This also checks the origin the backend derives from server.auth.webauthn.android.

The backend's /.well-known/assetlinks.json (with serveAssetLinks: true) gives exactly the statement computed from .ci/debug.keystore: handle_all_urls and get_login_creds for de.markusressel.mkdocseditor.debug.

./gradlew :auth:testDebugUnitTest --tests '*Live*' \
  -Pmkdocs.backend.url=http://127.0.0.1:7413 \
  -Pmkdocs.backend.users=alice:password -Pmkdocs.backend.admin=admin:password

App changes for the two additive backend deviations

• Passkey objects have an optional provider. The account screen shows it next to the dates, for example "Bitwarden · Added … · synced". lastUsedAt is null until first use and shows "never".
• POST /account/totp/confirm/ without a pending enrolment gives 409 conflict. The setup dialog closes and says the setup expired and must be started again.

Unit tests: an AccountViewModelTest for the expired enrolment and an OkHttpAuthApiTest for the provider and a null lastUsedAt. ./gradlew testDebugUnitTest app:assembleDebug passes (157 tests; the live tests are skipped without properties).

🤖 Generated with Claude Code