feat: sign in with passkeys, no password once an account has one; an account button and dialog in place of the sign-out button

internal/server/handlers_panel.go

@@ -87,7 +87,12 @@ func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
 	admin, _ := s.db.AdminByUsername(username)
 	if admin == nil || !checkPassword(admin.PassHash, pw) {
 		s.limiter.fin(ip, false)
-		s.render(w, "login.html", map[string]any{"Error": "Неверный логин или пароль."})
+		s.render(w, "login.html", map[string]any{"Error": "Неверный логин или пароль.", "Username": username})
+		return
+	}
+	// With a passkey on the account, the password alone does not do.
+	if s.db.CountAdminKeys(admin.ID) > 0 {
+		s.render(w, "login.html", map[string]any{"Error": "Для этого аккаунта вход только по ключу доступа.", "Username": username})
 		return
 	}
 	s.limiter.fin(ip, true)
@@ -370,6 +375,10 @@ func (s *Server) handleAgentRename(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleSettings(w http.ResponseWriter, r *http.Request) {
 	admins, _ := s.db.ListAdmins()
+	keyCounts := map[int64]int{}
+	for _, a := range admins {
+		keyCounts[a.ID] = s.db.CountAdminKeys(a.ID)
+	}
 	host := s.db.HostAddress()
 	secret := s.db.EnrollSecret()
 	code := s.db.InstallCode()
@@ -380,6 +389,7 @@ func (s *Server) handleSettings(w http.ResponseWriter, r *http.Request) {
 		"Host":          host,
 		"Secret":        secret,
 		"Admins":        admins,
+		"KeyCounts":     keyCounts,
 		"CSRF":          csrfToken(r),
 		"InstallShort":  fmt.Sprintf("wget -qO- %s/i/%s | sudo sh", host, code),
 		"InstallCurl":   fmt.Sprintf("curl -fsSL %s/install.sh | sudo HOST=%s ENROLL_SECRET=%s sh", host, host, secret),