fix: passkey rpid detect

[seefs001]

Summary by CodeRabbit

• New Features

  • Passkey origins now accepted as a single comma-separated string with whitespace tolerance and validation.
  • RP ID auto-derived from the server address when not set.
  • Default user verification set to “preferred” if unspecified.

• Refactor

  • Simplified Passkey settings form: origins moved from tag list to a single input field.
  • Unified submission flow to always include passkey settings from current form values.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Origins handling for passkeys changes from a string slice to a single comma-separated string across backend and frontend. Backend parsing trims and validates entries, with fallback auto-detection. Settings now lazily derive RP ID from server address if absent. Frontend form submits passkey fields directly, with origins as a plain string input.

Changes

Cohort / File(s)	Summary
Passkey service origin parsing service/passkey/service.go	resolveOrigins now reads settings.Origins as a comma-separated string, trims/validates entries, enforces insecure-origin checks, collects valid origins, and falls back to auto-detection when resulting list is empty.
System settings model updates setting/system_setting/passkey.go	PasskeySettings.Origins type changed from []string to string. Added URL parsing and trimming; lazy initialization of RPID from ServerAddress if empty, using parsed host or the raw value on parse failure. Defaults updated accordingly.
Frontend system settings form web/src/components/settings/SystemSetting.jsx	Replaced JSON/array handling for passkey.origins with a simple string field and input. Simplified submit logic to always send passkey fields from form values. Ensured default user_verification='preferred'. Switched bindings to bracketed field selectors and replaced TagInput with Form.Input for origins.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Admin as Admin UI
  participant UI as Settings Form
  participant API as Server API
  participant CFG as Settings Store
  participant SVC as Passkey Service

  Admin->>UI: Edit Passkey fields (origins string, rp_id, etc.)
  UI->>API: Submit settings payload
  API->>CFG: Persist passkey settings
  Note over CFG,SVC: Origins stored as comma-separated string
  API-->>UI: 200 OK

  SVC->>CFG: Load PasskeySettings
  alt RPID empty and ServerAddress present
    SVC->>SVC: Derive RPID from ServerAddress host
  end
  SVC->>SVC: Parse settings.Origins by comma, trim, validate
  alt No valid origins
    SVC->>SVC: Auto-detect origins (fallback)
  end
  SVC-->>SVC: Use resolved origins

Loading

sequenceDiagram
  autonumber
  participant SVC as Passkey Service
  participant VAL as Origin Validator

  SVC->>SVC: Read settings.Origins (string)
  alt Non-empty
    SVC->>SVC: Split by comma, trim whitespace
    loop For each entry
      SVC->>VAL: Validate origin / insecure checks
      VAL-->>SVC: Accept/Reject
    end
    alt None accepted
      SVC->>SVC: Auto-detect origins
    end
  else Empty
    SVC->>SVC: Auto-detect origins
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

• Calcium-Ion

Poem

I nibble commas, trim the white—
Origins line up, neat and tight.
From server burrow, RP peeks,
A host emerges—just what it seeks.
Tap-tap, submit; the settings sing.
Hop! The passkeys take to spring. 🥕✨

✨ Finishing touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7533ffc and fcc6172.

📒 Files selected for processing (3)

• service/passkey/service.go (1 hunks)
• setting/system_setting/passkey.go (2 hunks)
• web/src/components/settings/SystemSetting.jsx (8 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🧪 Early access (Sonnet 4.5): enabled

We are currently testing the Sonnet 4.5 model, which is expected to improve code review quality. However, this model may lead to increased noise levels in the review comments. Please disable the early access features if the noise level causes any inconvenience.

Note:

• Public repositories are always opted into early access features.
• You can enable or disable early access features from the CodeRabbit UI or by updating the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}