feat(passkey): require and record user verification at enrollment

	PublicKey    string // base64(COSE public key bytes)

	SignCount    uint32

	AAGUID       string

	// Ceremony flags captured at enrollment. UserVerified records that a PIN/biometric

	// (not mere presence) was performed; BackupEligible/BackupState record whether the

	// credential is syncable/backed up. All are non-secret ceremony facts a future login

	// path can enforce or surface per credential.

	UserVerified   bool

	BackupEligible bool

	BackupState    bool

}

// VerifiedAssertion is the output of a finished LOGIN (assertion) ceremony: which of the

		AAGUID:         vc.AAGUID,

		Name:           req.Name,

		CreatedAt:      a.now(),

		UserVerified:   vc.UserVerified,

		BackupEligible: vc.BackupEligible,

		BackupState:    vc.BackupState,

	}

	if err := a.Repo.CreatePasskeyCredential(r.Context(), cred); err != nil {

		if errors.Is(err, ErrConflict) {

// so an authenticator is never silently rebound. Empty aaguid/name land as SQL NULL.

func (p *PGRepo) CreatePasskeyCredential(ctx context.Context, c PasskeyCredential) error {

	res, err := p.db.ExecContext(ctx,

		`INSERT INTO webauthn_credentials (id, user_id, credential_id, public_key, sign_count, aaguid, name, created_at)

		 VALUES ($1, $2, $3, $4, $5, NULLIF($6, ''), NULLIF($7, ''), $8)

		`INSERT INTO webauthn_credentials

		   (id, user_id, credential_id, public_key, sign_count, aaguid, name, created_at,

		    user_verified, backup_eligible, backup_state)

		 VALUES ($1, $2, $3, $4, $5, NULLIF($6, ''), NULLIF($7, ''), $8, $9, $10, $11)

		 ON CONFLICT (credential_id) DO NOTHING`,

		c.ID, c.UserID, c.CredentialID, c.PublicKey, int64(c.SignCount), c.AAGUID, c.Name, c.CreatedAt)

		c.ID, c.UserID, c.CredentialID, c.PublicKey, int64(c.SignCount), c.AAGUID, c.Name, c.CreatedAt,

		c.UserVerified, c.BackupEligible, c.BackupState)

	if err != nil {

		return err

	}

// nullable last_used_at maps to a *time.Time (nil until an assertion is verified).

func (p *PGRepo) PasskeyCredentialsForUser(ctx context.Context, userID string) ([]PasskeyCredential, error) {

	const q = `SELECT id, user_id, credential_id, public_key, sign_count,

		COALESCE(aaguid, ''), COALESCE(name, ''), created_at, last_used_at

		COALESCE(aaguid, ''), COALESCE(name, ''), created_at, last_used_at,

		user_verified, backup_eligible, backup_state

		FROM webauthn_credentials WHERE user_id = $1 ORDER BY created_at DESC`

	rows, err := p.db.QueryContext(ctx, q, userID)

	if err != nil {

			lastUsed  sql.NullTime

		)

		if err := rows.Scan(&c.ID, &c.UserID, &c.CredentialID, &c.PublicKey, &signCount,

			&c.AAGUID, &c.Name, &c.CreatedAt, &lastUsed); err != nil {

			&c.AAGUID, &c.Name, &c.CreatedAt, &lastUsed,

			&c.UserVerified, &c.BackupEligible, &c.BackupState); err != nil {

			return nil, err

		}

		c.SignCount = uint32(signCount)

	Name         string

	CreatedAt    time.Time

	LastUsedAt   *time.Time

	// Ceremony flags captured at enrollment (migration 0009). UserVerified records that a

	// PIN/biometric was performed at bind; BackupEligible/BackupState record whether the

	// credential is syncable/backed up. Persisted so a future login path can enforce UV

	// per credential and reason about single-device vs. synced authenticators.

	UserVerified   bool

	BackupEligible bool

	BackupState    bool

}

// SessionedUser is the projection resolved from a live session cookie: the

		RPID:          rpID,

		RPDisplayName: displayName,

		RPOrigins:     origins,

		// Require user verification (a PIN/biometric, not mere presence) at enrollment,

		// so a bound passkey always proves two factors — possession of the authenticator

		// AND the user. go-webauthn stamps this requirement into the SessionData at begin

		// and enforces the UV flag at CreateCredential, so an authenticator that only

		// tested presence is rejected. A device that cannot do UV simply falls back to the

		// email-OTP factor (migration 0004); no one is locked out.

		AuthenticatorSelection: protocol.AuthenticatorSelection{

			UserVerification: protocol.VerificationRequired,

		},

	})

	if err != nil {

		return nil, err

		PublicKey:    base64.StdEncoding.EncodeToString(cred.PublicKey),

		SignCount:    cred.Authenticator.SignCount,

		AAGUID:       aaguidString(cred.Authenticator.AAGUID),

		// Record the ceremony flags go-webauthn derived from the authenticator data.

		// UserVerified is redundant with the required-UV policy today (a non-UV finish is

		// rejected before we get here) but persisting it makes the guarantee auditable and

		// survives a future policy that permits UV=preferred credentials. BackupEligible/

		// BackupState tell a later login path whether the passkey is a single-device key or

		// a syncable/multi-device one — a posture signal worth capturing at bind time.

		UserVerified:   cred.Flags.UserVerified,

		BackupEligible: cred.Flags.BackupEligible,

		BackupState:    cred.Flags.BackupState,

	}, nil

}

	if _, err := base64.StdEncoding.DecodeString(vc.PublicKey); err != nil {

		t.Errorf("PublicKey is not valid base64: %v", err)

	}

	// The default virtual authenticator performs user verification, and enrollment now

	// requires it — so the recorded UserVerified flag must be true. This proves the flag is

	// captured from the ceremony (not left at its zero value) end to end.

	if !vc.UserVerified {

		t.Error("UserVerified = false; a verified enrollment must record UV=true")

	}

}

// TestRegisterRequiresUserVerification proves the required-UV policy is enforced, not just

// advertised: an authenticator that tests presence but does NOT verify the user (no

// PIN/biometric) must be rejected at finish. go-webauthn stamps UV=required into the

// SessionData at begin and checks the UV flag at CreateCredential; without this guard a

// silent, presence-only passkey could be bound. Pairs with TestRegisterRoundTrip (which

// proves a UV-capable authenticator still succeeds), so the policy neither over- nor

// under-blocks.

func TestRegisterRequiresUserVerification(t *testing.T) {

	v := newTestVerifier(t)

	rp := virtualRP()

	// UserNotVerified: the authenticator signs with the UV flag clear.

	authenticator := virtualwebauthn.NewAuthenticatorWithOptions(virtualwebauthn.AuthenticatorOptions{UserNotVerified: true})

	cred := virtualwebauthn.NewCredential(virtualwebauthn.KeyTypeEC2)

	options, sessionData, err := v.BeginRegistration(testUser())

	if err != nil {

		t.Fatalf("BeginRegistration: %v", err)

	}

	attestationOpts, err := virtualwebauthn.ParseAttestationOptions(string(options))

	if err != nil {

		t.Fatalf("ParseAttestationOptions: %v", err)

	}

	attestationResponse := virtualwebauthn.CreateAttestationResponse(rp, authenticator, cred, *attestationOpts)

	if _, err := v.FinishRegistration(testUser(), sessionData, strings.NewReader(attestationResponse)); err == nil {

		t.Fatal("FinishRegistration accepted a presence-only (no user verification) attestation; want rejection")

	}

}

// TestRegisterOriginMismatchRejected proves the adapter is really checking the origin: an