feat(auth)!: go fully passwordless and fix cross-check review findings

		Restorer:    restorer,

		Backuper:    backuper,

		Submissions: submissions,

		// The external face is fronted by SessionAuth: it prefers a local-password

		// session cookie and otherwise delegates to the Cloudflare-Access JWT verifier,

		// so both auth models coexist on one face. The delegate's Keyfunc is

		// intentionally nil — the JWT path fails closed until a JWKS-backed key function

		// is wired (deployment integration point) — while the local-password path is

		// live the moment `felis breakGlass` flips local_auth_enabled on.

		// The external face is fronted by SessionAuth: it prefers a local session

		// cookie (minted by the passwordless doors) and otherwise delegates to the

		// Cloudflare-Access JWT verifier, so both auth models coexist on one face. The

		// delegate's Keyfunc is intentionally nil — the JWT path fails closed until a

		// JWKS-backed key function is wired (deployment integration point) — while the

		// local session path is live the moment `felis breakGlass` flips

		// local_auth_enabled on.

		External: api.SessionAuth{

			Repo:          repo,

			Delegate:      api.AccessVerifier{Audience: cfg.Auth.AccessJWTAud},

		},

		RootDomain:    cfg.Server.RootDomain,

		AdminHostname: cfg.Auth.AdminHostname,

		PanelHostname: cfg.Auth.PanelHostname,

		WakeCooldown:  30 * time.Second,

		// Bound concurrent console/build-log SSE streams per principal. Generous enough

		// for legitimate multi-tab / multi-server watching, while capping how many

		fmt.Fprintln(stderr, "felis api: passkey verifier disabled (auth.panel_hostname unset) — passkey endpoints return 503")

	}

	externalHandler := panel.Handler(a.ExternalHandler(), cfg.Server.RootDomain, cfg.Auth.PanelHostname, cfg.Auth.AdminHostname, resolvedVersion())

	// Derive the console hostnames when felis.toml leaves them unset, exactly as the

	// setup/breakGlass paths do — otherwise the SPA cannot tell which face it is

	// serving and falls back to the player console on op.console.<root>.

	externalHandler := panel.Handler(a.ExternalHandler(), cfg.Server.RootDomain,

		defaultPanelHostname(cfg.Server.RootDomain, cfg.Auth.PanelHostname),

		defaultAdminHostname(cfg.Server.RootDomain, cfg.Auth.AdminHostname),

		resolvedVersion())

	internalSrv := newAPIServer(*internalAddr, a.InternalHandler())

	externalSrv := newAPIServer(cfg.Server.Listen, externalHandler)

// authority is local root, so it legitimately BYPASSES the web Zero-Trust + Passkey

// path: critical recovery runs direct-to-Postgres. The thin-thread operation it

// ships here is the one that bootstraps everything else — provision (or reset) the

// single Owner account and turn local-password login on — so that even with the web

// single Owner account and turn local session sign-in on — so that even with the web

// auth path unconfigured an operator can get into op.console. It is a genuine

// interactive TUI, NOT a CLI: bare `felis` prints CLI usage, while `felis breakGlass`

// opens this full-screen console. It refuses to run unless euid is 0 (sudo/root).

// When a staff account already exists the console opens on a thin top-level menu

// (menuModel) so that operations are peers, not tails of one wizard. Two account

// operations are wired today: (1) provision/reset the Owner — the thin thread above,

// which also re-enables local-password login — and (2) add an Operator: an

// which also re-enables local session sign-in — and (2) add an Operator: an

// insert-only mint of an additional staff admin (provisionOperator) that

// deliberately never touches the global local_auth toggle. On a fresh machine (no

// Owner yet) the menu is skipped: bootstrapping the first Owner is the only sensible

	// The TUI runs on the alternate screen, which is torn down on exit and takes its

	// display with it. Re-print a durable summary to the normal screen so the

	// outcome — and any generated one-time password — survives in scrollback long

	// outcome — and the one-time setup URL — survives in scrollback long

	// enough for the operator to log in.

	if res.provisioned {

		if res.isOperator {

			// so the summary must not claim it did — only the Owner thread enables login.

			fmt.Fprintf(stdout, "\nfelis breakGlass: Operator account %q provisioned.\n", res.username)

		} else {

			fmt.Fprintf(stdout, "\nfelis breakGlass: Owner account %q provisioned; local-password login is ENABLED.\n", res.username)

			fmt.Fprintf(stdout, "\nfelis breakGlass: Owner account %q provisioned; local session sign-in is ENABLED.\n", res.username)

		}

		fmt.Fprintf(stdout, "Recorded as %q (mode: %s, os user: %s).\n", res.accountable, res.mode, res.osUser)

		if res.setupTokenURL != "" {

}

// enableLocalAuth flips the runtime local_auth_enabled toggle on

// direct-to-Postgres. It is a load-bearing write of break-glass: without it

// handleLogin returns 403 and the freshly provisioned Owner cannot log in, so a

// direct-to-Postgres. It is a load-bearing write of break-glass: without it every

// session-minting door (passkey / email-OTP / bind / op-login) returns 403

// local_auth_disabled and the freshly provisioned Owner cannot log in, so a

// successful provisionOwner with local auth off is not a usable thin thread.

func enableLocalAuth(ctx context.Context, s ownerStore) error {

	// The setting is read back with json.Unmarshal into a bool, so the stored jsonb

}

// performBreakGlass executes a resolved break-glass operation: provision (or reset)

// the Owner, enable local-password login, then record a best-effort accountability

// the Owner, enable local session sign-in, then record a best-effort accountability

// audit row. The Owner is passwordless — the setup-token flow handles first-login

// setup. The audit write is best-effort: a logging failure is reported via auditErr

// but does NOT fail the recovery — break-glass must still work when the audit sink

	}

	panelURL := res.panelURL

	if panelURL == "" {

		panelURL = localPanelURL(setup.cfg.Server.RootDomain)

		panelURL = localPanelURL(setup.cfg.Server.RootDomain, setup.cfg.Auth.AdminHostname)

	}

	if !res.provisioned && !res.connectConfigured {

	return port

}

func localPanelURL(rootDomain string) string {

func localPanelURL(rootDomain, adminHostname string) string {

	if ip := rootDomainEmbeddedIP(rootDomain); ip != "" {

		return fmt.Sprintf("https://%s:%d", ip, setupPanelNodePort())

	}

	host := defaultAdminHostname(rootDomain, "")

	host := defaultAdminHostname(rootDomain, adminHostname)

	if host == "" {

		return ""

	}

	return fmt.Sprintf("https://127.0.0.1:%d", setupPanelNodePort())

}

func checkPanelAccess(rootDomain string) panelAccessResult {

	base := localPanelURL(rootDomain)

func checkPanelAccess(rootDomain, adminHostname string) panelAccessResult {

	base := localPanelURL(rootDomain, adminHostname)

	if base == "" {

		return panelAccessResult{err: fmt.Errorf("root domain is empty")}

	}

// None is privileged: "Local" installs nothing, "Cloudflare Tunnel" is a

// turnkey integration, and "Reverse proxy" just records hostnames and hands the

// operator a copy-paste guide. The admin console is gated by the Owner's

// local-password session regardless; Cloudflare Access is an *additional* layer.

// local session (passwordless sign-in) regardless; Cloudflare Access is an

// *additional* layer.

type connectChooserModel struct {

	rootDomain string

	adminHost  string

		// A dim, untitled footnote — deliberately subordinate to the picker above

		// so the screen reads as a menu, not an info page.

		huh.NewNote().Description(

			"⚠  Local / reverse proxy gate the admin console on your Owner password alone. "+

				"Cloudflare Access adds an edge check in front."),

			"⚠  Local / reverse proxy gate the admin console on your Owner sign-in alone "+

				"(passkey / email code). Cloudflare Access adds an edge check in front."),

	)))

}