feat(auth): replace OAuth with WebAuthn, TOTP, and settings view #121

2026-03-27T17:46:45Z

barrettruth commented

2026-03-27 17:46:45 +00:00

Problem

Delta relied on third-party OAuth providers (GitHub/Google/GitLab) for
authentication. For a self-hosted app shared with friends, this is an
unwanted dependency — users should authenticate with hardware keys and
authenticator apps instead.

Solution

Remove all OAuth infrastructure and replace with self-hosted 2FA:

WebAuthn/Passkeys: hardware keys (YubiKey, SoloKeys) and platform
authenticators (Touch ID, Windows Hello, synced passkeys via 1Password
etc.) for passwordless login or 2FA
TOTP: authenticator app codes (Aegis, Bitwarden, etc.) as 2FA
Recovery codes: 8 one-time codes shown at 2FA setup, hashed in DB
Mandatory 2FA: new users must configure at least one method before
accessing the app (/setup-2fa redirect)
Settings view (/settings): config-file aesthetic with account,
security (passkey/TOTP/recovery management), and preferences sections.
Vim mnemonics (l/a/t/r/v/d) on each row. Sidebar footer
with gear icon + username, S keyboard shortcut
Login redesign: password flow with inline TOTP step, "sign in with
passkey" button for passwordless auth, auto-detect new username and
switch to sign-up mode with invite code

Env vars for deployment: WEBAUTHN_RP_ID, WEBAUTHN_ORIGIN.

## Problem Delta relied on third-party OAuth providers (GitHub/Google/GitLab) for authentication. For a self-hosted app shared with friends, this is an unwanted dependency — users should authenticate with hardware keys and authenticator apps instead. ## Solution Remove all OAuth infrastructure and replace with self-hosted 2FA: - **WebAuthn/Passkeys**: hardware keys (YubiKey, SoloKeys) and platform authenticators (Touch ID, Windows Hello, synced passkeys via 1Password etc.) for passwordless login or 2FA - **TOTP**: authenticator app codes (Aegis, Bitwarden, etc.) as 2FA - **Recovery codes**: 8 one-time codes shown at 2FA setup, hashed in DB - **Mandatory 2FA**: new users must configure at least one method before accessing the app (`/setup-2fa` redirect) - **Settings view** (`/settings`): config-file aesthetic with account, security (passkey/TOTP/recovery management), and preferences sections. Vim mnemonics (`l`/`a`/`t`/`r`/`v`/`d`) on each row. Sidebar footer with gear icon + username, `S` keyboard shortcut - **Login redesign**: password flow with inline TOTP step, "sign in with passkey" button for passwordless auth, auto-detect new username and switch to sign-up mode with invite code Env vars for deployment: `WEBAUTHN_RP_ID`, `WEBAUTHN_ORIGIN`.

Sign in to join this conversation.

No reviewers