Add passkey and magic link authentication

scripts/default-users.mjs

@@ -35,18 +35,18 @@ async function secureHash(password) {
 export async function initializeDefaultUsers(database, options = {}) {
 	const resetPasswords = options.resetPasswords === true;
 	const findUser = await database.prepare(
-		'SELECT id, username, role FROM users WHERE username = ? COLLATE NOCASE'
+		'SELECT id, username, role FROM users WHERE login_username = ? COLLATE NOCASE OR username = ? COLLATE NOCASE'
 	);
 	const insertUser = await database.prepare(
-		'INSERT INTO users (id, username, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?)'
+		'INSERT INTO users (id, username, login_username, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?, ?)'
 	);
 	const updateCredential = await database.prepare(
-		'UPDATE users SET password_hash = ?, role = ? WHERE id = ?'
+		'UPDATE users SET login_username = ?, password_hash = ?, role = ? WHERE id = ?'
 	);
 	const credentials = [];
 
 	for (const definition of defaultUsers) {
-		const existing = await findUser.get(definition.username);
+		const existing = await findUser.get(definition.username, definition.username);
 		if (existing && !resetPasswords) {
 			console.log(`${definition.username}: already exists (${existing.role}); left unchanged`);
 			continue;
@@ -60,12 +60,13 @@ export async function initializeDefaultUsers(database, options = {}) {
 		const passwordHash = await secureHash(password);
 
 		if (existing) {
-			await updateCredential.run(passwordHash, String(existing.role), existing.id);
+			await updateCredential.run(definition.username, passwordHash, String(existing.role), existing.id);
 			console.log(`${definition.username}: credentials reset; role and related data preserved`);
 		} else {
 			await insertUser.run(
 				randomUUID(),
 				definition.username,
+				definition.username,
 				passwordHash,
 				definition.role,
 				new Date().toISOString()