From e3e76c6fc60a7bd95f1519a0fbbeee2f90a797a1 Mon Sep 17 00:00:00 2001 From: DariusIII Date: Fri, 22 May 2026 12:54:17 +0200 Subject: [PATCH] Update agents.md and example env file --- .env.example | 10 ++++++++++ AGENTS.md | 3 ++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index 6c27a1858..a01ce6e66 100644 --- a/.env.example +++ b/.env.example @@ -78,6 +78,16 @@ APP_TIMEZONE=UTC APP_URL= # Passkey RP ID (domain only, no scheme/path) PASSKEY_RELYING_PARTY_ID= +# Passkey authenticator selection (controls which authenticators the browser offers). +# Leave PASSKEY_AUTHENTICATOR_ATTACHMENT empty for "no preference" so Windows Hello, +# platform biometrics, phones (hybrid/QR) AND FIDO2 security keys all appear in the +# browser picker. Set to "platform" or "cross-platform" to restrict. +PASSKEY_AUTHENTICATOR_ATTACHMENT= +# residentKey: preferred|required|discouraged. "preferred" is required for Windows +# domain-joined / managed machines where "required" can suppress Windows Hello. +PASSKEY_RESIDENT_KEY=preferred +# userVerification: preferred|required|discouraged +PASSKEY_USER_VERIFICATION=preferred # Trusted proxies / Cloudflare # Comma-separated list of additional proxies to trust alongside Cloudflare. diff --git a/AGENTS.md b/AGENTS.md index 4495ebbd1..f43ea7d69 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -33,7 +33,7 @@ NNTP → NNTPService → BinariesRunner → ReleaseCreationService → ReleasePr | **Observer** | `app/Observers/`, `AppServiceProvider` | `ReleaseObserver`, `MovieInfoObserver`, `RolePromotionObserver` | | **View Composer** | `app/View/Composers/`, `AppServiceProvider` | `GlobalDataComposer` shared across `layouts.*` and `admin.*` | | **Status Probe** | `app/Services/StatusProbes/` | `ServiceProbeRegistry` aggregates `DatabaseProbe`, `DiskProbe`, `NntpProbe`, `QueueProbe`, `RedisProbe`, `SearchProbe` for `StatusPageController` (`/status`) and `DegradeWhenRedisUnreachable` middleware; tune via `config/status-probes.php` | -| **Passkey** | `app/Actions/Passkeys/`, `app/Http/Controllers/Auth/Passkey*` | Spatie Laravel Passkeys; ceremony actions (`GeneratePasskeyRegisterOptionsAction`, `FindPasskeyToAuthenticateAction`) wire into routes `passkeys.*` in `routes/web.php` | +| **Passkey** | `app/Actions/Passkeys/`, `app/Http/Controllers/Auth/Passkey*` | Spatie Laravel Passkeys; ceremony actions (`GeneratePasskeyRegisterOptionsAction`, `FindPasskeyToAuthenticateAction`) wire into routes `passkeys.*` in `routes/web.php`. `GeneratePasskeyRegisterOptionsAction` overrides `authenticatorSelection()` (defaults: attachment=null, `residentKey=preferred`, `userVerification=preferred`) and injects WebAuthn L3 `hints` + `credProps` extension so Windows Hello / Touch ID / phone-via-QR / FIDO2 keys all appear in the browser picker on Windows domain machines. Tunable via `PASSKEY_AUTHENTICATOR_ATTACHMENT`, `PASSKEY_RESIDENT_KEY`, `PASSKEY_USER_VERIFICATION`, `PASSKEY_RELYING_PARTY_ID` (see `config/passkeys.php`) | ## Tmux Processing Engine @@ -85,6 +85,7 @@ PHPUnit only (no Pest). Create tests: `php artisan make:test --phpunit {name}` ### Config - App configs: `config/nntmux*.php`, `config/tmux.php`, `config/search.php` - Never `env()` outside config - use `config('key')` +- **Whenever you add or rename an `env()` key — in any file, whether under `config/*.php` or anywhere else in the codebase — you MUST also add it (with a sensible default and a short comment) to `.env.example`.** Treat any new env setting without the matching `.env.example` entry as an incomplete task. - Runtime settings: `Settings::settingValue()` - Laravel 13 route/middleware wiring lives in `bootstrap/app.php`; use that file when adding route groups, aliases, or middleware (for example the `/rss` mount) - Custom global middleware in `app/Http/Middleware/`: `DegradeWhenRedisUnreachable` (prepended; short-circuits requests when Redis is down via `StatusProbes`), `BlockAbusiveServices` (blocks AIOStreams, Oracle Cloud, UsenetStreamer, Cloudflare WARP), `NoCacheForAuthenticatedUsers` (CDN cache busting), `ContentSecurityPolicy`, `EnforceSessionToken`, `TrustedDevice2FAMiddleware`