Repository navigation
feat: track and invite passkey enrollment for imported users #338
Description
Problem
After an import, the work that remains is getting every person enrolled with a passkey or a security key, ideally two authenticators each. Today there is no way to see who still has not enrolled, or to invite them.
Proposal
- A clear "imported, not yet enrolled" state for users with no credential
- Admin action to send enrollment invites (single and bulk) using the existing magic link / OTP delivery, including external delivery mode so an organization can send them from its own mail system
- Enrollment progress per organization: not enrolled, one authenticator, two or more
- Expose it in the admin dashboard and through the API so it can feed the coverage report in No authentication coverage report for assessment and insurance responses #178
Activity
feat(enrollment): track and invite passkey enrollment
Bccorb commentedon Oct 6, 2026
In progress. Decisions:
prompt_passkey_enrollment, makes email or phone code sign-ins and magic link sign-ins returnnextStep: 'enroll_passkey'for a user with no passkey. That is how an invited user lands in enrollment, whichever way they sign in.PRs, in merge and release order:
sendEnrollmentInviteEmail. Released as messaging 0.2.0, together with the bootstrap-invite removal and the relicense already onmain.enrollment_invite_emaildelivery kind,prompt_passkey_enrollment,nextStepon code and magic link sign-ins, andadmin_enrollment_invite_sent.feat/enrollment-tracking, which covers:GET /admin/enrollment, with counts per status, scoped by organization or to imported users;POST /admin/enrollment/invites, for listed users or a whole organization, 200 at a time, skipping anyone invited in the last 24h, with external delivery supported;nextStep;enrollment_invited_atcolumn.The raw SQL was checked against a real Postgres. Its PR opens once 1 and 2 are published.
Found along the way: the Next.js adapter lacks the #337 retirement routes (fells-code/seamless-auth-server#180).
feat(enrollment): add schemas for tracking and inviting passkey enrol…
feat(proxy): pass the passkey enrollment admin routes through (#179)
Bccorb commentedon Oct 6, 2026
All the pieces are now up:
feat(enrollment): track and invite passkey enrollment (#351)