Rosewood access
Use the house identity provider to reach bookings, room release controls, owner blocks, house users, and the agent inbox. Passkeys remain available for local-device fallback access.
Identity plan
Access packet is ready to copy.
Authentik group membership syncs the local Better Auth admin role on sign-in.
Conrad, Jessica, and Sarah are members of the Rosewood house-admin group.
Passkeys still work for local-device access when the IDP path is not convenient.
After sign-in, bookings, users, rooms, and house-agent requests remain admin gated.
Use this packet when inviting Jessica, Sarah, the house manager, or another Rosewood operator.
Better Auth
Passkey-first contract
Registration context is ready.
conrad@rosewood.localSent to Better Auth as passkey context so resolveUser can match an invited Rosewood house user.
registration.requireSession=falseThe server allows passkey-first onboarding before a session exists.
manual prompt fallbackThe input keeps webauthn as the final autocomplete token, then conditional UI can preload.
Checking origin / Checking RP IDLocalhost is valid for local WebAuthn development before Rosewood is published.
Launch runbook
user, session, verification, passkeyRun bun run auth:migrate, then bun run db:seed before first registration.
credential + authenticator metadataBetter Auth stores credentialID, publicKey, aaguid, backup state, transports, and counter.
Sign-in required after registrationRegistering creates the credential; signing in creates the session that unlocks admin.
Admin unlock checklist
Admin unlock checklist is ready.
conrad@rosewood.localThe typed address is passed as Better Auth passkey context and must match a Rosewood invite.
Passkey prompt fallbackThis browser can use WebAuthn on localhost before the Rosewood site is published.
No active sessionRegister the platform passkey first, then sign in to create the admin-gated session.
/adminAfter sign-in, Rosewood admin opens to users, bookings, rooms, and house-agent requests.
Checking auth session...
Registered passkeys
No registered passkeys to show yet.
Sign in to list registered passkeys.