Passkey bug fix in gunicorn

backend/routes.py

@@ -544,7 +544,7 @@ def api_webauthn_register_complete():
     uid = _cur()
 
     try:
-        result = complete_registration(request, credential)
+        result = complete_registration(request, credential, user_id=uid)
         if result.get("user_id") != uid:
             return jsonify({"error": "注册上下文不匹配，请重试"}), 400
         update_auth_config(
@@ -569,6 +569,27 @@ def api_webauthn_register_complete():
         return jsonify({"error": f"Passkey 注册失败: {e}"}), 500
 
 
+@api.route("/api/auth/passkey", methods=["DELETE"])
+@login_required
+def api_remove_passkey():
+    """Remove the current user's Passkey (re-auth required).
+
+    If this leaves the account with no MFA method at all, the account is
+    flagged must_configure_mfa so the next login forces MFA setup again
+    (same guard as a fresh temp account).
+    """
+    if not require_reauth():
+        return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
+    uid = _cur()
+    cfg = get_auth_config(user_id=uid)
+    if not cfg.get("passkey_credential_id"):
+        return jsonify({"error": "未配置 Passkey"}), 400
+    update_auth_config(uid, passkey_credential_id="", passkey_public_key="")
+    if not has_mfa_configured(user_id=uid):
+        update_auth_config(uid, must_configure_mfa=1)
+    return jsonify({"ok": True})
+
+
 # ─── TOTP Setup ──────────────────────────────
 
 @api.route("/api/auth/totp/setup", methods=["POST"])
@@ -974,7 +995,7 @@ def admin_provision_passkey_complete(user_id):
         return jsonify({"error": "用户不存在"}), 404
 
     try:
-        result = complete_registration(request, credential)
+        result = complete_registration(request, credential, user_id=user_id)
         if result.get("user_id") != user_id:
             return jsonify({"error": "注册上下文不匹配，请重试"}), 400
         update_auth_config(