From d531b47a13bf098954788fbc2187ed48a32c24f0 Mon Sep 17 00:00:00 2001
From: JasperWelsing <jasper@digitaldeer.nl>
Date: Tue, 3 Feb 2026 11:46:46 +0100
Subject: [PATCH 1/2] Enable/Disable Passkey login feature config

---
 config/webauthn.php                             | 12 ++++++++++++
 resources/js/components/users/PublishForm.vue   |  3 ++-
 resources/js/pages/auth/Login.vue               |  7 ++++---
 resources/js/pages/users/Edit.vue               |  4 +++-
 .../Controllers/CP/Auth/LoginController.php     |  9 +++++----
 .../Controllers/CP/Auth/PasskeyController.php   |  5 +++++
 .../Controllers/CP/Users/UsersController.php    | 17 +++++++++--------
 7 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/config/webauthn.php b/config/webauthn.php
index 378f19d89d3..2908be64e1c 100644
--- a/config/webauthn.php
+++ b/config/webauthn.php
@@ -2,6 +2,18 @@
 
 return [
 
+    /*
+    |--------------------------------------------------------------------------
+    | Enable passkey login
+    |--------------------------------------------------------------------------
+    |
+    | Whether or not the passkey feature should be enabled,
+    |
+    */
+
+    'enable_login_with_passkey' => env('STATAMIC_PASSKEY_ENABLED', true),
+
+
     /*
     |--------------------------------------------------------------------------
     | Allow password logins to be used when user has a passkey
diff --git a/resources/js/components/users/PublishForm.vue b/resources/js/components/users/PublishForm.vue
index e0fcd99e480..56020fc07cc 100644
--- a/resources/js/components/users/PublishForm.vue
+++ b/resources/js/components/users/PublishForm.vue
@@ -18,7 +18,7 @@
                     </template>
                     <DropdownMenu>
                         <DropdownItem :text="__('Edit Blueprint')" icon="blueprint-edit" v-if="canEditBlueprint" :href="actions.editBlueprint" />
-                        <DropdownItem :text="__('Passkeys')" icon="key" :href="cp_url('passkeys')" />
+                        <DropdownItem :text="__('Passkeys')" icon="key" :href="cp_url('passkeys')" v-if="passkeyEnabled" />
                         <DropdownSeparator v-if="canEditBlueprint && itemActions.length" />
                         <DropdownItem
                             v-for="action in itemActions"
@@ -122,6 +122,7 @@ export default {
         canEditBlueprint: Boolean,
         requiresCurrentPassword: Boolean,
         twoFactor: Object,
+        passkeyEnabled: Boolean
     },
 
     data() {
diff --git a/resources/js/pages/auth/Login.vue b/resources/js/pages/auth/Login.vue
index c41ae7cf788..2bfb12156e4 100644
--- a/resources/js/pages/auth/Login.vue
+++ b/resources/js/pages/auth/Login.vue
@@ -11,6 +11,7 @@ defineOptions({ layout: Outside });
 const props = defineProps([
     'errors',
     'emailLoginEnabled',
+    'passkeyEnabled',
     'passkeyOptionsUrl',
     'passkeyVerifyUrl',
     'oauthEnabled',
@@ -55,7 +56,7 @@ const submit = () => {
 const passkey = usePasskey();
 
 const showPasskeyLogin = computed(() => {
-    return props.emailLoginEnabled && passkey.supported;
+     return props.passkeyEnabled && props.emailLoginEnabled && passkey.supported;
 })
 
 const emailAutocomplete = computed(() => {
@@ -111,7 +112,7 @@ onMounted(() => {
                     <template #actions>
                         <Link
                             :href="forgotPasswordUrl"
-                            class="text-ui-accent-text text-sm hover:text-ui-accent-text/80"
+                            class="text-sm text-ui-accent-text hover:text-ui-accent-text/80"
                             tabindex="6"
                             v-text="__('Forgot password?')"
                         />
@@ -137,7 +138,7 @@ onMounted(() => {
                         />
                         <ErrorMessage v-if="passkey.error.value" :text="passkey.error.value" />
                     </template>
-                    <div v-if="showOAuth" class="flex gap-4 justify-center items-center">
+                    <div v-if="showOAuth" class="flex items-center justify-center gap-4">
                         <Button
                             v-for="provider in providers"
                             :key="provider.name"
diff --git a/resources/js/pages/users/Edit.vue b/resources/js/pages/users/Edit.vue
index 4a6f3304d04..43afe49fb02 100644
--- a/resources/js/pages/users/Edit.vue
+++ b/resources/js/pages/users/Edit.vue
@@ -15,11 +15,12 @@ defineProps([
     'itemActions',
     'itemActionUrl',
     'twoFactor',
+    'passkeyEnabled'
 ]);
 </script>
 
 <template>
-    <div class="max-w-5xl 3xl:max-w-6xl mx-auto" data-max-width-wrapper>
+    <div class="max-w-5xl mx-auto 3xl:max-w-6xl" data-max-width-wrapper>
         <Head :title="__('Edit User')" />
 
         <UserPublishForm
@@ -37,6 +38,7 @@ defineProps([
             :initial-item-actions="itemActions"
             :item-action-url="itemActionUrl"
             :two-factor="twoFactor"
+            :passkey-enabled="passkeyEnabled"
         />
     </div>
 </template>
\ No newline at end of file
diff --git a/src/Http/Controllers/CP/Auth/LoginController.php b/src/Http/Controllers/CP/Auth/LoginController.php
index c8f8d3c5406..1792db8fa60 100644
--- a/src/Http/Controllers/CP/Auth/LoginController.php
+++ b/src/Http/Controllers/CP/Auth/LoginController.php
@@ -44,6 +44,7 @@ public function showLoginForm(Request $request)
             'referer' => $this->getReferrer($request),
             'forgotPasswordUrl' => cp_route('password.request'),
             'submitUrl' => cp_route('login'),
+            'passkeyEnabled' => config('statamic.webauthn.enable_login_with_passkey'),
             'passkeyOptionsUrl' => cp_route('passkeys.auth.options'),
             'passkeyVerifyUrl' => cp_route('passkeys.auth'),
         ]);
@@ -53,11 +54,11 @@ private function oauthProviders()
     {
         $redirect = parse_url(cp_route('index'))['path'];
 
-        return OAuth::providers()->map(fn (Provider $provider) => [
+        return OAuth::providers()->map(fn(Provider $provider) => [
             'name' => $provider->name(),
             'label' => $provider->label(),
-            'icon' => Statamic::svg('oauth/'.$provider->name()),
-            'url' => $provider->loginUrl().'?redirect='.$redirect,
+            'icon' => Statamic::svg('oauth/' . $provider->name()),
+            'url' => $provider->loginUrl() . '?redirect=' . $redirect,
         ])->values();
     }
 
@@ -107,7 +108,7 @@ public function redirectPath()
     {
         $cp = cp_route('index');
         $referer = request('referer');
-        $referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
+        $referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp . '/auth/');
 
         return $referredFromCp ? $referer : $cp;
     }
diff --git a/src/Http/Controllers/CP/Auth/PasskeyController.php b/src/Http/Controllers/CP/Auth/PasskeyController.php
index 85c4ab9b355..e82465597ad 100644
--- a/src/Http/Controllers/CP/Auth/PasskeyController.php
+++ b/src/Http/Controllers/CP/Auth/PasskeyController.php
@@ -14,6 +14,11 @@ class PasskeyController
 {
     public function index()
     {
+        // redirect if passkeys are disabled
+        if (!config('statamic.webauthn.enable_login_with_passkey')) {
+            return redirect(cp_route('users.edit', User::current()->id()));
+        }
+
         return Inertia::render('users/Passkeys', [
             'passkeys' => User::current()->passkeys()->map(function (Passkey $passkey) {
                 return [
diff --git a/src/Http/Controllers/CP/Users/UsersController.php b/src/Http/Controllers/CP/Users/UsersController.php
index d83f2108770..ec7be4fd46f 100644
--- a/src/Http/Controllers/CP/Users/UsersController.php
+++ b/src/Http/Controllers/CP/Users/UsersController.php
@@ -113,15 +113,15 @@ protected function searchUsers($search, $query, $useIndex = true)
 
         $query->where(function ($query) use ($search) {
             $query
-                ->where('email', 'like', '%'.$search.'%')
+                ->where('email', 'like', '%' . $search . '%')
                 ->when(User::blueprint()->hasField('first_name'), function ($query) use ($search) {
                     foreach (explode(' ', $search) as $word) {
                         $query
-                            ->orWhere('first_name', 'like', '%'.$word.'%')
-                            ->orWhere('last_name', 'like', '%'.$word.'%');
+                            ->orWhere('first_name', 'like', '%' . $word . '%')
+                            ->orWhere('last_name', 'like', '%' . $word . '%');
                     }
                 }, function ($query) use ($search) {
-                    $query->orWhere('name', 'like', '%'.$search.'%');
+                    $query->orWhere('name', 'like', '%' . $search . '%');
                 });
         });
 
@@ -145,18 +145,18 @@ public function create(Request $request)
 
         $fields = $blueprint->fields()->preProcess();
 
-        $broker = config('statamic.users.passwords.'.PasswordReset::BROKER_ACTIVATIONS);
+        $broker = config('statamic.users.passwords.' . PasswordReset::BROKER_ACTIVATIONS);
         $expiry = config("auth.passwords.{$broker}.expire") / 60;
 
         $additional = $fields->all()
-            ->reject(fn ($field) => in_array($field->handle(), ['roles', 'groups', 'super']))
-            ->reject(fn ($field) => in_array($field->visibility(), ['read_only', 'computed']))
+            ->reject(fn($field) => in_array($field->handle(), ['roles', 'groups', 'super']))
+            ->reject(fn($field) => in_array($field->visibility(), ['read_only', 'computed']))
             ->keys();
 
         $viewData = [
             'values' => (object) $fields->values()->only($additional)->all(),
             'meta' => (object) $fields->meta()->all(),
-            'fields' => collect($blueprint->fields()->toPublishArray())->filter(fn ($field) => $additional->contains($field['handle']))->values()->all(),
+            'fields' => collect($blueprint->fields()->toPublishArray())->filter(fn($field) => $additional->contains($field['handle']))->values()->all(),
             'blueprint' => $blueprint->toPublishArray(),
             'expiry' => $expiry,
             'separateNameFields' => $blueprint->hasField('first_name'),
@@ -290,6 +290,7 @@ public function edit(Request $request, $user)
                     ],
                 ],
             ] : null,
+            'passkeyEnabled' => config('statamic.webauthn.enable_login_with_passkey'),
         ];
 
         if ($request->wantsJson()) {

From 18a71135ab3565f6307392bb7a41f1c70dffbb4c Mon Sep 17 00:00:00 2001
From: JasperWelsing <jasper@digitaldeer.nl>
Date: Tue, 3 Feb 2026 12:29:59 +0100
Subject: [PATCH 2/2] run formatter

---
 config/webauthn.php                              |  1 -
 src/Http/Controllers/CP/Auth/LoginController.php |  8 ++++----
 .../Controllers/CP/Auth/PasskeyController.php    |  2 +-
 .../Controllers/CP/Users/UsersController.php     | 16 ++++++++--------
 4 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/config/webauthn.php b/config/webauthn.php
index 2908be64e1c..1c11897fa03 100644
--- a/config/webauthn.php
+++ b/config/webauthn.php
@@ -13,7 +13,6 @@
 
     'enable_login_with_passkey' => env('STATAMIC_PASSKEY_ENABLED', true),
 
-
     /*
     |--------------------------------------------------------------------------
     | Allow password logins to be used when user has a passkey
diff --git a/src/Http/Controllers/CP/Auth/LoginController.php b/src/Http/Controllers/CP/Auth/LoginController.php
index 1792db8fa60..1b4dbfa25b0 100644
--- a/src/Http/Controllers/CP/Auth/LoginController.php
+++ b/src/Http/Controllers/CP/Auth/LoginController.php
@@ -54,11 +54,11 @@ private function oauthProviders()
     {
         $redirect = parse_url(cp_route('index'))['path'];
 
-        return OAuth::providers()->map(fn(Provider $provider) => [
+        return OAuth::providers()->map(fn (Provider $provider) => [
             'name' => $provider->name(),
             'label' => $provider->label(),
-            'icon' => Statamic::svg('oauth/' . $provider->name()),
-            'url' => $provider->loginUrl() . '?redirect=' . $redirect,
+            'icon' => Statamic::svg('oauth/'.$provider->name()),
+            'url' => $provider->loginUrl().'?redirect='.$redirect,
         ])->values();
     }
 
@@ -108,7 +108,7 @@ public function redirectPath()
     {
         $cp = cp_route('index');
         $referer = request('referer');
-        $referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp . '/auth/');
+        $referredFromCp = Str::startsWith($referer, $cp) && ! Str::startsWith($referer, $cp.'/auth/');
 
         return $referredFromCp ? $referer : $cp;
     }
diff --git a/src/Http/Controllers/CP/Auth/PasskeyController.php b/src/Http/Controllers/CP/Auth/PasskeyController.php
index e82465597ad..b72eb08a52d 100644
--- a/src/Http/Controllers/CP/Auth/PasskeyController.php
+++ b/src/Http/Controllers/CP/Auth/PasskeyController.php
@@ -15,7 +15,7 @@ class PasskeyController
     public function index()
     {
         // redirect if passkeys are disabled
-        if (!config('statamic.webauthn.enable_login_with_passkey')) {
+        if (! config('statamic.webauthn.enable_login_with_passkey')) {
             return redirect(cp_route('users.edit', User::current()->id()));
         }
 
diff --git a/src/Http/Controllers/CP/Users/UsersController.php b/src/Http/Controllers/CP/Users/UsersController.php
index ec7be4fd46f..7220ab181f4 100644
--- a/src/Http/Controllers/CP/Users/UsersController.php
+++ b/src/Http/Controllers/CP/Users/UsersController.php
@@ -113,15 +113,15 @@ protected function searchUsers($search, $query, $useIndex = true)
 
         $query->where(function ($query) use ($search) {
             $query
-                ->where('email', 'like', '%' . $search . '%')
+                ->where('email', 'like', '%'.$search.'%')
                 ->when(User::blueprint()->hasField('first_name'), function ($query) use ($search) {
                     foreach (explode(' ', $search) as $word) {
                         $query
-                            ->orWhere('first_name', 'like', '%' . $word . '%')
-                            ->orWhere('last_name', 'like', '%' . $word . '%');
+                            ->orWhere('first_name', 'like', '%'.$word.'%')
+                            ->orWhere('last_name', 'like', '%'.$word.'%');
                     }
                 }, function ($query) use ($search) {
-                    $query->orWhere('name', 'like', '%' . $search . '%');
+                    $query->orWhere('name', 'like', '%'.$search.'%');
                 });
         });
 
@@ -145,18 +145,18 @@ public function create(Request $request)
 
         $fields = $blueprint->fields()->preProcess();
 
-        $broker = config('statamic.users.passwords.' . PasswordReset::BROKER_ACTIVATIONS);
+        $broker = config('statamic.users.passwords.'.PasswordReset::BROKER_ACTIVATIONS);
         $expiry = config("auth.passwords.{$broker}.expire") / 60;
 
         $additional = $fields->all()
-            ->reject(fn($field) => in_array($field->handle(), ['roles', 'groups', 'super']))
-            ->reject(fn($field) => in_array($field->visibility(), ['read_only', 'computed']))
+            ->reject(fn ($field) => in_array($field->handle(), ['roles', 'groups', 'super']))
+            ->reject(fn ($field) => in_array($field->visibility(), ['read_only', 'computed']))
             ->keys();
 
         $viewData = [
             'values' => (object) $fields->values()->only($additional)->all(),
             'meta' => (object) $fields->meta()->all(),
-            'fields' => collect($blueprint->fields()->toPublishArray())->filter(fn($field) => $additional->contains($field['handle']))->values()->all(),
+            'fields' => collect($blueprint->fields()->toPublishArray())->filter(fn ($field) => $additional->contains($field['handle']))->values()->all(),
             'blueprint' => $blueprint->toPublishArray(),
             'expiry' => $expiry,
             'separateNameFields' => $blueprint->hasField('first_name'),