feat(backend): WASM sandbox, BullMQ queues + DLQ, GraphQL subscriptions, WebAuthn core (BE-010, BE-006, BE-007, BE-008 partial)

backend/package.json

@@ -21,6 +21,8 @@
     "bench": "tsx benchmarks/runBenchmarks.ts",
     "collaboration": "tsx src/collaborationServer.ts",
     "collab:graphql": "tsx src/graphqlWsServer.ts",
+    "workers:queues": "tsx src/workers/queueWorkers.ts",
+    "start:workers": "node dist/workers/queueWorkers.js",
     "load:ws": "node scripts/ws-load-test.js",
     "db:seed": "tsx prisma/seed.ts",
     "migrate:locked": "tsx scripts/migrate-with-lock.ts"
@@ -33,6 +35,7 @@
     "@aws-sdk/client-kms": "^3.1076.0",
     "@aws-sdk/client-s3": "^3.1117.0",
     "@aws-sdk/lib-storage": "^3.1076.0",
+    "@graphql-tools/schema": "^10.0.33",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
     "@opentelemetry/resources": "^2.10.0",

backend/prisma/migrations/20261021000000_webauthn_passkeys/migration.sql

@@ -0,0 +1,50 @@
+-- CreateTable
+CREATE TABLE "webauthn_credentials" (
+    "id" TEXT NOT NULL,
+    "studentId" TEXT NOT NULL,
+    "credentialId" TEXT NOT NULL,
+    "publicKey" BYTEA NOT NULL,
+    "algorithm" INTEGER NOT NULL,
+    "signCount" BIGINT NOT NULL DEFAULT 0,
+    "transports" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "aaguid" TEXT,
+    "attestationFormat" TEXT NOT NULL,
+    "attestationType" TEXT NOT NULL,
+    "userVerified" BOOLEAN NOT NULL DEFAULT false,
+    "backupEligible" BOOLEAN NOT NULL DEFAULT false,
+    "backedUp" BOOLEAN NOT NULL DEFAULT false,
+    "deviceName" TEXT,
+    "cloneDetectedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastUsedAt" TIMESTAMP(3),
+
+    CONSTRAINT "webauthn_credentials_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "webauthn_challenges" (
+    "id" TEXT NOT NULL,
+    "challenge" TEXT NOT NULL,
+    "ceremony" TEXT NOT NULL,
+    "studentId" TEXT,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "webauthn_challenges_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "webauthn_credentials_credentialId_key" ON "webauthn_credentials"("credentialId");
+
+-- CreateIndex
+CREATE INDEX "webauthn_credentials_studentId_idx" ON "webauthn_credentials"("studentId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "webauthn_challenges_challenge_key" ON "webauthn_challenges"("challenge");
+
+-- CreateIndex
+CREATE INDEX "webauthn_challenges_expiresAt_idx" ON "webauthn_challenges"("expiresAt");
+
+-- AddForeignKey
+ALTER TABLE "webauthn_credentials" ADD CONSTRAINT "webauthn_credentials_studentId_fkey" FOREIGN KEY ("studentId") REFERENCES "students"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+

backend/prisma/schema.prisma

@@ -39,6 +39,7 @@ model Student {
   ideas            Idea[]
   votes            Vote[]
   passkeyCredentials PasskeyCredential[]
+  webauthnCredentials WebAuthnCredential[]
   hashSimulations  HashSimulation[]
   subscriptions    Subscription[]
 
@@ -68,6 +69,53 @@ model PasskeyCredential {
   @@map("passkey_credentials")
 }
 
+/// FIDO2/WebAuthn passkey bound to a student (BE-008).
+model WebAuthnCredential {
+  id                String    @id @default(cuid())
+  studentId         String
+  /// base64url credential ID chosen by the authenticator
+  credentialId      String    @unique
+  /// COSE_Key-encoded credential public key
+  publicKey         Bytes
+  /// COSE algorithm identifier (-7 ES256, -8 EdDSA, -257 RS256, ...)
+  algorithm         Int
+  /// Authenticator signature counter (uint32, hence BigInt)
+  signCount         BigInt    @default(0)
+  transports        String[]  @default([])
+  aaguid            String?
+  attestationFormat String
+  /// none | self | basic
+  attestationType   String
+  userVerified      Boolean   @default(false)
+  backupEligible    Boolean   @default(false)
+  backedUp          Boolean   @default(false)
+  deviceName        String?
+  /// Set when a signature-counter regression indicates a cloned authenticator; the credential is then refused
+  cloneDetectedAt   DateTime?
+  createdAt         DateTime  @default(now())
+  lastUsedAt        DateTime?
+
+  student Student @relation(fields: [studentId], references: [id], onDelete: Cascade)
+
+  @@index([studentId])
+  @@map("webauthn_credentials")
+}
+
+/// Single-use WebAuthn challenge nonce with a 60-second TTL (BE-008).
+model WebAuthnChallenge {
+  id        String   @id @default(cuid())
+  /// base64url-encoded 32-byte random nonce
+  challenge String   @unique
+  /// registration | authentication
+  ceremony  String
+  studentId String?
+  expiresAt DateTime
+  createdAt DateTime @default(now())
+
+  @@index([expiresAt])
+  @@map("webauthn_challenges")
+}
+
 model OAuthState {
   id        String    @id @default(cuid())
   state     String    @unique