Fix stale docs: WebAuthn now fully implemented, Phase 6 complete

API-Reference.md

@@ -392,23 +392,23 @@ Subscribe to push notifications.
 
 Unsubscribe from push notifications.
 
-## WebAuthn (Scaffolding)
+## WebAuthn (Passkeys)
 
 ### POST /auth/webauthn/register/begin
 
-Begin passkey registration. Returns WebAuthn options.
+Begin passkey registration for authenticated user. Returns WebAuthn credential creation options.
 
 ### POST /auth/webauthn/register/finish
 
-Finish passkey registration. (Not yet implemented)
+Complete passkey registration. Stores credential in `webauthn_credentials` table.
 
 ### POST /auth/webauthn/login/begin
 
-Begin passkey login. (Not yet implemented)
+Begin passkey login (no auth required). Returns WebAuthn assertion options.
 
 ### POST /auth/webauthn/login/finish
 
-Finish passkey login. (Not yet implemented)
+Complete passkey login. Creates session and sets cookie on success.
 
 ## File Upload
 

Phase-6.md

@@ -28,24 +28,25 @@ Phase 6 adds roles & permissions, push notifications, WebAuthn passkeys, and RES
 | Frontend push store | ✅ | Subscribe/unsubscribe with VAPID key fetch |
 | Settings UI toggle | ✅ | [ENABLE PUSH] / [DISABLE PUSH] in UserSettings |
 | Service worker | ✅ | Handles push events and notification clicks |
+| Mention parsing | ✅ | Parses @user, @everyone, @role and dispatches push |
 
 ### WebAuthn Passkeys
 
 | Feature | Status | Description |
 |---------|--------|-------------|
-| Backend scaffolding | ✅ | Registration and login endpoints (begin/finish) |
+| Backend complete | ✅ | Full registration and login begin/finish flow |
 | Credential storage | ✅ | webauthn_credentials table |
+| Challenge store | ✅ | In-memory challenge store with eviction |
 | Frontend register | ✅ | [REGISTER PASSKEY] button in UserSettings |
 | Frontend login | ✅ | [SIGN IN WITH PASSKEY] button on LoginForm |
-| Backend completion | ⏳ | Begin/finish flow needs full implementation |
 
 ### REST API Documentation
 
 | Feature | Status | Description |
 |---------|--------|-------------|
-| Swagger annotations | ✅ | @title, @version, @host, @BasePath on main.go |
+| Swagger annotations | ✅ | Full @Summary/@Router/@Param/@Success/@Security on all handlers |
 | Swagger UI | ✅ | Served at `/docs` endpoint |
-| Generated spec | ✅ | `docs/swagger.json`, `docs/swagger.yaml` |
+| Generated spec | ✅ | `docs/swagger.json`, `docs/swagger.yaml` with all endpoints |
 | Makefile target | ✅ | `make docs` to regenerate |
 
 ## API Endpoints
@@ -124,9 +125,3 @@ http://localhost:8080/docs
 | CONNECT_VOICE | 8 | 256 |
 | SPEAK_VOICE | 9 | 512 |
 | SHARE_SCREEN | 10 | 1024 |
-
-## What's Next
-
-- Complete WebAuthn backend (full begin/finish flow)
-- Add swaggo annotations to individual handlers for detailed API docs
-- Push notification mention parsing and dispatch