This looks great! I will definitely be taking a close look. Only thing I noticed with a quick try is that portier allows both a magic link and code for passwordless email login. Magic links are much more vulnerable to attack than codes because the email providers and anyone who may have access to your email can hijack your login from any location. I think it's fine to provide magic links but that choice should be the user's option when they enter their email, after warning them of the security implications.
EDIT: They actually address this in their non-goals document[0] but disagree with the decision, since many users may not realize the tradeoffs.
EDIT: They actually address this in their non-goals document[0] but disagree with the decision, since many users may not realize the tradeoffs.
[0]: https://github.com/portier/portier.github.io/blob/main/Non-G...