feat(auth-client): add passkey registration and management methods by MagentaManifold · Pull Request #20304 · mozilla/fxa

MagentaManifold · 2026-04-01T19:55:36Z

Because

we need to use these endpoints in settings

This pull request

add these methods to auth-client

Issue that this pull request solves

Closes: FXA-13071

Checklist

Put an x in the boxes that apply

My commit is GPG signed.
If applicable, I have modified or added tests which pass locally.
I have added necessary documentation (if appropriate).
I have verified that my changes render correctly in RTL (if appropriate).
I have manually reviewed all AI generated code.

How to review (Optional)

Key files/areas to focus on:
Suggested review order:
Risky or complex parts:

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

Copilot

Pull request overview

Adds client-side support for passkey (WebAuthn) registration and passkey management by exposing the relevant auth-server endpoints through fxa-auth-client, alongside a small server response-schema tweak and a shared Settings-side Passkey type.

Changes:

Added passkey registration start/finish and passkey list/delete/rename methods to fxa-auth-client.
Updated auth-server validation for passkey registration finish responses (lastUsedAt can be null, and response is a metadata subset).
Introduced and re-exported a Passkey TypeScript interface in fxa-settings passkeys lib.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
packages/fxa-settings/src/lib/passkeys/types.ts	Adds a `Passkey` interface representing passkey metadata returned by APIs.
packages/fxa-settings/src/lib/passkeys/index.ts	Re-exports the new `types` module from the passkeys lib entrypoint.
packages/fxa-auth-server/lib/routes/passkeys.ts	Aligns `/passkey/registration/finish` response validation with nullable `lastUsedAt` and a reduced response shape.
packages/fxa-auth-client/lib/client.ts	Adds new passkey-related client methods and introduces `jwtPatch` helper.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-01T20:01:45Z

+import type {
+  PublicKeyCredentialCreationOptionsJSON,
+  Passkey,
+} from './../../fxa-settings/src/lib/passkeys';


The auth-client package is importing types via a relative path into fxa-settings (./../../fxa-settings/src/lib/passkeys). Even as a type-only import, this will typically appear in the generated .d.ts and/or pull those source files into the auth-client TS program, which can break consumers that install fxa-auth-client without the fxa-settings sources and can unintentionally publish fxa-settings code as part of auth-client’s build output. Consider moving these shared Passkey/WebAuthn JSON types into a dedicated shared package (e.g. @fxa/shared or @fxa/accounts/passkey) or duplicating the minimal interfaces inside fxa-auth-client and exporting them from there, instead of importing from another package’s src/ directory.

MagentaManifold · 2026-04-01T19:58:09Z

-            aaguid: isA.string().required(),
-            backupEligible: isA.boolean().required(),
-            backupState: isA.boolean().required(),
-            prfEnabled: isA.boolean().required(),


Accidentally included these in the last PR 😓 Also lastUsedAt should be nullable (not directly related to this PR, but I want to sneak in the fixes)

We should probably at least keep prfEnabled?

MagentaManifold · 2026-04-01T20:04:59Z

+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+export interface Passkey {


Not sure if this is the best place to put the type; open to suggestions

MagentaManifold · 2026-04-01T20:06:39Z

+import type {
+  PublicKeyCredentialCreationOptionsJSON,
+  Passkey,
+} from './../../fxa-settings/src/lib/passkeys';


Surprise to see that we have so few imports here! A lot of methods in AuthClient implicitly returns any

vpomerleau

Considering the number of duplicated types, it might be good to move these to a shared location now to prevent drift, but not a blocker since we already have other duplicated types.

vpomerleau · 2026-04-06T17:07:32Z

+// NOTE: These passkey/webauthn related types are duplicated from fxa-settings.
+// We cannot import them because it will cause circular dependencies, which nx
+// does not allow.
+// TODO: We should consider moving these types to a shared package


/libs/shared/types might be a good shared location?

vpomerleau · 2026-04-06T17:09:40Z

-            aaguid: isA.string().required(),
-            backupEligible: isA.boolean().required(),
-            backupState: isA.boolean().required(),
-            prfEnabled: isA.boolean().required(),


We should probably at least keep prfEnabled?

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T13:53:30Z

+      expect(result).toEqual({
+        credentialId: mockPasskeyRecord.credentialId.toString('base64url'),
+        name: mockPasskeyRecord.name,
+        createdAt: mockPasskeyRecord.createdAt,
+        lastUsedAt: mockPasskeyRecord.lastUsedAt,
+        transports: mockPasskeyRecord.transports,


The route tests only cover the lastUsedAt value being a number, but the route schema was updated to allow lastUsedAt: null (which is the value returned for newly registered passkeys). Consider adding a test case (or adjusting the mock) where mockPasskeyRecord.lastUsedAt is null to ensure the handler mapping and response schema validation work for that case.

Because: * we need to use these endpoints in settings This commit: * add these methods to auth-client * adds more fields in the response of /passkey/registration/finish Closes FXA-13071

MagentaManifold requested a review from a team as a code owner April 1, 2026 19:55

Copilot AI review requested due to automatic review settings April 1, 2026 19:55

Copilot started reviewing on behalf of MagentaManifold April 1, 2026 19:56 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

MagentaManifold commented Apr 1, 2026

View reviewed changes

MagentaManifold marked this pull request as draft April 1, 2026 20:08

MagentaManifold force-pushed the FXA-13071 branch from 8417840 to 9727435 Compare April 2, 2026 16:18

MagentaManifold marked this pull request as ready for review April 2, 2026 16:57

vpomerleau approved these changes Apr 6, 2026

View reviewed changes

MagentaManifold force-pushed the FXA-13071 branch from 9727435 to ef98281 Compare April 7, 2026 04:20

MagentaManifold requested a review from Copilot April 7, 2026 13:47

Copilot started reviewing on behalf of MagentaManifold April 7, 2026 13:48 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

feat(auth-client): add passkey registration and management methods

cee220d

Because: * we need to use these endpoints in settings This commit: * add these methods to auth-client * adds more fields in the response of /passkey/registration/finish Closes FXA-13071

MagentaManifold force-pushed the FXA-13071 branch from ef98281 to cee220d Compare April 7, 2026 14:41

MagentaManifold merged commit 6528e16 into main Apr 7, 2026
22 checks passed

MagentaManifold deleted the FXA-13071 branch April 7, 2026 15:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth-client): add passkey registration and management methods#20304

feat(auth-client): add passkey registration and management methods#20304
MagentaManifold merged 1 commit intomainfrom
FXA-13071

MagentaManifold commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Uh oh!

Uh oh!

MagentaManifold Apr 1, 2026 •

edited

Loading

Uh oh!

vpomerleau Apr 6, 2026

Uh oh!

MagentaManifold Apr 1, 2026

Uh oh!

MagentaManifold Apr 1, 2026

Uh oh!

vpomerleau left a comment

Uh oh!

vpomerleau Apr 6, 2026

Uh oh!

vpomerleau Apr 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

MagentaManifold commented Apr 1, 2026

Because

This pull request

Issue that this pull request solves

Checklist

How to review (Optional)

Screenshots (Optional)

Other information (Optional)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MagentaManifold Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vpomerleau Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

MagentaManifold Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

MagentaManifold Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau left a comment

Choose a reason for hiding this comment

Uh oh!

vpomerleau Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MagentaManifold Apr 1, 2026 •

edited

Loading