Passkey rpId migration (phases 1–2), a census, and two accessibility fixes - #293
Merged
Conversation
The viewport locked maximumScale/userScalable, blocking zoom for anyone who magnifies; BugReportSheet's textarea goes 14px -> 16px so iOS still never zooms on focus. .forge-page is now the main landmark, and the four routes that rendered their own <main> are divs. Both are tested.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reports what is actually in the credential store: verifiable vs keyless legacy credentials, stray sibling blobs, and how many credentials are bound to the theforged.fit rpId. CRON_SECRET-gated, reads only, and tested to stay that way.
abraraaa
changed the title
Registration from a heatwayve origin now mints under rpId heatwayve.app; the legacy origin still mints legacy, since no reverse Related Origin Requests document exists. Both verify routes accept the rpId set and store the one the library matched, and login backfills it onto older credentials from the verified assertion. Login plans a single-rpId ceremony and offers only that pool's credentials, preferring native. Sunset is 2026-11-16. The census also reports which profiles' photos a sunset wipe would target. It reports only — no delete path exists.
abraraaa
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Passkey migration
Every credential — including ones minted this week — is scoped to rpId
theforged.fit. An rpId is fixed at creation, so clearing that is a re-enrolment, not a data migration. Window closes 2026-11-16 (90 days).heatwayve.app. The legacy origin still mints legacy: no reverse Related Origin Requests document exists, so a ceremony genuinely on the old domain cannot claim the native rpId.expectedRPIDand store the one the library actually matched (registrationInfo.rpID/authenticationInfo.rpID). The rpId is never inferred.login-optionsplans a single-rpId ceremony and offers only that pool, preferring native. Keyless credentials are no longer offered — a ceremony using one fails at verification after costing a prompt.tests/auth-server.test.jspinned the old "one rpId forever" contract; those expectations are updated, and the fail-closed properties they guarded (localhost isolation, preview hosts, lookalike hosts) are kept and broadened.Census
GET /api/diag/passkey-census, CRON_SECRET-gated, read-only. Verifiable vs keyless credentials, stray sibling blobs, minting either side of the flip, rpId split — and a proposed photo kill list for the sunset, split into profiles that lose their lock at the sunset versus profiles already claimable today.It reports only. No delete path exists in this branch. The route imports no writer and exposes only
GET, both asserted by tests.Accessibility
Viewport no longer locks
maximumScale/userScalable;BugReportSheet's textarea goes 14px → 16px so iOS still never zooms on focus..forge-pageis the<main>landmark, and the four routes that rendered their own are divs.Lint, 1037 tests and the build pass.
Not in this branch: the sunset predicate. After 2026-11-16
login-optionscorrectly reports "no passkey" for a legacy-only profile, buthasRealPasskeystill counts legacy credentials, so/api/auth/checkand the sync DELETE gate would disagree with it. That is phase 4, along with the prompt UI and the photo wipe.