Skip to content

[DO NOT MERGE WIP] Feature: WebAuthn Login#3580

Draft
hajinsuha1 wants to merge 88 commits intodevelopfrom
feature/webauthn-login
Draft

[DO NOT MERGE WIP] Feature: WebAuthn Login#3580
hajinsuha1 wants to merge 88 commits intodevelopfrom
feature/webauthn-login

Conversation

@hajinsuha1
Copy link
Collaborator

@hajinsuha1 hajinsuha1 commented Jan 15, 2026

TODO: Need to make a PR to update the extra-features-e2e-branch (example PR)

  • enable passkey
  • setup client ID with relying party

Description

This branch contains the following PRs:

Types of Changes

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Documentation update
  • Breaking change (could cause existing functionality to not work as expected)
  • Other changes (non-breaking changes that does not fit any of the above)

Breaking changes include:

  • Removing a public function or component or prop
  • Adding a required argument to a function
  • Changing the data type of a function parameter or return value
  • Adding a new peer dependency to package.json

Changes

  • (change1)

How to Test-Drive This PR

  • (step1)
  • test when browser does not support webauthn

Checklists

General

  • Changes are covered by test cases
  • CHANGELOG.md updated with a short description of changes (not required for documentation updates)

Accessibility Compliance

You must check off all items in one of the follow two lists:

  • There are no changes to UI

or...

Localization

  • Changes include a UI text update in the Retail React App (which requires translation)

hajinsuha1 and others added 11 commits November 5, 2025 14:43
- Created CreatePasskeyModal component for registering new passkeys with custom nicknames
- Added useAccountCreatedToast hook to show success toast with passkey promotion after account creation
- Integrated passkey registration flow into auth modal, checkout confirmation, and registration pages
- Implemented initial WebAuthn registration API call to /oauth2/webauthn/register/authorize
- Added UI elements for passkey nickname input and registration button
- Update
- Renamed CreatePasskeyModal component to PasskeyRegistrationModal for clearer naming
- Renamed useAccountCreatedToast hook to usePasskeyRegistration to better reflect its purpose
- Refactored modal state management to pass props directly instead of wrapping in component
- Updated imports and references across auth, registration and checkout confirmation pages
- Simplified modal state object returned from usePasskeyRegistration hook
- Updated component
- Added two-step passkey registration flow with email verification code
- Implemented WebAuthn credential creation using browser's native API
- Added base64url encoding/decoding utilities for WebAuthn binary data handling
- Created verification code input with auto-submit on 8 digits
- Added resend code functionality for verification step
- Added state management to handle registration steps and form data
- Updated modal UI to show different
- Moved PasskeyRegistrationModal from auth/registration/checkout pages to account page for consistent user experience
- Added session storage flag 'newAccountCreated' to track when to show passkey registration prompt
- Simplified registration flow by removing duplicate passkey modal instances
- Updated auth flows to defer passkey registration until user reaches account page
- Removed unused passkey imports from auth-modal, registration,
- Replaced direct sessionStorage calls with utility functions (setSessionJSONItem, getSessionJSONItem, clearSessionJSONItem)
- Consolidated new account flag handling across auth modal, registration, checkout, and account pages
- Added temporary login trigger for passkey registration testing
- Updated all components to use consistent storage approach for newAccountCreated flag
@cc-prodsec
Copy link
Collaborator

cc-prodsec commented Jan 15, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@hajinsuha1 hajinsuha1 changed the title [DO NOT MERGE WIP] Feature/webauthn login [DO NOT MERGE WIP] Feature: WebAuthn Login Jan 15, 2026
jeremy-jung1 and others added 17 commits January 15, 2026 15:10
…error handling

- Integrated finishWebauthnAuthentication to complete the passkey login flow.
- Improved error handling and logging for authentication processes.
- Added helper functions for base64url encoding/decoding to facilitate credential processing.
Co-authored-by: Jinsu Ha <j.ha@salesforce.com>
jeremy-jung1 and others added 17 commits January 28, 2026 15:02
* add new usePasskeyLogin hook to be used to initiate passkey login
* call usePasskeyLogin from ContactInfo page
* ensure merge basket is handled
…-modal

Signed-off-by: jeremy-jung1 <140001271+jeremy-jung1@users.noreply.github.com>
…d remove obsolete TypeScript ignore comment in Auth class.
…key-in-auth-modal

@W-20224220 Passkey login in auth modal and login page
Signed-off-by: Jinsu Ha <91205717+hajinsuha1@users.noreply.github.com>
@hajinsuha1 hajinsuha1 added the skip changelog Skip the "Changelog Check" GitHub Actions step even if the Changelog.md files are not updated label Feb 4, 2026
hajinsuha1 and others added 9 commits February 11, 2026 12:18
* Add passkey login validation to E2E tests
* Introduced a new function `validatePasskeyLogin` in `pageHelpers.js` to simulate passkey authentication using a virtual authenticator.
* Added 60s timeout prior to running passkey login tests in both desktop and mobile test suites to handle authentication cooldowns.
Signed-off-by: Jinsu Ha <91205717+hajinsuha1@users.noreply.github.com>
display user-friendly error message for errors during passkey login and registration
…way (#3688)

* Refactored passkey login logic in ContactInfo component to only prompt when step is not CONTACT_INFO
* Updated AuthModal, Login, ContactInfo to abort passkey login when unmounted
* Added abort functionality to usePasskeyLogin hook
* Enhanced passkey login handling with abort in
Signed-off-by: Jinsu Ha <91205717+hajinsuha1@users.noreply.github.com>
@salesforce-cla
Copy link

Thanks for the contribution! It looks like @jeremy-jung1 is an internal user so signing the CLA is not required. However, we need to confirm this.

@salesforce-cla
Copy link

Thanks for the contribution! Before we can merge this, we need @yunakim714 to sign the Salesforce Inc. Contributor License Agreement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla:missing skip changelog Skip the "Changelog Check" GitHub Actions step even if the Changelog.md files are not updated

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants