Skip to content

@W-20224082 - [Webauthn] Create passkey in browser and register in SLAS#3584

Merged
yunakim714 merged 33 commits intofeature/webauthn-loginfrom
W-20224082-passkey-registration
Jan 27, 2026
Merged

@W-20224082 - [Webauthn] Create passkey in browser and register in SLAS#3584
yunakim714 merged 33 commits intofeature/webauthn-loginfrom
W-20224082-passkey-registration

Conversation

@yunakim714
Copy link
Collaborator

@yunakim714 yunakim714 commented Jan 16, 2026

Description

Submitting the OTP should prompt the shopper to create a passkey on the browser, which is then registered in SLAS.

Types of Changes

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Documentation update
  • Breaking change (could cause existing functionality to not work as expected)
  • Other changes (non-breaking changes that does not fit any of the above)

Breaking changes include:

  • Removing a public function or component or prop
  • Adding a required argument to a function
  • Changing the data type of a function parameter or return value
  • Adding a new peer dependency to package.json

Changes

  • Once shopper inputs the OTP, they are prompted to create a passkey on the browser
    • Submitting the OTP sends a POST to the /webauthn/register/start endpoint
    • navigator.credentials.create() is then called with the response data from the start endpoint
    • The response from the navigator is then used to send a POST to the /webauthn/register/finish endpoint to save the passkey

How to Test-Drive This PR

Screenshot 2026-01-26 at 12 06 08 PM Screenshot 2026-01-26 at 12 06 13 PM

To run unit tests:

  • Run npm run test app/components/passkey-registration-modal

Checklists

General

  • Changes are covered by test cases
  • CHANGELOG.md updated with a short description of changes (not required for documentation updates)

Accessibility Compliance

You must check off all items in one of the follow two lists:

  • There are no changes to UI

or...

Localization

  • Changes include a UI text update in the Retail React App (which requires translation)

@cc-prodsec
Copy link
Collaborator

cc-prodsec commented Jan 16, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

resendAttempt: true
})
await handleSendEmailOtp(form.getValues('email'))
otpInputs.clear()
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should clear the OTP input when shopper clicks Resend Code

Base automatically changed from W-20474693-passkey-creation to feature/webauthn-login January 20, 2026 20:43
yunakim714 and others added 2 commits January 20, 2026 15:45
…ation

Signed-off-by: Yuna Kim <84923642+yunakim714@users.noreply.github.com>
…ceCommerceCloud/pwa-kit into W-20224082-passkey-registration
@yunakim714 yunakim714 marked this pull request as ready for review January 21, 2026 19:46
@yunakim714 yunakim714 requested a review from a team as a code owner January 21, 2026 19:46
@yunakim714 yunakim714 added the skip changelog Skip the "Changelog Check" GitHub Actions step even if the Changelog.md files are not updated label Jan 26, 2026
Comment on lines +194 to +199
const errorMessage =
err.message ||
formatMessage({
id: 'passkey_registration.modal.error.registration_failed',
defaultMessage: 'Failed to register passkey'
})
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we always return the localized error message and never the api error mesage? or map error messages from the API to a localized message similar to what we did here: https://salesforce.quip.com/97bPANYv5D2U

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thinking through this again, we will definitely need a localized error for some errors like when the /webauthn/register/authorize returns "Too many webauthn user authorization requests were made. Please try again later.".

How about we keep the error handling generic and create a separate story for error handling for registration and login to make sure we handle all the cases.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

})
} catch (createError) {
// Handle user cancellation or other errors from the WebAuthn API
if (createError.name === 'NotAllowedError' || createError.name === 'AbortError') {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we include a comment on when each of these errors are thrown?
e.g., AbortError implies the action was stopped, NotAllowedError implies a lack of permission or authorization.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will be addressed in the error handling ticket - will note in the description of the new work item!

@yunakim714 yunakim714 merged commit 9b304ef into feature/webauthn-login Jan 27, 2026
15 of 40 checks passed
@yunakim714 yunakim714 deleted the W-20224082-passkey-registration branch January 27, 2026 16:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip changelog Skip the "Changelog Check" GitHub Actions step even if the Changelog.md files are not updated

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants