You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The autofillPasskeys feature intercepts navigator.credentials.get() for conditional WebAuthn passkey autofill on Windows. It shipped with no unit tests despite complex concurrency, messaging, and WebIDL semantics.
This PR adds focused Jasmine coverage for the highest-risk paths and fixes ESM import suffixes in autofill-passkeys.js so the module loads under the unit test runner (no runtime behavior change).
Risky behavior now covered
Request registration:registerPasskeyRequest notifies native with rpId + requestId, subscribes to passkeySelected, and completes via narrowed originalGet with decoded allowCredentials.
Concurrency: superseding a pending conditional request rejects the first promise with AbortError; AbortSignal abort/reason handling and already-aborted fast path.
Updated:injected/src/features/autofill-passkeys.js (.js suffix on ESM imports only)
Why these tests materially reduce regression risk
navigator.credentials.get is a security-sensitive, promise-based API. Regressions in pass-through conditions, abort/supersede handling, or native message correlation can hang site login flows or break WebAuthn ceremonies. These tests lock in the behavior explicitly documented in the #2571 review thread without requiring Windows/WebView2 integration infrastructure.
Testing Steps
cd injected && npm run test-unit -- --filter=AutofillPasskeys
Checklist
I have tested this change locally
I have tested this change locally in all supported browsers
This change will be visible to users
I have added automated tests that cover this change
I have ensured the change is gated by config
This change was covered by a ship review
This change was covered by a tech design
Any dependent config has been merged
Note
Low Risk
Test-only coverage plus import path fixes; no intentional changes to passkey interception behavior in production.
Overview
Adds Jasmine unit coverage for the AutofillPasskeys injected feature (conditional WebAuthn passkey interception) and tweaks ESM import paths in autofill-passkeys.js so the module loads under the unit test runner.
The new injected/unit-test/autofill-passkeys.js suite exercises registerPasskeyRequest: native registerPasskeyRequest notify with rpId/requestId, passkeySelected subscription, narrowed originalGet with decoded allowCredentials, rpId fallback to location.hostname when publicKey.rpId is not a string, superseding pending requests, and AbortSignal handling.
It also locks in message validation (wrong requestId, malformed credentialId, invalid base64) and WebIDL-style rejection when option getters throw, plus init wrapper pass-through for non-conditional mediation, missing publicKey, non-secure context, and non-singleton credentials.get receivers versus interception on navigator.credentials.
Production change: only .js suffixes on imports from content-feature and captured-globals; no intended runtime behavior change.
Reviewed by Cursor Bugbot for commit 3449a00. Bugbot is set up for automated code reviews on this repo. Configure here.
Add Jasmine tests for the Windows passkey interception flow merged in
#2571, covering request registration, native message correlation, abort
handling, supersede behavior, and credentials.get pass-through guards.
Fix ESM import paths in autofill-passkeys.js so the feature can be loaded
by the unit test runner (no behavior change).
Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Reviewed diff 7a9074e..0230491 — production change is import-path normalization only; the bulk of the PR is new unit tests for AutofillPasskeys.
Web Compatibility Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1, 10
info
Import paths gain explicit .js extensions (content-feature.js, captured-globals.js). No runtime behavior change; consistent with other strict-core feature files (web-compat.js, message-bridge.js).
injected/unit-test/autofill-passkeys.js
(new)
info
Tests validate existing pass-through paths that protect compatibility: non-conditional mediation, missing publicKey, non-secure context, foreign CredentialsContainer receiver, and WebIDL promise semantics (throwing option getters reject the returned promise rather than throwing synchronously).
No web-compat regressions identified in the production diff.
Security Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1, 10
info
No security-relevant logic changes.
injected/unit-test/autofill-passkeys.js
(new)
info
Tests exercise existing security boundaries: rpId falls back to location.hostname when not a string (blocks object-coercion attacks), requestId correlation prevents cross-request credential injection, malformed/empty credentialId values are ignored, invalid base64 rejects. Outbound notify payloads use explicit { rpId, requestId } — no nativeData spread risk.
No new security vulnerabilities introduced.
Risk Level
Low Risk — test-only coverage addition plus cosmetic import-path normalization; no changes to API overrides, messaging transports, captured globals, or initialization order.
Recommendations
(info) All 16 new specs pass locally. No blocking items.
(info) The tests are a solid regression harness for the existing registerPasskeyRequest / credentials.get wrapper contract. Consider adding an integration test (Playwright) in a follow-up if end-to-end native messaging isn't already covered elsewhere — not required for this PR.
(info) The .js import extension change is safe for the bundler pipeline; no action needed.
Verdict: Approve from web-compat and security perspective.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Injected PR Evaluation: Web Compatibility & Security
Web Compatibility Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
Only change is adding .js extensions to static imports (content-feature.js, captured-globals.js). This is a bundler/ESM path normalization with no runtime behavior change. Mixed extension usage exists elsewhere in the repo; this aligns with newer feature files.
injected/unit-test/autofill-passkeys.js
(all)
info
Test-only file. No injected page-world code ships from this diff.
injected/unit-test/autofill-passkeys.js
377–473
info
init credentials.get wrapper tests document important pass-through guards already in production: non-conditional mediation, missing publicKey, non-secure context, and foreign this receiver. These are the primary web-compat safety rails for the interception path.
No web-compatibility regressions identified in production code.
Security Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
No logic, messaging, or API-wrapping changes. Security posture of the live feature is unchanged.
injected/unit-test/autofill-passkeys.js
200–219
info
Test confirms rpId is only taken from publicKey.rpId when typeof === 'string', rejecting object coercion via toString() — matches the production guard at line 95.
injected/unit-test/autofill-passkeys.js
305–337
info
Tests verify requestId correlation and malformed credentialId rejection, covering the inbound message trust boundary exercised by passkeySelected subscription.
injected/unit-test/autofill-passkeys.js
187–191, 446–449
info
Assertions confirm outbound notify('registerPasskeyRequest', { rpId, requestId }) uses an explicit field list — no object spread that could leak nativeData.
injected/unit-test/autofill-passkeys.js
—
info
Coverage gap (not a regression): no test for init() early-return when CredentialsContainer / navigator.credentials is absent, and no test for the randomUUID unavailable fallback path (lines 77–80). These are follow-up opportunities, not blockers for this PR.
No security vulnerabilities introduced by this diff.
Risk Level
Low Risk — the diff adds unit-test coverage and normalizes import paths; it does not modify API override logic, messaging transports, captured globals, or wrapper utilities.
Recommendations
(info) Consider follow-up tests for init() bail-out when the Credentials API is missing, and for the randomUUID fallback that delegates to originalGet.
(info) If native ever delivers credential IDs as base64url (common in WebAuthn), consider a follow-up test + feature check — current atob() path only handles standard base64 (partially exercised by the invalid-base64 rejection test).
Approve — this PR improves confidence in existing passkey interception behavior without changing production semantics.
Cursor Automation — Web Compatibility & Security review
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility & Security Review
Web Compatibility Assessment
No web compatibility regressions identified.
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
Production diff is import-path normalization only (content-feature.js, captured-globals.js). No runtime behavior change.
injected/unit-test/autofill-passkeys.js
377–473
info
New tests document and lock in correct pass-through behavior: non-conditional mediation, missing publicKey, non-secure contexts, and foreign CredentialsContainer receivers. These guard against accidental broadening of the credentials.get interception.
injected/unit-test/autofill-passkeys.js
456–472
info
Tests confirm WebIDL promise semantics: option-getter throws surface as rejected promises, not synchronous throws — matching native get() contract.
Security Assessment
No security vulnerabilities introduced.
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
No changes to messaging, API overrides, or captured-globals usage.
injected/unit-test/autofill-passkeys.js
200–219
info
Test validates rpId is narrowed via typeof === 'string' check, rejecting page-controlled toString() coercion — documents an existing security property of the feature.
injected/unit-test/autofill-passkeys.js
305–318
info
Test validates requestId matching on inbound passkeySelected messages, preventing cross-request credential injection.
Mock messaging uses explicit field construction for notify payloads — no object spreading that could leak nativeData.
Risk Level
Low Risk — test-only additions plus import-path normalization in production code; no changes to API overrides, wrapper utilities, messaging transports, or security-sensitive initialization.
Recommendations
No blocking issues. The test suite is thorough and exercises security-relevant edge cases (rpId type coercion, requestId correlation, abort handling, superseded requests).
Optional follow-up (info): Consider a test for the randomUUID absent fallback path (line 77–79 in production), which passes through to originalGet when UUID generation is unavailable.
Verified locally: All 16 specs in unit-test/autofill-passkeys.js pass.
…ify pending
Bugbot finding (medium severity): the two specs that try to prove
a passkey request stays pending raced the request promise against
`Promise.resolve('pending')` — already settled. The race always
resolves to 'pending' regardless of whether the request promise
later settles, so the assertion provides no guard against
hang/early-completion regressions.
Replace the inline race with a settledOrPending() helper that races
against a setTimeout-based sentinel. It returns 'pending' only if
the promise hasn't settled within 50ms; otherwise it returns the
promise's resolved value or rejection reason. Both 'ignores ...
without a matching requestId' and 'ignores malformed credentialId
values' specs now actually verify the documented behaviour.
Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Web Compatibility Assessment
No web-compatibility regressions identified in this diff.
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
Production change is limited to adding .js extensions on static imports (content-feature.js, captured-globals.js). This is a module-resolution convention with no runtime behavior change after bundling.
injected/unit-test/autofill-passkeys.js
(all)
info
New unit tests exercise existing CredentialsContainer.prototype.get wrapping logic but do not ship to end users. Test harness globals (Object.defineProperty, setTimeout) are isolated to the Jasmine environment.
The tests document several existing pass-through guards that protect compatibility: non-conditional mediation, absent publicKey, non-secure contexts, and foreign CredentialsContainer receivers all bypass interception — matching native behavior expectations.
Security Assessment
No security vulnerabilities introduced by this diff.
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
No changes to API overrides, messaging payloads, captured-globals usage, or trust-boundary checks.
injected/unit-test/autofill-passkeys.js
222–242
info
Tests confirm existing rpId hardening: non-string rpId values (including objects with a hostile toString) fall back to location.hostname via typeof check, not coercion. This documents correct existing behavior; no production change.
injected/unit-test/autofill-passkeys.js
327–341
info
Tests confirm passkeySelected handler ignores payloads with mismatched requestId, documenting request-correlation protection already present in production code.
Outbound messaging in tests uses explicit { rpId, requestId } literals — no nativeData spread risk in production or test notify paths.
Risk Level
Low Risk — This PR adds unit-test coverage and normalizes import paths; it does not modify wrapper utilities, captured globals, messaging transports, or any injected runtime interception logic.
Recommendations
No action required for web-compat or security on this diff.
(Optional, info) Consider a Playwright integration test for the full navigator.credentials.get({ mediation: 'conditional', publicKey }) → native registerPasskeyRequest → passkeySelected round-trip if one does not already exist; unit tests here validate logic but not wrapMethod descriptor fidelity (toString masking, .name/.length preservation).
(Optional, info) The settledOrPending helper is a good pattern for asserting promise pending state without microtask race false-positives — worth reusing in other async interception tests.
The reason will be displayed to describe this comment to others. Learn more.
Web Compatibility & Security Review
Web Compatibility Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
Only change is adding .js extensions to import paths. No runtime behavior change; consistent with other feature files.
injected/unit-test/autofill-passkeys.js
(all)
info
Test-only file. Does not ship to production bundles.
injected/unit-test/autofill-passkeys.js
399–495
info
New tests validate existing pass-through guards: non-conditional mediation, missing publicKey, non-secure context (isSecureContext === false), and foreign CredentialsContainer receivers. These are important web-compat boundaries for the existing wrapMethod shim.
injected/unit-test/autofill-passkeys.js
478–494
info
Tests confirm WebIDL-correct behavior: option getter throws surface as rejected promises, not synchronous throws — matching native credentials.get().
No web compatibility regressions introduced by this diff.
Security Assessment
File
Lines
Severity
Finding
injected/src/features/autofill-passkeys.js
1–10
info
Import-path-only change. No security surface change.
injected/unit-test/autofill-passkeys.js
(all)
info
Test harness uses uncaptured Object.defineProperty / Reflect.deleteProperty on globalThis — acceptable in unit tests; not injected code.
injected/unit-test/autofill-passkeys.js
222–242
info
Tests document an existing security property: rpId must be typeof === 'string'; objects with toString() are rejected in favor of location.hostname. Prevents coercion-based RP ID spoofing at the messaging layer.
Coverage gap (pre-existing feature, not a regression): no test for the randomUUID absence fallback (registerPasskeyRequest lines 77–80), which silently passes through to native get().
No security vulnerabilities introduced by this diff. Tests strengthen confidence in existing trust-boundary checks.
Risk Level
Low Risk — This PR adds unit tests and normalizes two import paths; it does not modify API overrides, messaging transports, captured globals, or initialization logic.
Recommendations
(info) Consider adding a unit test for the randomUUID unavailable fallback path to lock in pass-through behavior.
(info) Existing feature already uses wrapMethod (toString masking via wrapper-utils); an integration test asserting navigator.credentials.get.toString() returns [native code] would be a nice follow-up but is out of scope here.
No blocking issues for merge from a web-compat or security perspective.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
semver-patchBug fix / internal — no release needed
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Asana Task/Github Issue: Coverage automation — addresses untested
autofillPasskeysfeature merged in #2571Description
The
autofillPasskeysfeature interceptsnavigator.credentials.get()for conditional WebAuthn passkey autofill on Windows. It shipped with no unit tests despite complex concurrency, messaging, and WebIDL semantics.This PR adds focused Jasmine coverage for the highest-risk paths and fixes ESM import suffixes in
autofill-passkeys.jsso the module loads under the unit test runner (no runtime behavior change).Risky behavior now covered
registerPasskeyRequestnotifies native withrpId+requestId, subscribes topasskeySelected, and completes via narrowedoriginalGetwith decodedallowCredentials.AbortError;AbortSignalabort/reason handling and already-aborted fast path.requestId, empty/non-stringcredentialId; rejects invalid base64 instead of hanging.publicKey, non-secure context, and foreigncredentials.getreceivers do not register passkey requests.Test files added/updated
injected/unit-test/autofill-passkeys.js(16 specs)injected/src/features/autofill-passkeys.js(.jssuffix on ESM imports only)Why these tests materially reduce regression risk
navigator.credentials.getis a security-sensitive, promise-based API. Regressions in pass-through conditions, abort/supersede handling, or native message correlation can hang site login flows or break WebAuthn ceremonies. These tests lock in the behavior explicitly documented in the #2571 review thread without requiring Windows/WebView2 integration infrastructure.Testing Steps
cd injected && npm run test-unit -- --filter=AutofillPasskeysChecklist
Note
Low Risk
Test-only coverage plus import path fixes; no intentional changes to passkey interception behavior in production.
Overview
Adds Jasmine unit coverage for the
AutofillPasskeysinjected feature (conditional WebAuthn passkey interception) and tweaks ESM import paths inautofill-passkeys.jsso the module loads under the unit test runner.The new
injected/unit-test/autofill-passkeys.jssuite exercisesregisterPasskeyRequest: nativeregisterPasskeyRequestnotify withrpId/requestId,passkeySelectedsubscription, narrowedoriginalGetwith decodedallowCredentials,rpIdfallback tolocation.hostnamewhenpublicKey.rpIdis not a string, superseding pending requests, andAbortSignalhandling.It also locks in message validation (wrong
requestId, malformedcredentialId, invalid base64) and WebIDL-style rejection when option getters throw, plusinitwrapper pass-through for non-conditional mediation, missingpublicKey, non-secure context, and non-singletoncredentials.getreceivers versus interception onnavigator.credentials.Production change: only
.jssuffixes on imports fromcontent-featureandcaptured-globals; no intended runtime behavior change.Reviewed by Cursor Bugbot for commit 3449a00. Bugbot is set up for automated code reviews on this repo. Configure here.