feat(passkey): Add DELETE /passkey/wraps/{credentialId} by nshirley · Pull Request #21165 · mozilla/fxa

nshirley · 2026-09-08T17:11:38Z

Because:

A wrap the client can no longer unseal is permanent, leaving the passkey
stuck without passwordless Sync.
Settings needs a per-passkey switch for passwordless sign-in.

This commit:

Adds DELETE /passkey/wraps/{credentialId} behind an mfa:passkey token,
rate-limited as passkeyWrapsDelete.
Adds deletePasskeyWrap through the repository, manager, and service.
Reports a credential with no wrap as deleted: false, not 404.
Requires no credential binding, unlike the read and the write.
Adds deletePasskeyWrap to fxa-auth-client.

Copilot

🔵 Needs a closer look

It changes passkey authorization and credential-management behavior, warranting final human security review.

Pull request overview

Adds authenticated deletion of individual passkey wrap envelopes without removing the underlying passkey.

Changes:

Adds the rate-limited DELETE endpoint and security event.
Implements account-scoped deletion across repository, manager, and service layers.
Adds auth-client support and comprehensive tests.

File summaries

File	Description
`packages/fxa-auth-server/test/remote/passkey_wraps.in.spec.ts`	Tests endpoint behavior and authorization.
`packages/fxa-auth-server/lib/routes/passkey-wraps.ts`	Defines the DELETE route and handler.
`packages/fxa-auth-server/lib/routes/passkey-wraps.spec.ts`	Tests routing, rate limiting, and auditing.
`packages/fxa-auth-server/docs/swagger/passkeys-api.ts`	Documents the endpoint.
`packages/fxa-auth-client/test/client.ts`	Tests client request and response handling.
`packages/fxa-auth-client/lib/client.ts`	Exposes `deletePasskeyWrap`.
`libs/accounts/passkey/src/lib/passkey.wrap.repository.ts`	Adds account-scoped database deletion.
`libs/accounts/passkey/src/lib/passkey.wrap.repository.in.spec.ts`	Tests repository isolation and deletion.
`libs/accounts/passkey/src/lib/passkey.service.ts`	Adds deletion orchestration and metrics.
`libs/accounts/passkey/src/lib/passkey.service.spec.ts`	Tests service outcomes and failures.
`libs/accounts/passkey/src/lib/passkey.manager.ts`	Connects service and repository layers.

Review details

Files reviewed: 11/11 changed files
Comments generated: 1
Review effort level: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

vpomerleau · 2026-09-09T15:59:49Z

-// wrap_retrieved restates passkey.authentication_success) or is a side effect
-// they did not take (wrap_deleted rides the passkey-deletion cascade).
+// wrap_retrieved restates passkey.authentication_success) or lands on every
+// passwordless sign-in, at a volume that would crowd out the rest.


This would be a separate issue - but this filtering might make more sense on the backend.

Though I had replied already. but it was funny you mentioned this, I had logged this up right before you commented https://mozilla-hub.atlassian.net/browse/FXA-14492

vpomerleau · 2026-09-09T16:03:12Z

      'passkeyWrapsGet'
    );

+    if (!isBoundTo(cid, credentialId)) {


Moved below to ensure token check is rate limited?

Oh I see the explanation above 👌

oh yep, sorry, meant to add a comment. Something I found while reviewing all of the work so far and figured I could sneak it in here 😬

nshirley · 2026-09-09T16:38:17Z

Force push was to handle merge conflict and update with main

bcolsson

Approving but I'd consider adjusting the wording on one of the strings.

bcolsson · 2026-09-09T21:26:07Z

+# A passkey is a sign-in method that replaces a password. This string is shown when a passkey that could unlock the user's synced browser data had that access turned off, leaving the passkey itself usable for signing in.
+recent-activity-account-passkey-wrap-deleted = Passkey sync access removed
+# A passkey is a sign-in method that replaces a password. This string is shown when an attempt to turn off a passkey's access to the user's synced browser data did not complete.
+recent-activity-account-passkey-wrap-deletion-failure = Removing passkey sync access failed


Might just be me but Passkey sync access removal failed sounds more natural.

nshirley · 2026-09-12T01:06:41Z

Force push was to address the string update

Because: - A wrap the client can no longer unseal is permanent, leaving the passkey stuck without passwordless Sync. - Settings needs a per-passkey switch for passwordless sign-in. - POST and GET record their failures; a failed delete would have left no audit trail. This commit: - Adds DELETE /passkey/wraps/{credentialId} behind an mfa:passkey token, rate-limited as passkeyWrapsDelete, with no credential binding. - Adds deletePasskeyWrap through the repository, manager, service, and fxa-auth-client. - Reports a credential with no wrap as deleted: false, not 404. - Records wrap_deleted and wrap_deletion_failure, both hidden from the settings activity list. - Adds patch 198-199 for the wrap_deletion_failure event name.

nshirley · 2026-09-12T01:18:37Z

force push was just updating with main

nshirley commented Sep 8, 2026

View reviewed changes

Comment thread packages/fxa-auth-server/test/remote/passkey_wraps.in.spec.ts

nshirley marked this pull request as ready for review September 8, 2026 18:17

nshirley requested a review from a team as a code owner September 8, 2026 18:17

Copilot AI balanced review requested due to automatic review settings September 8, 2026 18:17

Copilot started reviewing on behalf of nshirley September 8, 2026 18:18 View session

Copilot AI reviewed Sep 8, 2026

View reviewed changes

Comment thread packages/fxa-auth-server/docs/swagger/passkeys-api.ts

nshirley force-pushed the passkey-wraps-delete branch 2 times, most recently from 7bc20fb to 3aff787 Compare September 8, 2026 19:50

vpomerleau reviewed Sep 8, 2026

View reviewed changes

Comment thread packages/fxa-auth-server/test/remote/passkey_wraps.in.spec.ts

Comment thread packages/fxa-settings/src/components/Settings/PageRecentActivity/SecurityEvent.tsx Outdated

Comment thread packages/fxa-auth-server/lib/routes/passkey-wraps.ts

nshirley mentioned this pull request Sep 9, 2026

feat(passkey): Add default rate limit rules for passkey wraps #21169

Merged

5 tasks

nshirley force-pushed the passkey-wraps-delete branch from 3aff787 to f8ff0e1 Compare September 9, 2026 03:25

nshirley requested a review from a team as a code owner September 9, 2026 03:25

nshirley force-pushed the passkey-wraps-delete branch from f8ff0e1 to 16aed8a Compare September 9, 2026 15:00

vpomerleau approved these changes Sep 9, 2026

View reviewed changes

nshirley force-pushed the passkey-wraps-delete branch from 16aed8a to 0e215cd Compare September 9, 2026 16:32

bcolsson approved these changes Sep 9, 2026

View reviewed changes

nshirley force-pushed the passkey-wraps-delete branch from 0e215cd to 5589a38 Compare September 12, 2026 01:03

nshirley force-pushed the passkey-wraps-delete branch from 5589a38 to 9d4f267 Compare September 12, 2026 01:17

Uh oh!

Conversation

nshirley commented Sep 8, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vpomerleau Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

nshirley Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vpomerleau Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

vpomerleau Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

nshirley Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

nshirley commented Sep 9, 2026

Uh oh!

bcolsson left a comment

Choose a reason for hiding this comment

Uh oh!

bcolsson Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

nshirley commented Sep 12, 2026

Uh oh!

nshirley commented Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants