Passkeys web wallet by maycon-mello · Pull Request #479 · docknetwork/wallet-sdk

maycon-mello · 2026-04-03T18:39:18Z

No description provided.

…extension

…tion

docs/cloud-wallet.md

Copilot

Pull request overview

Adds passkey-based authentication to the Truvera Web Wallet SDK, enabling WebAuthn PRF-derived key material to encrypt/decrypt the cloud wallet master key, with automatic enrollment + localStorage persistence on first use.

Changes:

Introduces low-level WebAuthn passkey helpers (register, PRF assertion, credentialId encoding).
Extends web initialize() to support passkey: true | { ...options }, including enrollment and subsequent authentication.
Adds core cloud-wallet passkey key-derivation + enrollment/authentication helpers and updates docs/examples/tests.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
packages/web/src/passkey.js	New WebAuthn/PRF helper utilities (registration, PRF extraction, credentialId encode/decode).
packages/web/src/passkey.test.js	Unit tests for passkey helpers.
packages/web/src/index.js	Adds passkey flow to SDK initialization, plus exported passkey helpers.
packages/web/src/index.test.js	Adds initialization tests for passkey enroll/auth flows and validation changes.
packages/web/README.md	Documents passkey auth usage/options and `mnemonic` return behavior.
packages/web/example.html	Updates mnemonic example to use local bundle and logs output.
packages/web/example-passkey.html	Adds passkey example HTML page.
packages/core/src/cloud-wallet.ts	Adds passkey-based vault key derivation + enroll/auth/init APIs.
packages/core/src/cloud-wallet.test.js	Adds tests for new core passkey APIs.
docs/cloud-wallet.md	Documents passkey authentication architecture and usage patterns.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/web/src/passkey.js

packages/web/src/index.js

packages/web/example.html

packages/web/src/passkey.js

packages/web/examples/passkey.html

…nfirmed during ceremony

…ow on large IDs

…lity

…stness

… contexts

…tension

…les/ folder

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T19:46:55Z

packages/web/src/passkey.js

+ * @throws {Error} If WebAuthn is not supported or user cancels
+ */
+export async function registerPasskey(identifier, rpName, rpId) {
+  if (!window.PublicKeyCredential) {


registerPasskey references window directly (window.PublicKeyCredential / window.location.hostname). If this function is called in a non-browser/SSR context where window is undefined, it will throw a ReferenceError before the intended “WebAuthn is not supported” error. Use the same typeof window === 'undefined' guard as checkPasskeySupport() and throw a clear error message when not in a browser.

Suggested change

if (!window.PublicKeyCredential) {

if (typeof window === 'undefined' || !window.PublicKeyCredential) {

Copilot · 2026-04-08T19:46:56Z

packages/web/src/passkey.js

+  if (!window.PublicKeyCredential) {
+    throw new Error('WebAuthn is not supported in this browser');


getPasskeyPRFKey also references window directly. In non-browser/SSR contexts this will throw a ReferenceError instead of a controlled failure. Add a typeof window === 'undefined' (and navigator?.credentials) guard and surface a clear error when WebAuthn APIs are unavailable.

Suggested change

if (!window.PublicKeyCredential) {

throw new Error('WebAuthn is not supported in this browser');

if (

typeof window === 'undefined' ||

typeof navigator === 'undefined' ||

!window.PublicKeyCredential ||

!navigator.credentials

) {

throw new Error(

'WebAuthn APIs are unavailable in this environment. ' +

'Passkey operations require a browser with PublicKeyCredential and navigator.credentials support.',

);

Copilot · 2026-04-08T19:46:56Z

packages/web/src/index.js

+  localStorage.setItem(
+    resolved.storageKey,
+    JSON.stringify({
+      passkeyCredentialId: credentialIdBase64url,
+      identifier: resolved.identifier,
+    }),
+  );


enrollPasskey writes enrollment metadata to localStorage without handling storage failures (e.g., Safari private mode, quota exceeded, storage disabled). This can cause passkey enrollment to succeed but initialization to hard-fail when localStorage.setItem throws. Wrap the write in a try/catch and either (a) proceed without persistence (forcing re-enrollment next time) or (b) throw a dedicated error explaining that persistent storage is required for passkey mode.

Suggested change

localStorage.setItem(

resolved.storageKey,

JSON.stringify({

passkeyCredentialId: credentialIdBase64url,

identifier: resolved.identifier,

}),

);

try {

localStorage.setItem(

resolved.storageKey,

JSON.stringify({

passkeyCredentialId: credentialIdBase64url,

identifier: resolved.identifier,

}),

);

} catch (_error) {

// Ignore storage failures (for example Safari private browsing, quota exceeded,

// or disabled storage). Enrollment has already succeeded; callers can still use

// the returned passkeyCredentialId for direct authentication on subsequent loads.

}

Copilot · 2026-04-08T19:46:56Z

packages/web/src/index.js

+      // Use the identifier from enrollment to ensure PRF salt consistency
+      if (
+        !resolved.identifier ||
+        resolved.identifier === resolvePasskeyOptions(true).identifier
+      ) {
+        identifier = stored.identifier || identifier;


This comparison calls resolvePasskeyOptions(true) just to retrieve the default identifier. In non-browser environments (no window.location.hostname), resolvePasskeyOptions(true) throws, which can break passkey initialization even when a valid identifier was provided. Avoid calling resolvePasskeyOptions(true) here; instead compare against the computed default identifier/hostname that’s already available in scope.

Copilot · 2026-04-08T19:46:56Z

packages/web/src/index.js

+    const prfOptions = passkeyCredentialId
+      ? {credentialId: base64urlToCredentialId(passkeyCredentialId), rpId}
+      : {rpId};


base64urlToCredentialId(passkeyCredentialId) will throw (via atob) with a low-level/cryptic message if the provided passkeyCredentialId is malformed. Since this is user-supplied config, consider validating/catching decode errors here and rethrowing a clear Initialization failed: invalid passkeyCredentialId style error so callers can diagnose configuration issues.

Suggested change

const prfOptions = passkeyCredentialId

? {credentialId: base64urlToCredentialId(passkeyCredentialId), rpId}

: {rpId};

let prfOptions;

if (passkeyCredentialId) {

try {

prfOptions = {

credentialId: base64urlToCredentialId(passkeyCredentialId),

rpId,

};

} catch {

throw new Error(

'Initialization failed: invalid passkeyCredentialId',

);

}

} else {

prfOptions = {rpId};

}

maycon-mello added 2 commits April 3, 2026 15:39

Add passkey authentication support for web wallet using WebAuthn PRF …

5e17875

…extension

Simplify passkey API with unified passkey config and update documenta…

1628bdc

…tion

maycon-mello force-pushed the passkeys-web-wallet branch from 732f7d1 to 1628bdc Compare April 3, 2026 18:43

maycon-mello requested a review from mike-parkhill April 3, 2026 18:44

maycon-mello added 3 commits April 3, 2026 15:49

Fix prettier formatting

434184b

Fix no-div-regex lint warning in base64url helper

228cf64

Fix unit test expected error message for passkey support

ce8045a

maycon-mello force-pushed the passkeys-web-wallet branch from 2019024 to ce8045a Compare April 3, 2026 19:05

Add unit tests for passkey authentication

78529c7

mike-parkhill requested a review from Copilot April 8, 2026 13:15

Copilot started reviewing on behalf of mike-parkhill April 8, 2026 13:16 View session

mike-parkhill reviewed Apr 8, 2026

View reviewed changes

docs/cloud-wallet.md Show resolved Hide resolved

Copilot AI reviewed Apr 8, 2026

View reviewed changes

mike-parkhill reviewed Apr 8, 2026

View reviewed changes

packages/web/src/passkey.js Show resolved Hide resolved

mike-parkhill reviewed Apr 8, 2026

View reviewed changes

packages/web/examples/passkey.html Show resolved Hide resolved

maycon-mello added 11 commits April 8, 2026 14:03

Return prf: unknown from checkPasskeySupport since PRF can only be co…

c9e06cd

…nfirmed during ceremony

Hash user.id with SHA-256 to comply with WebAuthn 64-byte limit

0229607

Use chunked encoding in credentialIdToBase64url to avoid stack overfl…

b843806

…ow on large IDs

Remove prfSupported hard check during enrollment for Safari compatibi…

7f5d927

…lity

Use stored identifier from localStorage and guard JSON.parse for robu…

c84642f

…stness

Guard window.location access in resolvePasskeyOptions for non-browser…

b848816

… contexts

Use placeholder values for credentials in example files

8ba8921

Clarify that PRF is a built-in WebAuthn capability, not a separate ex…

4c36a01

…tension

Rename credentialId to passkeyCredentialId and move examples to examp…

98a7b8c

…les/ folder

Merge branch 'master' into passkeys-web-wallet

11bf1bc

Fix Slack reporter counting retries as separate failures

001a380

maycon-mello requested review from Copilot and mike-parkhill April 8, 2026 19:41

Copilot started reviewing on behalf of maycon-mello April 8, 2026 19:42 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Passkeys web wallet#479

Passkeys web wallet#479
maycon-mello wants to merge 17 commits intomasterfrom
passkeys-web-wallet

maycon-mello commented Apr 3, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	if (!window.PublicKeyCredential) {
	if (typeof window === 'undefined' \|\| !window.PublicKeyCredential) {

		if (!window.PublicKeyCredential) {
		throw new Error('WebAuthn is not supported in this browser');

-  if (!window.PublicKeyCredential) {
-    throw new Error('WebAuthn is not supported in this browser');
+  if (
+    typeof window === 'undefined' ||
+    typeof navigator === 'undefined' ||
+    !window.PublicKeyCredential ||
+    !navigator.credentials
+  ) {
+    throw new Error(
+      'WebAuthn APIs are unavailable in this environment. ' +
+        'Passkey operations require a browser with PublicKeyCredential and navigator.credentials support.',
+    );

-    const prfOptions = passkeyCredentialId
-      ? {credentialId: base64urlToCredentialId(passkeyCredentialId), rpId}
-      : {rpId};
+    let prfOptions;
+    if (passkeyCredentialId) {
+      try {
+        prfOptions = {
+          credentialId: base64urlToCredentialId(passkeyCredentialId),
+          rpId,
+        };
+      } catch {
+        throw new Error(
+          'Initialization failed: invalid passkeyCredentialId',
+        );
+      }
+    } else {
+      prfOptions = {rpId};
+    }

Conversation

maycon-mello commented Apr 3, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants