test(passkey): add PRF output support to the virtual authenticator - #21115
Draft
vpomerleau wants to merge 3 commits into
Draft
test(passkey): add PRF output support to the virtual authenticator#21115vpomerleau wants to merge 3 commits into
vpomerleau wants to merge 3 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds deterministic PRF support to the test-only virtual authenticator and exposes it through functional-test browser polyfills.
Changes:
- Models supported, unsupported, registration, and assertion PRF behavior.
- Adds Playwright and unit coverage for PRF outputs.
- Moves authenticator helpers to a testing entry point.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
tsconfig.base.json |
Maps the testing entry point. |
packages/fxa-auth-server/test/remote/passkeys.in.spec.ts |
Uses the testing import. |
packages/fxa-auth-server/jest.config.js |
Resolves the testing entry point. |
packages/functional-tests/tests/unit/passkeyPolyfillPrf.spec.ts |
Tests browser-side PRF behavior. |
packages/functional-tests/package.json |
Declares the passkey dependency. |
packages/functional-tests/lib/passkeyPolyfill.ts |
Bridges PRF data across browser and Node contexts. |
libs/accounts/passkey/src/testing.ts |
Exports test-only authenticator helpers. |
libs/accounts/passkey/src/lib/webauthn-adapter.spec.ts |
Uses real PRF capability output. |
libs/accounts/passkey/src/lib/virtual-authenticator.ts |
Implements deterministic PRF modeling. |
libs/accounts/passkey/src/lib/virtual-authenticator.spec.ts |
Covers authenticator PRF behavior. |
libs/accounts/passkey/src/index.ts |
Removes test helpers from production exports. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+349
to
+351
| // PRF rides the CTAP `hmac-secret` authenticator extension, reported in | ||
| // authData under the ED flag and so covered by the signature, unlike the | ||
| // client extension results. Registration only: at assertion a real device |
Comment on lines
+10
to
+12
| derivePrfOutput, | ||
| VirtualAuthenticator, | ||
| type VirtualCeremonyExtensions, |
Because: - The virtual authenticator is test-only, but the package barrel exported it, so anything importing @fxa/accounts/passkey could reach it. - The PRF work adds derivePrfOutput, which looks like a key-derivation function and should not sit one autocomplete away from production passkey code. This commit: - Adds a `@fxa/accounts/passkey/testing` entry point holding the fake. - Drops the virtual authenticator from the package barrel. - Excludes the fake from the lib build; every consumer resolves to source. - Repoints the auth-server remote spec at the new entry point. - Maps the subpath ahead of the greedy accounts pattern in auth-server's jest config, which would otherwise resolve it under `passkey/testing/src`.
Because: - Nothing in the test stack could produce a PRF output, so the kB wrap work could not be tested above the unit layer. - The adapter spec hand-patched clientExtensionResults to route around the gap, leaving the fake's PRF path with no coverage at all. This commit: - Derives a deterministic per-credential output, hashing the salt under the `WebAuthn PRF` prefix as a real client does. - Reports `prf.enabled` at registration only; outputs sit behind an opt-in, since a CTAP2 device yields secrets at assertion. - Sets the ED flag over a signed `hmac-secret` extension at registration. - Models an authenticator with no PRF support via `prfSupported: false`. - Pins both domain-separation steps and their composition, and retires the adapter spec's hand-patch in favour of the real path.
Because: - The browser shim dropped `extensions`, so no eval salt ever reached the virtual authenticator and no output reached page code. - Page code needs the output as an ArrayBuffer, as a real browser returns it — binary outputs are what keep kB out of the request body. This commit: - Forwards PRF eval salts to Node and decodes outputs to ArrayBuffers. - Fixes DataView option values silently converting to empty bytes. - Adds two tests covering the browser shim seam, the one part of the polyfill no unit test can reach. - Declares the Nx dependency on `accounts-passkey`. Closes #FXA-14268
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Because
kBwrap work in this epic could not be tested above the unit layer.This pull request
WebAuthn PRFprefix.prf.enabledat registration only; registration-time outputs sit behind an opt-in.hmac-secretextension at registration.prfSupported: false.ArrayBuffer, with stack-free contract tests undertests/unit.prf.enabledin favour of the real path.@fxa/accounts/passkey/testingentry point.Issue that this pull request solves
Closes: FXA-14268
Checklist
Put an
xin the boxes that applyHow to review (Optional)
libs/accounts/passkey/src/lib/virtual-authenticator.ts8bd97ed3cf(entry point) → authenticator → polyfillderivePrfOutputis deterministic by construction and is not a real KDFScreenshots (Optional)
Please attach the screenshots of the changes made in case of change in user interface.
Other information (Optional)
Any other information that is important to this pull request.