Feat/TO-540: Add passkey controller#8422
Merged
tanguyenvn merged 46 commits intomainfrom Apr 27, 2026
Merged
Conversation
tanguyenvn
changed the title
…from simplewebauthn
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
…ing vault key protection
This reverts commit 819f0c4.
Contributor
Author
|
@codex review |
|
To use Codex here, create a Codex account and connect to github. |
Contributor
Author
|
@metamaskbot publish-previews |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
tanguyenvn
force-pushed
the
feat/TO-540-passkey-controller
branch
from
cb17b00 to
938fc5d
Compare
chaitanyapotti
previously approved these changes
Apr 27, 2026
Member
chaitanyapotti
left a comment
chaitanyapotti
left a comment
There was a problem hiding this comment.
Approved from Business logic end
Contributor
Author
|
@metamaskbot publish-previews |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
mcmire
reviewed
Apr 27, 2026
Contributor
There was a problem hiding this comment.
Had one more comment, but from a Core Platform perspective this looks good otherwise.
Only other comment I have is, is there any part of this controller that we don't need right now and don't anticipate needing in the future? There seems to be a lot of code here, and while all of it may be necessary (I'm not familiar with how passkeys work), if there is any way to simplify what we are introducing, now is a good time to do that rather than later.
| @@ -0,0 +1,42 @@ | |||
| export { | |||
| controllerName, | |||
Contributor
There was a problem hiding this comment.
Conventionally we do not export controller names, would you mind removing this?
Suggested change
| controllerName, |
Contributor
Author
There was a problem hiding this comment.
Hi @mcmire, I've removed unnecessary exports in index.ts file.
We strive to keep the codebase minimal. However, since the @simplewebauthn/server package requires NodeJS environment, we have to port necessary logic from this package to the webauthn folder to make it compatible with our environment.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f921608. Configure here.
|
@codex test |
|
To use Codex here, create an environment for this repo. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Introduces
@metamask/passkey-controller, aBaseController-backed package that orchestrates WebAuthn passkey enrollment and authentication for vault key protection: generating ceremony options, verifying authenticator responses, HKDF-based key derivation (PRF vsuserHandle), AES-256-GCM wrapping of the vault encryption key, renewal flows for password change, and state/ceremony management (including concurrent ceremonies and lifecycle clears).Also wires the package into the monorepo (workspace/tsconfig,
CODEOWNERS,teams.json, root README, lockfile).Notes for reviewers (SimpleWebAuthn)
Extension vs Core split
@simplewebauthn/browserfor client-side helpers that run wherenavigator.credentialsis available.@simplewebauthn/server: that package targets Node-oriented verification APIs and assumptions that do not fit the constrained extension background environment the same way.To keep verification logic aligned with SimpleWebAuthn while staying dependency-appropriate in Core, this package inlines / ports the relevant server-side verification behavior (registration and authentication response verification, signature verification, CBOR/WebAuthn parsing helpers) into
packages/passkey-controller/src/webauthn/rather than adding@simplewebauthn/serveras a runtime dependency. When reviewing, please treat those modules as parity-sensitive: changes should stay consistent with upstream SimpleWebAuthn semantics where we intentionally mirror them (see recent commits around verification parity).Changelog
packages/passkey-controller/CHANGELOG.md— follow monorepo changelog rules; ensureyarn validate:changelogpasses before merge.Related issues
Fixes:
Testing
yarn workspace @metamask/passkey-controller run testyarn workspace @metamask/passkey-controller run buildManual testing (consumers)
N/A for Core in isolation; extension integration should exercise registration, unlock, change-password / vault key renewal, wallet reset, and edge cases called out in the extension PR.
Note
High Risk
High risk because it introduces new authentication/cryptography flows (WebAuthn verification, HKDF/AES-GCM key wrapping) and new persisted state that will gate vault unlock and key rotation behavior.
Overview
Introduces a new
@metamask/passkey-controllerpackage implementing passkey-based vault key protection: option generation for registration/authentication ceremonies, verification of WebAuthn responses, HKDF-derived AES-256-GCM wrap/unwrap of the vault key, and a renewal flow for updating the protected vault key.Adds supporting utilities for ceremony state management (TTL/capacity, concurrency handling), key-derivation (PRF vs
userHandle), encoding/crypto helpers, and an error model (PasskeyControllerErrorwith stablecode/cause/context).Wires the new package into the monorepo via
README.mdentries andCODEOWNERSownership for the new controller and its release files, and includes initial docs/changelog plus comprehensive unit tests.Reviewed by Cursor Bugbot for commit 7317ce4. Bugbot is set up for automated code reviews on this repo. Configure here.