Closes#42. Last issue in the passkeys project (#36).
The four questions the issue existed to settle
Does a password reset revoke passkeys, or leave them? It revokes them.
A reset is the recovery path, and recovery has to be complete. The reset already deletes every session, on the reasoning that a compromise-driven reset must not leave an intruder signed in for the remaining 30 days of their cookie. A passkey an intruder registered has no expiry at all. Leaving those behind means a customer can recover their password and still not have their account back.
The objection is that this lets whoever controls the mailbox strip a customer's passkeys. It does, and it costs nothing: anyone who can complete a reset already controls the email address, and therefore already controls the account. The passkeys were not protecting anything by that point.
Any in-flight WebAuthn challenge goes too, or an intruder who pressed "add a passkey" moments earlier could finish that ceremony afterwards and put a credential straight back.
Does it terminate passkey-established sessions? Yes, and it needed no code, because #39 made both paths call one createSession. "It falls out for free" is a claim, so there is now a test that establishes a session through that exact function and watches the reset end it.
Is there a recovery path for a customer who has lost their email? No, deliberately. This shop holds no second proof of identity, and anything invented to fill that gap would be a weaker credential than the one it replaced. The manual route runs through you verifying against order history. Its third step, changing the address from the admin screen, does not exist yet — that is written up as a gap rather than smuggled in here, because it has its own notification and audit questions.
What replaces password reset for passkey-only accounts? Nothing yet, because they cannot exist yet. password_hash is NOT NULL. #332 creates the first ones and owns their recovery route, which is the identity provider. The revocation guard already anticipates it.
The asymmetry with change-password, which is intentional
change-password leaves passkeys alone. It requires the current password from someone already signed in, so nothing about it suggests a lockout, and it already spares the current session for the same reason. A customer who suspects one device revokes that device by name from the account page. A reset has no idea which credential is the problem, so it takes all of them.
Telling the customer, twice
Before, in the reset email and on the reset form, unconditionally. The form has no session and is never told whether the account has passkeys, because answering that would make the reset page an oracle for it. The wording reads the same to someone who has none.
After, with a count, and only when the count is not zero. This is the only moment that count can be reported — the rows are gone by the time anyone could go and look. A customer told two were removed who only remembers registering one has just learned something they could not otherwise find out. It is a panel that waits to be dismissed rather than a toast, because a toast dismisses itself and this is the message they need to still be looking at while they decide what to do.
Also in here
docs/ops/account-recovery.md records the whole policy, including the two answers that are not code.
Testing
Six integration tests on the reset and passkeys, two end-to-end tests on the copy and the notice, and an e2e helper that puts a credential row on an account (registering one for real needs an authenticator Playwright does not have).
Verified locally: backend tsc clean for src and tests, 521 unit tests pass, lint clean apart from warnings that predate this branch; frontend tsc, lint and build clean. The integration and e2e suites need a database this machine has no Docker for, so CI proves those.
Closes #42. Last issue in the passkeys project (#36).
## The four questions the issue existed to settle
**Does a password reset revoke passkeys, or leave them?** It revokes them.
A reset is the recovery path, and recovery has to be complete. The reset already deletes every session, on the reasoning that a compromise-driven reset must not leave an intruder signed in for the remaining 30 days of their cookie. A passkey an intruder registered has no expiry at all. Leaving those behind means a customer can recover their password and still not have their account back.
The objection is that this lets whoever controls the mailbox strip a customer's passkeys. It does, and it costs nothing: anyone who can complete a reset already controls the email address, and therefore already controls the account. The passkeys were not protecting anything by that point.
Any in-flight WebAuthn challenge goes too, or an intruder who pressed "add a passkey" moments earlier could finish that ceremony afterwards and put a credential straight back.
**Does it terminate passkey-established sessions?** Yes, and it needed no code, because #39 made both paths call one `createSession`. "It falls out for free" is a claim, so there is now a test that establishes a session through that exact function and watches the reset end it.
**Is there a recovery path for a customer who has lost their email?** No, deliberately. This shop holds no second proof of identity, and anything invented to fill that gap would be a weaker credential than the one it replaced. The manual route runs through you verifying against order history. Its third step, changing the address from the admin screen, **does not exist yet** — that is written up as a gap rather than smuggled in here, because it has its own notification and audit questions.
**What replaces password reset for passkey-only accounts?** Nothing yet, because they cannot exist yet. `password_hash` is `NOT NULL`. #332 creates the first ones and owns their recovery route, which is the identity provider. The revocation guard already anticipates it.
## The asymmetry with change-password, which is intentional
`change-password` leaves passkeys alone. It requires the current password from someone already signed in, so nothing about it suggests a lockout, and it already spares the current session for the same reason. A customer who suspects one device revokes that device by name from the account page. A reset has no idea which credential is the problem, so it takes all of them.
## Telling the customer, twice
**Before**, in the reset email and on the reset form, unconditionally. The form has no session and is never told whether the account has passkeys, because answering that would make the reset page an oracle for it. The wording reads the same to someone who has none.
**After**, with a count, and only when the count is not zero. This is the only moment that count can be reported — the rows are gone by the time anyone could go and look. A customer told two were removed who only remembers registering one has just learned something they could not otherwise find out. It is a panel that waits to be dismissed rather than a toast, because a toast dismisses itself and this is the message they need to still be looking at while they decide what to do.
## Also in here
`docs/ops/account-recovery.md` records the whole policy, including the two answers that are not code.
## Testing
Six integration tests on the reset and passkeys, two end-to-end tests on the copy and the notice, and an e2e helper that puts a credential row on an account (registering one for real needs an authenticator Playwright does not have).
Verified locally: backend `tsc` clean for src and tests, 521 unit tests pass, lint clean apart from warnings that predate this branch; frontend `tsc`, lint and build clean. The integration and e2e suites need a database this machine has no Docker for, so CI proves those.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The last issue in the passkeys project, and the only one that adds no capability. It is the safety net, and it exists because this is the piece most likely to be skipped and most expensive to discover missing.
A reset is the recovery path, and recovery has to be complete. The reset already deletes every session on the account, on the reasoning that a reset prompted by a compromise must not leave an intruder signed in for the remaining thirty days of their cookie. A passkey an intruder registered has no expiry at all. Leaving those behind would mean a customer can recover their password and still not have their account back.
The obvious objection is that this hands whoever controls the mailbox a way to strip a customer's passkeys. It does, and it costs nothing: anyone who can complete a reset already controls the email address and therefore already controls the account. The passkeys were not protecting anything by that point.
Anything in flight goes too. An intruder who pressed add a passkey moments before the reset could otherwise finish that ceremony afterwards and put a credential straight back onto the account the reset had just cleared.
Changing a password deliberately does not do this, and the asymmetry is the point. A change requires the current password from someone already signed in, so nothing about it suggests a lockout or a compromise, and it already spares the current session for the same reason. A customer who suspects one particular device revokes that device by name from the account page, which is a better tool than deleting everything. A reset has no idea which credential is the problem, so it takes all of them.
The customer is told twice. Before, in the reset email and on the reset form, unconditionally — that form has no session and is never told whether the account has passkeys, because answering that would make the reset page an oracle for it, so the wording has to read the same to someone who has none. After, with a count, and only when the count is not zero. That moment is the only one where the count can be reported: the rows are gone by the time anyone could go and look. A customer told two were removed who only remembers registering one has just learned something they could not otherwise find out.
That notice is a panel that waits to be dismissed rather than a toast, because a toast dismisses itself and this is the message a customer needs to still be looking at while they decide what to do about it.
The other question this issue asks — whether a reset ends a session established by a passkey — turns out to need no code, because #39 made both paths call one createSession. But "it falls out for free" is a claim, so there is now a test that establishes a session through that exact function and watches the reset end it.
docs/ops/account-recovery.md records the whole policy, including the two answers that are not code. Losing an authenticator is not a lockout: the customer signs in with their password and revokes the lost credential themselves, which is why this change implements nothing for it. Losing the email address is a lockout, and there is deliberately no self-service route out — this shop holds no second proof of identity, and anything invented to fill that gap would be a weaker credential than the one it replaced. The manual route runs through the shop owner verifying against order history, and its third step, changing the address from the admin screen, does not exist yet. That is written down as a gap with its own notification and audit questions rather than smuggled in here.
Verified: backend tsc clean for src and tests, 521 unit tests pass, lint clean apart from warnings that predate this branch; frontend tsc, lint and build clean. The integration and end-to-end suites need a database this machine has no Docker for, so CI is what proves those.
Closes#42
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #42. Last issue in the passkeys project (#36).
The four questions the issue existed to settle
Does a password reset revoke passkeys, or leave them? It revokes them.
A reset is the recovery path, and recovery has to be complete. The reset already deletes every session, on the reasoning that a compromise-driven reset must not leave an intruder signed in for the remaining 30 days of their cookie. A passkey an intruder registered has no expiry at all. Leaving those behind means a customer can recover their password and still not have their account back.
The objection is that this lets whoever controls the mailbox strip a customer's passkeys. It does, and it costs nothing: anyone who can complete a reset already controls the email address, and therefore already controls the account. The passkeys were not protecting anything by that point.
Any in-flight WebAuthn challenge goes too, or an intruder who pressed "add a passkey" moments earlier could finish that ceremony afterwards and put a credential straight back.
Does it terminate passkey-established sessions? Yes, and it needed no code, because #39 made both paths call one
createSession. "It falls out for free" is a claim, so there is now a test that establishes a session through that exact function and watches the reset end it.Is there a recovery path for a customer who has lost their email? No, deliberately. This shop holds no second proof of identity, and anything invented to fill that gap would be a weaker credential than the one it replaced. The manual route runs through you verifying against order history. Its third step, changing the address from the admin screen, does not exist yet — that is written up as a gap rather than smuggled in here, because it has its own notification and audit questions.
What replaces password reset for passkey-only accounts? Nothing yet, because they cannot exist yet.
password_hashisNOT NULL. #332 creates the first ones and owns their recovery route, which is the identity provider. The revocation guard already anticipates it.The asymmetry with change-password, which is intentional
change-passwordleaves passkeys alone. It requires the current password from someone already signed in, so nothing about it suggests a lockout, and it already spares the current session for the same reason. A customer who suspects one device revokes that device by name from the account page. A reset has no idea which credential is the problem, so it takes all of them.Telling the customer, twice
Before, in the reset email and on the reset form, unconditionally. The form has no session and is never told whether the account has passkeys, because answering that would make the reset page an oracle for it. The wording reads the same to someone who has none.
After, with a count, and only when the count is not zero. This is the only moment that count can be reported — the rows are gone by the time anyone could go and look. A customer told two were removed who only remembers registering one has just learned something they could not otherwise find out. It is a panel that waits to be dismissed rather than a toast, because a toast dismisses itself and this is the message they need to still be looking at while they decide what to do.
Also in here
docs/ops/account-recovery.mdrecords the whole policy, including the two answers that are not code.Testing
Six integration tests on the reset and passkeys, two end-to-end tests on the copy and the notice, and an e2e helper that puts a credential row on an account (registering one for real needs an authenticator Playwright does not have).
Verified locally: backend
tscclean for src and tests, 521 unit tests pass, lint clean apart from warnings that predate this branch; frontendtsc, lint and build clean. The integration and e2e suites need a database this machine has no Docker for, so CI proves those.🤖 Generated with Claude Code