[Bug]: macOS passkey mapping lets legacy requireResidentKey override residentKey #35964

Summary#

The macOS browser passkey path turns an explicit discouraged resident-key preference into a required resident key when the legacy Boolean is also true. The explicit modern preference should take precedence. A fake-native reproduction through the T3 adapter captured the incorrect requirement, and the mapping persists in the latest published native package.

Before submitting#

• Related issues: searched open and closed issues and PRs; distinct related coverage is listed under Additional context.
• Removed credentials, tokens, private paths, and sensitive data.

Area#

apps/desktop

Actual behavior#

For authenticatorSelection: { residentKey: "discouraged", requireResidentKey: true }, the native create handler passes residentKeyRequired=true to its internal authenticator operation. The same mapping occurs in native versions 1.3.1 and 1.4.0. Controls for residentKey required, a legacy-only true value, and discouraged with a false legacy value all map as expected.

Steps to reproduce#

1. Use a clean checkout at 59e64eef881632a23f89c4138bcf37f23d92bf93 with Node supporting node:module.stripTypeScriptTypes (the observed run used Node v26.12.1) and Git on PATH.
2. Save the script below outside the checkout and run node repro-resident.mjs /path/to/t3code. No workspace dependency installation is needed. Network access to unpkg.com is required to fetch the exact published source files; these are evaluated only as pure functions, with native operations replaced.
3. Inspect the controls and mismatch output below.

The recorded run reproduced the mismatch deterministically. The script creates disposable state directories with mkdtemp, redirects HOME, USERPROFILE, APPDATA, LOCALAPPDATA, XDG directories, TMPDIR, and T3CODE_HOME into them, and removes them on exit. It reads the checkout without changing it, opens no native passkey sheet, and uses no credentials. Exit 1 means defect reproduced, 0 means expected behavior, and 2 means setup or a control failed.

import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import vm from 'node:vm';
import { stripTypeScriptTypes, createRequire } from 'node:module';
import net from 'node:net';
import { domainToASCII } from 'node:url';
import { execFileSync } from 'node:child_process';
const checkout = path.resolve(process.argv[2] ?? '.');
const scratch = await fs.mkdtemp(path.join(os.tmpdir(), 'passkey-repro-'));
for (const key of ['HOME','USERPROFILE','APPDATA','LOCALAPPDATA','XDG_CONFIG_HOME','XDG_DATA_HOME','XDG_CACHE_HOME','XDG_STATE_HOME','T3CODE_HOME','TMPDIR']) {
  process.env[key] = path.join(scratch, key);
  await fs.mkdir(process.env[key]);
}
const read = (name) => fs.readFile(path.join(checkout, 'apps/desktop/src/preview', name), 'utf8');
const strip = (text) => stripTypeScriptTypes(text, {mode:'strip'});
const fn = (text, name) => {
  const start = text.indexOf(`function ${name}(`);
  const end = text.indexOf('\n}', start);
  if (start < 0 || end < 0) throw Error(`Missing function ${name}`);
  return text.slice(start, end + 2);
};
const download = async (name, version, file) => {
  const url = `https://unpkg.com/${name}@${version}/${file}`;
  const response = await fetch(url);
  if (!response.ok) throw Error(`Package download failed: ${response.status}`);
  return response.text();
};
let status = 2;
try {
  console.log(`Node ${process.version}; ${process.platform} ${process.arch}`);
  console.log(execFileSync('git', ['--version'], {encoding:'utf8'}).trim());
  console.log(`T3 commit ${execFileSync('git', ['-C', checkout, 'rev-parse', 'HEAD'], {encoding:'utf8'}).trim()}`);
  const nativeCalls = [];
  const webauthn = {createCredential: async (...args) => {nativeCalls.push(args); return {success:false,error:'NotAllowedError'};}};
  const adapter = strip(await read('PasskeyBackendMac.ts'))
    .replace(/^import .*;$/gm, '')
    .replace('export const macPasskeyBackend', 'const macPasskeyBackend')
    .replace('await import("electron-webauthn")', 'webauthn');
  const backend = new Function('getPublicSuffix','authenticatorDataFromAttestation','webauthn', adapter + '; return macPasskeyBackend;')(() => null, () => null, webauthn);
  const context = {origin:'https://example.com',nativeWindowHandle:Buffer.from([0])};
  const publicKey = {rp:{id:'example.com',name:'Example'}, user:{id:new Uint8Array([1]),name:'test-user',displayName:'Test User'},challenge:new Uint8Array([1]),pubKeyCredParams:[{type:'public-key',alg:-7}]};
  let failures = 0;
  for (const version of ['1.3.1','1.4.0']) {
    const text = await download('@electron-webauthn/macos', version, 'dist/index.js');
    console.log(`@electron-webauthn/macos ${version}`);
    const captured = [];
    const internal = async (...args) => {captured.push(args); return 'NotAllowedError';};
    const nativeCreate = new Function('Buffer','isRpIdAllowedForOrigin','getExtensionsConfiguration2','createCredentialInternal',
      ['bufferSourceToBuffer','isString','isNumber','isObject'].map(name=>fn(text,name)).join('\n') + '\nasync ' + fn(text,'createCredential') + ';return createCredential;')
      (Buffer,()=>({ok:true}),()=>({extensions:[]}),internal);
    webauthn.createCredential = nativeCreate;
    const check = async (selection, expected, label) => {
      captured.length=0;
      await backend.create({...publicKey,authenticatorSelection:selection},context);
      if (captured.length !== 1) throw Error(`Native mapping not reached: ${label}`);
      const actual = captured[0][11];
      console.log(`${label}: residentKeyRequired=${actual}; expected=${expected}`);
      return actual === expected;
    };
    if (!await check({residentKey:'required'},true,'required control')) throw Error('Required control failed');
    if (!await check({requireResidentKey:true},true,'legacy-only control')) throw Error('Legacy-only control failed');
    if (!await check({residentKey:'discouraged',requireResidentKey:false},false,'discouraged control')) throw Error('Discouraged control failed');
    if (!await check({residentKey:'discouraged',requireResidentKey:true},false,'discouraged + legacy true')) failures++;
  }
  status=failures ? 1 : 0;
} catch (error) {
  console.log(`Setup/control failure: ${error.message}`);
  status = 2;
} finally {
  await fs.rm(scratch, {recursive:true, force:true});
}
console.log(status === 0 ? 'RESULT: expected behavior' : status === 1 ? 'RESULT: defect reproduced' : 'RESULT: inconclusive');
process.exitCode = status;

Expected behavior#

WebAuthn creation §5.1.3, effective resident-key requirement makes an explicit discouraged value false and consults requireResidentKey only when residentKey is absent. Preserve that precedence when mapping creation options.

Impact#

Minor bug or occasional failure

Impact: P2 - A valid creation request reaches the authenticator operation with a stricter resident-key requirement than requested. This is a bounded option-mapping defect; the reproduction does not establish a completed credential or an actual device rejection.

The affected path forwards authenticatorSelection unchanged from T3 into the pinned macOS package. Supplying consistent legacy and modern values passes the controls. NOT_ENOUGH_INFO: the user-visible result on a particular authenticator was not tested because native sheets and real credentials were excluded from this investigation.

Version#

T3 Code source commit 59e64eef881632a23f89c4138bcf37f23d92bf93. electron-webauthn 1.3.1 and @electron-webauthn/macos 1.3.1 are repository pins. The reproduction additionally fetches the published @electron-webauthn/macos 1.4.0 implementation for comparison.

Runtime and platform#

Observed on macOS 27.2, arm64, Node v26.12.1, Git 2.56.0. Electron 44.10.1 is the repository pin; Electron was not launched.

Interface#

Library: desktop preview WebAuthn creation request mapping, reached by navigator.credentials create through the browser bridge.

Earliest failure stage#

Core processing

Evidence#

T3 forwards these creation options at apps/desktop/src/preview/PasskeyBackendMac.ts#L50-L53. In the published native 1.3.1 source, createCredential sets the Boolean for residentKey required and otherwise falls back to any truthy requireResidentKey, including when residentKey is explicitly discouraged. The reproduction executes this handler, replaces only the internal native operation with a recorder, and reads its resident-key argument.

Node v26.12.1; darwin arm64
git version 2.56.0
T3 commit 59e64eef881632a23f89c4138bcf37f23d92bf93
@electron-webauthn/macos 1.3.1
required control: residentKeyRequired=true; expected=true
legacy-only control: residentKeyRequired=true; expected=true
discouraged control: residentKeyRequired=false; expected=false
discouraged + legacy true: residentKeyRequired=true; expected=false
@electron-webauthn/macos 1.4.0
required control: residentKeyRequired=true; expected=true
legacy-only control: residentKeyRequired=true; expected=true
discouraged control: residentKeyRequired=false; expected=false
discouraged + legacy true: residentKeyRequired=true; expected=false
RESULT: defect reproduced

The public output omits Node's process-specific experimental-warning lines; the functional output is unchanged.

Restoration check#

The conflicting discouraged / true input must reach the internal operation with residentKeyRequired=false, with all three controls still passing. Both the pinned and comparison package observations are printed separately.

Additional context#

The first harness attempt read argument 12, which is the attachment preference, instead of argument 11, the resident-key Boolean. Its required control failed and it printed RESULT: inconclusive. After correcting that observation index, the recorded run below passed all controls and reproduced the mismatch. No application code was changed.

• https://github.com/pingdotgg/t3code/pull/16952 — introduces the macOS bridge; this report concerns a specific request-semantics mismatch rather than adding the bridge.
• https://github.com/pingdotgg/t3code/issues/34661 — tracks enabling the bridge in signed releases; the reproduction here exercises its source with synthetic inputs, independently of release capability approval.