Move Passkey Allowed Origin Configuration to Application-Level Configuration - #4331
Merged
ThaminduDilshan merged 1 commit intoJul 27, 2026
Conversation
NutharaNR
requested review from
DonOmalVindula,
ThaminduDilshan,
brionmario,
jeradrutnam and
thiva-k
as code owners
July 24, 2026 09:39
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 24, 2026 09:39
9c46d44 to
2d8c0d0
Compare
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughApplication-level passkey origins are added to backend contracts and persistence, synchronized with writable CORS settings, propagated through WebAuthn flows, and managed through new console controls with validation and localization. ChangesApplication-level passkey origin configuration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Console
participant ApplicationAPI
participant ApplicationService
participant PasskeyExecutor
participant PasskeyService
Console->>ApplicationAPI: submit PasskeyAllowedOrigins
ApplicationAPI->>ApplicationService: create or update application
ApplicationService->>ApplicationService: persist origins and sync CORS
PasskeyExecutor->>PasskeyService: passkey request with AllowedOrigins
PasskeyService->>PasskeyService: resolve request or configured origins
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
backend/pkg/thunderidengine/providers/model.go (1)
1008-1027: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win🔴 Documentation Required
This PR introduces user-facing changes that are not covered by documentation updates underdocs/.
Please update the relevant documentation before merging.Missing documentation:
- Application-level passkey origins: document the new
passkeyAllowedOriginsfield onInboundAuthProfileindocs/content/apis.mdxor a configuration guide.- Console Passkey Allowed Origins UI: document the advanced-settings app-level origin list and its CORS writable-origin auto-sync in
docs/content/guides/.Note: this cohort only includes a subset of the PR's files, so docs may already be added elsewhere in the full PR — please confirm.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/pkg/thunderidengine/providers/model.go` around lines 1008 - 1027, Update the relevant documentation to describe InboundAuthProfile.passkeyAllowedOrigins, including its optional application-level override behavior for passkey/WebAuthn origins. Add a console configuration guide covering the advanced-settings app-level origin list and its automatic synchronization with CORS writable origins, while preserving any existing server-level configuration documentation.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/application/service.go`:
- Around line 2117-2165: Update the CORS synchronization flow around
GetWritableConfig and SetConfig to use an atomic server-config merge or
versioned compare-and-retry update, re-reading and merging on write conflicts so
concurrent origin additions are preserved. Keep deduplication of literal origins
intact, and add a test that exercises concurrent writes and verifies no origin
is lost.
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx`:
- Around line 25-38: Update PasskeysSectionProps and PasskeysSection to accept
onValidationChange and report whether errors is non-empty whenever errors
changes. In
frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx#L200-L204,
add passkeysInvalid state, pass it to PasskeysSection, and include it in the
combined validation callback alongside identityAssertionsInvalid and
attestationInvalid.
---
Outside diff comments:
In `@backend/pkg/thunderidengine/providers/model.go`:
- Around line 1008-1027: Update the relevant documentation to describe
InboundAuthProfile.passkeyAllowedOrigins, including its optional
application-level override behavior for passkey/WebAuthn origins. Add a console
configuration guide covering the advanced-settings app-level origin list and its
automatic synchronization with CORS writable origins, while preserving any
existing server-level configuration documentation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 80869c92-a7d6-44fe-9912-74184f619eb6
📒 Files selected for processing (22)
backend/cmd/server/servicemanager.gobackend/internal/application/handler.gobackend/internal/application/handler_test.gobackend/internal/application/init.gobackend/internal/application/init_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/authn/passkey/model.gobackend/internal/authn/passkey/service.gobackend/internal/authn/passkey/utils.gobackend/internal/authn/passkey/utils_test.gobackend/internal/flow/executor/passkey_executor.gobackend/internal/flow/executor/passkey_executor_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_test.gobackend/pkg/thunderidengine/providers/model.gofrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/EditAdvancedSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/PasskeysSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.ts
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
2 times, most recently
from
July 24, 2026 10:40
f5f7001 to
cbd966e
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/EditAdvancedSettings.test.tsx`:
- Around line 455-469: Update the read-only assertion in the test using the same
key-based accessible-name matcher as the click test above, targeting the
`applications:edit.advanced.passkeys.allowedOrigins.addOrigin` translation key
instead of the literal “Add Origin” text. Keep the expectation that this button
is absent when `application.isReadOnly` is true.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 91c58572-a1e9-47ff-a7d1-103776552788
📒 Files selected for processing (23)
backend/cmd/server/servicemanager.gobackend/internal/actorprovider/utils.gobackend/internal/application/handler.gobackend/internal/application/handler_test.gobackend/internal/application/init.gobackend/internal/application/init_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/authn/passkey/model.gobackend/internal/authn/passkey/service.gobackend/internal/authn/passkey/utils.gobackend/internal/authn/passkey/utils_test.gobackend/internal/flow/executor/passkey_executor.gobackend/internal/flow/executor/passkey_executor_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_test.gobackend/pkg/thunderidengine/providers/model.gofrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/EditAdvancedSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/PasskeysSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.ts
🚧 Files skipped from review as they are similar to previous changes (20)
- frontend/apps/console/src/features/applications/models/application.ts
- backend/pkg/thunderidengine/providers/model.go
- backend/cmd/server/servicemanager.go
- backend/internal/authn/passkey/utils.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx
- backend/internal/authn/passkey/utils_test.go
- backend/internal/application/handler_test.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx
- backend/internal/flow/executor/passkey_executor.go
- backend/internal/application/init.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/PasskeysSection.test.tsx
- backend/internal/inboundclient/store.go
- backend/internal/flow/executor/passkey_executor_test.go
- backend/internal/authn/passkey/model.go
- frontend/packages/i18n/src/locales/en-US.ts
- backend/internal/application/init_test.go
- backend/internal/application/handler.go
- backend/internal/inboundclient/store_test.go
- backend/internal/authn/passkey/service.go
- backend/internal/application/service.go
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 26, 2026 14:08
cbd966e to
0a59362
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx`:
- Around line 200-204: Update the edit page’s PasskeysSection integration to
accept and invoke an onValidationChange callback for empty or invalid-origin
states, and combine that state with the parent’s aggregate validation used by
the Save guard. Preserve the read-only behavior, and add an integration test
confirming invalid passkey origins disable or block Save.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fd888411-bf64-4d13-98d3-c0a2c475d89f
📒 Files selected for processing (23)
backend/cmd/server/servicemanager.gobackend/internal/actorprovider/utils.gobackend/internal/application/handler.gobackend/internal/application/handler_test.gobackend/internal/application/init.gobackend/internal/application/init_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/authn/passkey/model.gobackend/internal/authn/passkey/service.gobackend/internal/authn/passkey/utils.gobackend/internal/authn/passkey/utils_test.gobackend/internal/flow/executor/passkey_executor.gobackend/internal/flow/executor/passkey_executor_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_test.gobackend/pkg/thunderidengine/providers/model.gofrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/EditAdvancedSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/PasskeysSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.ts
🚧 Files skipped from review as they are similar to previous changes (18)
- frontend/apps/console/src/features/applications/models/application.ts
- backend/cmd/server/servicemanager.go
- backend/internal/inboundclient/store.go
- backend/internal/authn/passkey/utils_test.go
- backend/internal/authn/passkey/utils.go
- backend/internal/flow/executor/passkey_executor.go
- backend/internal/actorprovider/utils.go
- backend/pkg/thunderidengine/providers/model.go
- backend/internal/authn/passkey/model.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/EditAdvancedSettings.test.tsx
- backend/internal/application/handler.go
- backend/internal/flow/executor/passkey_executor_test.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/PasskeysSection.test.tsx
- backend/internal/application/handler_test.go
- backend/internal/inboundclient/store_test.go
- backend/internal/application/service.go
- backend/internal/application/service_test.go
ThaminduDilshan
added
Type/Improvement
breaking change
ThaminduDilshan
removed
the
breaking change
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 27, 2026 04:19
0a59362 to
fc44504
Compare
thiva-k
added
the
trigger-pr-builder
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 27, 2026 06:05
fc44504 to
11b390a
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
api/application.yaml (1)
857-862: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd
format: uritopasskeyAllowedOriginsitems for consistency.Sibling URL fields (
redirectUris,url,logoUrl, etc.) all declareformat: urion their string items; the newpasskeyAllowedOriginsschema omits it in all three places it's defined.♻️ Proposed fix (repeat for all three occurrences)
passkeyAllowedOrigins: type: array items: type: string + format: uri description: Allowed origins for WebAuthn/passkey operations for this application. ...Also applies to: 1002-1007, 1129-1134
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/application.yaml` around lines 857 - 862, Update all three passkeyAllowedOrigins schema definitions to add format: uri to their string item schemas, matching the validation used by sibling URL fields such as redirectUris and logoUrl.frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx (1)
45-51: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
isValidURLaccepts non-Origin values (paths, non-http(s) schemes).
new URL(value)succeeding only provesvalueis some absolute URL — it acceptsftp://x,https://a.com/some/path, etc., none of which are valid WebAuthn Origins (RFC 6454: scheme + host[+port] only, no path/query/fragment). A path-bearing value would parse as "valid" here yet never actually match a browser'sOriginheader.♻️ Proposed fix
const isValidURL = (value: string): boolean => { try { - return Boolean(new URL(value)); + const url = new URL(value); + return ( + (url.protocol === 'http:' || url.protocol === 'https:') && + url.pathname === '/' && + !url.search && + !url.hash + ); } catch { return false; } };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx` around lines 45 - 51, Update isValidURL to validate WebAuthn Origin syntax rather than merely successful URL parsing: accept only http and https schemes with a host, and reject any nonempty path beyond “/”, query, or fragment components. Preserve the existing boolean return behavior for malformed or unsupported values.backend/internal/application/service_test.go (1)
4370-4396: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a regression test for duplicate origins within the same input slice.
None of the new tests pass an
originsargument containing a repeated value (e.g.[]string{"https://app.example.com", "https://app.example.com"}) to confirm only one copy is added. Given the dedup bug flagged inservice.go, a test here would both validate the fix and prevent regression.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/internal/application/service_test.go` around lines 4370 - 4396, Add a regression test alongside TestSyncPasskeyOriginsToCORS_AddsNewOrigins that passes duplicate values to syncPasskeyOriginsToCORS, such as the same origin twice, and verifies the persisted allowedOrigins contains that origin exactly once. Reuse the existing PatchConfig transform-mocking pattern and assertions, while ensuring the test would fail if duplicate input values were added.backend/internal/serverconfig/service.go (1)
181-238: 🗄️ Data Integrity & Integration | 🔵 TrivialIn-process mutex doesn't protect against cross-instance config races.
configMucorrectly serializesSetConfig/PatchConfigwithin a single process, fixing the previously-flagged same-process lost-update race. However, if the server ever runs multiple replicas, or another code path writesServerConfigrows directly (bypassing this service), concurrent writers across processes can still race onUpsertServerConfigsince there's no optimistic-concurrency check (e.g. a version/etag compare) at the store layer. Worth tracking as a follow-up if horizontal scaling of this service is on the roadmap.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/internal/serverconfig/service.go` around lines 181 - 238, Track the remaining cross-instance lost-update risk in PatchConfig and the corresponding SetConfig write path as a follow-up rather than relying solely on configMu. Add a store-layer optimistic-concurrency mechanism, such as version or etag comparison, so UpsertServerConfig rejects stale writes from other processes or direct writers while preserving the existing same-process serialization.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/application/service.go`:
- Around line 2137-2181: Add authoritative Origin validation in
backend/internal/application/service.go within syncPasskeyOriginsToCORS,
rejecting non-http(s) schemes and any origin containing a path, query, or
fragment before persistence or CORS merging. Also update isValidURL in
frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx
at lines 45-51 to enforce the same scheme and empty path/query/fragment
requirements.
- Around line 2137-2181: Validate every entry in origins within
syncPasskeyOriginsToCORS before appending or mutating the CORS configuration,
using the existing cors.ParseOrigin/compileLiteral validation path. Reject
malformed passkeyAllowedOrigins, including unsupported schemes, paths, queries,
fragments, wildcards, and control characters, and ensure invalid entries are not
merged or persisted.
- Around line 2161-2169: Update the origin-processing loop in the service method
containing existingLiterals so each newly accepted origin is added to
existingLiterals immediately after appending it. Continue skipping origins
already present, ensuring duplicates within the same origins input and
pre-existing configuration are both ignored.
---
Nitpick comments:
In `@api/application.yaml`:
- Around line 857-862: Update all three passkeyAllowedOrigins schema definitions
to add format: uri to their string item schemas, matching the validation used by
sibling URL fields such as redirectUris and logoUrl.
In `@backend/internal/application/service_test.go`:
- Around line 4370-4396: Add a regression test alongside
TestSyncPasskeyOriginsToCORS_AddsNewOrigins that passes duplicate values to
syncPasskeyOriginsToCORS, such as the same origin twice, and verifies the
persisted allowedOrigins contains that origin exactly once. Reuse the existing
PatchConfig transform-mocking pattern and assertions, while ensuring the test
would fail if duplicate input values were added.
In `@backend/internal/serverconfig/service.go`:
- Around line 181-238: Track the remaining cross-instance lost-update risk in
PatchConfig and the corresponding SetConfig write path as a follow-up rather
than relying solely on configMu. Add a store-layer optimistic-concurrency
mechanism, such as version or etag comparison, so UpsertServerConfig rejects
stale writes from other processes or direct writers while preserving the
existing same-process serialization.
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsx`:
- Around line 45-51: Update isValidURL to validate WebAuthn Origin syntax rather
than merely successful URL parsing: accept only http and https schemes with a
host, and reject any nonempty path beyond “/”, query, or fragment components.
Preserve the existing boolean return behavior for malformed or unsupported
values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6f4f68e5-4579-4896-beda-611aa2b24a42
⛔ Files ignored due to path filters (1)
backend/tests/mocks/serverconfigmock/ServerConfigService_mock.gois excluded by!**/*_mock.go
📒 Files selected for processing (28)
api/application.yamlbackend/cmd/server/servicemanager.gobackend/internal/actorprovider/utils.gobackend/internal/application/handler.gobackend/internal/application/handler_test.gobackend/internal/application/init.gobackend/internal/application/init_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/authn/passkey/model.gobackend/internal/authn/passkey/service.gobackend/internal/authn/passkey/utils.gobackend/internal/authn/passkey/utils_test.gobackend/internal/flow/executor/passkey_executor.gobackend/internal/flow/executor/passkey_executor_test.gobackend/internal/inboundclient/store.gobackend/internal/inboundclient/store_test.gobackend/internal/serverconfig/ServerConfigService_mock_test.gobackend/internal/serverconfig/error_constants.gobackend/internal/serverconfig/service.gobackend/internal/serverconfig/service_test.gobackend/pkg/thunderidengine/providers/model.gofrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/PasskeysSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/EditAdvancedSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/PasskeysSection.test.tsxfrontend/apps/console/src/features/applications/models/application.tsfrontend/packages/i18n/src/locales/en-US.ts
🚧 Files skipped from review as they are similar to previous changes (19)
- backend/internal/actorprovider/utils.go
- backend/internal/authn/passkey/utils.go
- frontend/apps/console/src/features/applications/models/application.ts
- backend/cmd/server/servicemanager.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/EditAdvancedSettings.test.tsx
- backend/internal/flow/executor/passkey_executor.go
- backend/internal/authn/passkey/utils_test.go
- backend/internal/application/init.go
- frontend/packages/i18n/src/locales/en-US.ts
- backend/internal/application/handler_test.go
- backend/internal/application/init_test.go
- backend/internal/authn/passkey/service.go
- backend/internal/application/handler.go
- backend/internal/inboundclient/store.go
- backend/pkg/thunderidengine/providers/model.go
- backend/internal/inboundclient/store_test.go
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/PasskeysSection.test.tsx
- backend/internal/flow/executor/passkey_executor_test.go
- backend/internal/authn/passkey/model.go
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 27, 2026 06:34
11b390a to
ee1a291
Compare
Contributor
There was a problem hiding this comment.
Check the declarative_resouce.go also, whether there is another place to update
Contributor
Author
|
After a discussion with @rajithacharith, it was decided to address the concurrency issue related to configuration updates as a separate effort. Since similar concurrency issues exist in other areas where configurations are updated, we agreed to implement a generic solution that can handle these cases consistently. cc: @ThaminduDilshan |
NutharaNR
marked this pull request as draft
July 27, 2026 08:44
NutharaNR
force-pushed
the
ease-configuration-passkey-origins
branch
from
July 27, 2026 09:04
ee1a291 to
daf07d2
Compare
NutharaNR
marked this pull request as ready for review
July 27, 2026 09:16
ThaminduDilshan
approved these changes
Jul 27, 2026
This was referenced Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Passkey allowed origins are currently configured only at the server level (
passkey.allowed_originsindeployment.toml). This means all applications share the same set of origins, which is too restrictive when different applications are hosted on different domains.This PR adds support for configuring passkey allowed origins per application. When an application has origins configured, those origins are used for WebAuthn challenge generation and verification for flows through that application. Applications without per-app origins fall back to the server-level configuration automatically.
Limitation: Adding origins to an application also adds them to the server CORS allowed origins list. There is currently no delete path for CORS origins, so removing an origin from an application does not automatically remove it from the server CORS configuration. Those must be removed separately.
Fixes: #1646
Approach
Backend
The new
passkeyAllowedOriginsfield is stored in the existingPROPERTIESJSONB column of theINBOUND_CLIENTtable via theinboundClientJSONBlobserialization struct. No DB schema migration is needed.Data flows through the stack as follows:
providers.InboundClientandproviders.InboundAuthProfileeach gain aPasskeyAllowedOrigins []stringfield.handler.go) forwards the field from the incoming request into theApplicationDTOfor both create and update paths.buildBaseApplicationProcessedDTOandbuildReturnApplicationDTOinservice.gopropagate the field so it is written to the store and returned in create/update responses.inboundclientstore marshals/unmarshals the field via the JSONB blob.For the passkey service, a
resolveAllowedOrigins(overrideOrigins []string) []stringhelper is added toutils.go. All four passkey operations (StartRegistration,FinishRegistration,StartAuthentication,FinishAuthentication) replace their hardcodedgetConfiguredOrigins()call withresolveAllowedOrigins(req.AllowedOrigins). WhenAllowedOriginsis empty (as in atomic API calls), it falls back to the server config unchanged.The flow executor reads
ctx.Application.PasskeyAllowedOriginsand sets it on all four passkey request types. Atomic API handlers make no changes; emptyAllowedOriginstriggers the fallback automatically.When an application is created or updated with passkeyAllowedOrigins, those origins are automatically merged into the server CORS allowed origins (writable layer) via syncPasskeyOriginsToCORS() in service.go. This sync is additive: origins already present are skipped, and origins removed from an application or deleted applications are not pruned from CORS. Removing stale origins from CORS requires manual intervention.
Frontend
A new
PasskeysSectioncomponent is added under Application Advanced Settings, following the existingRedirectURIsSectionpattern. It renders a list of origin text fields with add/delete controls and URL validation on blur. The section title is "Passkey Allowed Origins" with a hint clarifying server-level fallback behavior. TheEditAdvancedSettingscomponent wires this in viaonFieldChange('passkeyAllowedOrigins', ...).Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
Summary by CodeRabbit