fix(auth): unenroll the unverified factor after a failed registration by Kjubikstronk · Pull Request #2641 · supabase/supabase-js

Kjubikstronk · 2026-08-31T08:34:10Z

Closes #2640.

When _enroll fails, register() tries to clean up after itself by finding a webauthn factor with the same friendly name and unenrolling it. The lookup selects on v.status !== 'unverified', which matches a verified factor, so a failed re-registration can delete a passkey the user already had working.

The factor worth cleaning up is the unverified one the failed attempt just left behind, so the condition is inverted. That is the whole change:

-                v.status !== 'unverified'
+                v.status === 'unverified'

Two tests in passkey.methods.test.ts, which mocks fetch throughout and needs no server. One drives a failed enrollment with an existing verified factor of the same name and asserts unenroll is never called; the other does the same with an unverified factor and asserts it is unenrolled by id. Both fail on master and pass with the change, and the other 29 tests in that file are unaffected.

prettier --check is clean on both files.

coderabbitai · 2026-08-31T08:34:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: baaec986-346b-4abc-9792-6e7e2f8b16bd

📥 Commits

Reviewing files that changed from the base of the PR and between b3b939a and d48d45d.

📒 Files selected for processing (2)

packages/core/auth-js/src/lib/webauthn.ts
packages/core/auth-js/test/passkey.methods.test.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Summary by CodeRabbit

Bug Fixes
- Corrected WebAuthn enrollment cleanup after a failed registration.
- Previously verified factors are now preserved, while incomplete unverified factors are removed appropriately.

Walkthrough

The WebAuthn enrollment failure cleanup now matches factors with status === 'unverified'. It no longer unenrolls verified factors that share the requested friendly name. Regression tests cover both preservation of an existing verified factor and removal of a matching unverified factor.

Assessment against linked issues

Objective	Addressed	Explanation
Preserve verified passkeys after failed registration and remove only stale unverified factors [`#2640`]	✅

Merge Risk: 🔵 Low · up to d48d4

This change prevents a failed registration from deleting an existing verified passkey, but cleanup can still remove an unrelated unverified passkey with the same name during retries or concurrent registrations. The PR is mergeable with explicit owner awareness and follow-up to bind cleanup to the failed registration.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-09-01T12:48:33Z

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2641

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2641

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2641

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2641

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2641

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2641

commit: 97a16eb

mandarini

Hi @Kjubikstronk, thank you for contributing to Supabase! 💚

Fix is correct. FactorVerificationStatuses is a closed union of verified and unverified, so !== 'unverified' was exactly === 'verified'. Good catch, and thanks for keeping the diff to just that.

Two things before merge:

Add a comment above the changed line. A one character flip is easy to revert later by mistake. State the invariant: cleanup targets a stale unverified factor so a retry can succeed, and must never select a verified one.
Two more tests. Your existing two are solid. Please also cover a verified and an unverified factor sharing a name (verified survives), and no matching factor at all (unenroll never called).

Yours is the one we are taking of the PRs for this issue, the tests belong in passkey.methods.test.ts where you put them. Thanks again!

coveralls · 2026-09-01T12:53:16Z

coverage: 81.966% (+0.3%) from 81.697% — Kjubikstronk:webauthn-cleanup-unverified-factor into supabase:master

…anup Adds the invariant as a comment above the status check, so the one character is not flipped back by mistake, and two cases the existing tests did not reach: a verified and an unverified factor sharing a friendly name, and no matching factor at all.

Kjubikstronk · 2026-09-01T17:43:51Z

Both done in 97a16eb.

The comment. Above the status check, stating it in terms of what each status means rather than what the operator is:

// Only an unverified factor is leftover from the enrollment that just
// failed, and removing it is what lets a retry with the same name
// succeed. A verified factor of that name is a passkey the user is
// already using, so it must never be selected here.

The two tests. Both in passkey.methods.test.ts, next to the existing pair. The helper now takes a list of factors so the shared name case can be expressed directly:

removes only the unverified one when both share a name, asserting unenroll is called exactly once and with the unverified id, so the test fails if the search ever picks the first match by name alone.
does nothing when no factor of that name exists, with unenroll never called.

I checked the new tests actually bite: reverting the character back to !== 'unverified' fails three of the four, and the fourth is the no factor case, which is a control that should pass either way.

passkey.methods.test.ts is green, 33 of 33.

mandarini · 2026-09-02T10:40:49Z

@Kjubikstronk i'll fix the pnpm audit issues on master and I'll ask you to rebase

mandarini · 2026-09-02T10:49:53Z

@Kjubikstronk can you please rebase with master?

@mandarini

This PR updates `@supabase/supabase-js` to v2.114.0. **Source**: supabase-js-stable-release --- ## Release Notes ## v2.114.0 ## 2.114.0 (2026-09-02) ### 🚀 Features - **storage:** object versioning updates ([#2644](supabase/supabase-js#2644)) ### 🩹 Fixes - **auth:** unenroll the unverified factor after a failed registration ([#2641](supabase/supabase-js#2641)) - **deps:** override browserslist to patch high-severity advisories ([#2652](supabase/supabase-js#2652)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Miodrag Obradovic @Kjubikstronk - Tyler Hillery ## v2.113.0 ## 2.113.0 (2026-09-02) ### 🚀 Features - **realtime:** allow wait for pg changes ([#2630](supabase/supabase-js#2630)) ### ❤️ Thank You - Filipe Cabaço @filipecabaco This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>

fix(auth): unenroll the unverified factor after a failed registration

d48d45d

Kjubikstronk requested review from a team as code owners August 31, 2026 08:34

PedroHenrique0713 mentioned this pull request Sep 1, 2026

auth-js: mfa.webauthn.register() deletes an existing verified passkey when a re-registration fails #2640

Closed

mandarini requested changes Sep 1, 2026

View reviewed changes

mandarini mentioned this pull request Sep 1, 2026

fix(auth): preserve verified passkey when webauthn register() enrollment fails #2639

Closed

5 of 9 tasks

mandarini approved these changes Sep 2, 2026

View reviewed changes

mandarini merged commit bef68e0 into supabase:master Sep 2, 2026
21 of 23 checks passed

supabase-supabase-autofixer Bot mentioned this pull request Sep 2, 2026

chore: update @supabase/supabase-js to v2.114.0 supabase/multiplayer.dev#88

Merged

This was referenced Sep 2, 2026

chore: update @supabase/supabase-js to v2.114.0 supabase/realtime#2155

Merged

chore: update @supabase/supabase-js to v2.114.0 supabase/ssr#289

Merged

supabase-supabase-autofixer Bot mentioned this pull request Sep 2, 2026

feat: update @supabase/*-js libraries to v2.114.0 supabase/supabase#49905

Closed

Navigation Menu

Repository navigation

fix(auth): unenroll the unverified factor after a failed registration - #2641

fix(auth): unenroll the unverified factor after a failed registration#2641
mandarini merged 2 commits into
supabase:masterfrom
Kjubikstronk:webauthn-cleanup-unverified-factor

Kjubikstronk commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Assessment against linked issues

Uh oh!

pkg-pr-new Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

mandarini left a comment

Uh oh!

coveralls commented Sep 1, 2026

Uh oh!

Kjubikstronk commented Sep 1, 2026

Uh oh!

mandarini commented Sep 2, 2026

Uh oh!

mandarini commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Kjubikstronk commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Assessment against linked issues

Uh oh!

pkg-pr-new Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mandarini left a comment

Choose a reason for hiding this comment

Uh oh!

coveralls commented Sep 1, 2026

Uh oh!

Kjubikstronk commented Sep 1, 2026

Uh oh!

mandarini commented Sep 2, 2026

Uh oh!

mandarini commented Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

pkg-pr-new Bot commented Sep 1, 2026 •

edited

Loading