fix: issue regarding passkey with next-auth

[pranalidhanavade]

What

• fix: issue regarding passkey with next-auth

---

Important

Fixes passkey authentication issue by adding isPassword boolean and updating authentication logic in Auth.ts, user-auth-form.tsx, and authOptions.ts.

• Behavior:
  • Adds isPassword boolean to IUserSignInData in Auth.ts to differentiate between password and passkey authentication.
  • Updates handleSignIn and authenticateWithPasskey in user-auth-form.tsx to use isPassword for authentication logic.
  • Modifies authorize function in authOptions.ts to handle isPassword and parse JSON strings for passkey authentication.
• Misc:
  • Removes verifyAuthenticationMethod from user-auth-form.tsx.
  • Updates imports in user-auth-form.tsx to remove unused functions and add useSession.

^{This description was created by for 5d253b9. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Caution

Changes requested ❌

Reviewed everything up to e1f722f in 2 minutes and 20 seconds. Click for details.

• Reviewed 268 lines of code in 3 files
• Skipped 0 files when reviewing.
• Skipped posting 4 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. nextjs/src/app/api/Auth.ts:24

• Draft comment:
  Clarify the distinct roles of 'isPasskey' vs 'isPassword' in IUserSignInData to avoid future confusion.
• Reason this comment was not posted:
  Comment was not on a location in the diff, so it can't be submitted as a review comment.

2. nextjs/src/utils/authOptions.ts:99

• Draft comment:
  Ensure that URL concatenation is correct: verify that 'apiRoutes.auth.fidoVerifyAuthentication' includes a trailing slash or adjust the concatenation to safely append parsedObj.userName.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 20% vs. threshold = 50% The comment starts with "Ensure that..." which is a red flag according to the rules. However, URL concatenation issues can cause real bugs. But we don't have visibility into apiRoutes.auth.fidoVerifyAuthentication to know if this is actually an issue. The comment is speculative without seeing the actual route definition. I might be too focused on the technical merit of URL safety while ignoring the clear rule about avoiding "Ensure that..." comments. Also, this could be something that would be caught in testing. The rules are very clear about avoiding speculative comments and those that start with "Ensure that...". Without seeing the route definition, we can't be certain this is a real issue. Delete the comment as it violates multiple rules - it's speculative, starts with "Ensure that...", and requires more context about the route definition to verify if it's actually an issue.

3. nextjs/src/features/auth/components/user-auth-form.tsx:194

• Draft comment:
  Typo: "challangeId" appears to be a typographical error. Consider renaming it to "challengeId" for consistency.
• Reason this comment was not posted:
  Comment was on unchanged code.

4. nextjs/src/utils/authOptions.ts:90

• Draft comment:
  Typographical Error: The route name 'sinIn' appears to be a typo. It might be intended as 'signIn'. Please verify the correct naming for the authentication endpoint.
• Reason this comment was not posted:
  Comment was on unchanged code.

Workflow ID: wflow_18u35NSngBNIS08T

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[ellipsis-dev]

In the passkey authentication flow, you're sending 'isPasswordTab' in entityData. Use 'isPassword: isPasswordTab' instead to match the backend's expectation.

Suggested change

	isPasswordTab,
	isPassword: isPasswordTab,

[ellipsis-dev]

Relying on session?.accessToken immediately after signIn might result in stale or missing data. Consider using the returned token from the signIn callback or await a proper session update.

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed 3a1820d in 33 seconds. Click for details.

• Reviewed 13 lines of code in 1 files
• Skipped 0 files when reviewing.
• Skipped posting 1 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. nextjs/src/features/auth/components/user-auth-form.tsx:196

• Draft comment:
  Renamed property 'isPasswordTab' to 'isPassword' for consistency. Ensure that the backend and related interfaces are updated to expect 'isPassword'.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% The comment is asking the author to ensure that the backend and related interfaces are updated to expect the new property name. This falls under asking the author to ensure something is done, which is against the rules. The comment does not provide a specific suggestion or ask for a specific test to be written, so it should be removed.

Workflow ID: wflow_D8acSCdVCYseQnZr

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[sujitaw]

ok

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed 5d253b9 in 1 minute and 29 seconds. Click for details.

• Reviewed 13 lines of code in 1 files
• Skipped 0 files when reviewing.
• Skipped posting 1 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. nextjs/src/features/auth/components/user-auth-form.tsx:196

• Draft comment:
  Using shorthand property 'isPasswordTab' instead of 'isPassword'—ensure that the backend and type definitions are updated accordingly. Also, note that the password flow sends 'isPassword', so consider unifying the naming for consistency.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 20% vs. threshold = 50% The comment makes a valid point about consistency - we have isPassword in one place and isPasswordTab in another. However, this could be a deliberate change to improve naming. Without seeing the backend code or type definitions, we can't be certain which name is correct. The comment is speculative about backend impacts. I may be overthinking this - the core issue is that we have inconsistent naming within this single file, which could cause confusion regardless of backend concerns. While naming consistency is important, we don't have enough context to know which name is correct, and the comment speculates about backend impacts we can't verify. The comment should be deleted as it makes assumptions about backend requirements and asks for verification rather than pointing out a clear issue.

Workflow ID: wflow_aPJG9GnrBSsKI3gB

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}