From 7e4556681195fbe2f48f7c8a6d6a7a0fbefd258e Mon Sep 17 00:00:00 2001
From: scanash00 <scan@scanash.com>
Date: Wed, 29 Jul 2026 09:31:09 -0800
Subject: [PATCH] passkey fixes

---
 crates/tranquil-pds/src/auth/webauthn.rs | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/crates/tranquil-pds/src/auth/webauthn.rs b/crates/tranquil-pds/src/auth/webauthn.rs
index e255f25..88d3b5c 100644
--- a/crates/tranquil-pds/src/auth/webauthn.rs
+++ b/crates/tranquil-pds/src/auth/webauthn.rs
@@ -61,6 +61,7 @@ impl WebAuthnConfig {
                 None,
             )
             .map(|(mut ccr, state)| {
+                ccr.public_key.hints = None;
                 let sel = ccr
                     .public_key
                     .authenticator_selection
@@ -146,3 +147,19 @@ impl WebAuthnConfig {
             .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string()))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::WebAuthnConfig;
+
+    #[test]
+    fn registration_does_not_prefer_security_key_ui() {
+        let config = WebAuthnConfig::new("pds.example.com").unwrap();
+        let (challenge, _) = config
+            .start_registration("did:plc:test", "alice", "Alice", Vec::new())
+            .unwrap();
+        let challenge = serde_json::to_value(challenge).unwrap();
+
+        assert!(challenge.pointer("/publicKey/hints").is_none());
+    }
+}
-- 
2.51.2