From f2a4e660320596fa440e5b8db1793a3450d76354 Mon Sep 17 00:00:00 2001
From: Bryan Brooks <bryanbrooks@I3-MINI--BITS-2.local>
Date: Tue, 24 Feb 2026 12:54:06 -0600
Subject: [PATCH] fix: require discoverable credential for passkey registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

residentKey: 'preferred' → 'required' so Firefox stores passkeys
as discoverable credentials. The OIDC login page authenticates
without allowCredentials (user not identified yet), which requires
discoverable credentials to work.
---
 gateway/src/services/passkey.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gateway/src/services/passkey.ts b/gateway/src/services/passkey.ts
index 4e33e77..2d088dc 100644
--- a/gateway/src/services/passkey.ts
+++ b/gateway/src/services/passkey.ts
@@ -67,7 +67,7 @@ export class PasskeyService {
         transports: cred.transports as AuthenticatorTransportFuture[] | undefined,
       })),
       authenticatorSelection: {
-        residentKey: 'preferred',
+        residentKey: 'required',
         userVerification: 'preferred',
         authenticatorAttachment: undefined, // Allow both platform and cross-platform
       },
-- 
2.51.2