Harden passkey management

project.inlang/messages/de.json

@@ -798,6 +798,7 @@
 				"action": "Hinzufügen",
 				"success": "Passkey hinzugefügt",
 				"error": "Passkey konnte nicht hinzugefügt werden",
+				"errorDeleteSuccess": "Teilweise hinzugefügter Passkey gelöscht",
 				"maxReached": {
 					"title": "Maximum erreicht",
 					"description": "Du hast bereits die maximale Anzahl von Passkeys für Deinen Account erreicht"

project.inlang/messages/en.json

@@ -806,6 +806,7 @@
 				"action": "Add Passkey",
 				"success": "Passkey added",
 				"error": "Passkey could not be added",
+				"errorDeleteSuccess": "Partially added Passkey deleted",
 				"maxReached": {
 					"title": "Maximum reached",
 					"description": "You've reached the maximum amount of Passkeys for this account"

src/routes/(pages)/dashboard/account/passkeys/(components)/add-passkey-form/add-passkey-form.svelte

@@ -167,6 +167,17 @@
     } catch (error) {
       console.error("Unable to add passkey", error);
       toast.error(m["account.passkeys.add.error"]());
+
+      // Try to delete the partially added passkey if it was created
+      await fetch(`/api/auth/passkeys/${$formData.id}`, {
+        method: "DELETE",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ tenantId }),
+        credentials: "same-origin",
+      });
+      toast.info(m["account.passkeys.add.errorDeleteSuccess"]());
     } finally {
       isSubmitting = false;
     }

src/routes/api/auth/challenge/+server.ts

@@ -229,10 +229,12 @@ export const POST: RequestHandler = async ({ request, cookies, url }) => {
     // Try to get user by email - but don't fail if not found
     let user = null;
     let isRegistration = false;
+    let passkeysLength = 0;
 
     try {
       user = await UserService.getUserByEmail(requestEmail);
       const passkeys = await UserService.getUserPasskeys(user.id);
+      passkeysLength = passkeys.length;
       if (passkeys.length === 0) {
         isRegistration = true; // User exists but has no passphrase - must register
       }
@@ -279,6 +281,10 @@ export const POST: RequestHandler = async ({ request, cookies, url }) => {
         path: "/",
         maxAge: 60 * 5, // 5 minutes
       });
+    } else {
+      if (passkeysLength >= 3) {
+        throw new BackendError("Maximum number of passkeys reached", 400);
+      }
     }
 
     let allowCredentials: Array<{