IS-11288 adds new page to reregister a device linked to previous username by mkrzeminskicurity · Pull Request #155 · curityio/ui-kit

mkrzeminskicurity · 2026-05-06T14:00:41Z

No description provided.

Update main

Bumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) from 7.9.5 to 7.12.0. - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) --- updated-dependencies: - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 6.4.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 4.3.9 to 6.4.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…mon/css/lib/lodash-4.18.1 Bump lodash from 4.17.21 to 4.18.1 in /src/common/css/lib

…mon/css/lib/vite-6.4.2 Bump vite from 4.3.9 to 6.4.2 in /src/common/css/lib

…mon/css/docs/vite-6.4.2 Bump vite from 6.4.1 to 6.4.2 in /src/common/css/docs

…outer-7.12.0 Bump react-router from 7.9.5 to 7.12.0

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.1.12 to 7.3.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Bump vite from 7.1.12 to 7.3.2

Bumps [defu](https://github.com/unjs/defu) from 6.1.4 to 6.1.7. - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) --- updated-dependencies: - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…mon/css/docs/defu-6.1.7 Bump defu from 6.1.4 to 6.1.7 in /src/common/css/docs

…name

Copilot

Pull request overview

Adds new “replace stale credential” pages for both WebAuthn and Passkeys authenticators, enabling a user to re-register a device when the previously registered credential is no longer valid (e.g., tied to an old username/account state).

Changes:

Added new replace-stale-credential GET templates for WebAuthn and Passkeys.
Added corresponding client-side scripts to initiate credential creation and POST the resulting JSON back to the server.
Added localized message bundles for EN, SV, PT, and PT-PT.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/identity-server/templates/core/authenticator/webauthn/replace-stale-credential/get.vm	New WebAuthn page template to initiate replacement registration.
src/identity-server/templates/core/authenticator/webauthn/js/replace-stale-credential.vm	WebAuthn JS flow to create a new credential and submit it.
src/identity-server/templates/core/authenticator/passkeys/replace-stale-credential/get.vm	New Passkeys page template to initiate replacement registration.
src/identity-server/templates/core/authenticator/passkeys/js/replace-stale-credential.vm	Passkeys JS flow to create a new credential and submit it.
src/identity-server/messages/core/sv/authenticator/webauthn/replace-stale-credential/messages	Swedish strings for WebAuthn replacement page.
src/identity-server/messages/core/sv/authenticator/passkeys/replace-stale-credential/messages	Swedish strings for Passkeys replacement page.
src/identity-server/messages/core/pt/authenticator/webauthn/replace-stale-credential/messages	Portuguese strings for WebAuthn replacement page.
src/identity-server/messages/core/pt/authenticator/passkeys/replace-stale-credential/messages	Portuguese strings for Passkeys replacement page.
src/identity-server/messages/core/pt-pt/authenticator/webauthn/replace-stale-credential/messages	Portuguese (PT-PT) strings for WebAuthn replacement page.
src/identity-server/messages/core/pt-pt/authenticator/passkeys/replace-stale-credential/messages	Portuguese (PT-PT) strings for Passkeys replacement page.
src/identity-server/messages/core/en/authenticator/webauthn/replace-stale-credential/messages	English strings for WebAuthn replacement page.
src/identity-server/messages/core/en/authenticator/passkeys/replace-stale-credential/messages	English strings for Passkeys replacement page.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+#
+
+view.description=Din nyckel är inte längre giltig eftersom din kontoinformation har ändrats. Du måste registrera en ny nyckel för att fortsätta.
+view.button.register=Registrera fler enheter


daniellindau · 2026-05-21T14:29:09Z

+#
+
+view.description=Din nyckel är inte längre giltig eftersom din kontoinformation har ändrats. Du måste registrera en ny nyckel för att fortsätta.
+view.button.register=Registrera fler enheter


I don't we should use "Enhet" or device for passkey. More fitting for Webauthn though.

Suggestion: Registrera en ny nyckel ( or "ny passkey" if we want to go that route)

renatoathaydes · 2026-05-21T14:29:31Z

I asked Claude to have a look:

I'll review the diff focusing on the message files for translations and naming issues.

This is a one-shot review, so tasks aren't needed. Continuing the review.

Now I have enough to give a complete review. Here are the issues I found, focused on the message/translation files:

Issues Found

Patch 13 (`replace-stale-credential`)

1. Swedish — incoherent button translation

In both [sv/.../passkeys/replace-stale-credential/messages](src/identity-server/messages/core/sv/authenticator/passkeys/replace-stale-credential/messages) and [sv/.../webauthn/replace-stale-credential/messages](src/identity-server/messages/core/sv/authenticator/webauthn/replace-stale-credential/messages):

view.button.register=Registrera fler enheter

This means "Register more devices" (plural), but the English source says "Register new device" (singular). The existing webauthn/register/messages uses Registrera ny enhet (line 12-13 of the existing file) — that's the correct phrasing here.

2. Swedish — vocabulary inconsistency ("nyckel" vs "passkey")

view.description=Din nyckel är inte längre giltig ...

English uses "passkey" throughout, but the Swedish description translates it as just "nyckel" ("key"). Other parts of the codebase keep it as passkey (e.g., view.button.any-attachment=Fortsätt med en passkey). Should be aligned.

3. Portuguese — pt-pt is actually Brazilian Portuguese

[pt-pt/.../passkeys/replace-stale-credential/messages](src/identity-server/messages/core/pt-pt/authenticator/passkeys/replace-stale-credential/messages) is identical to the pt file and uses Brazilian spelling (registrar instead of European registar; Você deve instead of impersonal). This mirrors a pre-existing pattern in the repo (the existing pt and pt-pt webauthn/register/messages files are also byte-identical), so not strictly a regression — but worth flagging because the patch perpetuates it.

Patch 14 (`*-success` pages)

4. MAJOR — all non-English translations are missing

All 12 non-English message files (pt, pt-pt, sv × {passkeys, webauthn} × {replace-stale-credential-success, replace-previous-username-bound-credential-success}) contain the English source text verbatim. The files exist under language-specific directories but the content was never translated. Example — [sv/.../webauthn/replace-stale-credential-success/messages](src/identity-server/messages/core/sv/authenticator/webauthn/replace-stale-credential-success/messages):

view.description=Your new passkey has been registered successfully. ...
view.button.continue=Continue

This is the "wrong file names" issue — files placed in pt/, pt-pt/, sv/ directories but containing English content.

5. Orphan message files for replace-previous-username-bound-credential-success

The patch adds message files for path replace-previous-username-bound-credential-success (8 files across passkeys/webauthn and 4 langs) but creates no templates for that path. The templates added are only replace-stale-credential-success/get.vm for passkeys and webauthn. Either:

a replace-previous-username-bound-credential-success/get.vm template is missing for both authenticators, or
these 8 message files are dead and should be removed.

Also note: there's no replace-previous-username-bound-credential/ directory (without -success) — only the -success variant. So the "previous-username-bound" flow appears to have only a landing/success page and no entry page, while replace-stale-credential has both. This asymmetry suggests something is incomplete.

Minor

6. Copyright header drift

daniellindau

Made some suggestions on the swedish wording, but I believe it merits a quick discussion with @urre

daniellindau · 2026-05-21T14:20:49Z

+# For further information, please contact Curity AB.
+#
+
+view.description=Your new passkey has been registered successfully. Your old passkey is still stored in your browser or keychain but will no longer work on this site. To avoid being prompted to use it, remove it from your browser or device's passkey manager.


Not portugese

daniellindau · 2026-05-21T14:21:17Z

+# For further information, please contact Curity AB.
+#
+
+view.description=Your new passkey has been registered successfully. Your old passkey is still stored in your browser or keychain but will no longer work on this site. To avoid being prompted to use it, remove it from your browser or device's passkey manager.


Not portugese

daniellindau · 2026-05-21T14:21:27Z

+# For further information, please contact Curity AB.
+#
+
+view.description=Your new passkey has been registered successfully. Your old passkey is still stored in your browser or keychain but will no longer work on this site. To avoid being prompted to use it, remove it from your browser or device's passkey manager.


Not portugese

daniellindau · 2026-05-21T14:21:43Z

+# For further information, please contact Curity AB.
+#
+
+view.description=Your new passkey has been registered successfully. Your old passkey is still stored in your browser or keychain but will no longer work on this site. To avoid being prompted to use it, remove it from your browser or device's passkey manager.


Not portugese

daniellindau · 2026-05-21T14:21:52Z

+# For further information, please contact Curity AB.
+#
+
+view.description=Your new passkey has been registered successfully. Your old passkey is still stored in your browser or keychain but will no longer work on this site. To avoid being prompted to use it, remove it from your browser or device's passkey manager.


Not portugese

daniellindau · 2026-05-21T14:35:37Z

@@ -0,0 +1,15 @@
+#
+# Copyright (C) 2024 Curity AB. All rights reserved.


daniellindau · 2026-05-21T14:35:50Z

@@ -0,0 +1,15 @@
+#
+# Copyright (C) 2024 Curity AB. All rights reserved.


daniellindau · 2026-05-21T14:36:01Z

@@ -0,0 +1,15 @@
+#
+# Copyright (C) 2024 Curity AB. All rights reserved.


daniellindau · 2026-05-21T14:36:13Z

@@ -0,0 +1,15 @@
+#
+# Copyright (C) 2024 Curity AB. All rights reserved.


daniellindau · 2026-05-21T14:36:23Z

@@ -0,0 +1,15 @@
+#
+# Copyright (C) 2024 Curity AB. All rights reserved.


Matus Marko and others added 21 commits March 10, 2026 11:32

IS-10937 changing the download script

23399fe

IS-10937 fix running idsvr previewer

c6f263a

IS-10397 fix start script for windows

6745640

IS-10397 fix start script for windows, exec running script

e23a1c1

IS-10397 spawn shell option for win

0f8e85a

IS-10397 fix start script for windows, absolute paths

c542e0d

Merge branch 'main' into update-main

2d15c2f

Merge pull request #66 from curityio/update-main

0b3c256

Update main

Merge pull request #128 from curityio/dependabot/npm_and_yarn/src/com…

4cf3ba2

…mon/css/lib/lodash-4.18.1 Bump lodash from 4.17.21 to 4.18.1 in /src/common/css/lib

Merge pull request #123 from curityio/dependabot/npm_and_yarn/src/com…

e190f0a

…mon/css/lib/vite-6.4.2 Bump vite from 4.3.9 to 6.4.2 in /src/common/css/lib

Merge pull request #119 from curityio/dependabot/npm_and_yarn/src/com…

875ebee

…mon/css/docs/vite-6.4.2 Bump vite from 6.4.1 to 6.4.2 in /src/common/css/docs

Merge pull request #100 from curityio/dependabot/npm_and_yarn/react-r…

13c58a2

…outer-7.12.0 Bump react-router from 7.9.5 to 7.12.0

Merge pull request #118 from curityio/dependabot/npm_and_yarn/vite-7.3.2

5e0b22e

Bump vite from 7.1.12 to 7.3.2

Merge pull request #132 from curityio/dependabot/npm_and_yarn/src/com…

4a29d48

…mon/css/docs/defu-6.1.7 Bump defu from 6.1.4 to 6.1.7 in /src/common/css/docs

IS-11288 adds new page to reregister a device linked to previous user…

90e8343

…name

Copilot AI review requested due to automatic review settings May 6, 2026 14:00

Copilot started reviewing on behalf of mkrzeminskicurity May 6, 2026 14:01 View session

Copilot AI reviewed May 6, 2026

View reviewed changes

markoweb force-pushed the main branch from 4a29d48 to 93c596b Compare May 18, 2026 13:11

IS-11288 adds new page to inform of all passkyes in the browser

3a6dfe8

daniellindau approved these changes May 21, 2026

View reviewed changes

		@@ -0,0 +1,15 @@
		#
		# Copyright (C) 2024 Curity AB. All rights reserved.

Conversation

mkrzeminskicurity commented May 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

renatoathaydes commented May 21, 2026

Issues Found

Patch 13 (replace-stale-credential)

Patch 14 (*-success pages)

Minor

Uh oh!

daniellindau left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Patch 13 (`replace-stale-credential`)

Patch 14 (`*-success` pages)