System-End/identity-vault
1
0
Fork 0
mirror of https://github.com/System-End/identity-vault.git synced 2026-04-19 22:05:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

actually fix passkey destroy

Browse source
This commit is contained in:
24c02 2026-01-13 16:15:19 -05:00
parent c3123509ec
commit cbc246bedc
2 changed files with 6 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
app/controllers/identity_webauthn_credentials_controller.rb
View file

@ -1,8 +1,6 @@
class IdentityWebauthnCredentialsController < ApplicationController
include WebauthnAuthenticatable
before_action :require_step_up_for_destroy, only: [ :destroy ]
def index
@webauthn_credentials = current_identity.webauthn_credentials.order(created_at: :desc)
render layout: request.headers["HX-Request"] ? "htmx" : false
@ -69,24 +67,7 @@ class IdentityWebauthnCredentialsController < ApplicationController
end
def destroy
credential = current_identity.webauthn_credentials.find(params[:id])
credential.destroy
consume_step_up!
flash[:success] = t(".successfully_removed")
redirect_to security_path
end
private
def require_step_up_for_destroy
return if current_session.recently_stepped_up?(for_action: "remove_passkey")
session[:pending_destroy_credential_id] = params[:id]
redirect_to new_step_up_path(
action_type: "remove_passkey",
return_to: identity_webauthn_credential_path(params[:id])
)
redirect_to new_step_up_path(action_type: "remove_passkey")
end
end

7
app/controllers/step_up_controller.rb
View file

@ -174,8 +174,11 @@ class StepUpController < ApplicationController
when "remove_passkey"
credential_id = session.delete(:pending_destroy_credential_id)
if credential_id
redirect_to identity_webauthn_credential_path(credential_id), method: :delete
credential = current_identity.webauthn_credentials.find_by(id: credential_id) if credential_id
if credential
credential.destroy
consume_step_up!
redirect_to security_path, notice: t("identity_webauthn_credentials.successfully_removed")
else
redirect_to security_path
end