`passless client list` does not reflect credential changes until restart

[pando85]

Description:

When credentials (passkeys) are added, updated, or removed while the passless service is running, the changes are not reflected in:

passless client list

The updated state only becomes visible after restarting the passless process.

Steps to reproduce:

1. Start passless.
2. Register or modify a client credential (passkey).
3. Run passless client list.
4. Observe that the new/updated credential is not shown.
5. Restart passless.
6. Run passless client list again — the credential now appears correctly.

Expected behavior:

passless client list should reflect credential changes immediately without requiring a restart.

Actual behavior:

Credential changes are only visible after restarting the service.

[pando85]

@forkline could you handle this?

[forkline-bot]

I've completed the fix for issue #148. Here's a summary:

Fix Summary

Problem: passless client list was returning hardcoded test data instead of querying the actual storage backend, causing credential changes to not be reflected until restart.

Solution: Rewrote the credential management handlers in cmd/passless/src/commands/custom.rs to properly query the storage backend for all CTAP credential management subcommands:

• getCredsMetadata (0x01): Now queries storage for actual credential count
• enumerateRPsBegin/Next (0x02/0x03): Enumerates RPs from storage
• enumerateCredentialsBegin/Next (0x04/0x05): Enumerates credentials from storage
• deleteCredential (0x06): Deletes from storage
• updateUserInformation (0x07): Updates user info in storage

Changes:

• 704 lines added, 99 lines removed in cmd/passless/src/commands/custom.rs
• All tests pass
• Clippy warnings fixed

Status: ✅ Committed locally as b70dff8

Note: I was unable to push to the remote due to git proxy authentication issues in this environment. The commit is ready and needs to be pushed manually:

git push origin master

Or you can create a PR from this branch.

[forkline-bot]

Summary

I've fixed the issue where passless client list doesn't reflect credential changes until restart.

Root Cause

The update_indexes_on_write function in cmd/passless/src/storage/index.rs was unconditionally pushing credential IDs to the rp and rp_hash vectors every time a credential was written. When credentials are updated (e.g., sign count changes during authentication), this caused duplicate entries in the indexes.

Fix

Modified update_indexes_on_write to check if the credential already exists in the id index before adding to the rp and rp_hash vectors. This prevents duplicates while still allowing the credential data in the id map to be updated.

Changes in cmd/passless/src/storage/index.rs:

• Added check for is_new_credential before adding to RP vectors
• Added 5 unit tests to verify the fix:
  • test_update_indexes_on_write_new_credential
  • test_update_indexes_on_write_no_duplicates_on_update
  • test_update_indexes_on_write_multiple_credentials_same_rp
  • test_update_indexes_on_delete
  • test_rp_id_hash_consistency

Commit

80ad3dd fix: prevent duplicate entries in credential indexes on update

Note: I was unable to push the changes due to authentication restrictions in this environment. The changes are committed locally on branch fix/148-credential-index-duplicates and ready to be pushed when access is available.

[pando85]

@forkline I want you to do the best fix possible of both that you proposed. Update the PR with it

[forkline-bot]

Summary

Fixed issue #148 where passless client list did not reflect credential changes until restart.

Root Cause: The custom credential management command handler (0x0a) was returning hardcoded responses instead of querying the actual storage backend. This happened because:

1. cred_mgmt was set to None in the authenticator config, disabling soft-fido2's built-in credential management
2. A custom handler was registered for command 0x0a that returned hardcoded test data

Changes Made:

1. cmd/passless/src/authenticator.rs - Enabled built-in credential management by setting cred_mgmt: Some(true)
2. cmd/passless/src/main.rs - Removed registration of custom 0x0a handler
3. cmd/passless/src/commands/custom.rs - Removed register_standard_credential_mgmt function (109 lines deleted)

PR created: #149