passkey-flags.ts

1/**2 * passkey-flags.ts — single switch for the Firefox passkey content-script proxy.3 *4 * FIREFOX_USE_CONTENT_SCRIPT_PROXY5 *6 * true  — Use the content script monkey-patch (current workaround).7 *         Required until Mozilla ships webAuthenticationProxy in stable Firefox.8 *9 * false — Use the native webAuthenticationProxy path (Chrome today; future10 *         Firefox once the API ships).11 *12 * The value is computed at runtime from feature presence, not a hard-coded13 * boolean. The day Firefox exposes `chrome.webAuthenticationProxy`, this flag14 * flips to false on updated browsers without any code change. Cleanup at that15 * point is purely subtractive — see the removal checklist below.16 *17 * TO REMOVE THE MONKEY-PATCH:18 *   1. Confirm `webAuthenticationProxy` is in stable Firefox (not Nightly)19 *      and the minimum supported Firefox version for Peach covers it.20 *   2. Verify this flag evaluates to `false` automatically on the new build.21 *   3. Delete src/content/passkeys-firefox.ts22 *   4. Delete src/content/passkeys-firefox-relay.ts23 *   5. Delete src/shared/passkey-flags.ts24 *   6. Remove the PASSKEY_HAS_CREDENTIALS handler in src/background/messages.ts25 *      and the Firefox branches in PASSKEY_CREATE / PASSKEY_GET handlers.26 *   7. Remove the two Firefox content_scripts entries from manifest.firefox.json27 *      and add `"webAuthenticationProxy"` to its permissions list.28 *   8. The Chrome webAuthenticationProxy path already handles everything.29 *30 * Track removal readiness:31 *   https://github.com/w3c/webextensions/issues/  (WECG passkey API issue)32 */33export const FIREFOX_USE_CONTENT_SCRIPT_PROXY: boolean = (() => {34  // chrome.webAuthenticationProxy presence wins over everything — that path35  // is preferred when available, regardless of how we got here.36  const c = (typeof chrome !== "undefined" ? chrome : undefined) as37    | { webAuthenticationProxy?: unknown; runtime?: { getURL?: (path: string) => string } }38    | undefined;39  if (c?.webAuthenticationProxy) return false;4041  try {42    const url = c?.runtime?.getURL?.("") ?? "";43    return url.startsWith("moz-extension://");44  } catch {45    return false;46  }47})();