fix(ai-client): normalize passkey PRF byte arrays - #1351
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review. 📝 WalkthroughWalkthroughThe BYOK passkey flow now validates 32-byte PRF arrays, converts valid arrays to ChangesPasskey PRF byte-array support
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This change accepts valid 32-byte passkey PRF arrays while preserving existing encryption and storage behavior, and rejects malformed results before saving. Registration, unlock, reload, resave, and invalid-input behavior are covered, with no current merge-blocking risk identified. Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant PasskeyProvider
participant deriveAesKey
participant CryptoSubtle
participant BYOKStorage
PasskeyProvider->>deriveAesKey: return PRF byte array
deriveAesKey->>deriveAesKey: validate and convert array
deriveAesKey->>CryptoSubtle: import normalized bytes for HKDF
CryptoSubtle-->>deriveAesKey: derived AES key
deriveAesKey->>BYOKStorage: save or load encrypted BYOK data
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
tannerlinsley
enabled auto-merge (squash)
September 9, 2026 05:20
|
View your CI Pipeline Execution ↗ for commit 5d4b7ce
☁️ Nx Cloud last updated this comment at |
@tanstack/ai
@tanstack/ai-acp
@tanstack/ai-angular
@tanstack/ai-anthropic
@tanstack/ai-bedrock
@tanstack/ai-byteplus
@tanstack/ai-claude-code
@tanstack/ai-client
@tanstack/ai-cloudflare
@tanstack/ai-code-mode
@tanstack/ai-code-mode-snippets
@tanstack/ai-codex
@tanstack/ai-cohere
@tanstack/ai-compaction
@tanstack/ai-devtools-core
@tanstack/ai-durable-stream
@tanstack/ai-elevenlabs
@tanstack/ai-event-client
@tanstack/ai-fal
@tanstack/ai-gemini
@tanstack/ai-grok
@tanstack/ai-grok-build
@tanstack/ai-groq
@tanstack/ai-isolate-cloudflare
@tanstack/ai-isolate-daytona
@tanstack/ai-isolate-node
@tanstack/ai-isolate-quickjs
@tanstack/ai-isolate-quickjs-bun
@tanstack/ai-llmgateway
@tanstack/ai-lovable
@tanstack/ai-mcp
@tanstack/ai-memory
@tanstack/ai-mistral
@tanstack/ai-octane
@tanstack/ai-ollama
@tanstack/ai-openai
@tanstack/ai-opencode
@tanstack/ai-openrouter
@tanstack/ai-perplexity
@tanstack/ai-persistence
@tanstack/ai-preact
@tanstack/ai-react
@tanstack/ai-react-ui
@tanstack/ai-reactor
@tanstack/ai-remix
@tanstack/ai-sandbox
@tanstack/ai-sandbox-blaxel
@tanstack/ai-sandbox-cloudflare
@tanstack/ai-sandbox-daytona
@tanstack/ai-sandbox-docker
@tanstack/ai-sandbox-local-process
@tanstack/ai-sandbox-sprites
@tanstack/ai-sandbox-upstash-box
@tanstack/ai-sandbox-vercel
@tanstack/ai-skills
@tanstack/ai-solid
@tanstack/ai-solid-ui
@tanstack/ai-svelte
@tanstack/ai-utils
@tanstack/ai-vercel-gateway
@tanstack/ai-vertex
@tanstack/ai-vue
@tanstack/ai-vue-ui
@tanstack/openai-base
@tanstack/preact-ai-devtools
@tanstack/react-ai-devtools
@tanstack/solid-ai-devtools
@tanstack/svelte-ai-devtools
commit: |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Saving an API key with a 1Password passkey can fail in Chrome because its PRF result is a plain array. Validate those bytes and convert them to
Uint8Arraybefore Web Crypto imports the key.🎯 Changes
✅ Checklist
pnpm run test:pr.docs/advanced/byok.md.@tanstack/ai-client.🚀 Release Impact
Root cause
Issue. BYOK save fails with
importKeyrejecting its key data when the passkey provider returns a plain array.Cause.
deriveAesKeypassed the provider result directly to Web Crypto, which requires binary data.Fix. Require exactly 32 integer bytes in the range 0 through 255, then convert the array without changing its bytes. Native binary values retain their existing path.
Possible alternatives
Testing
pnpm test:pr: passed, including a rerun after syncing main.Agent-written regression, identical command in isolated worktrees:
Manual test:
The storage regression and Chrome BYOK test cover these paths with mocked WebAuthn and actual encryption. The browser test uses actual IndexedDB. Real 1Password prompts are not automated.
Risk / rollback
Scoped to plain-array PRF results. Byte-preservation tests check compatibility with native results. Revert this PR to undo the change.
Security and scope checks passed: no new dependencies, network calls, lifecycle scripts, CI permissions, or unrelated refactors. CodeRabbit: no PR existed during the local review.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation