Implemented phase 6 for the POC prototype in the Website service.

Services/Website/Tests/Browser/passkeys.py

@@ -82,7 +82,21 @@ chrome.send("Page.navigate", url=f"{BASE}/")
 chrome.wait_for("document.readyState === 'complete'")
 anonymous = chrome.evaluate("fetch('/sign-in/passkey/options', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{\"add\": true}'}).then(r => r.status)")
 check("refusal: nobody adds a passkey signed out", anonymous == 401, anonymous)
-held_before = 0
+
+# 3c. Every passkey lost, a one-time link sets up a new one — which replaces the others, and signs in.
+link = chrome.evaluate("""fetch('/recover', {method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: 'email=sam.okafor%40example.com'})
+  .then(r => r.text()).then(html => (html.match(/\\/recover\\/[0-9a-f]+/) || [null])[0])""")
+check("recover: a known email gets a one-time link", bool(link), link)
+chrome.send("Page.navigate", url=f"{BASE}{link}")
+assert chrome.wait_for("document.querySelector('[data-passkey=recover]') && !document.querySelector('[data-passkey=recover]').hidden")
+chrome.evaluate("document.querySelector('[data-passkey=recover]').click(); true")
+recovered = chrome.wait_for("location.pathname === '/account'")
+check("recover: the new passkey signs in, on the account screen", recovered, status() if not recovered else "")
+check("recover: it replaced every other passkey", chrome.wait_for("document.querySelectorAll('.rows__row--passkey').length === 1"))
+chrome.send("Page.navigate", url=f"{BASE}{link}")
+check("recover: the link works once", chrome.wait_for("document.body.textContent.includes('That link has run out')"))
+chrome.evaluate("fetch('/sign-out', {method: 'POST'}).then(() => true)")
+held_before = len(credentials())
 
 # 4. A demo account has no passkey, and none can be added to it.
 open_sign_in("/")