From 8e9429a58cf31e42fa70de9a067a35b08049f9e5 Mon Sep 17 00:00:00 2001
From: MagentaManifold <17zhaomingyuan@gmail.com>
Date: Wed, 11 Feb 2026 17:03:01 -0500
Subject: [PATCH] feat(settings): Add passkey to MFA scopes

Because:

* passkey operations are protected by MFA

This commit:

* adds passkey to MFA scopes

Closes FXA-13049
---
 packages/fxa-auth-server/config/index.ts              |  2 +-
 .../src/components/Settings/SubRow/index.tsx          |  5 ++---
 packages/fxa-settings/src/lib/types.ts                | 11 ++++++++++-
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/packages/fxa-auth-server/config/index.ts b/packages/fxa-auth-server/config/index.ts
index 1574a3cb40b..6838ba3f762 100644
--- a/packages/fxa-auth-server/config/index.ts
+++ b/packages/fxa-auth-server/config/index.ts
@@ -2672,7 +2672,7 @@ const convictConf = convict({
       env: 'MFA__ENABLED',
     },
     actions: {
-      default: ['test', '2fa', 'email', 'recovery_key', 'password'],
+      default: ['test', '2fa', 'email', 'recovery_key', 'password', 'passkeys'],
       doc: 'Actions protected by MFA',
       format: Array,
       env: 'MFA__ACTIONS',
diff --git a/packages/fxa-settings/src/components/Settings/SubRow/index.tsx b/packages/fxa-settings/src/components/Settings/SubRow/index.tsx
index 206fbb8f149..68a5786df25 100644
--- a/packages/fxa-settings/src/components/Settings/SubRow/index.tsx
+++ b/packages/fxa-settings/src/components/Settings/SubRow/index.tsx
@@ -463,12 +463,11 @@ export const PasskeySubRow = ({
       />
       {deleteModalRevealed && (
         <MfaGuard
-          // TODO: replace with actual required scope and reason when available
-          requiredScope="test"
+          requiredScope="passkeys"
           onDismissCallback={async () => {
             hideDeleteModal();
           }}
-          reason={MfaReason.test}
+          reason={MfaReason.removePasskey}
         >
           <Modal
             onDismiss={hideDeleteModal}
diff --git a/packages/fxa-settings/src/lib/types.ts b/packages/fxa-settings/src/lib/types.ts
index 0faff1d7878..7006c92df94 100644
--- a/packages/fxa-settings/src/lib/types.ts
+++ b/packages/fxa-settings/src/lib/types.ts
@@ -36,6 +36,9 @@ export enum MfaReason {
   createBackupCodes = 'create backup codes',
   createRecoveryKey = 'create recovery key',
   removeRecoveryKey = 'remove recovery key',
+  createPasskey = 'create passkey',
+  renamePasskey = 'rename passkey',
+  removePasskey = 'remove passkey',
   test = 'test',
 }
 
@@ -92,4 +95,10 @@ export type TotpInfo = {
   secret: string;
 };
 
-export type MfaScope = 'test' | '2fa' | 'email' | 'recovery_key' | 'password';
+export type MfaScope =
+  | 'test'
+  | '2fa'
+  | 'email'
+  | 'recovery_key'
+  | 'password'
+  | 'passkeys';