Add challenge token to the passkey registration flow

[ThaminduDilshan]

Purpose

This pull request addresses an issue with passkey registration by ensuring the challenge token is included in the registration payload. This resolves a missing parameter that could prevent successful passkey registration.

Related Issues

• N/A

Related PRs

• N/A

Checklist

• Followed the CONTRIBUTING guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Unit tests provided. (Add links if there are any)

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines?
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets?

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where the challenge token was not being included during passkey registration and OAuth authentication flows, ensuring proper security token handling across sign-up submissions.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 94a869e7-6523-45e5-afa1-0ea3c9ae092b

📥 Commits

Reviewing files that changed from the base of the PR and between ef3f739 and 2e73a94.

📒 Files selected for processing (2)

• .changeset/social-lizards-jog.md
• packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx

---

📝 Walkthrough

Walkthrough

This pull request adds support for including a missing challenge token during passkey registration by creating a changeset entry and conditionally appending a challengeToken field from challengeTokenRef.current to sign-up request payloads across OAuth and passkey registration flows.

Changes

Cohort / File(s)	Summary
Challenge Token Support .changeset/social-lizards-jog.md, packages/react/src/components/presentation/auth/SignUp/v2/BaseSignUp.tsx	Adds changeset documentation and conditionally includes challengeToken in OAuth popup and passkey registration submission payloads when a persisted token reference exists.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• [V2] Support per step challenge token #466: Modifies BaseSignUp with identical challenge-token persistence and inclusion logic across OAuth/popup and submission flows.

Suggested reviewers

• thiva-k

Poem

🐰 A token hops through the signup dance,
No longer lost in registration's prance,
Now passkeys bloom with challengers near,
The missing piece at last is here! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description includes the required Purpose section explaining the fix and follows the template structure; however, all checklist items remain unchecked, indicating incomplete testing, documentation, and security verification.	Complete and check off the verification items, particularly manual testing and security checks, to confirm the changes have been properly validated before merging.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly describes the main change: adding challenge token to passkey registration flow, which aligns with the file modifications and changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[asgardeo-github-bot]

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.