Bug 1853747 - add a link to Windows settings for passkey management. r=keeler,fluent-reviewers,settings-reviewers,desktop-theme-reviewers,dao,bolsson,flod

Differential Revision: https://phabricator.services.mozilla.com/D195613

browser/components/preferences/privacy.inc.xhtml

@@ -585,9 +585,12 @@
     </hbox>
     <description id="windows-sso-caption" class="indent tip-caption"
            data-l10n-id="forms-windows-sso-desc"/>
-
 #endif
   </vbox>
+
+  <label id="openWindowsPasskeySettings">
+    <html:a class="text-link" data-l10n-id="windows-passkey-settings-label" href="ms-settings:savedpasskeys" />
+  </label>
   <!--
     Those two strings are meant to be invisible and will be used exclusively to provide
     localization for an alert window.

browser/components/preferences/privacy.js

@@ -886,6 +886,14 @@ var gPrivacyPane = {
     }
   },
 
+  initWebAuthn() {
+    document.getElementById("openWindowsPasskeySettings").hidden =
+      !Services.prefs.getBoolPref(
+        "security.webauthn.show_ms_settings_link",
+        true
+      );
+  },
+
   /**
    * Sets up the UI for the number of days of history to keep, and updates the
    * label of the "Clear Now..." button.
@@ -1196,6 +1204,8 @@ var gPrivacyPane = {
 
     this.initDoH();
 
+    this.initWebAuthn();
+
     // Notify observers that the UI is now ready
     Services.obs.notifyObservers(window, "privacy-pane-loaded");
   },

browser/locales/en-US/browser/preferences/preferences.ftl

@@ -1050,6 +1050,8 @@ forms-windows-sso =
 forms-windows-sso-learn-more-link = Learn more
 forms-windows-sso-desc = Manage accounts in your device settings
 
+windows-passkey-settings-label = Manage passkeys in system settings
+
 ## OS Authentication dialog
 
 # This message can be seen by trying to add a Primary Password.

browser/themes/shared/preferences/privacy.css

@@ -337,8 +337,16 @@
   margin-block-start: 2em;
 }
 
+/* DNS over HTTPS */
+
 #dohDescription,
 #dohLearnMore,
 #dohStatusSection {
   line-height: 1.8em;
 }
+
+/* Logins and Passwords */
+
+#openWindowsPasskeySettings {
+  margin-block-start: 2em;
+}

dom/webauthn/WinWebAuthnService.cpp

@@ -8,6 +8,7 @@
 #include "mozilla/ipc/BackgroundParent.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/MozPromise.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/ScopeExit.h"
 #include "mozilla/StaticMutex.h"
 #include "mozilla/Unused.h"
@@ -136,7 +137,9 @@ nsresult WinWebAuthnService::EnsureWinWebAuthnModuleLoaded() {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (gWinWebauthnGetApiVersionNumber() >= WEBAUTHN_API_VERSION_4) {
+  DWORD version = gWinWebauthnGetApiVersionNumber();
+
+  if (version >= WEBAUTHN_API_VERSION_4) {
     gWinWebauthnGetPlatformCredentialList =
         reinterpret_cast<decltype(WebAuthNGetPlatformCredentialList)*>(
             GetProcAddress(gWinWebAuthnModule,
@@ -151,6 +154,16 @@ nsresult WinWebAuthnService::EnsureWinWebAuthnModuleLoaded() {
     }
   }
 
+  // Bug 1869584: In some of our tests, a content process can end up here due to
+  // a call to WinWebAuthnService::AreWebAuthNApisAvailable. This causes us to
+  // fail an assertion in Preferences::SetBool, which is parent-process only.
+  if (XRE_IsParentProcess()) {
+    NS_DispatchToMainThread(NS_NewRunnableFunction(__func__, [version]() {
+      Preferences::SetBool("security.webauthn.show_ms_settings_link",
+                           version >= WEBAUTHN_API_VERSION_7);
+    }));
+  }
+
   markModuleUnusable.release();
   return NS_OK;
 }

modules/libpref/init/StaticPrefList.yaml

@@ -13947,6 +13947,13 @@
   mirror: always
   rust: true
 
+# Show the Windows Passkey settings link in about:preferences. This is
+# set to true if we find that webauthn.dll is sufficiently recent.
+- name: security.webauthn.show_ms_settings_link
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # Block Worker/SharedWorker scripts with wrong MIME type.
 - name: security.block_Worker_with_wrong_mime
   type: bool