From 0cbf259e6c2fa50290a49939ca3d5d0746b8b559 Mon Sep 17 00:00:00 2001
From: John Schanck <jschanck@mozilla.com>
Date: Tue, 12 Dec 2023 20:34:39 +0000
Subject: [PATCH] Bug 1853747 - add a link to Windows settings for passkey
 management.
 r=keeler,fluent-reviewers,settings-reviewers,desktop-theme-reviewers,dao,bolsson,flod

Differential Revision: https://phabricator.services.mozilla.com/D195613
---
 browser/components/preferences/privacy.inc.xhtml  |  5 ++++-
 browser/components/preferences/privacy.js         | 10 ++++++++++
 .../en-US/browser/preferences/preferences.ftl     |  2 ++
 browser/themes/shared/preferences/privacy.css     |  8 ++++++++
 dom/webauthn/WinWebAuthnService.cpp               | 15 ++++++++++++++-
 modules/libpref/init/StaticPrefList.yaml          |  7 +++++++
 6 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/browser/components/preferences/privacy.inc.xhtml b/browser/components/preferences/privacy.inc.xhtml
index 906628bde519..7e89a3646cb4 100644
--- a/browser/components/preferences/privacy.inc.xhtml
+++ b/browser/components/preferences/privacy.inc.xhtml
@@ -585,9 +585,12 @@
     </hbox>
     <description id="windows-sso-caption" class="indent tip-caption"
            data-l10n-id="forms-windows-sso-desc"/>
-
 #endif
   </vbox>
+
+  <label id="openWindowsPasskeySettings">
+    <html:a class="text-link" data-l10n-id="windows-passkey-settings-label" href="ms-settings:savedpasskeys" />
+  </label>
   <!--
     Those two strings are meant to be invisible and will be used exclusively to provide
     localization for an alert window.
diff --git a/browser/components/preferences/privacy.js b/browser/components/preferences/privacy.js
index 03ddd4c709df..29a4d1d7f03c 100644
--- a/browser/components/preferences/privacy.js
+++ b/browser/components/preferences/privacy.js
@@ -886,6 +886,14 @@ var gPrivacyPane = {
     }
   },
 
+  initWebAuthn() {
+    document.getElementById("openWindowsPasskeySettings").hidden =
+      !Services.prefs.getBoolPref(
+        "security.webauthn.show_ms_settings_link",
+        true
+      );
+  },
+
   /**
    * Sets up the UI for the number of days of history to keep, and updates the
    * label of the "Clear Now..." button.
@@ -1196,6 +1204,8 @@ var gPrivacyPane = {
 
     this.initDoH();
 
+    this.initWebAuthn();
+
     // Notify observers that the UI is now ready
     Services.obs.notifyObservers(window, "privacy-pane-loaded");
   },
diff --git a/browser/locales/en-US/browser/preferences/preferences.ftl b/browser/locales/en-US/browser/preferences/preferences.ftl
index 15f86c99863e..66ae67467f12 100644
--- a/browser/locales/en-US/browser/preferences/preferences.ftl
+++ b/browser/locales/en-US/browser/preferences/preferences.ftl
@@ -1050,6 +1050,8 @@ forms-windows-sso =
 forms-windows-sso-learn-more-link = Learn more
 forms-windows-sso-desc = Manage accounts in your device settings
 
+windows-passkey-settings-label = Manage passkeys in system settings
+
 ## OS Authentication dialog
 
 # This message can be seen by trying to add a Primary Password.
diff --git a/browser/themes/shared/preferences/privacy.css b/browser/themes/shared/preferences/privacy.css
index 0117e953524f..8328cf6481ab 100644
--- a/browser/themes/shared/preferences/privacy.css
+++ b/browser/themes/shared/preferences/privacy.css
@@ -337,8 +337,16 @@
   margin-block-start: 2em;
 }
 
+/* DNS over HTTPS */
+
 #dohDescription,
 #dohLearnMore,
 #dohStatusSection {
   line-height: 1.8em;
 }
+
+/* Logins and Passwords */
+
+#openWindowsPasskeySettings {
+  margin-block-start: 2em;
+}
diff --git a/dom/webauthn/WinWebAuthnService.cpp b/dom/webauthn/WinWebAuthnService.cpp
index 2ea11f220ff6..8667cf561565 100644
--- a/dom/webauthn/WinWebAuthnService.cpp
+++ b/dom/webauthn/WinWebAuthnService.cpp
@@ -8,6 +8,7 @@
 #include "mozilla/ipc/BackgroundParent.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/MozPromise.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/ScopeExit.h"
 #include "mozilla/StaticMutex.h"
 #include "mozilla/Unused.h"
@@ -136,7 +137,9 @@ nsresult WinWebAuthnService::EnsureWinWebAuthnModuleLoaded() {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (gWinWebauthnGetApiVersionNumber() >= WEBAUTHN_API_VERSION_4) {
+  DWORD version = gWinWebauthnGetApiVersionNumber();
+
+  if (version >= WEBAUTHN_API_VERSION_4) {
     gWinWebauthnGetPlatformCredentialList =
         reinterpret_cast<decltype(WebAuthNGetPlatformCredentialList)*>(
             GetProcAddress(gWinWebAuthnModule,
@@ -151,6 +154,16 @@ nsresult WinWebAuthnService::EnsureWinWebAuthnModuleLoaded() {
     }
   }
 
+  // Bug 1869584: In some of our tests, a content process can end up here due to
+  // a call to WinWebAuthnService::AreWebAuthNApisAvailable. This causes us to
+  // fail an assertion in Preferences::SetBool, which is parent-process only.
+  if (XRE_IsParentProcess()) {
+    NS_DispatchToMainThread(NS_NewRunnableFunction(__func__, [version]() {
+      Preferences::SetBool("security.webauthn.show_ms_settings_link",
+                           version >= WEBAUTHN_API_VERSION_7);
+    }));
+  }
+
   markModuleUnusable.release();
   return NS_OK;
 }
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index ac599f51c926..230fd46ab11e 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -13947,6 +13947,13 @@
   mirror: always
   rust: true
 
+# Show the Windows Passkey settings link in about:preferences. This is
+# set to true if we find that webauthn.dll is sufficiently recent.
+- name: security.webauthn.show_ms_settings_link
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # Block Worker/SharedWorker scripts with wrong MIME type.
 - name: security.block_Worker_with_wrong_mime
   type: bool