From 326836f82f041970de816bb09dee2cd4305e267b Mon Sep 17 00:00:00 2001
From: Leendert de Borst <ldeborst@xivisoft.com>
Date: Thu, 4 Jun 2026 23:42:04 +0200
Subject: [PATCH] Update linting notices

---
 .../src/entrypoints/background.ts               | 17 +++++++++++++++--
 .../utils/passkey/WebAuthnRequestValidation.ts  |  5 ++++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/apps/browser-extension/src/entrypoints/background.ts b/apps/browser-extension/src/entrypoints/background.ts
index e32ae0ac0..b5eb81f5d 100644
--- a/apps/browser-extension/src/entrypoints/background.ts
+++ b/apps/browser-extension/src/entrypoints/background.ts
@@ -14,6 +14,7 @@ import { handleCheckAuthStatus, handleClearPersistedFormValues, handleClearSessi
 import { LocalPreferencesService } from '@/utils/LocalPreferencesService';
 import { onMessage, sendMessage } from "@/utils/messaging/ExtensionMessaging";
 import { validateWebAuthnRequest } from '@/utils/passkey/WebAuthnRequestValidation';
+import type { WebAuthnBridgeRequest } from '@/utils/passkey/WebAuthnRequestValidation';
 
 import { defineBackground, browser } from '#imports';
 
@@ -30,6 +31,10 @@ type TrustedWebAuthnSenderContext = {
   host: string;
 };
 
+/**
+ * Resolve a trusted origin and host context from the message sender, returning null when the
+ * sender is not a secure (https or localhost) web origin.
+ */
 function getTrustedWebAuthnSenderContext(sender: WebAuthnMessageSender): TrustedWebAuthnSenderContext | null {
   const senderOrigin = typeof sender.origin === 'string' && sender.origin !== 'null'
     ? sender.origin
@@ -55,7 +60,11 @@ function getTrustedWebAuthnSenderContext(sender: WebAuthnMessageSender): Trusted
   }
 }
 
-function handleValidatedWebAuthnCreate(data: any, sender: WebAuthnMessageSender): Promise<any> | { fallback: true } {
+/**
+ * Validate a WebAuthn create request against the sender's trusted origin before forwarding it to
+ * the passkey create flow, falling back when validation fails.
+ */
+function handleValidatedWebAuthnCreate(data: WebAuthnBridgeRequest, sender: WebAuthnMessageSender): Promise<unknown> | { fallback: true } {
   const senderContext = getTrustedWebAuthnSenderContext(sender);
   if (!senderContext || !validateWebAuthnRequest('create', data, senderContext.origin, senderContext.host)) {
     return { fallback: true };
@@ -67,7 +76,11 @@ function handleValidatedWebAuthnCreate(data: any, sender: WebAuthnMessageSender)
   });
 }
 
-function handleValidatedWebAuthnGet(data: any, sender: WebAuthnMessageSender): Promise<any> | { fallback: true } {
+/**
+ * Validate a WebAuthn get request against the sender's trusted origin before forwarding it to
+ * the passkey get flow, falling back when validation fails.
+ */
+function handleValidatedWebAuthnGet(data: WebAuthnBridgeRequest, sender: WebAuthnMessageSender): Promise<unknown> | { fallback: true } {
   const senderContext = getTrustedWebAuthnSenderContext(sender);
   if (!senderContext || !validateWebAuthnRequest('get', data, senderContext.origin, senderContext.host)) {
     return { fallback: true };
diff --git a/apps/browser-extension/src/utils/passkey/WebAuthnRequestValidation.ts b/apps/browser-extension/src/utils/passkey/WebAuthnRequestValidation.ts
index bdf85ef9f..d63f2f229 100644
--- a/apps/browser-extension/src/utils/passkey/WebAuthnRequestValidation.ts
+++ b/apps/browser-extension/src/utils/passkey/WebAuthnRequestValidation.ts
@@ -3,7 +3,7 @@ import type { WebAuthnCreateEventDetail, WebAuthnGetEventDetail } from '@/utils/
 type WebAuthnRequestType = 'create' | 'get';
 type WebAuthnBridgeDetail = WebAuthnCreateEventDetail | WebAuthnGetEventDetail;
 
-type WebAuthnBridgeRequest = {
+export type WebAuthnBridgeRequest = {
   origin?: unknown;
   publicKey?: unknown;
 };
@@ -24,6 +24,9 @@ function normalizeWebAuthnHost(value: string | undefined): string | null {
   return normalized;
 }
 
+/**
+ * Type guard that narrows an unknown value to a non-null object.
+ */
 function isObject(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null;
 }