fix: refuse to delete a user's last sign-in method #400

Activity

1. Bccorb

   added this to the v0.20 milestone on Oct 13, 2026
2. Bccorb

   added

   P1Security work outside the FIDO2 trackSecurity work outside the FIDO2 track

   safeServes the safe promise: no lockout, no lock-in, honestServes the safe promise: no lockout, no lock-in, honest

   v0.20Targets the v0.20 releaseTargets the v0.20 release

   on Oct 13, 2026
3. Bccorb

   added the

   Bug

   issue type on Oct 13, 2026
4. Bccorb

   added a parent issue on Oct 13, 2026

   • Epic: v0.20 never locked out #386
5. Bccorb

   added

   v0.19Targets the v0.19 releaseTargets the v0.19 release

   and removed

   v0.20Targets the v0.20 releaseTargets the v0.20 release

   on Oct 17, 2026
6. Bccorb

   modified the milestones: v0.20, v0.19 on Oct 17, 2026
7. Bccorb

   removed a parent issue on Oct 17, 2026

   • Epic: v0.20 never locked out #386
8. Bccorb

   added a parent issue on Oct 17, 2026

   • Epic: v0.19 the right choice today #385
9. Bccorb commented on Oct 17, 2026

   

   Bccorb

   on Oct 17, 2026

   ContributorAuthor

   More actions

   Already handled on main, found while working #433:

   • deleteCredential (src/controllers/user.ts) refuses to delete a user's last credential with 400 You must keep at least one credential., so no user action can remove their only passkey.
   • The admin override the issue asks for exists as device replacement recovery (POST /admin/users/{userId}/recovery/device-replacement), which requires admin:write plus step-up and records identity proofing in the audit trail.

   The adjacent gap, removing the last admin, is fixed in #433. Policy changes that could strand users are #402 and #403 (v0.20).
10. Bccorb

    closed this as completedon Oct 17, 2026