From 5e315005b72a8e9e6670f10b1d30b532763f7fe6 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Fri, 6 Nov 2026 23:37:49 -0700
Subject: Passkeys in the WebView builds: the apps name v3.coinos.io too, and a
 failed passkey sign-in no longer goes on to make a new one. Coinos Beta's
 passkey sign-in failed after the account was picked — "CredMan getCredential
 call failed … RP ID cannot be validated" (Pixel 9, 2026-11-06). An app's
 association with a site runs both ways: the site's assetlinks.json names the
 app (it did), and the app's manifest names the site through asset_statements
 meta-data — which the TWA has and the webview/fcm manifests didn't. They
 declare it now, and the shared asset_statements string carries
 get_login_creds beside handle_all_urls. And passkeyLogin rolled any sign-in
 failure into creating a passkey, so the validation error was followed by a
 second, failed create dialog: only NotAllowedError (how browsers report "no
 passkey here", or a dismissed sheet) leads to creating one now; any other
 error is shown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMan6Ts5Tktega8VbLg31q
---
 android/app/src/fcm/AndroidManifest.xml     | 6 ++++++
 android/app/src/main/res/values/strings.xml | 2 +-
 android/app/src/webview/AndroidManifest.xml | 6 ++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

(limited to 'android/app/src')

diff --git a/android/app/src/fcm/AndroidManifest.xml b/android/app/src/fcm/AndroidManifest.xml
index 71e75b9..640056c 100644
--- a/android/app/src/fcm/AndroidManifest.xml
+++ b/android/app/src/fcm/AndroidManifest.xml
@@ -16,6 +16,12 @@
       android:theme="@style/AppTheme"
       android:supportsRtl="true"
       android:usesCleartextTraffic="false">
+    <!-- the app's half of the association with v3.coinos.io (the site's half
+         is its assetlinks.json): passkeys for the site work in this app only
+         when both name each other -->
+    <meta-data
+        android:name="asset_statements"
+        android:resource="@string/asset_statements" />
     <activity
         android:name="io.coinos.app.MainActivity"
         android:exported="true"
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 8132a82..77fa055 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -12,7 +12,7 @@
   <!-- must match the site's /.well-known/assetlinks.json for URL-bar-less TWA -->
   <string name="asset_statements">
     [{
-      \"relation\": [\"delegate_permission/common.handle_all_urls\"],
+      \"relation\": [\"delegate_permission/common.handle_all_urls\", \"delegate_permission/common.get_login_creds\"],
       \"target\": { \"namespace\": \"web\", \"site\": \"https://v3.coinos.io\" }
     }]
   </string>
diff --git a/android/app/src/webview/AndroidManifest.xml b/android/app/src/webview/AndroidManifest.xml
index 0942377..85a6f95 100644
--- a/android/app/src/webview/AndroidManifest.xml
+++ b/android/app/src/webview/AndroidManifest.xml
@@ -14,6 +14,12 @@
       android:theme="@style/AppTheme"
       android:supportsRtl="true"
       android:usesCleartextTraffic="false">
+    <!-- the app's half of the association with v3.coinos.io (the site's half
+         is its assetlinks.json): passkeys for the site work in this app only
+         when both name each other -->
+    <meta-data
+        android:name="asset_statements"
+        android:resource="@string/asset_statements" />
     <activity
         android:name="io.coinos.app.MainActivity"
         android:exported="true"
-- 
cgit v1.2.3