From 2fa4d06ed6acc0a9667ca5b5431ff2b1c887c3f2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:09:48 +0200
Subject: [PATCH] fix(auth): allow restricted accounts to confirm passwords for
 passkeys

---
 bootstrap/helpers/subscriptions.php      |  1 +
 tests/Feature/Auth/PasskeyAccessTest.php | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/bootstrap/helpers/subscriptions.php b/bootstrap/helpers/subscriptions.php
index afe1631a19..95442ca359 100644
--- a/bootstrap/helpers/subscriptions.php
+++ b/bootstrap/helpers/subscriptions.php
@@ -86,6 +86,7 @@ function allowedPathsForUnsubscribedAccounts()
         'profile',
         'profile/appearance',
         'profile/passkeys/confirm',
+        'user/confirm-password',
         'user/passkeys',
         'user/passkeys/options',
         'passkeys/confirm',
diff --git a/tests/Feature/Auth/PasskeyAccessTest.php b/tests/Feature/Auth/PasskeyAccessTest.php
index 2f11771a09..8d2a9d5fca 100644
--- a/tests/Feature/Auth/PasskeyAccessTest.php
+++ b/tests/Feature/Auth/PasskeyAccessTest.php
@@ -61,6 +61,26 @@ it('asks for the password before the add passkey form opens', function () {
         ->assertSessionHas('status', 'passkey-add');
 });
 
+it('lets restricted accounts confirm their password before adding a passkey', function (bool $selfHosted) {
+    config()->set('constants.coolify.self_hosted', $selfHosted);
+    $this->team->update(['show_boarding' => true]);
+    $this->actingAs($this->user)->withSession(['currentTeam' => $this->team]);
+
+    $this->get(route('profile.passkeys.confirm'))->assertRedirect(route('password.confirm'));
+    $this->get(route('password.confirm'))->assertOk();
+    $this->post(route('password.confirm.store'), ['password' => 'wrong-password'])
+        ->assertSessionHasErrors('password');
+    expect(session('auth.password_confirmed_at'))->toBeNull();
+
+    $this->post(route('password.confirm.store'), ['password' => 'password'])
+        ->assertRedirect(route('profile.passkeys.confirm'));
+    expect(session('auth.password_confirmed_at'))->toBeInt();
+    $this->get(route('profile.passkeys.confirm'))
+        ->assertRedirect(route('profile'))
+        ->assertSessionHas('status', 'passkey-add');
+    $this->getJson(route('passkey.registration-options'))->assertOk();
+})->with(['onboarding' => true, 'cloud without a subscription' => false]);
+
 it('records audit events for passkey changes', function (string $eventClass, string $auditName) {
     $passkey = $this->user->passkeys()->create([
         'name' => 'Laptop',