feat: Fire an event when a passkey is revoked

src/Events.php

@@ -85,4 +85,16 @@ class Events extends Base
      * @param int[] $aMergeIds The IDs of the users who were merged into $iKeepId
      */
     const USER_MERGE_COMPLETE = 'AUTH:USER:MERGE:COMPLETE';
+
+    /**
+     * Fired after a passkey is revoked
+     *
+     * Fires regardless of what deleted it (self-service, admin, or otherwise), so
+     * anything that treats "has a passkey" as meaningful — an MFA driver built on
+     * top of passkeys, for instance — can react without this module knowing it
+     * exists.
+     *
+     * @param int $iUserId The ID of the user the passkey belonged to
+     */
+    const USER_DID_REMOVE_PASSKEY = 'AUTH:USER:PASSKEY:REMOVED';
 }

src/Service/Passkey.php

@@ -15,6 +15,7 @@
 use lbuchs\WebAuthn\WebAuthn;
 use lbuchs\WebAuthn\WebAuthnException;
 use Nails\Auth\Constants;
+use Nails\Auth\Events;
 use Nails\Auth\Exception\Passkey\ChallengeException;
 use Nails\Auth\Exception\Passkey\CredentialExistsException;
 use Nails\Auth\Exception\Passkey\InvalidResponseException;
@@ -28,6 +29,7 @@
 use Nails\Common\Exception\FactoryException;
 use Nails\Common\Exception\ModelException;
 use Nails\Common\Service\Cookie;
+use Nails\Common\Service\Event;
 use Nails\Common\Service\Input;
 use Nails\Common\Service\Session;
 use Nails\Config;
@@ -809,6 +811,7 @@ public function revoke(Resource\User\Passkey $oPasskey, array $aEventData = []):
         $bResult = $this->getModel()->delete((int) $oPasskey->id);
 
         if ($bResult) {
+
             createUserEvent(
                 'did_remove_passkey',
                 array_merge(
@@ -818,6 +821,19 @@ public function revoke(Resource\User\Passkey $oPasskey, array $aEventData = []):
                 null,
                 (int) $oPasskey->user_id
             );
+
+            /**
+             * A live event, not the audit log above: anything that treats "has a
+             * passkey" as meaningful (an MFA driver built on top of passkeys, for
+             * instance) can react to this without this module knowing it exists.
+             */
+            /** @var Event $oEventService */
+            $oEventService = Factory::service('Event');
+            $oEventService->trigger(
+                Events::USER_DID_REMOVE_PASSKEY,
+                Events::getEventNamespace(),
+                [(int) $oPasskey->user_id]
+            );
         }
 
         return $bResult;