feat(db): delete passkey wraps when a password reset rotates kB

[vpomerleau]

Because

• A passkey wrap seals kB to the generation recorded in keysChangedAt. A password reset without a recovery key advances it, so every wrap on the account is permanently undecryptable.
• Left in place, the next Sync sign-in asks for a password only after a failed unwrap rather than up front.

This pull request

• Adds resetAccount_20 (patch-197-198), deleting passkeyWraps inside the existing IF keysHaveChangedArg = 1 block alongside recoveryKeys.
• Leaves the passkeys rows in place, so the credential stays usable for re-enrolment.
• Points Proc.ResetAccount at the new procedure.
• Covers both branches of the guard in packages/fxa-auth-server/test/remote/db.in.spec.ts.
• Adds passkeys and passkeyWraps fixtures to the fxa-shared auth test schema and moves the fixture procedure to resetAccount_20.
• Corrects the DB migration command in CLAUDE.md. Unrelated to the ticket — the documented nx target does not exist.

Issue that this pull request solves

Closes: FXA-14421

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: patch-197-198.sql — the procedure is resetAccount_19 verbatim plus one DELETE, so the diff against patch-159-160.sql is the useful comparison.
• Suggested review order: the patch, then base-auth.ts, then the tests.
• Risky or complex parts: repointing Proc.ResetAccount moves every db.resetAccount caller to the new procedure at once.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

• No security event is emitted. account.passkey.wrap_invalidated stays registered but unused: account.reset is the parent event, and other rows a reset drops don't raise their own.
• The Recorded Future force-reset (scripts/recorded-future/check-and-reset.ts) was checked per the ticket comment and deliberately left unchanged. It randomizes wrapWrapKb but leaves keysChangedAt untouched, so it does not rotate kB — rotation happens at the user's follow-up reset, which this procedure covers.

[Copilot]

Pull request overview

Deletes obsolete passkey wraps whenever password reset rotates kB, while preserving passkey credentials for re-enrolment.

Changes:

• Adds and adopts resetAccount_20.
• Adds fixtures and integration coverage for both key-change branches.
• Updates migration instructions.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/fxa-shared/test/db/models/auth/sp_resetAccount.sql	Updates the fixture procedure and wrap deletion.
packages/fxa-shared/test/db/models/auth/passkeys.sql	Adds the passkeys test table.
packages/fxa-shared/test/db/models/auth/passkey-wraps.sql	Adds the wraps test table.
packages/fxa-shared/test/db/models/auth/helpers.ts	Loads the new fixtures.
packages/fxa-shared/db/models/auth/base-auth.ts	Selects resetAccount_20.
packages/fxa-auth-server/test/remote/db.in.spec.ts	Tests wrap deletion and preservation.
packages/db-migrations/databases/fxa/target-patch.json	Advances schema level to 198.
packages/db-migrations/databases/fxa/patches/patch-198-197.sql	Adds the commented rollback.
packages/db-migrations/databases/fxa/patches/patch-197-198.sql	Creates the updated reset procedure.
CLAUDE.md	Corrects migration instructions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.