[release/11.0-rc1] SignInManager: return SignInResult.Failed for expired passkey session challenge

src/Identity/Core/src/SignInManager.cs

@@ -665,8 +665,22 @@ public virtual async Task<SignInResult> PasskeySignInAsync([StringSyntax(StringS
 
     private async Task<SignInResult> PasskeySignInCoreAsync(string credentialJson)
     {
+        ThrowIfNoPasskeyHandler();
         ArgumentException.ThrowIfNullOrEmpty(credentialJson);
 
+        var passkeyInfo = await RetrievePasskeyAuthenticationInfoAsync();
+        if (passkeyInfo is null)
+        {
+            return SignInResult.Failed;
+        }
+
+        if (!string.Equals(PasskeyOperations.Assertion, passkeyInfo.Operation, StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                $"Expected passkey operation '{PasskeyOperations.Assertion}', but got '{passkeyInfo.Operation}'. " +
+                $"This may indicate that you have not previously called '{nameof(SignInManager<>)}.{nameof(MakePasskeyRequestOptionsAsync)}()'.");
+        }
+
         var assertionResult = await PerformPasskeyAssertionAsync(credentialJson);
         if (!assertionResult.Succeeded)
         {

src/Identity/test/Identity.Test/SignInManagerTest.cs

@@ -648,6 +648,36 @@ public async Task PasskeySignInReturnsLockedOutWhenLockedOut()
         auth.Verify();
     }
 
+    [Fact]
+    public async Task PasskeySignInReturnsFailedWhenSessionChallengeHasExpired()
+    {
+        // Setup
+        var user = new PocoUser { UserName = "Foo" };
+        var passkeyHandler = new Mock<IPasskeyHandler<PocoUser>>();
+        var manager = SetupUserManager(user, passkeyHandler: passkeyHandler.Object);
+        var context = new DefaultHttpContext();
+        var auth = MockAuth(context);
+
+        // Do NOT call SetupPasskeyAuth — simulates expired/missing session
+        auth.Setup(a => a.AuthenticateAsync(context, IdentityConstants.TwoFactorUserIdScheme))
+            .ReturnsAsync(AuthenticateResult.Fail("Session expired."))
+            .Verifiable();
+        auth.Setup(a => a.SignOutAsync(context, IdentityConstants.TwoFactorUserIdScheme, It.IsAny<AuthenticationProperties>()))
+            .Returns(Task.CompletedTask)
+            .Verifiable();
+
+        var helper = SetupSignInManager(manager.Object, context);
+
+        // Act
+        var signInResult = await helper.PasskeySignInAsync(credentialJson: "<some-passkey>");
+
+        // Assert
+        Assert.False(signInResult.Succeeded);
+        Assert.Same(SignInResult.Failed, signInResult);
+        passkeyHandler.Verify(h => h.PerformAssertionAsync(It.IsAny<PasskeyAssertionContext>()), Times.Never);
+        auth.Verify();
+    }
+
     private static void SetupPasskeyAuth(HttpContext context, Mock<IAuthenticationService> auth)
     {
         // Calling AuthenticateAsync will return a failure result