ChallengeRecord

A single-use, expiring WebAuthn challenge, bound to a ceremony (and, for registration, to the target actor). The challenge bytes are the secret the ceremony proves knowledge of, so they follow the secret-bearing contract: private, redacted in dumps, non-serializable, non-clonable, one `value()` exit. Compared in constant time. A {@see Contracts\ChallengeStore} holds it; the host store enforces single use.

public function __construct(string $id, string $challenge, Milpa\Auth\WebAuthn\CeremonyType $ceremonyType, DateTimeImmutable $issuedAt, int $ttlSeconds, ?string $actorId = null):

Parameters

public function value(): string

The one deliberate way to read the challenge bytes — for the verifier to match the ceremony.

public function matches(string $candidate): bool

Whether $candidate equals the challenge, compared in constant time (no early-exit leak).

Parameters

public function isExpired(DateTimeImmutable $now): bool

Whether this challenge has expired as of $now (issuedAt + ttl). Fail-closed: expired ⇒ unusable.

Parameters

public function __debugInfo(): array

Returns

redacted for safe dumping

public function __serialize(): array

public function __clone(): void