ChallengeStore

Where a single-use, expiring {@see ChallengeRecord} is held between the two round-trips of a WebAuthn ceremony. Mirrors {@see \Milpa\Auth\Contracts\SessionStore}: the leaf declares WHAT the store does, the host decides HOW. `consume` is fail-closed and single-use — a real (clustered) implementation MUST make it atomic (delete-on-read) so a challenge cannot be replayed.

abstract public function issue(Milpa\Auth\WebAuthn\ChallengeRecord $record): void

Store a freshly issued challenge for later single-use consumption.

Parameters

abstract public function consume(string $challengeId): ?Milpa\Auth\WebAuthn\ChallengeRecord

Consume the challenge by id: return it once and invalidate it, or null if absent, expired, or already consumed.

Parameters