PasskeyAuthenticator

The authentication ceremony, composed safe: issue a one-time challenge, then accept an assertion only when that challenge is spent exactly once, the credential is known, the signature verifies, and the sign counter has not gone backwards. The published {@see WebAuthnAssertionVerifier} answers «did this key sign this challenge?»; this answers the question that makes it a LOGIN rather than a lab check — «and was this a fresh ceremony, for a credential we registered, by an authenticator that has not been cloned?» (greenhouse H-PASSKEY-3). The challenge's single use is what stops replay; the counter's monotonic climb is what surfaces a clone.

public function __construct(Milpa\Auth\WebAuthn\ChallengeStore $challenges, Milpa\Auth\WebAuthn\PasskeyCredentialStore $credentials, Milpa\Auth\WebAuthn\WebAuthnAssertionVerifier $verifier = new WebAuthnAssertionVerifier()):

Parameters

public function challenge(): string

Mint a fresh challenge for an authentication ceremony — the caller sends its base64url to the client.

public function authenticate(string $rpId, string $credentialId, string $clientDataJson, string $authenticatorData, string $signature): ?Milpa\Auth\WebAuthn\VerifiedPasskey

Complete an authentication, or refuse it. Returns the recognized passkey, or null when anything — replay, an unknown credential, a bad signature, a counter regression — does not hold.

Parameters