PasskeyLogin

Turns a passkey authentication into a session — the WEB counterpart of what a signed `session:own` is on the CLI (greenhouse H-PASSKEY-4). This is where the passkey path MEANS something: a ceremony that only verifies is a lab check; one that mints a session is a login. It holds the same discipline the gpg path does (decisions/0117): possession is not identity. A verified passkey proves the holder controls a registered authenticator; whether the house RECOGNIZES that credential — and with what scopes — is a separate question a resolver answers. An unrecognized passkey authenticates cryptographically and still gets no session, exactly as an unenrolled gpg key gets no principal. The resolver is where the passkey path meets the SAME recognition model as the key path.

public function __construct(Milpa\Auth\WebAuthn\PasskeyAuthenticator $authenticator, Milpa\Auth\Contracts\SessionStore $sessions, callable $scopesFor, int $ttlSeconds = 3600, ?callable $clock = null):

Parameters

public function login(string $rpId, string $credentialId, string $clientDataJson, string $authenticatorData, string $signature): ?Milpa\Auth\SessionRecord

Authenticate a passkey and, if the house recognizes it, mint a session — or return null.

Parameters