WebAuthnCredentialRecord
The storage-agnostic record of a registered passkey — a credential's public key and metadata, owned by an actor. Mirrors {@see \Milpa\Auth\SessionRecord}: the leaf-clean shape a {@see Contracts\WebAuthnCredentialStore} moves, knowing nothing about where it is kept. The public key is not a secret; `signCount` is a clone-detection SIGNAL, not an authorization gate.
WebAuthnCredentialRecord::__construct()
public function __construct(string $credentialId, string $publicKeyCose, int $signCount, string $actorId, ?string $aaguid, array $transports, DateTimeImmutable $createdAt, ?DateTimeImmutable $lastUsedAt = null):Parameters
| Name | Type | Description |
|---|---|---|
| $credentialId | string | |
| $publicKeyCose | string | |
| $signCount | int | |
| $actorId | string | |
| $aaguid | ?string | |
| $transports | list<string> | the authenticator transports the browser reported |
| $createdAt | DateTimeImmutable | |
| $lastUsedAt | ?DateTimeImmutable |
WebAuthnCredentialRecord::withSignCount()
public function withSignCount(int $signCount): selfA copy with an updated sign counter (recorded on each assertion; never used to reject).
Parameters
| Name | Type | Description |
|---|---|---|
| $signCount | int |
WebAuthnCredentialRecord::touch()
public function touch(DateTimeImmutable $now): selfA copy stamped as just used at $now.
Parameters
| Name | Type | Description |
|---|---|---|
| $now | DateTimeImmutable |