WebAuthnCredentialStore

The registry of registered passkeys — the WebAuthn public-key store. Mirrors {@see \Milpa\Auth\Contracts\SessionStore}: the leaf declares WHAT it needs, the host implements HOW (Doctrine, etc.). Two invariants the contract REQUIRES and the implementation MUST enforce: global `credentialId` uniqueness (usernameless login resolves a user by credential id alone), and that `updateSignCount` records the latest counter — which is a clone-detection SIGNAL, never an authorization gate.

abstract public function save(Milpa\Auth\WebAuthn\WebAuthnCredentialRecord $record): void

Persist a newly registered credential. MUST reject a duplicate credentialId (global uniqueness).

Parameters

abstract public function findByCredentialId(string $credentialId): ?Milpa\Auth\WebAuthn\WebAuthnCredentialRecord

The credential with this id, or null if unknown (the usernameless/discoverable lookup).

Parameters

abstract public function listForActor(string $actorId): array

The actor's credentials — builds a ceremony's allowCredentials.

Parameters

abstract public function updateSignCount(string $credentialId, int $signCount): void

Record the latest sign counter for a credential after an assertion (a signal, not a gate).

Parameters