WebAuthnVerifier

The two-ceremony WebAuthn producer — NOT a {@see \Milpa\Auth\Contracts\CredentialVerifier} (a passkey is a stateful two-round-trip ceremony, not a single-shot per-request credential). `create*` issue a challenge into the {@see ChallengeStore} and return the options the browser needs; `verify*` consume the challenge and check the ceremony fail-closed. `verifyAuthentication` returns the cryptographic proof ({@see WebAuthnAssertionResult}); it does NOT mint a session — the host does that.

abstract public function createRegistrationOptions(Milpa\Auth\Actor $actor, Milpa\Auth\WebAuthn\RelyingParty $rp, Milpa\Auth\WebAuthn\WebAuthnRegistrationContext $context): Milpa\Auth\WebAuthn\PublicKeyCredentialCreationOptions

Begin registration for a known actor: issue a challenge, return the creation options.

Parameters

abstract public function verifyRegistration(Milpa\Auth\WebAuthn\WebAuthnRegistrationResponse $response, Milpa\Auth\WebAuthn\RelyingParty $rp): Milpa\Auth\WebAuthn\WebAuthnCredentialRecord

Finish registration: verify the attestation ('none'), return the credential record for the host to save.

Parameters

abstract public function createAuthenticationOptions(Milpa\Auth\WebAuthn\RelyingParty $rp, Milpa\Auth\WebAuthn\WebAuthnAuthenticationContext $context): Milpa\Auth\WebAuthn\PublicKeyCredentialRequestOptions

Begin authentication: issue a challenge, return the request options (allowCredentials for a known actor, empty for discoverable).

Parameters

abstract public function verifyAuthentication(Milpa\Auth\WebAuthn\WebAuthnAuthenticationResponse $response, Milpa\Auth\WebAuthn\RelyingParty $rp): Milpa\Auth\WebAuthn\WebAuthnAssertionResult

Finish authentication: verify the assertion signature/origin/rpId/flags fail-closed; return the proof (never a session).

Parameters