VerifyPasskey
class VerifyPasskey
Traits
Methods
Dispatch the given event if listeners are registered.
Validate the passkey credential and return the passkey.
Get the authenticator assertion response from the credential.
Get the passkey by credential ID.
Ensure the passkey belongs to the expected user.
Resolve the passkey owner for passwordless login.
Get the owner morph class supported by the selected guard.
Get the relying party ID stored in the verification options.
Update the passkey with the latest credential data.
Details
in
DispatchesEvents at line 16
protected void
dispatchIfListening(string $eventClass, Closure $event)
Dispatch the given event if listeners are registered.
at line 35
Passkey
__invoke(PublicKeyCredential $credential, PublicKeyCredentialRequestOptions $options, PasskeyUser|null $user = null)
Validate the passkey credential and return the passkey.
at line 78
protected AuthenticatorAssertionResponse
getResponse(PublicKeyCredential $credential)
Get the authenticator assertion response from the credential.
at line 92
Passkey
getPasskey(PublicKeyCredential $credential, bool $lock = false)
Get the passkey by credential ID.
at line 122
void
ensurePasskeyBelongsToUser(Passkey $passkey, PasskeyUser|null $user)
Ensure the passkey belongs to the expected user.
at line 142
protected PasskeyUser
resolvePasskeyOwner(Passkey $passkey, string $ownerType)
Resolve the passkey owner for passwordless login.
at line 161
protected string
ownerMorphClassForGuard(StatefulGuard $guard)
Get the owner morph class supported by the selected guard.
at line 182
protected CredentialRecord
validate(AuthenticatorAssertionResponse $response, Passkey $passkey, PublicKeyCredentialRequestOptions $options)
Validate the credential against the stored passkey.
at line 210
protected string
hostFromOptions(PublicKeyCredentialRequestOptions $options)
Get the relying party ID stored in the verification options.
at line 225
void
updatePasskey(Passkey $passkey, CredentialRecord $source)
Update the passkey with the latest credential data.
The credential must be persisted after each use to store the updated signature counter, which is used to detect cloned authenticators.