Interface WebAuthnCredentialStore

Readonlykind

findByCredentialId

• findByCredentialId(credentialId: string): Promise<WebAuthnCredential | null>

  Look up a credential by its credentialId. Returns null when not found.

  Parameters

  • credentialId: string

  Returns Promise<WebAuthnCredential | null>

listByUserId

• listByUserId(userId: string): Promise<readonly WebAuthnCredential[]>

  Return all credentials registered for a given userId.

  Parameters

  • userId: string

  Returns Promise<readonly WebAuthnCredential[]>

registerCredential

• registerCredential(record: WebAuthnCredential): Promise<void>

  Atomically insert a new credential record.

  MUST throw WebAuthnCredentialStorageError({ reason: "duplicate-credential" }) if a record with the same credentialId already exists. The existing record MUST be preserved unchanged — no partial mutation on failure.

  Concurrency contract: N concurrent calls with the same credentialId MUST result in exactly one success and N-1 throws of WebAuthnCredentialStorageError({ reason: "duplicate-credential" }).

  Per spec §2.3.1 + Codex Round 5 P2 (TOCTOU fix).

  Parameters

  • record: WebAuthnCredential

  Returns Promise<void>

remove

• remove(credentialId: string): Promise<void>

  Remove a credential by its credentialId. No-op if not found.

  Parameters

  • credentialId: string

  Returns Promise<void>

updateSignCount

• updateSignCount(
      credentialId: string,
      args: {
          expectedCurrentSignCount: number;
          lastUsedAt: Date;
          newSignCount: number;
      },
  ): Promise<boolean>

  Atomic compare-and-set for signCount (spec §2.3.1, Codex fix #4).

  Updates signCount and lastUsedAt IFF the stored signCount equals expectedCurrentSignCount at the moment of the write.

  Parameters

  • credentialId: string
  • args: { expectedCurrentSignCount: number; lastUsedAt: Date; newSignCount: number }

  Returns Promise<boolean>

  true if the CAS succeeded; false if the stored signCount did not match expectedCurrentSignCount (concurrent update race). Callers MUST treat false as a replay/clone attack signal.