AXIAM PHP SDK

WebauthnAttestationPolicy
in package
implements JsonSerializable

FinalYes

Per-tenant WebAuthn attestation policy (D5). One row per tenant; an absent row means [`WebauthnAttestationPolicy::default`], which is today's behavior unchanged.

This is a REPLACEMENT body (§27.4 rule 5): every field is required, so omitting one is a constructor error rather than a silent erasure server-side.

Table of Contents

Interfaces

JsonSerializable

Properties

$allowedAaguids  : array<string|int, mixed>|null
$blockedAaguids  : array<string|int, mixed>|null
$blockRevokedStatus  : bool
$minCertification  : CertificationLevel|null
$mode  : AttestationMode
$requireFidoCertified  : bool
$unknownAaguid  : UnknownAaguidAction|null

Methods

__construct()  : mixed
Constructs a WebauthnAttestationPolicy.
fromArray()  : self
Rebuilds a WebauthnAttestationPolicy from one decoded JSON object.
jsonSerialize()  : array<string, mixed>
Renders this object for `json_encode()`.
toArray()  : array<string, mixed>
Renders this object back to its wire form.

Properties

Methods

__construct()

Constructs a WebauthnAttestationPolicy.

public __construct(bool $blockRevokedStatus, AttestationMode $mode, bool $requireFidoCertified[, array<int, string>|null $allowedAaguids = null ][, array<int, string>|null $blockedAaguids = null ][, CertificationLevel|null $minCertification = null ][, UnknownAaguidAction|null $unknownAaguid = null ]) : mixed
Parameters
$blockRevokedStatus : bool

Deny registration if the MDS entry has ever reported REVOKED or any *_COMPROMISE status (sticky — D8 step 7).

$mode : AttestationMode

the server's mode field

$requireFidoCertified : bool

Require some FIDO_CERTIFIED* status, any level. Independent of (and checked before) min_certification.

$allowedAaguids : array<int, string>|null = null

None = every AAGUID is allowed except blocked_aaguids. Some(vec![]) is a deliberate "nothing may register" policy and is accepted as such: evaluate denies every AAGUID against an empty allow-list. Nothing rejects it, precisely because the failure direction is safe — a client that sends [] when it meant null gets a locked-down tenant, which is visible immediately, rather than an open one, which is not. (optional)

$blockedAaguids : array<int, string>|null = null

the server's blocked_aaguids field (optional)

$minCertification : CertificationLevel|null = null

the server's min_certification field (optional)

$unknownAaguid : UnknownAaguidAction|null = null

the server's unknown_aaguid field (optional)

fromArray()

Rebuilds a WebauthnAttestationPolicy from one decoded JSON object.

public static fromArray(array<string, mixed> $data) : self
Parameters
$data : array<string, mixed>

The raw wire object.

Return values
self

jsonSerialize()

Renders this object for `json_encode()`.

public jsonSerialize() : array<string, mixed>

Any Sensitive it carries stays WRAPPED here, so a log line or a json_encode($model) in application code prints [SENSITIVE]. The one place a secret is revealed is ManagementTransport, on the way to the wire and nowhere else (§27.5).

Return values
array<string, mixed>

toArray()

Renders this object back to its wire form.

public toArray() : array<string, mixed>

§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.

Return values
array<string, mixed>
On this page

Search results