WebauthnPolicy
in package
implements
JsonSerializable
WebAuthn ceremony policy. One field today. It is a struct rather than a bare field on [`SecuritySettings`] so that the next WebAuthn control has an obvious home, and so the admin UI can group them. The *attestation* policy is deliberately not here: it lives in [`crate::models::webauthn_policy::WebauthnAttestationPolicy`], is tenant-only, and cannot join this model because AAGUID allow/block lists have no "more restrictive than" ordering to validate an override against. User verification does, so it can.
Table of Contents
Interfaces
- JsonSerializable
Properties
- $webauthnUserVerification : string
Methods
- __construct() : mixed
- Constructs a WebauthnPolicy.
- fromArray() : self
- Rebuilds a WebauthnPolicy from one decoded JSON object.
- jsonSerialize() : array<string, mixed>
- Renders this object for `json_encode()`.
- toArray() : array<string, mixed>
- Renders this object back to its wire form.
Properties
$webauthnUserVerification read-only
public
string
$webauthnUserVerification
Methods
__construct()
Constructs a WebauthnPolicy.
public
__construct(string $webauthnUserVerification) : mixed
Parameters
- $webauthnUserVerification : string
-
How hard the authenticator must prove who is present. Applies to enrolment and to second-factor authentication. Usernameless sign-in is held to
requiredwhatever this says — see [WebauthnUserVerification].
fromArray()
Rebuilds a WebauthnPolicy from one decoded JSON object.
public
static fromArray(array<string, mixed> $data) : self
Parameters
- $data : array<string, mixed>
-
The raw wire object.
Return values
selfjsonSerialize()
Renders this object for `json_encode()`.
public
jsonSerialize() : array<string, mixed>
Any Sensitive it carries stays WRAPPED here, so a log line or a
json_encode($model) in application code prints [SENSITIVE]. The one place a secret
is revealed is ManagementTransport, on the way to the wire
and nowhere else (§27.5).
Return values
array<string, mixed>toArray()
Renders this object back to its wire form.
public
toArray() : array<string, mixed>
§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.