Passkey model & schema

RoundlyConsulting\Passkeys\Models\Passkey is a soft-deleting, polymorphic Eloquent model for a stored WebAuthn credential. Its owner is the authenticatable morph-to relation, and three scopes cover the lookups:

use RoundlyConsulting\Passkeys\Models\Passkey;

$passkey = Passkey::query()->forCredentialId($base64UrlId)->first();
$owned   = Passkey::query()->forUserHandle($handle)->get();
$mine    = Passkey::query()->ownedBy($user)->get();

$passkey->authenticatable;   // the owning model (MorphTo)

• forCredentialId($id) — match by credential ID through its sha-256 lookup hash.
• forUserHandle($handle) — match by discoverable-login user handle.
• ownedBy($owner) — exactly one owner: its morph type and its key.
• Passkey::hashCredentialId($id) — the static sha-256 lookup hash of a (possibly long) base64url credential ID.
• advanceSignCount($signCount, $backupState) — one conditional UPDATE that moves sign_count forward, records backup_state and stamps last_used_at; false (with the model reloaded) when the counter did not advance.
• recordUsage($backupState) — record backup_state and stamp last_used_at without moving the counter (a flag-policy regression).
• Casts: transports (array), sign_count (integer), backup_eligible and backup_state (boolean), last_used_at (datetime).

Schema

The unique index sits on the fixed-length credential_id_hash rather than the variable-length credential_id, so roaming-key IDs are stored in full and the index fits every database’s key-length limit.

Using your own model

Point passkeys.model at a subclass of Passkey. The package resolves the configured class everywhere — the passkeys() relation, both ceremonies and the factory — so registration hands your class back and its model events fire. A class that is not Passkey or a subclass of it throws InvalidConfigurationException naming the key — it is never silently replaced by the packaged model. Keep the scopes, casts, hidden attributes and hashCredentialId() intact; the ceremonies rely on them:

// app/Models/Credential.php
use RoundlyConsulting\Passkeys\Models\Passkey;

class Credential extends Passkey
{
    // your accessors, relationships and model events
}

// config/passkeys.php
'model' => App\Models\Credential::class,

UUID and ULID owners

The authenticatable morph column defaults to bigint. If the models that own passkeys use UUID or ULID primary keys, set the key type before migrating — every owning model must share one key type, and an unrecognised value throws InvalidConfigurationException rather than silently building bigint keys:

PASSKEYS_KEY_TYPE=uuid   # bigint (default), uuid or ulid