<?php

namespace App\Support\Webauthn;

use RuntimeException;
use Webauthn\Counter\CounterChecker;
use Webauthn\CredentialRecord;

/**
 * Counter check that tolerates authenticators which don't support a signature counter
 * (platform authenticators / synchronized passkeys always report 0): a current counter
 * of 0 is accepted, while a non-zero counter must strictly increase — keeping the
 * cloned-authenticator / rollback detection for keys that do count.
 */
class ZeroTolerantCounterChecker implements CounterChecker
{
    public function check(CredentialRecord $credentialRecord, int $currentCounter): void
    {
        // Tolerate 0 ONLY when the stored counter is also 0 (authenticator never counts).
        // A 0 after a previously non-zero counter is a rollback/clone → reject.
        if ($currentCounter === 0 && $credentialRecord->counter === 0) {
            return;
        }

        if ($currentCounter <= $credentialRecord->counter) {
            throw new RuntimeException('Invalid WebAuthn signature counter (possible cloned authenticator).');
        }
    }
}