<?php

namespace App\Support\Webauthn;

use RuntimeException;
use Webauthn\Counter\CounterChecker;
use Webauthn\CredentialRecord;

/**
 * Counter check that tolerates authenticators which don't support a signature counter
 * (platform authenticators / synchronized passkeys always report 0): a current counter
 * of 0 is accepted, while a non-zero counter must strictly increase — keeping the
 * cloned-authenticator / rollback detection for keys that do count.
 */
class ZeroTolerantCounterChecker implements CounterChecker
{
    public function check(CredentialRecord $credentialRecord, int $currentCounter): void
    {
        if ($currentCounter === 0) {
            return; // counter unsupported by this authenticator
        }

        if ($currentCounter <= $credentialRecord->counter) {
            throw new RuntimeException('Invalid WebAuthn signature counter (possible cloned authenticator).');
        }
    }
}