Struct WebauthnCredential 

pub struct WebauthnCredential {
    pub credential_id: String,
    pub public_key_cose: Vec<u8>,
    pub sign_count: u32,
    pub device_name: String,
    pub registered_at: i64,
    pub last_used_at: i64,
    pub attestation_format: String,
    pub user_verified: bool,
    pub backup_eligible: bool,
    pub backup_state: bool,
}

A registered WebAuthn credential.

The integrator persists one record per credential. WebauthnCredential::sign_count is security-relevant state: after every successful crate::verify_authentication, the caller must atomically persist AuthenticationResult::new_sign_count (monotonic counter used for authenticator-clone detection).

Security note

public_key_cose is parsed and signature-checked on every authentication, but the bytes stored at registration time should be treated as trusted only because they were validated by crate::verify_registration before persisting. Never accept a credential record whose provenance you cannot establish.

Fields

credential_id: String

Base64url-encoded credential ID.

public_key_cose: Vec<u8>

COSE public key bytes (CBOR-encoded).

sign_count: u32

Counter to prevent replay/clone attacks. Persist the updated value returned by crate::verify_authentication after each login.

device_name: String

Human-readable device name (e.g. “YubiKey 5 NFC”).

registered_at: i64

Registration timestamp (Unix seconds).

last_used_at: i64

Last authentication timestamp (Unix seconds).

attestation_format: String

Attestation format (e.g. “none”, “packed”, “fido-u2f”, “android-key”).

Raw informational string; see the registration result’s crate::attestation::AttestationResult for the verified trust level.

user_verified: bool

Whether user verification (biometrics/PIN) was performed at registration.

backup_eligible: bool

Backup eligibility (BE) flag at registration: true when the credential is a multi-device/syncable credential. Immutable for the lifetime of the credential — persist and keep for policy decisions.

Security note

BE=1 means account recovery follows the user’s cloud account rules, not this credential’s confinement to one device. See crate::policy::BackupPolicy for the trade-offs.

backup_state: bool

Backup state (BS) flag at registration: whether the credential was backed up at ceremony time. Volatile — superseded by the BS flag reported on every AuthenticationResult.

Trait Implementations

impl Clone for WebauthnCredential

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WebauthnCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WebauthnCredential

Available on crate feature serde only.

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for WebauthnCredential

Available on crate feature serde only.

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.