Mobile authentication
Authentication state machine
Trigger sign-in, expiry, refresh, revocation, and recovery. See permitted transitions and why recovery must not silently bypass step-up.
Send an event
Events run against the current modeled state. Invalid transitions are logged rather than silently succeeding.
Current state
Signed out
Transition log
- No events yet. Try signing in, expiring a token, or requesting recovery.
What this model does — and does not do
This is a deterministic teaching model with synthetic inputs. No real credentials, traffic, signing keys, attestation services, authentication endpoints, or customer data are processed. A production system needs actual cryptographic checks, authoritative persistence, concurrency control, and integration tests.
Inspect the actual lab model
Download the deterministic TypeScript model and its automated regression tests as a self-contained source bundle. It contains no production app code, real secrets, or platform attestation implementation.
Download reference source + tests