stzAuth

(no comment in the source: the name reads as a sentence) initno extension

Persist through a chosen store (e.g. StzAuthDbStoreQ("auth.db")). The default is in-memory. Pass a DB store for durability -- its sqlite is an engine handle, so the held copy still writes the same database.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) store qno extension

how long a new session lives, in seconds (0 = no expiry). Existing sessions keep the TTL they were issued with.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) session ttlno extension

idle timeout: a session dies if untouched for this many seconds (0 = off). Every successful validation slides the window (touches last-seen).QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) idle ttlno extension

passwordless config (mail port + magic-link) -------------------- bind the mail PORT passwordless flows send through -- a stzMailSandbox in dev (captured + assertable), your SMTP adapter at deploy. Any object with Send(to, subject, body) works.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) mail port qno extension

(no comment in the source: the name reads as a sentence) has mail portno extension

the app URL a magic link points at; the token is appended as ?token=... (or &token=... if the URL already has a query). "" -> a softanza:// URI.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) magic link base urlno extension

how long a magic link / email-OTP stays valid (seconds).QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) passwordless ttlno extension

brute-force lockout configQCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) max attemptsno extension

(no comment in the source: the name reads as a sentence) set lockout secondsQCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) lockout secondsno extension

the credential store -------------------------------------------- register a user with a password -- stores ONLY the salted hash.no extension

register an account with NO usable password -- reachable only through a passwordless factor (magic-link / email-OTP). The stored hash is of a random value nobody holds, so Login can never succeed for it.no extension

(no comment in the source: the name reads as a sentence) is registeredno extension

(no comment in the source: the name reads as a sentence) number of usersno extension

change a password (the current one must be presented). TRUE on success.no extension

remove a user (and end any of their sessions).no extension

MIGRATION: a hash stored before Argon2id (PBKDF2 "salt:hash") is still accepted, and on a SUCCESSFUL check it is replaced by an Argon2id hash of the password just proven -- the only moment the plaintext is in hand. So old accounts upgrade themselves, one login at a time, with no reset.no extension

authenticate AND, on success, open a session -> returns an opaque token ("" on failure OR lockout -- indistinguishable, so it leaks nothing).no extension

deterministic form (explicit 'now') for tests.no extension

same, capturing the DEVICE CONTEXT (ip + user-agent) so the session can be listed and revoked per device.no extension

(no comment in the source: the name reads as a sentence) login with atno extension

Password AND second factor in one call. For a user WITHOUT 2FA the code is ignored (password alone opens the session), so an app may always route login through here. For a 2FA user, a valid TOTP (or one-time recovery) code is required. Returns a session token, or "" on any failure / lockout.no extension

(no comment in the source: the name reads as a sentence) login two factor atno extension

(no comment in the source: the name reads as a sentence) login two factor withno extension

(no comment in the source: the name reads as a sentence) login two factor with atno extension

the user behind a live session token, or "" if unknown / ended / EXPIRED (checked against the wall clock).also written: SessionPersonno extension

same, against an explicit 'now' (epoch seconds) -- deterministic for tests. Checks BOTH the absolute expiry and (when enabled) the idle window, and slides the idle window by touching last-seen on a valid access.also written: SessionPersonAtno extension

(no comment in the source: the name reads as a sentence) is valid sessionno extension

(no comment in the source: the name reads as a sentence) is valid session atno extension

the session as a stzToken (its expiry, its kind), or NULL if unknown -- reconstructed from the stored token + expiry.no extension

the epoch-seconds a session expires at (0 = never), or -1 if unknown.no extension

drop expired sessions (housekeeping) -> the number pruned. Prunes BOTH absolute-expired and (when idle timeout is on) idle-expired sessions.no extension

(no comment in the source: the name reads as a sentence) purge expiredno extension

(no comment in the source: the name reads as a sentence) number of sessionsno extension

(no comment in the source: the name reads as a sentence) logoutno extension

revoke ONE session (per-device "sign out this device"). Alias of Logout, named for the device-management flow.no extension

end EVERY session for a user without removing the account ("log out everywhere") -- distinct from Unregister.no extension

the "your devices" surface + fixation defense ------------------- every live session of a user, as public descriptors -- the data a "your active devices" view lists (token to revoke by, plus when/where/what). [ [ :token, :user, :created, :ip, :userAgent, :expires, :lastSeen ], ... ]no extension

(no comment in the source: the name reads as a sentence) sessions of atno extension

one session's public descriptor, or [] if unknown.no extension

ROTATE a session's token (session-fixation defense): after a privilege change -- 2FA, password change, elevation -- issue a NEW token for the same user + device, void the OLD one, and return the new token ("" if invalid). The pre-elevation token can no longer be replayed.no extension

(no comment in the source: the name reads as a sentence) rotate session atno extension

A user may add an authenticator-app second factor. Enrollment is TWO steps so a mis-scanned secret can never lock the user out: EnableTotp issues a secret stored UNCONFIRMED (not yet enforced -- plain Login still works); ConfirmTotp proves the app is in sync, enforces the factor, and hands back one-time recovery codes. From then on a plain Login is refused for that user and LoginTwoFactor is the only door. The factor is stzTotp; per-user state (secret + recovery-code hashes) lives in the store. whether a user has a CONFIRMED (enforced) second factor.also written: RequiresTwoFactorno extension

begin enrollment: mint a secret, store it UNCONFIRMED, and return [ :secret, :uri ]. Render :uri as a QR code for the user's app; :secret is the same key for manual entry. Nothing is enforced until ConfirmTotp. Raises if a CONFIRMED factor already exists (disable it first); a still-pending enrollment is simply replaced.no extension

finish enrollment: verify the app's current code. On success the factor is confirmed (now enforced) and a fresh set of one-time recovery codes is returned -- show them to the user ONCE (only their hashes are stored). Returns [] on a bad code (enrollment stays pending).no extension

(no comment in the source: the name reads as a sentence) confirm totp atno extension

verify a TOTP code (or a one-time recovery code) for a confirmed user.no extension

(no comment in the source: the name reads as a sentence) verify totp atno extension

turn 2FA off (removes the secret + every recovery code).no extension

issue a FRESH set of recovery codes (the old set stops working). Returns the plaintext to show once. Only for a confirmed factor.no extension

how many unused recovery codes remain.no extension

Send a one-time sign-in LINK to the user's email. The emailed token is random (256-bit); only its sha256 is stored, so a leaked store never yields a usable link. ENUMERATION-SAFE: the call behaves identically whether or not the email has an account -- a link is minted and sent only for a real user, but the return is always the same. Requires a bound mail port.no extension

(no comment in the source: the name reads as a sentence) request magic link atno extension

redeem a magic-link token -> a session token ("" if invalid / expired / for a user who since vanished, or whose 2FA forbids the shortcut).no extension

(no comment in the source: the name reads as a sentence) redeem magic link atno extension

(no comment in the source: the name reads as a sentence) redeem magic link withno extension

(no comment in the source: the name reads as a sentence) redeem magic link with atno extension

The recovery path is where accounts are taken over, so it holds the same line as every other door: - ENUMERATION-SAFE: the request answers the same whether or not the email has an account; a link is minted and mailed only for a real one; - the token is 256 random bits, stored ONLY as its sha256, ONE-TIME and short-lived (30 min); a newer request cancels the older link; - a reset stores an Argon2id hash and ENDS EVERY SESSION -- an attacker holding one is signed out with the rest; - it does NOT sign anybody in: the next login still asks for the second factor when 2FA is on; - it cannot undo CONTAINMENT: an account a responder or an operator locked (LockAccount) is refused; a lockout from failed attempts, which is what a forgotten password produces, is cleared.no extension

(no comment in the source: the name reads as a sentence) request password resetno extension

(no comment in the source: the name reads as a sentence) request password reset atno extension

Redeem a reset link. 1 when the password was changed, 0 otherwise -- unknown, used, expired, a new password too short, or a locked account.no extension

(no comment in the source: the name reads as a sentence) reset password atno extension

Email a short numeric code (6 digits) the user types back. The code is salted- hashed at rest and one pending code exists per email (a new request replaces it). A wrong code counts toward the brute-force lockout. Enumeration-safe, and requires a bound mail port.no extension

(no comment in the source: the name reads as a sentence) request email otp atno extension

verify an emailed OTP -> a session token ("" on any failure / lockout / a 2FA user).no extension

(no comment in the source: the name reads as a sentence) verify email otp atno extension

(no comment in the source: the name reads as a sentence) verify email otp withno extension

(no comment in the source: the name reads as a sentence) verify email otp with atno extension

The payoff of the whole auth story. A successful login produces not just a session but the ACTOR the governance system already reasons about: a stzSystemActor carrying a capability set (the effectful / sensing / compute / inference lattice) derived from the user's roles, at a trust posture. The SAME username is the governance actor (stzGovernance.MayProceed) and the org-chart person (separation-of-duties). Roles are DEFINED here (capability bundles, app config) and GRANTED per user (durable). Four roles ship by default; an 'assistant' (LLM-backed) role holds only 'inference', so its session is authenticated yet cannot cause effects -- the agentic-safety invariant, extended to identity. define a role = a capability bundle. kinds are drawn from the lattice (effectful / sensing / compute / inference); posture is trusted / external / sandboxed. Re-defining a role replaces it. Returns This.no extension

(no comment in the source: the name reads as a sentence) has role definedno extension

(no comment in the source: the name reads as a sentence) role namesno extension

(no comment in the source: the name reads as a sentence) role definitionno extension

grant a role to a user (durable). The role must be defined and the user must exist. Returns This.no extension

(no comment in the source: the name reads as a sentence) revoke roleno extension

(no comment in the source: the name reads as a sentence) has roleno extension

(no comment in the source: the name reads as a sentence) roles ofno extension

the ACTOR a user resolves to: a stzSystemActor named for the user, holding the UNION of its roles' capability kinds, at the MOST RESTRICTIVE posture among them. A user with no roles is a capability-less, sandboxed actor -- properly authenticated, yet permitted nothing (least privilege by default).no extension

the actor behind a LIVE session (NULL if the session is invalid / expired).also written: SessionActorno extension

(no comment in the source: the name reads as a sentence) actor of atalso written: SessionActorAtno extension

does the logged-in user hold a capability kind? (FALSE for an invalid session.)no extension

(no comment in the source: the name reads as a sentence) session can atno extension

can this session cause EFFECTS? An assistant/LLM-role session holds only 'inference', so it is authenticated yet effect-less.no extension

(no comment in the source: the name reads as a sentence) session is effectful atno extension

a session-gated governance decision: the session must be LIVE and the governance instance (passed by reference, never held) must permit the action for this user. Bridges authn to the existing authz engine.no extension

(no comment in the source: the name reads as a sentence) session may proceed atno extension

The enterprise counterpart to OIDC: the corporate IdP authenticates the employee and POSTs back a signed assertion; stzAuth verifies it (engine-side XML-DSig, then issuer / audience / validity / replay -- see stzSamlServiceProvider) and opens a normal session. As with OIDC, the user that comes out is an ordinary Softanza citizen with the same governance actor -- SSO is a way IN, not a separate kind of account.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) saml service provider qno extension

(no comment in the source: the name reads as a sentence) has saml service providerno extension

(no comment in the source: the name reads as a sentence) saml whyno extension

the local user name a SAML subject maps to (its NameID -- typically the corporate email).no extension

(no comment in the source: the name reads as a sentence) login with samlno extension

(no comment in the source: the name reads as a sentence) login with saml atno extension

(no comment in the source: the name reads as a sentence) login with saml withno extension

(no comment in the source: the name reads as a sentence) login with saml with atno extension

A passkey replaces the password with a key pair the user's DEVICE holds: the private half never leaves the authenticator, so there is nothing to phish, reuse, or steal in a breach. Registration stores the public key; login is a signature over a fresh challenge. The relying-party judgement (origin, challenge, user presence, the cloned-authenticator counter) lives in stzPasskeyServer; the credentials live in the store, one row per DEVICE. bind the relying party: the domain credentials are bound to, and the exact origin the browser reports. The origin check is what makes a passkey unphishable, so both are required.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) passkey relying party qno extension

(no comment in the source: the name reads as a sentence) has passkey relying partyno extension

(no comment in the source: the name reads as a sentence) passkey whyno extension

a fresh challenge for either ceremony -- the app holds it for that one exchange, which is what stops a captured response being replayed.no extension

enroll a device for a user. TRUE on success (PasskeyWhy explains a refusal).no extension

the devices a user has enrolled (public data only -- never a private key).no extension

(no comment in the source: the name reads as a sentence) number of passkeysno extension

(no comment in the source: the name reads as a sentence) has passkeyno extension

un-enroll one device (losing a key should not cost the account).no extension

(no comment in the source: the name reads as a sentence) remove all passkeysno extension

sign in with a device -> a session token, or "" (PasskeyWhy explains).no extension

(no comment in the source: the name reads as a sentence) login with passkey atno extension

(no comment in the source: the name reads as a sentence) login with passkey with atno extension

"Sign in with Google / Okta / Entra". The provider proves who the user is and hands back an id-token; stzAuth VERIFIES it locally (signature against the provider's published key, then issuer / audience / expiry / nonce -- see stzOidcClient) and, only then, opens a normal Softanza session. From that point the user is indistinguishable from any other: the same session, the same roles, the same governance ACTOR (phase 5). An external identity is a way IN, not a separate kind of citizen.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) oidc client qno extension

(no comment in the source: the name reads as a sentence) has oidc clientno extension

create a local account the first time an external identity signs in (the usual want). Turn it off to admit only pre-provisioned users.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) oidc auto provisionno extension

why the last external login was refused ("" when it succeeded).no extension

the local user name an external identity maps to: its verified email when the provider asserts one, else "issuer|subject" (always unique, never collides with a local account name).no extension

(no comment in the source: the name reads as a sentence) login with oidcno extension

(no comment in the source: the name reads as a sentence) login with oidc atno extension

(no comment in the source: the name reads as a sentence) login with oidc withno extension

> a session token, or "" (with OidcWhy() explaining).no extension

lockout queriesno extension

(no comment in the source: the name reads as a sentence) is locked out atno extension

The failure lockout above is a COUNTER: it engages after N bad passwords and expires by itself. A LOCK is an ACT: a responder or an operator closes the account until someone opens it again. It refuses every login path (they all ask IsLockedOutAt) AND every existing session -- UserOfSession answers "" for a locked user -- and it is kept in the store, so it survives a restart with a durable store.no extension

(no comment in the source: the name reads as a sentence) unlock accountno extension

(no comment in the source: the name reads as a sentence) is account lockedno extension

[ :reason, :at ] or [] -- why and since when the account is locked.no extension

(no comment in the source: the name reads as a sentence) failed attemptsno extension

(no comment in the source: the name reads as a sentence) showno extension