stzAuth

(sans commentaire dans la source : le nom se lit comme une phrase) initaucune extension

Persist through a chosen store (e.g. StzAuthDbStoreQ("auth.db")). The default is in-memory. Pass a DB store for durability -- its sqlite is an engine handle, so the held copy still writes the same database.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) store qaucune extension

how long a new session lives, in seconds (0 = no expiry). Existing sessions keep the TTL they were issued with.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) session ttlaucune extension

idle timeout: a session dies if untouched for this many seconds (0 = off). Every successful validation slides the window (touches last-seen).QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) idle ttlaucune extension

passwordless config (mail port + magic-link) -------------------- bind the mail PORT passwordless flows send through -- a stzMailSandbox in dev (captured + assertable), your SMTP adapter at deploy. Any object with Send(to, subject, body) works.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) mail port qaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has mail portaucune extension

the app URL a magic link points at; the token is appended as ?token=... (or &token=... if the URL already has a query). "" -> a softanza:// URI.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) magic link base urlaucune extension

how long a magic link / email-OTP stays valid (seconds).QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) passwordless ttlaucune extension

brute-force lockout configQCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) max attemptsaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) set lockout secondsQCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) lockout secondsaucune extension

the credential store -------------------------------------------- register a user with a password -- stores ONLY the salted hash.aucune extension

register an account with NO usable password -- reachable only through a passwordless factor (magic-link / email-OTP). The stored hash is of a random value nobody holds, so Login can never succeed for it.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) is registeredaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) number of usersaucune extension

change a password (the current one must be presented). TRUE on success.aucune extension

remove a user (and end any of their sessions).aucune extension

MIGRATION: a hash stored before Argon2id (PBKDF2 "salt:hash") is still accepted, and on a SUCCESSFUL check it is replaced by an Argon2id hash of the password just proven -- the only moment the plaintext is in hand. So old accounts upgrade themselves, one login at a time, with no reset.aucune extension

authenticate AND, on success, open a session -> returns an opaque token ("" on failure OR lockout -- indistinguishable, so it leaks nothing).aucune extension

deterministic form (explicit 'now') for tests.aucune extension

same, capturing the DEVICE CONTEXT (ip + user-agent) so the session can be listed and revoked per device.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with ataucune extension

Password AND second factor in one call. For a user WITHOUT 2FA the code is ignored (password alone opens the session), so an app may always route login through here. For a 2FA user, a valid TOTP (or one-time recovery) code is required. Returns a session token, or "" on any failure / lockout.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login two factor ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login two factor withaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login two factor with ataucune extension

the user behind a live session token, or "" if unknown / ended / EXPIRED (checked against the wall clock).aussi écrite: SessionPersonaucune extension

same, against an explicit 'now' (epoch seconds) -- deterministic for tests. Checks BOTH the absolute expiry and (when enabled) the idle window, and slides the idle window by touching last-seen on a valid access.aussi écrite: SessionPersonAtaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) is valid sessionaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) is valid session ataucune extension

the session as a stzToken (its expiry, its kind), or NULL if unknown -- reconstructed from the stored token + expiry.aucune extension

the epoch-seconds a session expires at (0 = never), or -1 if unknown.aucune extension

drop expired sessions (housekeeping) -> the number pruned. Prunes BOTH absolute-expired and (when idle timeout is on) idle-expired sessions.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) purge expiredaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) number of sessionsaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) logoutaucune extension

revoke ONE session (per-device "sign out this device"). Alias of Logout, named for the device-management flow.aucune extension

end EVERY session for a user without removing the account ("log out everywhere") -- distinct from Unregister.aucune extension

the "your devices" surface + fixation defense ------------------- every live session of a user, as public descriptors -- the data a "your active devices" view lists (token to revoke by, plus when/where/what). [ [ :token, :user, :created, :ip, :userAgent, :expires, :lastSeen ], ... ]aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) sessions of ataucune extension

one session's public descriptor, or [] if unknown.aucune extension

ROTATE a session's token (session-fixation defense): after a privilege change -- 2FA, password change, elevation -- issue a NEW token for the same user + device, void the OLD one, and return the new token ("" if invalid). The pre-elevation token can no longer be replayed.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) rotate session ataucune extension

A user may add an authenticator-app second factor. Enrollment is TWO steps so a mis-scanned secret can never lock the user out: EnableTotp issues a secret stored UNCONFIRMED (not yet enforced -- plain Login still works); ConfirmTotp proves the app is in sync, enforces the factor, and hands back one-time recovery codes. From then on a plain Login is refused for that user and LoginTwoFactor is the only door. The factor is stzTotp; per-user state (secret + recovery-code hashes) lives in the store. whether a user has a CONFIRMED (enforced) second factor.aussi écrite: RequiresTwoFactoraucune extension

begin enrollment: mint a secret, store it UNCONFIRMED, and return [ :secret, :uri ]. Render :uri as a QR code for the user's app; :secret is the same key for manual entry. Nothing is enforced until ConfirmTotp. Raises if a CONFIRMED factor already exists (disable it first); a still-pending enrollment is simply replaced.aucune extension

finish enrollment: verify the app's current code. On success the factor is confirmed (now enforced) and a fresh set of one-time recovery codes is returned -- show them to the user ONCE (only their hashes are stored). Returns [] on a bad code (enrollment stays pending).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) confirm totp ataucune extension

verify a TOTP code (or a one-time recovery code) for a confirmed user.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) verify totp ataucune extension

turn 2FA off (removes the secret + every recovery code).aucune extension

issue a FRESH set of recovery codes (the old set stops working). Returns the plaintext to show once. Only for a confirmed factor.aucune extension

how many unused recovery codes remain.aucune extension

Send a one-time sign-in LINK to the user's email. The emailed token is random (256-bit); only its sha256 is stored, so a leaked store never yields a usable link. ENUMERATION-SAFE: the call behaves identically whether or not the email has an account -- a link is minted and sent only for a real user, but the return is always the same. Requires a bound mail port.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) request magic link ataucune extension

redeem a magic-link token -> a session token ("" if invalid / expired / for a user who since vanished, or whose 2FA forbids the shortcut).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) redeem magic link ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) redeem magic link withaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) redeem magic link with ataucune extension

The recovery path is where accounts are taken over, so it holds the same line as every other door: - ENUMERATION-SAFE: the request answers the same whether or not the email has an account; a link is minted and mailed only for a real one; - the token is 256 random bits, stored ONLY as its sha256, ONE-TIME and short-lived (30 min); a newer request cancels the older link; - a reset stores an Argon2id hash and ENDS EVERY SESSION -- an attacker holding one is signed out with the rest; - it does NOT sign anybody in: the next login still asks for the second factor when 2FA is on; - it cannot undo CONTAINMENT: an account a responder or an operator locked (LockAccount) is refused; a lockout from failed attempts, which is what a forgotten password produces, is cleared.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) request password resetaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) request password reset ataucune extension

Redeem a reset link. 1 when the password was changed, 0 otherwise -- unknown, used, expired, a new password too short, or a locked account.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) reset password ataucune extension

Email a short numeric code (6 digits) the user types back. The code is salted- hashed at rest and one pending code exists per email (a new request replaces it). A wrong code counts toward the brute-force lockout. Enumeration-safe, and requires a bound mail port.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) request email otp ataucune extension

verify an emailed OTP -> a session token ("" on any failure / lockout / a 2FA user).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) verify email otp ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) verify email otp withaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) verify email otp with ataucune extension

The payoff of the whole auth story. A successful login produces not just a session but the ACTOR the governance system already reasons about: a stzSystemActor carrying a capability set (the effectful / sensing / compute / inference lattice) derived from the user's roles, at a trust posture. The SAME username is the governance actor (stzGovernance.MayProceed) and the org-chart person (separation-of-duties). Roles are DEFINED here (capability bundles, app config) and GRANTED per user (durable). Four roles ship by default; an 'assistant' (LLM-backed) role holds only 'inference', so its session is authenticated yet cannot cause effects -- the agentic-safety invariant, extended to identity. define a role = a capability bundle. kinds are drawn from the lattice (effectful / sensing / compute / inference); posture is trusted / external / sandboxed. Re-defining a role replaces it. Returns This.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has role definedaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) role namesaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) role definitionaucune extension

grant a role to a user (durable). The role must be defined and the user must exist. Returns This.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) revoke roleaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has roleaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) roles ofaucune extension

the ACTOR a user resolves to: a stzSystemActor named for the user, holding the UNION of its roles' capability kinds, at the MOST RESTRICTIVE posture among them. A user with no roles is a capability-less, sandboxed actor -- properly authenticated, yet permitted nothing (least privilege by default).aucune extension

the actor behind a LIVE session (NULL if the session is invalid / expired).aussi écrite: SessionActoraucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) actor of ataussi écrite: SessionActorAtaucune extension

does the logged-in user hold a capability kind? (FALSE for an invalid session.)aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) session can ataucune extension

can this session cause EFFECTS? An assistant/LLM-role session holds only 'inference', so it is authenticated yet effect-less.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) session is effectful ataucune extension

a session-gated governance decision: the session must be LIVE and the governance instance (passed by reference, never held) must permit the action for this user. Bridges authn to the existing authz engine.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) session may proceed ataucune extension

The enterprise counterpart to OIDC: the corporate IdP authenticates the employee and POSTs back a signed assertion; stzAuth verifies it (engine-side XML-DSig, then issuer / audience / validity / replay -- see stzSamlServiceProvider) and opens a normal session. As with OIDC, the user that comes out is an ordinary Softanza citizen with the same governance actor -- SSO is a way IN, not a separate kind of account.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) saml service provider qaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has saml service provideraucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) saml whyaucune extension

the local user name a SAML subject maps to (its NameID -- typically the corporate email).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with samlaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with saml ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with saml withaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with saml with ataucune extension

A passkey replaces the password with a key pair the user's DEVICE holds: the private half never leaves the authenticator, so there is nothing to phish, reuse, or steal in a breach. Registration stores the public key; login is a signature over a fresh challenge. The relying-party judgement (origin, challenge, user presence, the cloned-authenticator counter) lives in stzPasskeyServer; the credentials live in the store, one row per DEVICE. bind the relying party: the domain credentials are bound to, and the exact origin the browser reports. The origin check is what makes a passkey unphishable, so both are required.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) passkey relying party qaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has passkey relying partyaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) passkey whyaucune extension

a fresh challenge for either ceremony -- the app holds it for that one exchange, which is what stops a captured response being replayed.aucune extension

enroll a device for a user. TRUE on success (PasskeyWhy explains a refusal).aucune extension

the devices a user has enrolled (public data only -- never a private key).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) number of passkeysaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has passkeyaucune extension

un-enroll one device (losing a key should not cost the account).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) remove all passkeysaucune extension

sign in with a device -> a session token, or "" (PasskeyWhy explains).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with passkey ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with passkey with ataucune extension

"Sign in with Google / Okta / Entra". The provider proves who the user is and hands back an id-token; stzAuth VERIFIES it locally (signature against the provider's published key, then issuer / audience / expiry / nonce -- see stzOidcClient) and, only then, opens a normal Softanza session. From that point the user is indistinguishable from any other: the same session, the same roles, the same governance ACTOR (phase 5). An external identity is a way IN, not a separate kind of citizen.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) oidc client qaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) has oidc clientaucune extension

create a local account the first time an external identity signs in (the usual want). Turn it off to admit only pre-provisioned users.QCSXTZZZIBWU

(sans commentaire dans la source : le nom se lit comme une phrase) oidc auto provisionaucune extension

why the last external login was refused ("" when it succeeded).aucune extension

the local user name an external identity maps to: its verified email when the provider asserts one, else "issuer|subject" (always unique, never collides with a local account name).aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with oidcaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with oidc ataucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) login with oidc withaucune extension

> a session token, or "" (with OidcWhy() explaining).aucune extension

lockout queriesaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) is locked out ataucune extension

The failure lockout above is a COUNTER: it engages after N bad passwords and expires by itself. A LOCK is an ACT: a responder or an operator closes the account until someone opens it again. It refuses every login path (they all ask IsLockedOutAt) AND every existing session -- UserOfSession answers "" for a locked user -- and it is kept in the store, so it survives a restart with a durable store.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) unlock accountaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) is account lockedaucune extension

[ :reason, :at ] or [] -- why and since when the account is locked.aucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) failed attemptsaucune extension

(sans commentaire dans la source : le nom se lit comme une phrase) showaucune extension