sirtimbly/cairnquire
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

accounts and email

Browse Source
This commit is contained in:
Tim Bendt
2026-06-04 08:50:34 -04:00
parent 73d505ac7e
commit ddc7d5cbf5
46 changed files with 2685 additions and 309 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
.project/specs/authentication-api.md
View File

@@ -11,9 +11,12 @@ Endpoints:
- `GET /setup`
- `POST /api/setup`
- `GET /login`
- `GET /password-reset?token=...`
- `GET /account`
- `GET /account/tokens/new`
- `POST /api/auth/register/password`
- `POST /api/auth/login/password`
- `POST /api/auth/password/reset`
- `POST /api/auth/logout`
- `GET /api/auth/me`
- `POST /api/auth/password/change`
@@ -38,7 +41,7 @@ Developer clients use bearer tokens:
Authorization: Bearer cq_pat_<id>_<secret>
```
The token is shown once. The server stores the token id and SHA-256 hash of the secret. Tokens can be scoped and revoked.
The token is shown once. The server stores the token id and SHA-256 hash of the secret. Tokens can be scoped and revoked. Browser users create tokens at `/account/tokens/new`.
Endpoints:
@@ -56,6 +59,24 @@ Supported scopes:
Authorization is role plus scope: a token must have the required scope, and the owning user role must allow that operation.
## Account Administration
Administrators update user roles and disabled-account state in one bulk form.
Disabled accounts cannot authenticate with passwords, passkeys, existing
sessions, or API tokens. At least one enabled administrator account must remain.
Administrators can send a password-reset email to a user who cannot log in.
Each click creates a fresh one-hour link and invalidates that user's earlier
unused reset links. Completing a reset changes the password, consumes the link,
and revokes the user's existing browser sessions.
Endpoints:
- `PATCH /api/admin/auth-users`
- `POST /api/admin/auth-users/{id}/password-reset`
- `GET /password-reset?token=...`
- `POST /api/auth/password/reset`
## Device Flow
CLI clients can avoid handling browser cookies by using the first-party device flow:
@@ -72,7 +93,8 @@ This is intentionally inspired by OAuth device authorization, but it is not a ge
## Route Protection
- Setup-only until configured: initial setup page and endpoint.
- Public: health, static assets, document reads, login/account entry pages, password/passkey begin-login/register endpoints when signups are enabled, device start/token polling.
- Public: health, static assets, document reads, login and password-reset pages, password/passkey begin-login/register endpoints when signups are enabled, password-reset submission, device start/token polling.
- Authenticated browser pages: account management and token creation screens.
- Session or bearer token required: auth profile/logout, edit/save APIs, uploads, sync/content APIs, device approval.
- Admin role required: admin APIs and API token management.