Struct AuthCredential 

pub struct AuthCredential {
    pub schema_version: u16,
    pub kind: AuthKind,
    pub kdf: KdfKind,
    pub salt: [u8; 16],
    pub credential_hash: [u8; 32],
    pub kdf_params: KdfParams,
    pub expires_tick: Option<Tick>,
    pub bound_tick: Tick,
}

Stored authentication credential — at least one per User (invariant E-user-2). Secret material is a KDF output; no raw password is stored.

Fields

schema_version: u16

Wire-level schema version tag.

kind: AuthKind

Channel family.

kdf: KdfKind

Hash family. Argon2id is the runtime default.

salt: [u8; 16]

Per-credential random salt (16 bytes).

credential_hash: [u8; 32]

KDF output: kdf(password, salt, params).

kdf_params: KdfParams

Cost parameters used for credential_hash.

expires_tick: Option<Tick>

Optional rotation deadline (S8 anchor).

bound_tick: Tick

Tick at which the credential was bound.

Implementations

impl AuthCredential

pub const DEFAULT_KDF: KdfKind = KdfKind::Argon2id

Runtime default KDF — OWASP 2024 recommendation.

pub const MIN_ARGON2ID_M_COST: u32 = 19_456

Minimum Argon2id memory cost (19 MiB).

pub const MIN_ARGON2ID_T_COST: u32 = 2

Minimum Argon2id iteration count.

pub const MIN_ARGON2ID_P_COST: u32 = 1

Minimum Argon2id parallelism.

pub const MIN_SCRYPT_N_COST: u32

Minimum Scrypt cost N (power-of-two, ≥ 2^15).

pub const MIN_SCRYPT_R_COST: u32 = 8

Minimum Scrypt block-size r.

pub fn validate_kdf_params(kdf: KdfKind, p: &KdfParams) -> bool

L1-compute validator for KDF parameters — rejects weak settings.

Trait Implementations

impl ArkheComponent for AuthCredential

const TYPE_CODE: u32 = 196610u32

Globally stable dispatch code within the runtime TypeCode registry.

const SCHEMA_VERSION: u16 = 1u16

Monotone schema version. Bump on field addition (#[serde(default)] paired); field removal / reorder forbidden.

fn type_code() -> TypeCode

TypeCode wrapper convenience.

fn approx_size(&self) -> usize

Approximate payload size for quota tracking. Default returns size_of::<Self>(); override for bytes::Bytes-carrying Components.

impl Clone for AuthCredential

fn clone(&self) -> AuthCredential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthCredential

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AuthCredential

fn eq(&self, other: &AuthCredential) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AuthCredential

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for AuthCredential

impl StructuralPartialEq for AuthCredential