Module auth_api 

Operator auth over HTTP (kernel spec §3, §8): the one-time setup, login and logout, step-up, the signed-in sessions, and passkeys (plan 3c).

Constants

MAX_BODY_BYTES

The largest request body the auth routes read: a password is at most 1024 bytes (MAX_PASSWORD_BYTES), and a passkey’s answer, with no attestation asked for (plan 3c decision 4), about one, so anything much larger is refused with 413 before it is parsed.

Functions

router

The operator auth routes. Setup has its own Origin rule; the rest are browser routes (kernel spec §3.3). Serve with ConnectInfo<SocketAddr>: the address policy resolves the limiter key from that peer, never identity.