Module auth 

Passwordless sign-in: one-time codes by email, passkeys, and sessions.

1. Auth::send_code emails a 6-digit code (valid 10 minutes, 5 tries, at most 5 codes per address per 15 minutes); Auth::verify_code checks it. The email address is the account.
2. Once signed in, a user can add a passkey (Auth::passkey_register_start and _finish) and later sign in with it (Auth::passkey_login_start and _finish).
3. Either way the app creates a session (Auth::create_session): an opaque token for a cookie or an Authorization: Bearer header, valid 30 days and renewed while used. Ending it (Auth::end_session) takes effect at once.

Only hashes of codes and tokens are stored. The tables (login_code, session, passkey, auth_challenge) are defined in the project’s first migration.

Settings: SMTP_URL (e.g. smtps://user:pass@smtp.example.com) and MAIL_FROM send the codes; without SMTP_URL, debug builds log them (and write them to MAIL_DIR, if set) instead. PASSKEY_RP_ID (default localhost) is the domain passkeys belong to, shared by its subdomains; PASSKEY_ORIGIN (default http://localhost:8000) is its web origin.

Structs

Auth

Sign-in for one application. Cheap to clone.

Challenge

A passkey ceremony to finish in the browser: options go to navigator.credentials (publicKey), id comes back with the result.

Session

A signed-in session.

Functions

normalize_email

email trimmed and lowercased, if it looks like an address.