Crate sofie_identity

Modules§

Account
AddingMember
MemberAdded: An account made a member of an area from a task or a seed, as the first staff member of a Permitted area is, whose sign-up admits nobody to anything.
MembershipRemoved: A membership removed, and with sessions the account’s sessions in its area ended in the same commit, so a cookie open there stops at its next request.
Memberships
Password: Never printed or serialized, only hashed or checked; kept in NFC, as NIST SP 800-63B asks.
PasswordHash: Written as Argon2id in the PHC string format, $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>. pbkdf2-sha256$<iterations>$<salt>$<hash>, written before, is still read and checked.
SignedIn

add_member: An address no account holds gets one without a password, which signs in once its owner sets one (password-reset), follows a sign-in link or connects a provider. An account already a member keeps its membership, so adding it again changes nothing but a role. An account adopted, or given a role, whose address nobody proved may have been signed up by someone else expecting this, so it is distrusted.
add_member_task: For an app’s tasks: Tasks::new().task("sofie_identity.add_member", add_member_task), then <app> task sofie_identity.add_member --email … --area … [--role …].
member
migrations
module
remove_membership: Read and committed beyond the request’s reach, as an area’s principal seldom owns its members’ records. Without sessions, a session open in the area stays open until its cookie expires.
routes: Mounted in Web; sign-ins and sign-ups are rate-limited per address.
sign_in_for: Signs account in to an area whose principal is another of its records, such as an organization it belongs to; the session is listed as the account’s. The caller, an Admitter of its own, has checked that the account may act as principal.
worker