API Reference datadeft_auth v#0.6.1

Framework-independent authentication using a supervised, separate Rust process.

Fake-mode test helper result: the newest outbox email's landing URL for an address. The URL carries the bearer token and is redacted in Inspect. Never available outside mode: :fake.

A redacted operational error. Codes are internal diagnostics, not HTTP responses.

Read-only flow state for redirect-landing pages. On usable: false the application clears its confirm cookie. Confirmation and account identity are redacted in Inspect.

Scanner-safe landing outcome. confirm_cookie is the temporary flow state the application stores client-side (HttpOnly cookie); confirmation is the value the confirmation page submits. Both are secrets and are redacted in Inspect, as is the account identity. The answer shape is uniform for every unusable link.

Proof-of-work challenge in the shipping browser client's wire shape: serialize it as JSON for the client verbatim. Every field is public data the client already sees; the HMAC tag binds the tuple so none of it can be altered.

Solution verification outcome. On admitted: true, proof_cookie (redacted in Inspect) is the bearer value to set as the dd_pow cookie (HttpOnly, Secure, the configured proof TTL). Every failed check collapses into one admitted: false shape, so the application answers with a single generic "solve again" response. mint_to_verify_ms is the server-derived solve-timing signal for metrics and risk tagging, never for hard blocking.

Successful confirmation outcome. session_cookie is the bearer session value (set it HttpOnly, Secure, with the configured lifetimes) and is redacted in Inspect, as is the user identifier.

Session validation outcome. A refreshed_cookie (redacted in Inspect) re-issues the session cookie with the same Set-Cookie settings on a no-store response; nil means the presented cookie stays. The user identifier is also redacted in Inspect.