Accounts: who may sign in, their password hashes, two-factor, invites, and
the signed cookie that keeps them signed in (the SDK's accounts/auth.ts).
An app turns them on with Runlight.routes(rl, accounts: true).
The owner can do everything, and nobody else can remove them or change their role; they can hand ownership to an admin. An admin can do everything the owner can apart from that. A member changes sites, goals, links, and the rest, but not people, the mail service, the assistant's settings, or deleting a site. A viewer reads every site's stats and changes nothing.
A user is a JavaScript object: id, email, hash, role, createdAt, twoFactor, and recoveryLeft, and signedOut once the account has signed out.
Summary
Functions
Turns an invite into an account with the password its person chose. The link then stops working. It takes a turn, so it cannot cross a removal of whoever sent it, and the sender must still be someone who may invite.
Drops a set-up left half done, after too many wrong codes, so it must start again with the password.
Checks a six-digit code, or a recovery code, for an account with two-factor on. A code works once: one already used, or older, is refused, and a recovery code is crossed off. One check at a time per account here, and the database has the last word, since another process does not wait.
Turns two-factor on once a code from the new secret checks out, and returns ten recovery codes, shown once.
A long-lived mark for a browser that signed in to an account. A new password withdraws it.
Ends every session an account has, in every browser, as signing out does.
Removes the accounts and invitations kept to a site that was deleted. A site made later is often given the same id, from its domain, and they must not find their way into it.
The account a sign-in link is for. A link works once: using it withdraws it, and every link sent before it.
The account a code-step ticket names.
The signed-in user for a cookie value, or nil.
Makes an admin the owner, and the owner an admin.
Invites someone to join with a role, and returns the invite and the code for their link. Asking again replaces the earlier invite.
The invite a link's code belongs to, while it still works.
How long an invite link works.
Invites that still work, newest first. Expired ones are cleared on the way.
A ticket for a sign-in link sent by email, for fifteen minutes. A new password withdraws it.
The shortest password taken.
Accounts in an instance's database, signing with secret.
New recovery codes in place of the old ones.
A short-lived ticket naming an account whose password checked out and which still owes a code.
Removes an account. The owner cannot be removed.
The session cookie's name.
A cookie value naming the user and when it expires, signed with the server's secret and the user's password hash, so changing a password signs out every other browser.
Thirty days, renewed on every sign-in.
Makes an account, or sets a new password on an existing one. A new account is the owner when it is the first, and otherwise an admin unless a role is given, since a server has one owner.
Changes a role. The owner's never changes here, and nobody becomes the owner here: see hand_over/3.
The account for an email and password, or nil. Takes the same time either way. Only a few checks run at once; with too many waiting it raises an AccountError coded "busy".
Starts turning on two-factor: a new secret, kept aside until a code from it is confirmed.
Types
Functions
Turns an invite into an account with the password its person chose. The link then stops working. It takes a turn, so it cannot cross a removal of whoever sent it, and the sender must still be someone who may invite.
Drops a set-up left half done, after too many wrong codes, so it must start again with the password.
Checks a six-digit code, or a recovery code, for an account with two-factor on. A code works once: one already used, or older, is refused, and a recovery code is crossed off. One check at a time per account here, and the database has the last word, since another process does not wait.
Turns two-factor on once a code from the new secret checks out, and returns ten recovery codes, shown once.
A long-lived mark for a browser that signed in to an account. A new password withdraws it.
Ends every session an account has, in every browser, as signing out does.
Removes the accounts and invitations kept to a site that was deleted. A site made later is often given the same id, from its domain, and they must not find their way into it.
The account a sign-in link is for. A link works once: using it withdraws it, and every link sent before it.
The account a code-step ticket names.
The signed-in user for a cookie value, or nil.
Makes an admin the owner, and the owner an admin.
Invites someone to join with a role, and returns the invite and the code for their link. Asking again replaces the earlier invite.
The invite a link's code belongs to, while it still works.
How long an invite link works.
Invites that still work, newest first. Expired ones are cleared on the way.
A ticket for a sign-in link sent by email, for fifteen minutes. A new password withdraws it.
The shortest password taken.
@spec new(Runlight.t(), String.t()) :: t()
Accounts in an instance's database, signing with secret.
New recovery codes in place of the old ones.
A short-lived ticket naming an account whose password checked out and which still owes a code.
Removes an account. The owner cannot be removed.
The session cookie's name.
A cookie value naming the user and when it expires, signed with the server's secret and the user's password hash, so changing a password signs out every other browser.
Thirty days, renewed on every sign-in.
Makes an account, or sets a new password on an existing one. A new account is the owner when it is the first, and otherwise an admin unless a role is given, since a server has one owner.
Changes a role. The owner's never changes here, and nobody becomes the owner here: see hand_over/3.
The account for an email and password, or nil. Takes the same time either way. Only a few checks run at once; with too many waiting it raises an AccountError coded "busy".
Starts turning on two-factor: a new secret, kept aside until a code from it is confirmed.