auth-password
Email and password. The oldest login method, and the only one where a stranger can simply keep guessing.
As a git dependency
cargo add cratefield-auth-password --git https://github.com/Cratefield/harnessIn the repository, not on crates.io yet.
What it is
auth-password.
Register, log in, change a password. Most of the crate is about the part that makes this method different from every other one here: a stranger can sit and guess, so registration and login answer the same way whatever the account state, and the lockout columns live on the credential rather than in a cache that forgets.
It requires the paid Workers plan, and that is a measurement rather than a preference. ADR 0200 timed Argon2id at the parameters this uses (m=19456, t=2, p=1) at roughly 40 ms per hash or verify on Workers. The free tier allows 10 ms of CPU, which cannot fit one verify at any sane parameters. Weakening the parameters to fit is the trade this crate refuses to make.
Ports
Database · Clock · IdGen · RateLimiter, Captcha and HttpClient optional
Routes
/v1/auth-password
- POST
/v1/auth-password/register - POST
/v1/auth-password/login - POST
/v1/auth-password/change
The breach check
The optional HttpClient is for one thing: telling somebody their new password is already in a public breach corpus. Without it the module runs; the check is the part a deployment can decline.
Tables
None of its own. auth-core owns every table it touches, including the lockout columns on credentials.
History
Changelog.
Not released on its own: it is taken from the repository as a git dependency, and has no CHANGELOG.md yet.
A password is the method a passkey exists to replace. Both are here.