Authentication — current state¶
Version: 0.2 · Last Updated: 2026-09-08 · Status: 🔴 evidence refreshed; design ratification unchanged
Verified against source revision 2465fcc (develop baseline). Test references
below identify the executable contracts; they are not a new coverage percentage.
Credential precedence¶
AuthCore verifies configured Basic, static Bearer and JWT credentials.
gak_ API keys use the API-key store and never fall through to JWT on a miss.
A present invalid Authorization header raises HTTPUnauthorized; it does not
fall back to a logged-in session. AuthMixin.authenticate uses the session's
root avatar only when no Authorization header is supplied.
The server's local user and token stores are optional. Configured store
descriptors use storage nodes; a ready store can be supplied directly.
Bootstrap admin configuration upserts that account at boot. Password login and
OIDC methods live on ServerApplication and attach an avatar in place. OIDC
configuration requires a declared external_url at server construction.
Claim anchors: AuthCore, AuthMixin, authenticate, authenticate, ServerApplication.
Authorization and hosted-site identity¶
RoutedApplication passes avatar tags to the auth plugin: unknown identity
receives 401, insufficient tags receive 403. The error middleware negotiates
the login challenge. The monitor declares SERVER_ADMIN; users, tokens and tasks declare
SUPERADMIN. Login endpoints are public.
A hosted site's connection-user change updates the SPA pool's indexes. It does not implement the separately recorded return-path conversion into a core session avatar with server-configured tags. That bridge/session work remains a distinct target.
Claim anchors: RoutedApplication.
Behavior evidence: MonitorSection, UsersSection, TokensSection, TasksSection.