# datadeft_auth v0.6.1 - Table of Contents

> Framework-independent authentication through an isolated Rust process

## Pages

- [datadeft_auth](readme.md)

## Modules

- [DatadeftAuth](DatadeftAuth.md): Framework-independent authentication using a supervised, separate Rust process.
- [DatadeftAuth.DevMagicLink](DatadeftAuth.DevMagicLink.md): Fake-mode test helper result: the newest outbox email's landing URL for an
address. The URL carries the bearer token and is redacted in `Inspect`.
Never available outside `mode: :fake`.

- [DatadeftAuth.Error](DatadeftAuth.Error.md): A redacted operational error. Codes are internal diagnostics, not HTTP responses.
- [DatadeftAuth.FlowState](DatadeftAuth.FlowState.md): Read-only flow state for redirect-landing pages. On `usable: false` the
application clears its confirm cookie. Confirmation and account identity are
redacted in `Inspect`.

- [DatadeftAuth.Landing](DatadeftAuth.Landing.md): Scanner-safe landing outcome. `confirm_cookie` is the temporary flow
state the application stores client-side (HttpOnly cookie); `confirmation`
is the value the confirmation page submits. Both are secrets and are
redacted in `Inspect`, as is the account identity. The answer shape is uniform
for every unusable link.

- [DatadeftAuth.PowChallenge](DatadeftAuth.PowChallenge.md): Proof-of-work challenge in the shipping browser client's wire shape:
serialize it as JSON for the client verbatim. Every field is public data
the client already sees; the HMAC `tag` binds the tuple so none of it can
be altered.

- [DatadeftAuth.PowVerification](DatadeftAuth.PowVerification.md): Solution verification outcome. On `admitted: true`, `proof_cookie`
(redacted in `Inspect`) is the bearer value to set as the `dd_pow` cookie
(HttpOnly, Secure, the configured proof TTL). Every failed check collapses
into one `admitted: false` shape, so the application answers with a single
generic "solve again" response. `mint_to_verify_ms` is the server-derived
solve-timing signal for metrics and risk tagging, never for hard blocking.

- [DatadeftAuth.Session](DatadeftAuth.Session.md): Successful confirmation outcome. `session_cookie` is the bearer session
value (set it HttpOnly, Secure, with the configured lifetimes) and is
redacted in `Inspect`, as is the user identifier.

- [DatadeftAuth.Validation](DatadeftAuth.Validation.md): Session validation outcome. A `refreshed_cookie` (redacted in `Inspect`)
re-issues the session cookie with the same `Set-Cookie` settings on a
`no-store` response; nil means the presented cookie stays. The user identifier
is also redacted in `Inspect`.