correio - v0.1.0

correio/passwordless

Independent passwordless evidence. Applications own delivery and sessions.

Types

Challenge

opaque </> 
pub opaque type Challenge(a)

ConfigError

</> 
pub type ConfigError {
  InvalidBinding
  WeakKey
  InvalidPolicy
  InvalidCodeLength
}

Constructors 

  • InvalidBinding
  • WeakKey
  • InvalidPolicy
  • InvalidCodeLength

IssueError

</> 
pub type IssueError(a) {
  InvalidIssue(ConfigError)
  IssueFailed(store.Fault)
  IssueUnknown(IssueRecovery(a))
}

Constructors

IssueRecovery

opaque </> 
pub opaque type IssueRecovery(a)

Method

</> 
pub type Method {
  MagicLink
  EmailCode(digits: Int)
}

Constructors 

  • MagicLink
  • EmailCode(digits: Int)

RevokeError

</> 
pub type RevokeError(a) {
  RevokeRefused(store.Refusal)
  RevokeFailed(store.Fault)
  RevokeUnknown(RevokeRecovery(a))
}

Constructors

RevokeRecovery

opaque </> 
pub opaque type RevokeRecovery(a)

Service

opaque </> 
pub opaque type Service(a)

Verified

opaque </> 
pub opaque type Verified(a)

VerifyError

</> 
pub type VerifyError(a) {
  Refused(store.Refusal)
  VerifyFailed(store.Fault)
  VerifyUnknown(VerifyRecovery(a))
}

Constructors

VerifyRecovery

opaque </> 
pub opaque type VerifyRecovery(a)

Values

authenticated_at

</> 
pub fn authenticated_at(evidence: Verified(a)) -> Int

challenge_answer

</> 
pub fn challenge_answer(challenge: Challenge(a)) -> String

Secret projection for explicit delivery only. Do not log this value.

challenge_expires_at

</> 
pub fn challenge_expires_at(challenge: Challenge(a)) -> Int

challenge_id

</> 
pub fn challenge_id(challenge: Challenge(a)) -> String

describe_issue_error

</> 
pub fn describe_issue_error(error: IssueError(a)) -> String

Use these descriptions for ordinary logs. Runtime inspection of opaque values can reveal keys, answers, subjects, and recovery commands.

describe_revoke_error

</> 
pub fn describe_revoke_error(error: RevokeError(a)) -> String

describe_verify_error

</> 
pub fn describe_verify_error(error: VerifyError(a)) -> String

destination

</> 
pub fn destination(evidence: Verified(a)) -> String

issue

</> 
pub fn issue(
  service: Service(a),
  subject: a,
  destination: String,
  method: Method,
) -> Result(Challenge(a), IssueError(a))

new

</> 
pub fn new(
  store: store.Store(a),
  scope: String,
  purpose: String,
  key: BitArray,
) -> Result(Service(a), ConfigError)

The key must contain at least 32 cryptographically random bytes. Keep it stable across service instances that share a store and its retained rows.

purpose

</> 
pub fn purpose(evidence: Verified(a)) -> String

recover_issue

</> 
pub fn recover_issue(
  recovery: IssueRecovery(a),
) -> Result(Challenge(a), IssueError(a))

recover_revoke

</> 
pub fn recover_revoke(
  recovery: RevokeRecovery(a),
) -> Result(Nil, RevokeError(a))

recover_verify

</> 
pub fn recover_verify(
  recovery: VerifyRecovery(a),
) -> Result(Verified(a), VerifyError(a))

revoke

</> 
pub fn revoke(
  service: Service(a),
  id: String,
) -> Result(Nil, RevokeError(a))

scope

</> 
pub fn scope(evidence: Verified(a)) -> String

subject

</> 
pub fn subject(evidence: Verified(a)) -> a

verification_id

</> 
pub fn verification_id(evidence: Verified(a)) -> String

verify

</> 
pub fn verify(
  service: Service(a),
  id: String,
  destination: String,
  answer: String,
) -> Result(Verified(a), VerifyError(a))

Destination must be the current trusted application-selected value. Exact comparison is intentional; this module does not normalize email addresses.

with_policy

</> 
pub fn with_policy(
  service: Service(a),
  ttl_ms: Int,
  max_attempts: Int,
  retention_ms: Int,
) -> Result(Service(a), ConfigError)

Milliseconds. TTL is bounded at 24h, attempts at 100, retention at 30 days.

✨ Search Document