provider/credentials.aug
OpenID Connect login application · Source and specification
Files in this project
main.augclient/contracts.augclient/endpoints.augclient/export.augclient/login.augclient/logout.augclient/protocol.augclient/session.augclient/views.augcommon/export.augcommon/headers.augcommon/keys.augcommon/settings.augcommon/views.augprovider/authorization.augprovider/contracts.augprovider/credentials.augprovider/discovery.augprovider/export.augprovider/token.augprovider/userinfo.augprovider/views.aug
Code
// aug-spec: "credentials.aug.md" explains this file. Read it before changes; refresh with aug spec.
import Crypto from crypto
/** One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. */
verifyCredentials(string username, string password, resolve Crypto crypto):
if username.length() > 64 or password.length() > 256:
return false
actual = crypto.passwordHash(
password=password.bytes(),
salt="August demo salt v1".bytes(),
iterations=600000
)
expected = crypto.decodeBase64url(input="s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A")
userMatches = crypto.equal(left=username.bytes(), right="ada".bytes())
passwordMatches = crypto.equal(left=actual, right=expected)
return userMatches and passwordMatches// aug-spec: "credentials.aug.md" explains this file. Read it before changes; refresh with aug spec.
import Crypto from crypto
/** One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. */
verifyCredentials(string username, string password, resolve Crypto crypto) {
if username.length() > 64 or password.length() > 256 {
return false
}
actual = crypto.passwordHash(
password=password.bytes(),
salt="August demo salt v1".bytes(),
iterations=600000
)
expected = crypto.decodeBase64url(input="s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A")
userMatches = crypto.equal(left=username.bytes(), right="ada".bytes())
passwordMatches = crypto.equal(left=actual, right=expected)
return userMatches and passwordMatches
}Compiled specification
verifyCredentials · source
One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. It takes username and password as strings. It gets crypto (Crypto) from dependency injection.
It can call Crypto.passwordHash, Crypto.decodeBase64url, and Crypto.equal. Failures can raise CryptoError.
If the byte length of username is greater than 64 or the byte length of password is greater than 256, it returns false. It sets actual to crypto.passwordHash with password from the UTF-8 bytes of password, salt from the UTF-8 bytes of "August demo salt v1", and iterations 600000. It sets expected to crypto.decodeBase64url with input "s70USYF6WohPz2f7VLA9haS_ZgEtenviSf_HG0o7B_A". It sets userMatches to crypto.equal with left from the UTF-8 bytes of username and right from the UTF-8 bytes of "ada". source
It sets passwordMatches to crypto.equal with left from actual and right from expected. It returns userMatches and passwordMatches. source
Checked interface
verifyCredentials(string username, string password, resolve Crypto crypto) returns bool unless CryptoError uses Crypto.passwordHash, Crypto.decodeBase64url, Crypto.equalIt takes username and password as strings. It gets crypto (Crypto) from dependency injection. It can call Crypto.passwordHash, Crypto.decodeBase64url, and Crypto.equal. Failures can raise CryptoError.
Dependencies
It uses Crypto (decodeBase64url, equal, and passwordHash) from crypto.
Built-in operations follow the language reference.