- webauthn: the passkey ceremony service (a fake in tests) - totp: the TOTP authenticator; the secret is AEAD-sealed at rest (A9) - sealer: the AEAD TOTP sealer - identities/sessions/credentials: the GUID state machine - flow: the enroll/login screens + the passkey nudge (pre-session double-submit CSRF — A15), rendered inside the shell |
||
|---|---|---|
| .. | ||
| audit | ||
| auth | ||
| config | ||
| httpx | ||
| middleware | ||
| routing | ||
| server | ||
| store | ||
| users | ||