Malachi.Auth.PasswordProvider (malachi v0.8.13)

View Source

The username/password authentication provider: the built-in Malachi.Auth.AuthProvider.

Wraps the session-less credential check (Malachi.Auth.verify_credentials/2) so the password mechanism fits the same contract as the external providers (mTLS today; OIDC/LDAP later): it resolves credentials to an identity (%{username, permissions}) and lets the boundary mint the session. It does not log or audit: that stays with the boundary, which maps the specific error to a client-facing :invalid_credentials.

Summary

Functions

authenticate(arg, context)

Resolves {username, password} to an identity. context may carry a :verify seam ((username, password -> {:ok, permissions} | {:error, reason}), default Auth.verify_credentials/2) for testing. Returns {:ok, %{username, permissions}} or {:error, :invalid_password | :user_not_found}.

Functions

authenticate(arg, context)

Resolves {username, password} to an identity. context may carry a :verify seam ((username, password -> {:ok, permissions} | {:error, reason}), default Auth.verify_credentials/2) for testing. Returns {:ok, %{username, permissions}} or {:error, :invalid_password | :user_not_found}.