andy
3de6e53ab0
Foundation for the persistent, inspectable cognitive runtime: README, implementation plan with phases and risk register, architecture, security model, threat model, contributing guide, eight ADRs covering the global workspace, event immutability, memory representation, LLM abstraction, capability system, authentication, frontend and storage. Includes Makefile, env example, compose stack (pgvector) and Dockerfile skeleton, plus a record of the development environment assumptions.
19 lines
1.3 KiB
Markdown
19 lines
1.3 KiB
Markdown
# ADR-0006: Local authentication design
|
|
|
|
Date: 2026-09-14
|
|
Status: Accepted
|
|
|
|
## Context
|
|
The admin interface controls a system that can act on infrastructure. It needs strong local authentication first, with room for OIDC.
|
|
|
|
## Decision
|
|
Argon2id (64 MiB, t=3, p=2, 16-byte salt) password hashes; opaque 256-bit session tokens stored as SHA-256 hashes with idle and absolute expiry; cookies `HttpOnly; SameSite=Lax; Path=/` and `Secure` outside development; per-session CSRF token checked on all state-changing cookie-authenticated requests plus Origin check; login limiter per IP (token bucket) and per account (exponential backoff persisted in the database); optional TOTP (RFC 6238, implemented with stdlib HMAC) with hashed recovery codes; session listing and revocation; roles `administrator`, `operator`, `observer` enforced by route middleware. Personal API tokens (hashed, role-bound) authenticate `noemactl` and scripts. `auth.Authenticator` is an interface so OIDC can be added.
|
|
|
|
## Consequences
|
|
- No third-party auth dependencies beyond `x/crypto`.
|
|
- First-run bootstrap admin from environment or `noemactl user create`.
|
|
|
|
## Alternatives considered
|
|
- OIDC-only: blocks single-operator deployments.
|
|
- JWT sessions: revocation and listing become awkward; opaque tokens are simpler and safer.
|