菜单
Auth engine rules for QAuth. Use when working with CredentialProvider implementations, token claim generation, the provider registry, or the federation layer. Enforces the pluggable provider pattern and correct token claim behaviour.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
OAuth 2.1 / OIDC rules for QAuth. Use when working with authorization endpoints, token flows, PKCE, JWKS, OIDC discovery, or spec compliance (RFC 9700, OIDC Core 1.0). Covers endpoint behaviour, email claim rules, and token security.
Database schema rules for QAuth. Use when working with the identity model, Drizzle ORM, migrations, repositories, or claim resolution. Reflects the CURRENT shipped schema — the identifier-abstraction model (ADR-002, IMPLEMENTED via Epic
Link GitHub issues in parent-child (sub-issue) relationships using GraphQL
Add a GitHub issue to a project board using gh project item-add
Create a new GitHub issue following QAuth project conventions using gh issue create
Create a pull request following QAuth conventions with gh pr create
| name | auth-engine |
| description | Auth engine rules for QAuth. Use when working with CredentialProvider implementations, token claim generation, the provider registry, or the federation layer. Enforces the pluggable provider pattern and correct token claim behaviour. |
You are working in the QAuth authentication core.
Every authentication method implements the CredentialProvider interface:
// libs/server/federation/src/providers/credential-provider.interface.ts
export interface CredentialProvider {
readonly type: string;
verify(input: unknown): Promise<VerifiedIdentity>;
extractAttributes(result: VerifiedIdentity): UserAttribute[];
}
The auth engine:
user_credentials by (realm_id, provider_type, external_sub)provider.verify()VerifiedIdentityuser_attributes from provider.extractAttributes()sub = users.idThe engine does not contain provider-specific logic. Switch/case on provider_type
belongs only in the provider registry, not in service routes.
PasswordProvider (provider_type: 'password') — Phase 1, COMPLETE
libs/server/federation/src/providers/password.provider.tsexternalSub is the normalized email addressassuranceLevel: 'low' — no acr claim in tokensWalletProvider (provider_type: 'wallet') — T4, IN PROGRESS (Epic #231)
libs/server/federation/src/providers/wallet.provider.tsverify() throws by design until a validated OID4VP presentation exists — proving key possession is not authentication (see #233); do not wire it into a login path yetsub: always users.id (UUID) — never email, never external_subemail: from user_attributes WHERE attr_key='email' AND verified=true, highest-trust source
OMIT entirely if no verified email — do not set nullacr: eIDAS assurance level from VerifiedIdentity.assuranceLevel
Omit for password credentials (assuranceLevel: 'low' → no acr claim)user_attributes, same trust-ordered resolution// Claim resolution order by source trust level
// wallet > oidc_* > self_reported
const emailAttr = await fastify.repositories.userAttributes.findVerifiedByUserIdAndKey(
userId,
'email'
);
// Returns undefined if no verified email → omit claim from token
All signing, hashing, and key operations go through libs/server/jwt/ and libs/server/password/.
Never implement crypto directly in TypeScript service code.
The libs/server/password/ library wraps Argon2id for password hashing — use it via
the passwordHasher Fastify decorator. Do not call Argon2 directly.
response_type=vp_token,
which excludes the Self-Issued ID Token. Do not implement SIOPv2. See
ADR-004 § Spec status (2026-07-20);
profile order is decided (#296 locked): oid4vp-1.0-base first, haip-1.0 second.PasswordProvider is permanent infrastructure, not a legacy path to be deprecated