Auth

📄️Log in with email/password (local provider)

Validates credentials against the `local` provider matching the email's domain. On success either issues access/refresh cookies directly, or (if MFA is enabled/required) issues a restricted `safebucket_mfa_token` cookie and returns `mfa_required: true`.

📄️Verify an access token and return its claims

Verify an access token and return its claims

📄️Exchange a refresh token for a new access token

Reads the refresh token from the `safebucket_refresh_token` cookie, falling back to the `Authorization: Bearer` header. Sets a new `safebucket_access_token` cookie on success.

📄️Log out and revoke the current session

Clears all auth cookies. Idempotent if no refresh cookie/session is present.

📄️Complete login by verifying an MFA TOTP code

Requires the restricted `safebucket_mfa_token` (audience `auth:mfa:login`) issued by `/auth/login`. On success issues full access/refresh cookies (or, in the password-reset flow, a fresh restricted MFA-reset cookie).

📄️Get the authenticated user's identity summary

Get the authenticated user's identity summary

📄️Request a password reset code by email

Always returns 201 regardless of whether the email exists (enumeration-safe). If a matching local-provider user exists, a 6-character code is emailed and a password-reset challenge is created (5 min expiry, 3 attempts). Rate-limited per email (3 requests per 1-hour window).

📄️Validate a password-reset code

On success issues a restricted `safebucket_mfa_token` cookie (audience `auth:mfa:password-reset`) used to complete the reset via `/complete`, optionally after an MFA step-up if the account has MFA enabled.

📄️Complete a password reset

Requires the restricted `safebucket_mfa_token` from `/validate` (challenge ID in the JWT must match the path). Revokes all existing sessions and issues new full access/refresh cookies.

📄️List configured auth providers

Used by the login page to render provider buttons.

📄️Begin an OIDC login redirect

Redirects the browser to the OIDC provider's authorization endpoint.

📄️OIDC redirect callback

Exchanges the authorization code, verifies the ID token, then redirects to `app.web_url` with auth (or MFA) cookies set. Creates the user on first login if allowed by the provider's domain restrictions.