Module accounts

Installation persistence facade for the independent account domain.

Identities, roles, credential policy and revocable client keys belong to aede-accounts. This adapter retains bounded private-file access, the existing JSON parser, atomic writes and compatibility with full backups. Callers hold the data-directory writer lock for read/modify/save operations.

Structs

Account

An account with an immutable personal-data owner and private verifier.

Accounts

Independently versioned account store; an empty store is never published.

ApiKey

Safe public metadata for an independently revocable API credential. The owner, credential generation and salted verifier stay private.

Enums

Role

Installation privileges; every account may access only its own opinions.

Constants

ACCOUNTS_FILE

Account store inside the data directory.

FORMAT_VERSION

Account-store format, independent of the catalog and personal stores.

LOCAL_OWNER

Stable owner of the installation’s first administrator and legacy personal data.

MAX_ACCOUNTS

Maximum number of accounts in one installation.

MAX_API_KEYS

Maximum number of persistent API keys in one installation.

MAX_API_KEYS_PER_ACCOUNT

Maximum number of persistent API keys belonging to one account.

MAX_API_KEY_LABEL_BYTES

Maximum UTF-8 label length, measured before any presentation escaping.

MAX_PASSWORD_BYTES

Maximum accepted UTF-8 password length in bytes.

Functions

accounts_path

Build the private credential-store path.

check_private_file

Refuse links, special files and Unix credentials readable by other users. An absent destination is accepted for a new atomic write.

from_json

Refuse malformed, duplicate or administrator-less credentials as one whole store. The independent domain retains the bounded hash policy and numeric contract.

load

Read a bounded private account file; initial absence is distinct from malformed data. The opened descriptor is rechecked for regular-file type and private Unix permissions, including device/inode identity on Unix. Disappearance after inspection is an error, so it cannot silently disable authentication.

login_name

Validate and canonicalize a login name without treating it as a path or owner. Accept 1–64 ASCII letters, digits, dots, underscores or hyphens, with at least one letter or digit. The canonical spelling is lowercase.

random_token

Generate an opaque 256-bit secret from the operating system’s secure RNG. Failures are reported; there is no timestamp or deterministic fallback.

save

Save credentials atomically, preserving private permissions and validating all rows. The caller must hold the existing data-directory writer lock.

to_json

Serialize the credential store for protected persistence and full backups only. Never expose this document as an account-list or catalog API response.