@greenpandastudios/aug-cli 0.19.0 → 0.21.0

package/examples/oidc-login/provider/authorization.aug

@@ -1,14 +1,15 @@
+// aug-spec: "authorization.aug.md" explains this file. Read it before changes; refresh with aug spec.
 import AuthorizationRequest and AuthorizationCode and LoginForm and LoginError from contracts
 import ProviderLogin and ProviderFailure from views
 import verifyCredentials from credentials
 import settings and securityHeaders and withCookie from common
-import Crypto from august.crypto
-import Clock from august.time
-import ExpiringStore and StoreFull from august.memory
-import urlEncode from august.web
+import Crypto from crypto
+import Clock from time
+import ExpiringStore and StoreFull from memory
+import urlEncode from web
 
 /** Validate the registered client before offering a login form. A malformed redirect is never followed. */
-endpoint GET "/provider/authorize" as authorize(string response_type from query, string client_id from query, string redirect_uri from query, string requestedScope from query "scope", string state from query, string nonce from query, string code_challenge from query, string code_challenge_method from query, resolve Crypto crypto, resolve Clock clock, resolve ExpiringStore<AuthorizationRequest> requests) returns HttpResponse<Html> uses crypto.random and crypto.decodeBase64url and clock.now and requests.put unless LoginError with status 400 and CryptoError with status 503 and TimeError with status 503 and StoreFull with status 503 and HttpError:
+endpoint GET "/provider/authorize" as authorize(string response_type from query, string client_id from query, string redirect_uri from query, string requestedScope from query "scope", string state from query, string nonce from query, string code_challenge from query, string code_challenge_method from query, resolve Crypto crypto, resolve Clock clock, resolve ExpiringStore<AuthorizationRequest> requests) unless LoginError with status 400 and CryptoError with status 503 and TimeError with status 503 and StoreFull with status 503 and HttpError:
     config = settings()
     if client_id != config.clientId or redirect_uri != config.callback or response_type != "code" or code_challenge_method != "S256":
         throw LoginError()
@@ -31,7 +32,7 @@ endpoint GET "/provider/authorize" as authorize(string response_type from query,
     return HttpResponse(body=ProviderLogin(requestId, csrf, message="Authorize the registered August login app.", submit=handle providerLogin(input from form)), headers=headers)
 
 /** The browser binding and CSRF token are checked before credentials. Each form request is consumed once. */
-endpoint POST "/provider/login" as providerLogin(LoginForm form from form, optional string browser from cookie "aug_authorize", optional string origin from header "origin", resolve Crypto crypto, resolve Clock clock, resolve ExpiringStore<AuthorizationRequest> requests, resolve ExpiringStore<AuthorizationCode> codes) returns HttpResponse<Html> uses crypto.equal and crypto.random and crypto.passwordHash and crypto.decodeBase64url and clock.now and requests.take and codes.put unless CryptoError with status 503 and TimeError with status 503 and StoreFull with status 503 and HttpError:
+endpoint POST "/provider/login" as providerLogin(LoginForm form from form, optional string browser from cookie "aug_authorize", optional string origin from header "origin", resolve Crypto crypto, resolve Clock clock, resolve ExpiringStore<AuthorizationRequest> requests, resolve ExpiringStore<AuthorizationCode> codes) unless CryptoError with status 503 and TimeError with status 503 and StoreFull with status 503 and HttpError:
     config = settings()
     try:
         if origin != config.baseUrl:

package/examples/oidc-login/provider/authorization.aug.md

@@ -1,264 +1,49 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `authorization.aug` specification
+# `authorization.aug`
 
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
-
-## In this file
-
-- [`authorize`](authorization.aug.md#symbol-authorize) handles `GET` `/provider/authorize` returning `HttpResponse<Html>`.
-- [`providerLogin`](authorization.aug.md#symbol-providerLogin) handles `POST` `/provider/login` returning `HttpResponse<Html>`.
+Plain handler results default to HTTP 200 unless another status is declared. HttpResponse values choose their own status. Unhandled request failures return HTTP 500 and cancel the request tasks.
 
 <a id="symbol-authorize"></a>
+## `authorize` · [source](authorization.aug#L12)
 
-## `authorize`
-
-[source](authorization.aug#L11)
-
-**Inputs**
-
-- `response_type` (`string`) — read from the HTTP query.
-- `client_id` (`string`) — read from the HTTP query.
-- `redirect_uri` (`string`) — read from the HTTP query.
-- `requestedScope` (`string`) — read from the HTTP query named `scope`.
-- `state` (`string`) — read from the HTTP query.
-- `nonce` (`string`) — read from the HTTP query.
-- `code_challenge` (`string`) — read from the HTTP query.
-- `code_challenge_method` (`string`) — read from the HTTP query.
-- `crypto` ([`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)) — injected; callers omit it.
-- `clock` ([`Clock`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock)) — injected; callers omit it.
-- `requests` ([`ExpiringStore<AuthorizationRequest>`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)) — injected; callers omit it.
-
-Returns: `HttpResponse<Html>`.
-
-Capabilities: [`crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random), [`crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url), [`clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now), [`requests.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put).
-
-Can fail with `LoginError`, `CryptoError`, `TimeError`, `StoreFull`, `HttpError`. Callers must catch or propagate these errors.
+`authorize` handles `GET /provider/authorize`. Validate the registered client before offering a login form. A malformed redirect is never followed.
 
-HTTP route: `GET` `/provider/authorize`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
+It reads `response_type`, `client_id`, `redirect_uri`, `scope`, `state`, `nonce`, `code_challenge`, and `code_challenge_method` from the HTTP query. `scope` is called `requestedScope` here. It gets `crypto` ([`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto)), `clock` ([`Clock`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock)), and `requests` ([`ExpiringStore<AuthorizationRequest>`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore)) from dependency injection. The handler responds with HTTP 400 for [`LoginError`](contracts.aug.md#symbol-LoginError), HTTP 503 for `CryptoError`, HTTP 503 for `TimeError`, and HTTP 503 for [`StoreFull`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-StoreFull).
 
-Declared HTTP failures: [`LoginError`](contracts.aug.md#symbol-LoginError) returns status 400; `CryptoError` returns status 503; `TimeError` returns status 503; [`StoreFull`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-StoreFull) returns status 503.
+It can also raise `HttpError`. It gets `config` from [`settings`](../common/settings.aug.md#symbol-settings). It checks that `client_id` equals `config.clientId` and `redirect_uri` equals `config.callback` and `response_type` equals `"code"` and `code_challenge_method` equals `"S256"`, `requestedScope` is either `"openid"` or `"openid profile"`, and `state` is a URL-safe ASCII token with `43` to `128` characters and `nonce` is a URL-safe ASCII token with `43` to `128` characters and the byte length of `code_challenge` equals `43`. It raises a [`LoginError`](contracts.aug.md#symbol-LoginError) at the first failed check.
 
-**What it does**
+It checks that the byte length of [`crypto.decodeBase64url`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.decodeBase64url) with `input` from `code_challenge` equals `32`. It raises a [`LoginError`](contracts.aug.md#symbol-LoginError) at the first failed check. If this work raises `CryptoError`, it raises a [`LoginError`](contracts.aug.md#symbol-LoginError). It sets `requestId`, `browser`, and `csrf` separately, each to the URL-safe base64 encoding of [`crypto.random`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.random) with `size` `32`.
 
-- Set `config` to call [`settings`](../common/settings.aug.md#symbol-settings).
-- If (((`client_id` does not equal `clientId` of `config`) or (`redirect_uri` does not equal `callback` of `config`)) or (`response_type` does not equal `"code"`)) or (`code_challenge_method` does not equal `"S256"`):
-  - Fail with call [`LoginError`](contracts.aug.md#symbol-LoginError). Transfer control to a matching catch or propagate the failure.
-- If (`requestedScope` does not equal `"openid"`) and (`requestedScope` does not equal `"openid profile"`):
-  - Fail with call [`LoginError`](contracts.aug.md#symbol-LoginError). Transfer control to a matching catch or propagate the failure.
-- If (not (call `isToken` on `state` with `min` = `43`; `max` = `128`) or not (call `isToken` on `nonce` with `min` = `43`; `max` = `128`)) or (call `length` on `code_challenge` does not equal `43`):
-  - Fail with call [`LoginError`](contracts.aug.md#symbol-LoginError). Transfer control to a matching catch or propagate the failure.
-- Try these operations:
-  - If call `length` on call [`Crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url) on `crypto` with `input` = `code_challenge` does not equal `32`:
-    - Fail with call [`LoginError`](contracts.aug.md#symbol-LoginError). Transfer control to a matching catch or propagate the failure.
-- If they fail with `CryptoError`, name the failure `error` and recover:
-  - Fail with call [`LoginError`](contracts.aug.md#symbol-LoginError). Transfer control to a matching catch or propagate the failure.
-- Set `requestId` to call `base64url` on call [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) on `crypto` with `size` = `32`.
-- Set `browser` to call `base64url` on call [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) on `crypto` with `size` = `32`.
-- Set `csrf` to call `base64url` on call [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) on `crypto` with `size` = `32`.
-- Set `now` to call [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) on `clock`.
-- Set `request` to call [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest) with `clientId` = `client_id`; `redirectUri` = `redirect_uri`; `state` = `state`; `nonce` = `nonce`; `challenge` = `code_challenge`; `browser` = `browser`; `csrf` = `csrf`; `expires` = (`now` plus `300`).
-- Call [`ExpiringStore.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put) on `requests` with `key` = `requestId`; `value` = `request`; `expires` = `expires` of `request`; `now` = `now`.
-- Set `headers` to call [`withCookie`](../common/headers.aug.md#symbol-withCookie) with `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders); `name` = `"aug_authorize"`; `value` = `browser`; `path` = `"/provider"`; `maxAge` = `300`; `secure` = `secureCookies` of `config`.
-- Return call `HttpResponse` with `body` = call [`ProviderLogin`](views.aug.md#symbol-ProviderLogin) with `requestId` = `requestId`; `csrf` = `csrf`; `message` = `"Authorize the registered August login app."`; `submit` = a deferred HTTP form action for [`providerLogin`](authorization.aug.md#symbol-providerLogin); inputs: `1` from the checked form input supplied when the HTTP form is submitted; capture supplied values when rendering, and read form inputs when submitted; send the form to that endpoint with its declared HTTP method; `headers` = `headers`.
+It sets `now` to [`clock.now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now). It sets `request` to an [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest) with `clientId` from `client_id`, `redirectUri` from `redirect_uri`, `state`, `nonce`, `challenge` from `code_challenge`, `browser`, `csrf`, and `expires` from `now` plus `300`. It calls [`requests.put`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.put) with `key` from `requestId`, `value` from `request`, `request.expires`, and `now`. It sets `headers` to [`withCookie`](../common/headers.aug.md#symbol-withCookie) with `headers` from [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders), `name` `"aug_authorize"`, `value` from `browser`, `path` `"/provider"`, `maxAge` `300`, and `secure` from `config.secureCookies`.
 
-**Author documentation**
-
-Validate the registered client before offering a login form. A malformed redirect is never followed.
+It returns HTTP 200 with [`ProviderLogin`](views.aug.md#symbol-ProviderLogin) with `requestId`, `csrf`, `message` `"Authorize the registered August login app."`, and `submit` from a form action that sends `POST /provider/login` to [`providerLogin`](authorization.aug.md#symbol-providerLogin) on submission and `headers` headers.
 
 <a id="symbol-providerLogin"></a>
+## `providerLogin` · [source](authorization.aug#L35)
 
-## `providerLogin`
-
-[source](authorization.aug#L34)
-
-**Inputs**
-
-- `form` ([`LoginForm`](contracts.aug.md#symbol-LoginForm)) — read from the HTTP form.
-- `browser` (`optional string`) — read from the HTTP cookie named `aug_authorize`; absent value becomes null.
-- `origin` (`optional string`) — read from the HTTP header named `origin`; absent value becomes null.
-- `crypto` ([`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)) — injected; callers omit it.
-- `clock` ([`Clock`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock)) — injected; callers omit it.
-- `requests` ([`ExpiringStore<AuthorizationRequest>`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)) — injected; callers omit it.
-- `codes` ([`ExpiringStore<AuthorizationCode>`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)) — injected; callers omit it.
-
-Returns: `HttpResponse<Html>`.
-
-Capabilities: [`crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal), [`crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random), [`crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash), [`crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url), [`clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now), [`requests.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take), [`codes.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put).
-
-Can fail with `CryptoError`, `TimeError`, `StoreFull`, `HttpError`. Callers must catch or propagate these errors.
-
-HTTP route: `POST` `/provider/login`. Use status 200 when the handler returns a body; a returned HttpResponse can set its own status. An unhandled request failure returns status 500 and cancels its request tasks.
-
-Declared HTTP failures: `CryptoError` returns status 503; `TimeError` returns status 503; [`StoreFull`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-StoreFull) returns status 503.
-
-**What it does**
-
-- Set `config` to call [`settings`](../common/settings.aug.md#symbol-settings).
-- Try these operations:
-  - If `origin` does not equal `baseUrl` of `config`:
-    - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The sign-in form must come from this app."`; `status` = `403`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-  - Select the matching case for call [`ExpiringStore.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take) on `requests` with `key` = `request_id` of `form`; `now` = call [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) on `clock`:
-    - A null value, including omitted optional input:
-      - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The sign-in request expired or was already used."`; `status` = `400`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-    - A present, non-null value, named `request`:
-      - Select the matching case for `browser`:
-        - A null value, including omitted optional input:
-          - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The browser binding is missing."`; `status` = `403`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-        - A present, non-null value, named `secret`:
-          - If not (call [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) on `crypto` with `left` = call `bytes` on `secret`; `right` = call `bytes` on `browser` of `request`) or not (call [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) on `crypto` with `left` = call `bytes` on `csrf` of `form`; `right` = call `bytes` on `csrf` of `request`):
-            - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The sign-in form could not be verified."`; `status` = `403`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-      - If not (call [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials) with `username` = `username` of `form`; `password` = `password` of `form`; inject `crypto` from `crypto`):
-        - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The username or password was not accepted."`; `status` = `401`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-      - Set `now` to call [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) on `clock`.
-      - Set `code` to call `base64url` on call [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) on `crypto` with `size` = `32`.
-      - Set `grant` to call [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode) with `clientId` = `clientId` of `request`; `redirectUri` = `redirectUri` of `request`; `challenge` = `challenge` of `request`; `nonce` = `nonce` of `request`; `subject` = `"demo-ada"`; `name` = `"Ada"`; `expires` = (`now` plus `60`).
-      - Call [`ExpiringStore.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put) on `codes` with `key` = `code`; `value` = `grant`; `expires` = `expires` of `grant`; `now` = `now`.
-      - Build `location` by joining these text parts without separators, in order:
-        1. `redirectUri` of `request`
-        2. `"?code="`
-        3. call [`urlEncode`](../.aug-spec/august/0.19.0/web/contracts.aug.md#symbol-urlEncode) with `input` = `code`
-        4. `"&state="`
-        5. call [`urlEncode`](../.aug-spec/august/0.19.0/web/contracts.aug.md#symbol-urlEncode) with `input` = `state` of `request`
-      - Set `headers` to call [`withCookie`](../common/headers.aug.md#symbol-withCookie) with `headers` = call `with` on call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) with `name` = `"location"`; `value` = `location`; `name` = `"aug_authorize"`; `value` = `""`; `path` = `"/provider"`; `maxAge` = `0`; `secure` = `secureCookies` of `config`.
-      - Return call `HttpResponse` with `body` = the HTML element `p` containing `Returning to the application.` (rendered on the server with embedded text escaped); `status` = `303`; `headers` = `headers`.
-- If they fail with `HttpError`, name the failure `error` and recover:
-  - Return call `HttpResponse` with `body` = call [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) with `message` = `"The submitted form is invalid."`; `status` = `400`; `headers` = call [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders).
-
-**Author documentation**
-
-The browser binding and CSRF token are checked before credentials. Each form request is consumed once.
-
-## Dependencies used by this file
-
-Only referenced types and operations appear here. Each name links to its complete specification.
-
-### [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto)
-
-Capability interface from `august.crypto`.
-
-- [`Crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url) (`input`: `string`) → `Bytes`; can fail with `CryptoError`.
-- [`Crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal) (`left`: `Bytes`, `right`: `Bytes`) → `bool`.
-- [`Crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash) (`password`: `Bytes`, `salt`: `Bytes`, `iterations`: `int`) → `Bytes`; can fail with `CryptoError`.
-- [`Crypto.random`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.random) (`size`: `int`) → `Bytes`; can fail with `CryptoError`.
-
-### [`ExpiringStore`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore)
-
-Capability interface from `august.memory`.
-
-- [`ExpiringStore.put`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.put) (`key`: `string`, `value`: `T`, `expires`: `int`, `now`: `int`) → `void`; can fail with `StoreFull`.
-- [`ExpiringStore.take`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-ExpiringStore.take) (`key`: `string`, `now`: `int`) → `optional T`.
-
-### [`StoreFull`](../.aug-spec/august/0.19.0/memory/store.aug.md#symbol-StoreFull)
-
-Class from `august.memory`.
-
-Used as a type or provider.
-
-### [`Clock`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock)
-
-Capability interface from `august.time`.
-
-- [`Clock.now`](../.aug-spec/august/0.19.0/time/contracts.aug.md#symbol-Clock.now) (no caller inputs) → `int`; can fail with `TimeError`.
-
-### [`urlEncode`](../.aug-spec/august/0.19.0/web/contracts.aug.md#symbol-urlEncode)
-
-Function from `august.web`.
-
-- [`urlEncode`](../.aug-spec/august/0.19.0/web/contracts.aug.md#symbol-urlEncode) (`input`: `string`) → `string`; can fail with `HttpError`.
-
-### [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders)
-
-Function from `common`.
-
-- [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) (no caller inputs) → `Headers`; can fail with `HttpError`.
-
-### [`withCookie`](../common/headers.aug.md#symbol-withCookie)
-
-Function from `common`.
-
-- [`withCookie`](../common/headers.aug.md#symbol-withCookie) (`headers`: `Headers`, `name`: `string`, `value`: `string`, `path`: `string`, `maxAge`: `int`, `secure`: `bool`) → `Headers`; can fail with `HttpError`.
-
-### [`Settings`](../common/settings.aug.md#symbol-Settings)
-
-Record.
-
-- Read `baseUrl` (`string`).
-- Read `callback` (`string`).
-- Read `clientId` (`string`).
-- Read `secureCookies` (`bool`).
-
-### [`settings`](../common/settings.aug.md#symbol-settings)
-
-Function from `common`.
-
-- [`settings`](../common/settings.aug.md#symbol-settings) (no caller inputs) → [`Settings`](../common/settings.aug.md#symbol-Settings).
-
-### [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode)
-
-Record from `contracts`.
-
-- Construct with `clientId`: `string`, `redirectUri`: `string`, `challenge`: `string`, `nonce`: `string`, `subject`: `string`, `name`: `string`, `expires`: `int` → [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode).
-- Read `expires` (`int`).
-
-### [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest)
-
-Record from `contracts`.
-
-- Construct with `clientId`: `string`, `redirectUri`: `string`, `state`: `string`, `nonce`: `string`, `challenge`: `string`, `browser`: `string`, `csrf`: `string`, `expires`: `int` → [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest).
-- Read `browser` (`string`).
-- Read `challenge` (`string`).
-- Read `clientId` (`string`).
-- Read `csrf` (`string`).
-- Read `expires` (`int`).
-- Read `nonce` (`string`).
-- Read `redirectUri` (`string`).
-- Read `state` (`string`).
-
-### [`LoginError`](contracts.aug.md#symbol-LoginError)
-
-Class from `contracts`.
-
-- Construct with no caller inputs → [`LoginError`](contracts.aug.md#symbol-LoginError).
-
-### [`LoginForm`](contracts.aug.md#symbol-LoginForm)
-
-Record from `contracts`.
-
-- Read `csrf` (`string`).
-- Read `password` (`string`).
-- Read `request_id` (`string`).
-- Read `username` (`string`).
-
-### [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials)
-
-Function from `credentials`.
+`providerLogin` handles `POST /provider/login`. The browser binding and CSRF token are checked before credentials. Each form request is consumed once.
 
-- [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials) (`username`: `string`, `password`: `string`) → `bool`; inject `crypto`: [`Crypto`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto); uses [`crypto.passwordHash`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.passwordHash), [`crypto.decodeBase64url`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.decodeBase64url), [`crypto.equal`](../.aug-spec/august/0.19.0/crypto/contracts.aug.md#symbol-Crypto.equal); can fail with `CryptoError`.
+It takes `form` as [`LoginForm`](contracts.aug.md#symbol-LoginForm) from the HTTP form, `browser` as `optional string` from the HTTP cookie `aug_authorize`, and `origin` as `optional string` from the HTTP header `origin`. It gets `crypto` ([`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto)), `clock` ([`Clock`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock)), `requests` ([`ExpiringStore<AuthorizationRequest>`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore)), and `codes` ([`ExpiringStore<AuthorizationCode>`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore)) from dependency injection. Omitted optional inputs are null. The handler responds with HTTP 503 for `CryptoError`, HTTP 503 for `TimeError`, and HTTP 503 for [`StoreFull`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-StoreFull).
 
-### [`ProviderFailure`](views.aug.md#symbol-ProviderFailure)
+It can also raise `HttpError`.
 
-Function from `views`.
+It gets `config` from [`settings`](../common/settings.aug.md#symbol-settings). If `origin` does not equal `config.baseUrl`, it returns HTTP 403 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The sign-in form must come from this app."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers. It obtains [`requests.take`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.take) with `key` from `form.request_id` and `now` from [`clock.now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now). If no value is found, it returns HTTP 400 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The sign-in request expired or was already used."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers.
 
-- [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) (`message`: `string`) → `Html`.
+The non-null result becomes `request`. If `browser` is null, it returns HTTP 403 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The browser binding is missing."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers. The non-null `browser` becomes `secret`. If [`crypto.equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal) with `left` from the UTF-8 bytes of `secret` and `right` from the UTF-8 bytes of `request.browser` returns false or [`crypto.equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal) with `left` from the UTF-8 bytes of `form.csrf` and `right` from the UTF-8 bytes of `request.csrf` returns false, it returns HTTP 403 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The sign-in form could not be verified."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers.
 
-### [`ProviderLogin`](views.aug.md#symbol-ProviderLogin)
+If [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials) with `form.username` and `form.password` using injected `crypto` returns false, it returns HTTP 401 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The username or password was not accepted."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers. It sets `now` to [`clock.now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now). It sets `code` to the URL-safe base64 encoding of [`crypto.random`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.random) with `size` `32`. It sets `grant` to an [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode) with `request.clientId`, `request.redirectUri`, `request.challenge`, `request.nonce`, `subject` `"demo-ada"`, `name` `"Ada"`, and `expires` from `now` plus `60`.
 
-Function from `views`.
+It calls [`codes.put`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.put) with `key` from `code`, `value` from `grant`, `grant.expires`, and `now`. It builds `location` as the text `{request.redirectUri}?code={urlEncode with input from code}&state={urlEncode with input from request.state}`. It sets `headers` to [`withCookie`](../common/headers.aug.md#symbol-withCookie) with `headers` from [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) with the header `"location"` set to `location`, `name` `"aug_authorize"`, `value` `""`, `path` `"/provider"`, `maxAge` `0`, and `secure` from `config.secureCookies`. It returns HTTP 303 with a paragraph containing `Returning to the application.` with escaped text and `headers` headers.
 
-- [`ProviderLogin`](views.aug.md#symbol-ProviderLogin) (`requestId`: `string`, `csrf`: `string`, `message`: `string`, `submit`: `HttpAction`) → `Html`.
+If this work raises `HttpError`, it returns HTTP 400 with [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) showing `"The submitted form is invalid."` and [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders) headers.
 
-## Built-in operations used by this file
+## Dependencies
 
-- `Bytes.base64url` (no inputs) → `string`: Encode immutable bytes as unpadded RFC 4648 URL-safe base64.
-- `Bytes.length` (no inputs) → `int`: Read the number of elements.
-- `Headers.with` (`name`: `string`, `value`: `string`) → `Headers`: Return new headers with one additional validated field. Header names ignore case; duplicate values remain separate. Can fail with `HttpError`.
-- `string.bytes` (no inputs) → `Bytes`: Encode this string as immutable UTF-8 bytes.
-- `string.isToken` (`min`: `int`, `max`: `int`) → `bool`: Require an ASCII RFC 3986 unreserved token with a bounded length.
-- `string.length` (no inputs) → `int`: Read the number of UTF-8 bytes. Unicode text is preserved losslessly.
+It uses [`ExpiringStore`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore) ([`put`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.put) and [`take`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-ExpiringStore.take)) and [`StoreFull`](../.aug-spec/packages/%40git/url_0eb7c89453c87681ed15/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/store.aug.md#symbol-StoreFull) from `memory`. It uses [`urlEncode`](../.aug-spec/packages/%40git/url_897efafd565158fc4908/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-urlEncode) from `web`. It uses [`Crypto`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto) ([`decodeBase64url`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.decodeBase64url), [`equal`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.equal), [`passwordHash`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.passwordHash), and [`random`](../.aug-spec/packages/%40git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug.md#symbol-Crypto.random)) from `crypto`. It uses [`Clock`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock) ([`now`](../.aug-spec/packages/%40git/url_c092cd151499c4e1d8a1/0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug.md#symbol-Clock.now)) from `time`.
 
-[Full built-in reference](https://greenpandastudios.github.io/augscript/language-constructs).
+It uses [`securityHeaders`](../common/headers.aug.md#symbol-securityHeaders), [`withCookie`](../common/headers.aug.md#symbol-withCookie), and [`settings`](../common/settings.aug.md#symbol-settings) from `common`. It uses [`Settings`](../common/settings.aug.md#symbol-Settings) (`baseUrl`, `callback`, `clientId`, and `secureCookies`). It uses [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode) (`expires`), [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest) (`browser`, `challenge`, `clientId`, `csrf`, `expires`, `nonce`, `redirectUri`, and `state`), [`LoginError`](contracts.aug.md#symbol-LoginError), and [`LoginForm`](contracts.aug.md#symbol-LoginForm) (`csrf`, `password`, `request_id`, and `username`) from `contracts`. It uses [`verifyCredentials`](credentials.aug.md#symbol-verifyCredentials) from `credentials`.
 
-## Shared language rules
+It uses [`ProviderFailure`](views.aug.md#symbol-ProviderFailure) and [`ProviderLogin`](views.aug.md#symbol-ProviderLogin) from `views`.
 
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+Built-in operations follow the [language reference](https://greenpandastudios.github.io/augscript/language-constructs).

package/examples/oidc-login/provider/contracts.aug

@@ -1,3 +1,4 @@
+// aug-spec: "contracts.aug.md" explains this file. Read it before changes; refresh with aug spec.
 /** A provider request is bound to a browser cookie, a form CSRF token, and a registered client. */
 record AuthorizationRequest(string clientId, string redirectUri, string state, string nonce, string challenge, string browser, string csrf, int expires)
 /** Codes are short-lived, single-use and bound to a redirect URI and S256 challenge. */

package/examples/oidc-login/provider/contracts.aug.md

@@ -1,193 +1,58 @@
 <!-- Generated by aug spec. Edit the August source, then regenerate. -->
 
-# `contracts.aug` specification
-
-August 0.19.0. This document is compiled from checked code with deterministic wording guided by Simplified Technical English.
-
-## In this file
-
-- [`AuthorizationRequest`](contracts.aug.md#symbol-AuthorizationRequest) is an immutable record.
-- [`AuthorizationCode`](contracts.aug.md#symbol-AuthorizationCode) is an immutable record.
-- [`IdClaims`](contracts.aug.md#symbol-IdClaims) is an immutable record.
-- [`AccessGrant`](contracts.aug.md#symbol-AccessGrant) is an immutable record.
-- [`TokenResponse`](contracts.aug.md#symbol-TokenResponse) is an immutable record.
-- [`OAuthError`](contracts.aug.md#symbol-OAuthError) is an immutable record.
-- [`TokenForm`](contracts.aug.md#symbol-TokenForm) is an immutable record.
-- [`LoginForm`](contracts.aug.md#symbol-LoginForm) is an immutable record.
-- [`UserInfo`](contracts.aug.md#symbol-UserInfo) is an immutable record.
-- [`LoginError`](contracts.aug.md#symbol-LoginError) is a class implementing `Error`.
-- [`CodeError`](contracts.aug.md#symbol-CodeError) is a class implementing `Error`.
+# `contracts.aug`
 
 <a id="symbol-AuthorizationRequest"></a>
+## `AuthorizationRequest` · immutable record · [source](contracts.aug#L3)
 
-## `AuthorizationRequest`
-
-[source](contracts.aug#L2)
-
-Immutable record.
-
-**Author documentation**
-
-A provider request is bound to a browser cookie, a form CSRF token, and a registered client.
-
-**Inputs**
-
-- `clientId` (`string`) — required labeled input — stored as `clientId` and read-only after initialization.
-- `redirectUri` (`string`) — required labeled input — stored as `redirectUri` and read-only after initialization.
-- `state` (`string`) — required labeled input — stored as `state` and read-only after initialization.
-- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
-- `challenge` (`string`) — required labeled input — stored as `challenge` and read-only after initialization.
-- `browser` (`string`) — required labeled input — stored as `browser` and read-only after initialization.
-- `csrf` (`string`) — required labeled input — stored as `csrf` and read-only after initialization.
-- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+A provider request is bound to a browser cookie, a form CSRF token, and a registered client. It takes `clientId`, `redirectUri`, `state`, `nonce`, `challenge`, `browser`, and `csrf` as strings, kept read-only and `expires` as an integer, kept read-only.
 
 <a id="symbol-AuthorizationCode"></a>
+## `AuthorizationCode` · immutable record · [source](contracts.aug#L5)
 
-## `AuthorizationCode`
-
-[source](contracts.aug#L4)
-
-Immutable record.
-
-**Author documentation**
-
-Codes are short-lived, single-use and bound to a redirect URI and S256 challenge.
-
-**Inputs**
-
-- `clientId` (`string`) — required labeled input — stored as `clientId` and read-only after initialization.
-- `redirectUri` (`string`) — required labeled input — stored as `redirectUri` and read-only after initialization.
-- `challenge` (`string`) — required labeled input — stored as `challenge` and read-only after initialization.
-- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
-- `subject` (`string`) — required labeled input — stored as `subject` and read-only after initialization.
-- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
-- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+Codes are short-lived, single-use and bound to a redirect URI and S256 challenge. It takes `clientId`, `redirectUri`, `challenge`, `nonce`, `subject`, and `name` as strings, kept read-only and `expires` as an integer, kept read-only.
 
 <a id="symbol-IdClaims"></a>
+## `IdClaims` · immutable record · [source](contracts.aug#L6)
 
-## `IdClaims`
-
-[source](contracts.aug#L5)
-
-Immutable record.
-
-**Inputs**
-
-- `iss` (`string`) — required labeled input — stored as `iss` and read-only after initialization.
-- `sub` (`string`) — required labeled input — stored as `sub` and read-only after initialization.
-- `aud` (`string`) — required labeled input — stored as `aud` and read-only after initialization.
-- `exp` (`int`) — required labeled input — stored as `exp` and read-only after initialization.
-- `iat` (`int`) — required labeled input — stored as `iat` and read-only after initialization.
-- `nonce` (`string`) — required labeled input — stored as `nonce` and read-only after initialization.
-- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+It takes `iss`, `sub`, and `aud` as strings, kept read-only, `exp` and `iat` as integers, kept read-only, and `nonce` and `name` as strings, kept read-only.
 
 <a id="symbol-AccessGrant"></a>
+## `AccessGrant` · immutable record · [source](contracts.aug#L7)
 
-## `AccessGrant`
-
-[source](contracts.aug#L6)
-
-Immutable record.
-
-**Inputs**
-
-- `subject` (`string`) — required labeled input — stored as `subject` and read-only after initialization.
-- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
-- `expires` (`int`) — required labeled input — stored as `expires` and read-only after initialization.
+It takes `subject` and `name` as strings, kept read-only and `expires` as an integer, kept read-only.
 
 <a id="symbol-TokenResponse"></a>
+## `TokenResponse` · immutable record · [source](contracts.aug#L8)
 
-## `TokenResponse`
-
-[source](contracts.aug#L7)
-
-Immutable record.
-
-**Inputs**
-
-- `token_type` (`string`) — required labeled input — stored as `token_type` and read-only after initialization.
-- `access_token` (`string`) — required labeled input — stored as `access_token` and read-only after initialization.
-- `id_token` (`string`) — required labeled input — stored as `id_token` and read-only after initialization.
-- `expires_in` (`int`) — required labeled input — stored as `expires_in` and read-only after initialization.
-- `scope` (`string`) — required labeled input — stored as `scope` and read-only after initialization.
+It takes `token_type`, `access_token`, and `id_token` as strings, kept read-only, `expires_in` as an integer, kept read-only, and `scope` as a string, kept read-only.
 
 <a id="symbol-OAuthError"></a>
+## `OAuthError` · immutable record · [source](contracts.aug#L9)
 
-## `OAuthError`
-
-[source](contracts.aug#L8)
-
-Immutable record.
-
-**Inputs**
-
-- `error` (`string`) — required labeled input — stored as `error` and read-only after initialization.
-- `error_description` (`string`) — required labeled input — stored as `error_description` and read-only after initialization.
+It takes `error` and `error_description` as strings, kept read-only.
 
 <a id="symbol-TokenForm"></a>
+## `TokenForm` · immutable record · [source](contracts.aug#L10)
 
-## `TokenForm`
-
-[source](contracts.aug#L9)
-
-Immutable record.
-
-**Inputs**
-
-- `grant_type` (`string`) — required labeled input — stored as `grant_type` and read-only after initialization.
-- `code` (`string`) — required labeled input — stored as `code` and read-only after initialization.
-- `redirect_uri` (`string`) — required labeled input — stored as `redirect_uri` and read-only after initialization.
-- `client_id` (`string`) — required labeled input — stored as `client_id` and read-only after initialization.
-- `code_verifier` (`string`) — required labeled input — stored as `code_verifier` and read-only after initialization.
+It takes `grant_type`, `code`, `redirect_uri`, `client_id`, and `code_verifier` as strings, kept read-only.
 
 <a id="symbol-LoginForm"></a>
+## `LoginForm` · immutable record · [source](contracts.aug#L11)
 
-## `LoginForm`
-
-[source](contracts.aug#L10)
-
-Immutable record.
-
-**Inputs**
-
-- `request_id` (`string`) — required labeled input — stored as `request_id` and read-only after initialization.
-- `csrf` (`string`) — required labeled input — stored as `csrf` and read-only after initialization.
-- `username` (`string`) — required labeled input — stored as `username` and read-only after initialization.
-- `password` (`string`) — required labeled input — stored as `password` and read-only after initialization.
+It takes `request_id`, `csrf`, `username`, and `password` as strings, kept read-only.
 
 <a id="symbol-UserInfo"></a>
+## `UserInfo` · immutable record · [source](contracts.aug#L12)
 
-## `UserInfo`
-
-[source](contracts.aug#L11)
-
-Immutable record.
-
-**Inputs**
-
-- `sub` (`string`) — required labeled input — stored as `sub` and read-only after initialization.
-- `name` (`string`) — required labeled input — stored as `name` and read-only after initialization.
+It takes `sub` and `name` as strings, kept read-only.
 
 <a id="symbol-LoginError"></a>
+## `LoginError` · class · [source](contracts.aug#L13)
 
-## `LoginError`
-
-[source](contracts.aug#L12)
-
-Behavioral class.
-
-Satisfies `Error`.
+It implements `Error`.
 
 <a id="symbol-CodeError"></a>
+## `CodeError` · class · [source](contracts.aug#L15)
 
-## `CodeError`
-
-[source](contracts.aug#L14)
-
-Behavioral class.
-
-Satisfies `Error`.
-
-## Shared language rules
-
-See the [language reference](https://greenpandastudios.github.io/augscript/reference) for numeric, equality, ownership, and task rules.
+It implements `Error`.

package/examples/oidc-login/provider/credentials.aug

@@ -1,6 +1,7 @@
-import Crypto from august.crypto
+// aug-spec: "credentials.aug.md" explains this file. Read it before changes; refresh with aug spec.
+import Crypto from crypto
 /** One development account with a PBKDF2-HMAC-SHA256 verifier. Production account storage is deliberately a separate capability. */
-verifyCredentials(string username, string password, resolve Crypto crypto) returns bool uses crypto.passwordHash and crypto.decodeBase64url and crypto.equal unless CryptoError:
+verifyCredentials(string username, string password, resolve Crypto crypto) :
     if username.length() > 64 or password.length() > 256:
         return false
     actual = crypto.passwordHash(password=password.bytes(), salt="August demo salt v1".bytes(), iterations=600000)