Headless user management and RBAC

Access tokens expire after 15 minutes. Refresh tokens rotate on every use — reuse of an old refresh token triggers automatic revocation of all sessions (replay attack protection).

Uses pwdlib[argon2] — the memory-hard Argon2id algorithm. Parameters: 64MB memory, 3 iterations, 4 parallelism. Vastly stronger than bcrypt against GPU cracking.

Roles are assigned per site, not globally. An editor on toa://games cannot access toa://blog. Sites register with toa://auth and define their own role sets.

Max 5 login attempts per IP per minute via slowapi. After 10 failed attempts the account locks for 15 minutes. Timing-safe comparisons prevent user enumeration.

Users can see all active sessions with device, IP hash, and last-seen time. Individual sessions can be revoked, or all sessions revoked at once.

Service-to-service authentication via scoped API keys. Keys are displayed once, hashed in the database. Scopes: read:content, write:content, admin.

All auth events logged: login, logout, token refresh, failed attempts, password reset. IPs are SHA-256 hashed — never stored in plaintext. Logs anonymised after 90 days.

Only username and password hash are required. Email is optional, AES-256 encrypted at rest, and only used for password reset. No names, no profile data, no tracking.