Skip to content
Elimi Docs

Authentication

Authentication (RPL)

Section titled “Authentication (RPL)”

Audience: domain, product
Status: specced
Owns: product + backend
Depends on: Orchestrator, Domain — User

Product intent

Section titled “Product intent”
  • Create account, verify account, forgot password, reset password.
  • Verification uses OTP (4-digit max; not email magic links).
  • Sign-in: password and Google (Gmail) in v1.
  • Shared auth/JWT issuance lives in the Orchestrator; CAP validates via JWKS and provisions cap_users from user.created.
  • Register may include intents[] (e.g. cap, lms) so OL notifies the right platforms.
  • OTP email is sent via Orchestrator Notifications.
  • Login payload stays thin (tokens + User, including mustChangePassword after staff invite provision). After login the client calls CAP GET /me and GET /onboarding/mine to choose screens.
  • Change password: Orchestrator PATCH /auth/change-password.
  • Delete account: Orchestrator POST /auth/delete-account ({ password } or Google-only { confirm: true }). Login is deactivated (User.status=deactivated); CAP consumes user.deleted and anonymizes PII. Check CAP GET /me/deletion-eligibility first (warns if last centre super_admin).
  • Notification channel prefs: Orchestrator GET/PUT /notifications/preferences (own user). Auth OTP / password-reset / provisioned-password emails still send even if email is off.
  • Centre-staff invite does not use self-register: CAP → OL gRPC ProvisionAccount. Generated passwords never leave OL except in that mail.

See also

Section titled “See also”